Merge pull request #4445 from github/mbg/bump-yauzl

Bump `yauzl` to `3.4.0`

Author: mbg

extensions/ql-vscode/package-lock.json

@@ -2101,7 +2101,7 @@
     "vscode-extension-telemetry": "^0.1.6",
     "vscode-jsonrpc": "^8.2.1",
     "vscode-languageclient": "^8.0.2",
-    "yauzl": "^3.3.0",
+    "yauzl": "^3.4.0",
     "zip-a-folder": "^4.0.4"
   },
   "devDependencies": {