Skip to content

chore(deps-dev): bump js-yaml from 4.1.1 to 4.2.0#802

Merged
ashleyshaw merged 3 commits into
developfrom
dependabot/npm_and_yarn/js-yaml-4.2.0
Jun 3, 2026
Merged

chore(deps-dev): bump js-yaml from 4.1.1 to 4.2.0#802
ashleyshaw merged 3 commits into
developfrom
dependabot/npm_and_yarn/js-yaml-4.2.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Jun 3, 2026

Bumps js-yaml from 4.1.1 to 4.2.0.

Changelog

Sourced from js-yaml's changelog.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.
  • Fix digits in YAML named tag handles.

Security

  • Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

  • Backported v4.1.1 fix to v3
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.2.0.
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the area:dependencies Composer/npm dependency work label Jun 3, 2026
@dependabot dependabot Bot requested a review from ashleyshaw as a code owner June 3, 2026 16:01
@dependabot dependabot Bot added the area:dependencies Composer/npm dependency work label Jun 3, 2026
@chatgpt-codex-connector
Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

@github-actions github-actions Bot added lang:js JavaScript/TypeScript lang:json JSON config/content status:needs-review Awaiting code review priority:normal Default priority type:chore Chore / small hygiene change meta:needs-changelog Requires a changelog entry before merge meta:dependabot-security Dependabot update appears security-related and eligible for guarded automation labels Jun 3, 2026
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the repository’s development dependency on js-yaml to 4.2.0, aligning the toolchain with the latest upstream fixes and improvements.

Changes:

  • Bump js-yaml in devDependencies from ^4.1.1 to ^4.2.0.
  • Regenerate package-lock.json to reflect js-yaml@4.2.0 and updated lockfile metadata.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File Description
package.json Updates the declared dev dependency version for js-yaml.
package-lock.json Updates the resolved js-yaml package entry and lockfile metadata after the bump.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Jun 3, 2026

🚫 This PR description is missing required template sections.

Missing required section(s): Linked issues, Changelog, Global DoD checklist

Please update the PR body using one of the repository PR templates:

This check must pass before merge.

@ashleyshaw ashleyshaw merged commit 751e330 into develop Jun 3, 2026
13 of 14 checks passed
@ashleyshaw ashleyshaw deleted the dependabot/npm_and_yarn/js-yaml-4.2.0 branch June 3, 2026 19:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:dependencies Composer/npm dependency work lang:js JavaScript/TypeScript lang:json JSON config/content meta:dependabot-security Dependabot update appears security-related and eligible for guarded automation meta:needs-changelog Requires a changelog entry before merge priority:normal Default priority status:needs-review Awaiting code review type:chore Chore / small hygiene change

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants