chore(master): release 2.0.0

[github-actions]

🤖 I have created a release beep boop

2.0.0 (2026-04-09)

⚠ BREAKING CHANGES

• Update dependencies (requires node.js 20)

Bug Fixes

• Update dependencies (requires node.js 20) (0a603e0)

---

This PR was generated with Release Please. See documentation.

[jwasnoggin]

@coreyfarrell Would be great if this release can be published as it resolves GHSA-h67p-54hq-rp68

[GitHubNewbie0]

Thanks for pulling this together — the move to yaml and dropping js-yaml entirely is a clean resolution. Worth noting for anyone tracking this: 2.0.0 closes more than the prototype-pollution CVE in the existing issues. js-yaml ≤4.1.1 also carries CVE-2026-53550 (quadratic-complexity DoS via repeated merge-key aliases), and since this release removes js-yaml from the dependency entirely, it clears that one too. That's a second advisory off the board for every downstream consumer (babel-plugin-istanbul → test-exclude → load-nyc-config, etc.) once published. Would be great to see 2.0.0 tagged when you get a chance.

[thiagosan252]

@coreyfarrell when will this version be released? I'm also seeing this alert in my project.

[millansingh]

Also hoping to see a release here, so upstream deps can get updated and we can close out our CVEs.

[cgalvan]

Is there an ETA for this release? My org has several vulnerabilities that are blocked by this as well.