Skip to content

chore(deps): bump js-yaml from 4.3.2 to 5.4.2 - #2871

Open
dependabot[bot] wants to merge 2 commits into
masterfrom
dependabot/npm_and_yarn/js-yaml-5.4.2
Open

chore(deps): bump js-yaml from 4.3.2 to 5.4.2#2871
dependabot[bot] wants to merge 2 commits into
masterfrom
dependabot/npm_and_yarn/js-yaml-5.4.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps js-yaml from 4.3.2 to 5.4.2.

Changelog

Sourced from js-yaml's changelog.

[5.4.2] - 2026-09-13

Fixed

  • forceQuotes no longer quotes non-string scalars, #798.

[5.4.1] - 2026-08-26

Changed

  • Hard-limit merge sequence size to 100.

Security

  • Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

[5.4.0] - 2026-08-25

Added

  • Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

Changed

  • [breaking] Flattened the low-level AST node style representation. Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property. Alias nodes now contain only kind and anchor. This only affects code that directly constructs or edits AST nodes.
  • [breaking] The sortKeys option was rewritten using AST mutation to avoid side effects.
  • Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.

Fixed

  • Accept a byte order mark at the start of each document in a stream, #791.
  • Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys, #786.
  • Preserve empty scalar items when converting block sequences to flow style.
  • Do not apply the 1024-character simple-key limit to flow mapping keys.
  • Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.
  • Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.

[5.3.0] - 2026-08-14

This release focuses on reworking the documentation and making small architectural improvements before moving forward.

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 9, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner October 9, 2026 22:02
@dependabot dependabot Bot mentioned this pull request Oct 9, 2026
Closed
@github-actions

github-actions Bot commented Oct 9, 2026 •
edited
Loading

Copy link
Copy Markdown

🎩 Preview

A preview build has been created at: dependabot/npm_and_yarn/js-yaml-5.4.2/edf968c

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/js-yaml-5.4.2 branch from 51d2d7d to 8339a25 Compare October 9, 2026 22:09
@dependabot
chore(deps): bump js-yaml from 4.3.2 to 5.4.2
cdd5cf5 
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.2 to 5.4.2.
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.3.2...5.4.2)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 5.4.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/js-yaml-5.4.2 branch from 8339a25 to cdd5cf5 Compare October 9, 2026 22:38
@camielvs @claude
fix(deps): adapt to js-yaml 5's named exports
edf968c 
js-yaml 5 ships flat named exports and no default export, so every
`import yaml from "js-yaml"` resolved to undefined at runtime while still
type-checking. Import it as a namespace instead.

js-yaml 5 also bundles its own types, which makes @types/js-yaml unused,
and types `maxDepth` on LoadOptions, so the cast around
PIPELINE_YAML_LOAD_OPTIONS is no longer needed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@camielvs