Skip to content

chore(deps): bump js-yaml from 5.3.0 to 5.4.1 in /validation - #438

Merged
hdamker merged 1 commit into
mainfrom
dependabot/npm_and_yarn/validation/js-yaml-5.4.1
Sep 2, 2026
Merged

chore(deps): bump js-yaml from 5.3.0 to 5.4.1 in /validation#438
hdamker merged 1 commit into
mainfrom
dependabot/npm_and_yarn/validation/js-yaml-5.4.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor

Bumps js-yaml from 5.3.0 to 5.4.1.

Changelog

Sourced from js-yaml's changelog.

[5.4.1] - 2026-08-26

Changed

  • Hard-limit merge sequence size to 100.

Security

  • Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

[5.4.0] - 2026-08-25

Added

  • Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

Changed

  • [breaking] Flattened the low-level AST node style representation. Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property. Alias nodes now contain only kind and anchor. This only affects code that directly constructs or edits AST nodes.
  • [breaking] The sortKeys option was rewritten using AST mutation to avoid side effects.
  • Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.

Fixed

  • Accept a byte order mark at the start of each document in a stream, #791.
  • Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys, #786.
  • Preserve empty scalar items when converting block sequences to flow style.
  • Do not apply the 1024-character simple-key limit to flow mapping keys.
  • Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.
  • Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.
Commits

@dependabot dependabot Bot added dependencies Used by Dependabot javascript Pull requests that update JavaScript dependencies labels Aug 31, 2026
@dependabot
dependabot Bot requested review from Kevsy, hdamker and rartych as code owners August 31, 2026 20:24
@dependabot dependabot Bot added dependencies Used by Dependabot javascript Pull requests that update JavaScript dependencies labels Aug 31, 2026
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 5.3.0 to 5.4.1.
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@5.3.0...5.4.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 5.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/validation/js-yaml-5.4.1 branch from e308bd6 to 8263889 Compare September 2, 2026 17:11
@hdamker
hdamker merged commit 8e77c05 into main Sep 2, 2026
7 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/validation/js-yaml-5.4.1 branch September 2, 2026 17:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Used by Dependabot javascript Pull requests that update JavaScript dependencies

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant