js-yaml
5.5.0 · 15 Oct 2026MIT322.7M / weekRepositoryHomepagenpmAtom feed
Upgrading js-yaml from 2.1.0 to 3.15.0
51 releases in betweennotes for 3
3.0.0 has no release note on GitHub or in the repository's changelog, so its breaking changes are missing from the counts below.
- ?
- changes to make
- 4
- advisories fixed
- ?
- new
- 4+
- fixes
Counted from 3 of 51 release notes. Advisories are counted from the advisory database, in full.
Security
2 advisories still affect 3.15.0
- js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourceshigh · GHSA-2883-xcg3-v3hh
- JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backportedhigh · GHSA-5p4m-2wfm-xmqj
Upgrading to 3.15.2 clears them.
Fixes 4 advisories affecting 2.1.0
- js-yaml has prototype pollution in merge (<<)moderate · GHSA-mh29-5h37-fv8m
- Denial of Service in js-yamlmoderate · GHSA-2pr6-76vf-7546
- Code Injection in js-yamlhigh · GHSA-8j8c-7jfh-h6hx
- JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliasesmoderate · GHSA-h67p-54hq-rp68
Release by release
3.0.0 – 3.15.048 releases, no release note
- fixed
Fix wrong loading of empty block scalars.
- fixed
- fixed
Fix unwanted line breaks in folded scalars.
- fixed
- fixed
Dumper now respects deprecated booleans syntax from YAML 1.0/1.1
- fixed
Fixed reader bug in JSON-like sequences/mappings.
- fixed