Update js-yaml dep

See https://nodesecurity.io/advisories/JS-YAML_Deserialization_Code_Execution