diff --git a/package.json b/package.json
index ae0074137e5..205c643973a 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "ini": "^1.3.5",
     "is-ci": "^1.1.0",
     "isbinaryfile": "^3.0.2",
-    "js-yaml": "^3.11.0",
+    "js-yaml": "^4.2.0",
     "lazy-val": "^1.0.3",
     "lodash.isequal": "^4.5.0",
     "mime": "^2.3.1",
diff --git a/yarn.lock b/yarn.lock
index b063d1e0924..bff38c8ec14 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -471,6 +471,10 @@ argparse@^1.0.7:
   dependencies:
     sprintf-js "~1.0.2"
 
+argparse@^2.0.1:
+  version "2.0.1"
+  resolved "https://registry.yarnpkg.com/argparse/-/argparse-2.0.1.tgz#246f50f3ca78a3240f6c997e8a9bd1eac49e4b38"
+
 argv-tools@^0.1.1:
   version "0.1.1"
   resolved "https://registry.yarnpkg.com/argv-tools/-/argv-tools-0.1.1.tgz#588283f3393ada47141440b12981cd41bf6b7032"
@@ -3538,6 +3542,12 @@ js-yaml@^3.10.0, js-yaml@^3.11.0, js-yaml@^3.4.2, js-yaml@^3.7.0, js-yaml@^3.9.1
     argparse "^1.0.7"
     esprima "^4.0.0"
 
+js-yaml@^4.2.0:
+  version "4.2.0"
+  resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.2.0.tgz#2bd9e85682dd91bd469afb809d816043b3d49524"
+  dependencies:
+    argparse "^2.0.1"
+
 js2xmlparser@~3.0.0:
   version "3.0.0"
   resolved "https://registry.yarnpkg.com/js2xmlparser/-/js2xmlparser-3.0.0.tgz#3fb60eaa089c5440f9319f51760ccd07e2499733"