js-yaml
5.5.0 · 15 Oct 2026MIT322.7M / weekRepositoryHomepagenpmAtom feed
Your version
5.5.0 is the newest release of 5.x.
In short
1 breaking1 new
- breaking
quoteStylenow selects the preferred quote style; use the restoredforceQuotesoption to force quoting non-key strings.
Security
4 advisories affect 5.1.0; 5.4.1 fixes them
- Highjs-yaml: Exponential parsing time in flow collections leads to denial of serviceGHSA-pm4m-ph32-ghv5 · 24 Jul 2026Fixed in 5.2.2
- Moderatejs-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesGHSA-r3ph-w7gj-g6xm · 29 Sep 2026Fixed in 5.4.1
- Moderatejs-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yamlGHSA-g796-fgmg-93mv · 20 Jul 2026Fixed in 5.2.0
- Moderatejs-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMAGHSA-724g-mxrg-4qvm · 20 Jul 2026Fixed in 5.2.1
Release note
Added
Collection tags can finalize an incrementally populated carrier into a
different result value.
Changed
- breaking
quoteStylenow selects the preferred quote style; use the
restoredforceQuotesoption to force quoting non-key strings.