js-yaml
5.5.0 · 15 Oct 2026MIT322.7M / weekRepositoryHomepagenpmAtom feed
Upgrading js-yaml from 0.3.3 to 0.3.7
4 releases in betweenevery note read
Security
5 advisories still affect 0.3.7
- js-yaml has prototype pollution in merge (<<)moderate · GHSA-mh29-5h37-fv8m
- Deserialization Code Execution in js-yamlcritical · GHSA-xxvw-45rp-3mj2
- Denial of Service in js-yamlmoderate · GHSA-2pr6-76vf-7546
Upgrading to 3.15.0 clears them.
Release by release
- fixed
Fix export of
addConstructor(). Closes #39.
- fixed
- fixed
Removed YUI compressor warning (renamed
doublevariable). Closes #40.
- fixed
- fixed
Workagound for .npmignore fuckup under windows. Thanks to airportyh.
- fixed
- new
Adds better has change support for browserified demo.
- fixed
Fixes str for oldIEs support.
- fixed
Improves compact output of Error. Closes #33.
- new
1 other line we could not sort, mostly version bumps
- 0.3.6
Removed AMD parts - too buggy to use. Need help to rewrite from scratch