Skip to content

chore(deps): update dependency js-yaml to v4.3.1 - #30

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/js-yaml-4.x-lockfile
Open

chore(deps): update dependency js-yaml to v4.3.1#30
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/js-yaml-4.x-lockfile

Conversation

@renovate

@renovate renovate Bot commented Nov 12, 2025

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
js-yaml 4.1.04.3.1 age confidence

Release Notes

nodeca/js-yaml (js-yaml)

v4.3.1

Compare Source

v4.3.0

Compare Source

v4.2.0

Compare Source

Added
  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better
    exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix,
    but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.
Changed
  • Stop resolving numbers with underscores as numeric scalars, #​627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.
Fixed
  • Fix parsing of properties on the first implicit block mapping key, #​62.
  • Fix trailing whitespace handling when folding flow scalar lines, #​307.
  • Reject top-level block scalars without content indentation, #​280.
  • Ensure numbers survive round-trip, #​737.
  • Fix test coverage for issue #​221.
  • Fix flow scalar trailing whitespace folding, #​307.
  • Fix digits in YAML named tag handles.
Security
  • Fix potential DoS via quadratic complexity in merge - deduplicate repeated
    elements (makes sense for malformed files > 10K).

v4.1.1

Compare Source

Security
  • Fix prototype pollution issue in yaml merge (<<) operator.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Nov 12, 2025

Copy link
Copy Markdown

Deploying website-v2 with  Cloudflare Pages  Cloudflare Pages

Latest commit: c5e3b42
Status: ✅  Deploy successful!
Preview URL: https://ed92ddb4.website-v2-250.pages.dev
Branch Preview URL: https://renovate-js-yaml-4-x-lockfil.website-v2-250.pages.dev

View logs

@renovate
renovate Bot force-pushed the renovate/js-yaml-4.x-lockfile branch from 92c6e2b to 37b3844 Compare November 18, 2025 12:36
@renovate
renovate Bot force-pushed the renovate/js-yaml-4.x-lockfile branch from 37b3844 to 833ca90 Compare February 2, 2026 16:42
@renovate
renovate Bot force-pushed the renovate/js-yaml-4.x-lockfile branch from 833ca90 to a71a8cc Compare February 12, 2026 15:10
@renovate
renovate Bot force-pushed the renovate/js-yaml-4.x-lockfile branch from a71a8cc to cb82104 Compare March 5, 2026 18:58
@renovate
renovate Bot force-pushed the renovate/js-yaml-4.x-lockfile branch from cb82104 to f23e910 Compare March 13, 2026 11:55
@renovate
renovate Bot force-pushed the renovate/js-yaml-4.x-lockfile branch from f23e910 to d87dc3e Compare April 29, 2026 14:52
@renovate
renovate Bot force-pushed the renovate/js-yaml-4.x-lockfile branch 2 times, most recently from 8369d3c to edc0db5 Compare May 18, 2026 20:37
@renovate
renovate Bot force-pushed the renovate/js-yaml-4.x-lockfile branch from edc0db5 to ae9dddb Compare May 28, 2026 19:15
@renovate renovate Bot changed the title chore(deps): update dependency js-yaml to v4.1.1 chore(deps): update dependency js-yaml to v4.2.0 Jun 1, 2026
@renovate
renovate Bot force-pushed the renovate/js-yaml-4.x-lockfile branch 2 times, most recently from fa55363 to ef312c1 Compare June 1, 2026 20:11
@renovate
renovate Bot force-pushed the renovate/js-yaml-4.x-lockfile branch from ef312c1 to 0906f73 Compare June 11, 2026 21:11
@renovate renovate Bot changed the title chore(deps): update dependency js-yaml to v4.2.0 chore(deps): update dependency js-yaml to v4.3.0 Jun 27, 2026
@renovate
renovate Bot force-pushed the renovate/js-yaml-4.x-lockfile branch from 0906f73 to 1413ab8 Compare June 27, 2026 01:36
@renovate
renovate Bot force-pushed the renovate/js-yaml-4.x-lockfile branch 2 times, most recently from 3bb4a2c to a54c2e6 Compare July 16, 2026 19:42
@renovate
renovate Bot force-pushed the renovate/js-yaml-4.x-lockfile branch 2 times, most recently from 51fe394 to 8a98424 Compare July 24, 2026 21:37
@renovate
renovate Bot force-pushed the renovate/js-yaml-4.x-lockfile branch from 8a98424 to 09b7b98 Compare July 30, 2026 14:56
@renovate renovate Bot changed the title chore(deps): update dependency js-yaml to v4.3.0 chore(deps): update dependency js-yaml to v4.3.1 Jul 31, 2026
@renovate
renovate Bot force-pushed the renovate/js-yaml-4.x-lockfile branch from 09b7b98 to d314208 Compare July 31, 2026 18:06
@renovate
renovate Bot force-pushed the renovate/js-yaml-4.x-lockfile branch from d314208 to 2c4bd52 Compare August 12, 2026 01:05
@renovate
renovate Bot force-pushed the renovate/js-yaml-4.x-lockfile branch from 2c4bd52 to c5e3b42 Compare August 14, 2026 19:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants