js-yaml
5.5.0 · 15 Oct 2026MIT322.7M / weekRepositoryHomepagenpmAtom feed
Your version
5.5.0 is the newest release of 5.x.
In short
1 security1 changed
Security
Fixes 1 advisory that affected 5.4.0
- Moderatejs-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesGHSA-r3ph-w7gj-g6xm · 29 Sep 2026Fixed in 5.4.1
Release note
Changed
Hard-limit merge sequence size to 100.
Security
- security
Count empty mappings in merge sequences toward
maxTotalMergeKeysto limit
CPU usage, #797.