Packages

js-yaml

5.5.0 · 15 Oct 2026MIT322.7M / weekRepositoryHomepagenpmAtom feed

Upgrading js-yaml from 1.0.1 to 3.15.2

62 releases in betweennotes for 60

Other targets from 1.0.1Newest 1.x1.0.3Clears its 5 advisories3.15.0Latest5.5.0
1+
change to make
5
advisories fixed
15+
new
59+
fixes

Counted from 60 of 62 release notes. Advisories are counted from the advisory database, in full.

Before you upgrade

Tick each one off as you go
  • breaking3.1.0

Security

Fixes 5 advisories affecting 1.0.1

  • Backported maxTotalMergeKeys option.

    3.15.0

  • Backported v4.1.1 fix to v3

    3.14.2

  • Fix possible code execution in (already unsafe) .load() (in &anchor).

    3.14.1

  • Fix possible code execution in (already unsafe) .load(), #480.

    3.13.1

  • Security fix: safeLoad() can hang when arrays with nested refs used as key. Now throws exception for nested arrays. #475.

    3.13.0

  • Close security issue in !!js/function constructor. Big thanks to @nealpoole for security audit.

    2.0.5

Release by release

  1. 3.14.1 – 3.15.25 releases, nothing new or fixed; 2 without a note

  2. 3.14.0

    22 May 20201 new · 4 fixes
    • new

      Support safe/loadAll(input, options) variant of call.

    • fixed

      Quote = in plain scalars #519.

    • fixed

      Check the node type for !<?> tag in case user manually specifies it.

    • fixed

      Verify that there are no null-bytes in input.

    • fixed

      Fix wrong quote position when writing condensed flow, #526.

  3. 3.13.0 – 3.13.12 releases, nothing new or fixed in the notes

  4. 3.12.2

    26 Feb 20191 fix
    • fixed

      Fix noArrayIndent option for root level, #468.

  5. 3.12.1

    5 Jan 20191 new
    • new

      Added noArrayIndent option, #432.

  6. 3.12.0

    1 Jun 20181 new
    • new

      Support arrow functions without a block statement, #421.

  7. 3.11.0

    5 Mar 20181 new · 1 fix
    • new

      Add arrow functions suport for !!js/function.

    • fixed

      Fix dump in bin/octal/hex formats for negative integers, #399.

  8. 3.10.0

    11 Sep 20172 fixes
    • fixed

      Fix condenseFlow output (quote keys for sure, instead of spaces), #371, #370.

    • fixed

      Dump astrals as codepoints instead of surrogate pair, #368.

29 other lines we could not sort, mostly version bumps

  • Dev deps bump.

    3.14.0

  • Maintenance: Update browserified build.

    3.8.1

  • Maintenance release.

    3.5.3

  • Maintenance: Missed comma in bower config.

    3.5.2

  • Removed inherit dependency, #239.

    3.5.1

  • Better browserify workaround for esprima load.

    3.5.1

  • Demo rewrite.

    3.5.1

  • Use standalone inherit to keep browserified files clear.

    3.4.6

  • Maintenance release - deps bump (esprima, argparse).

    3.4.3

  • Throw error on unknown tags (was warning before).

    3.4.0

4 internal lines (docs, tests, tooling) left out.