js-yaml
5.5.0 · 15 Oct 2026MIT322.7M / weekRepositoryHomepagenpmAtom feed
5.5.0 is the newest release of 5.x.
In short
5 breaking1 deprecated7 new11 changed1 internal
- breaking
Removed deprecated
safeLoad(),safeLoadAll()andsafeDump()exports. - breaking
Removed
DEFAULT_SCHEMAand the nestedtypesexport. - breaking
Removed loader options
onWarning,legacyandlistener. - breaking
Removed dumper options
styles,replacer,noCompatMode,condenseFlow,quotingTypeandforceQuotes. RenamednoArrayIndenttoseqNoIndent. Formatting and representation are now configured through presenter options, schemas and tag definitions. See migration guide on how to replace. - breaking
Removed support for importing internal files from
lib/. - deprecated
Deprecated the
loadAllsignature with an iterator (still works, but is a candidate for removal).
Security
4 advisories affect 5.0.0; 5.4.1 fixes them
- Highjs-yaml: Exponential parsing time in flow collections leads to denial of serviceGHSA-pm4m-ph32-ghv5 · 24 Jul 2026Fixed in 5.2.2
- Moderatejs-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesGHSA-r3ph-w7gj-g6xm · 29 Sep 2026Fixed in 5.4.1
- Moderatejs-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yamlGHSA-g796-fgmg-93mv · 20 Jul 2026Fixed in 5.2.0
- Moderatejs-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMAGHSA-724g-mxrg-4qvm · 20 Jul 2026Fixed in 5.2.1
Release note
Added
Added named exports for schemas, tags, parser events and AST utilities.
Reworked
JSON_SCHEMAandCORE_SCHEMAwith spec-compliant scalar resolution
rules, and addedYAML11_SCHEMA.Added
realMapTagfor lossless mappings with non-string and complex keys.
Object-based mappings now reject complex keys instead of stringifying them.Added
dump()transformoption for changing the generated AST before
rendering.Added
dump()optionsseqInlineFirst,flowBracketPadding,flowSkipCommaSpace,flowSkipColonSpace,quoteFlowKeys,quoteStyleandtagBeforeAnchor.Added formal data layers (events and AST) for modular data pipelines.
Added low-level parser (to events), presenter and visitor APIs.
Added the YAML Test Suite to the
test set.
Changed
Rewritten in TypeScript and reorganized the public API around flat named
exports.Reduced the set of exported schemas:
YAML 1.2 schemas:
CORE_SCHEMA(loader default),JSON_SCHEMA,FAILSAFE_SCHEMA.YAML11_SCHEMA, a combination of all YAML 1.1 tags (YAML 1.1 does not
specify a schema, only "types").
load/dumpdefault behaviour is now specified exactly via schemas:loadusesCORE_SCHEMA, without!!mergeby default.dumpusesYAML11_SCHEMA+CORE_SCHEMAfor the quoting check, to
guarantee backward compatibility by default.
!!setis now loaded as a JavaScriptSet.Replaced the
TypeAPI with a tags API. Similar, but more precise and
simpler. See examples for details. Tags can be defined viadefineScalarTag(),defineSequenceTag()anddefineMappingTag(), or as a
spread + override of an existing tag.Renamed
Schema.extend()toSchema.withTags().Expanded YAML 1.2 conformance and improved handling of directives, document
markers, block keys, multiline scalars, tag syntax and other things.load()now throws on empty input instead of returningundefined.Moved browser builds to the
js-yaml/browserexport.- deprecated
Deprecated the
loadAllsignature with an iterator (still works, but is a
candidate for removal).
Removed
- breaking
Removed deprecated
safeLoad(),safeLoadAll()andsafeDump()exports. - breaking
Removed
DEFAULT_SCHEMAand the nestedtypesexport. - breaking
Removed loader options
onWarning,legacyandlistener. - breaking
Removed dumper options
styles,replacer,noCompatMode,condenseFlow,quotingTypeandforceQuotes. RenamednoArrayIndenttoseqNoIndent.
Formatting and representation are now configured through presenter options,
schemas and tag definitions. See migration guide on how to replace. - breaking
Removed support for importing internal files from
lib/.