js-yaml
5.5.0 · 15 Oct 2026MIT322.7M / weekRepositoryHomepagenpmAtom feed
Upgrading js-yaml from 3.10.0 to 5.5.0
31 releases in betweennotes for 12
Counted from 12 of 31 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- breaking5.4.0
- breaking5.4.0
- breaking5.3.0
- breaking5.2.0
- breaking5.1.0
- breaking5.0.0
- breaking5.0.0
- breaking5.0.0
- breaking5.0.0
- breaking5.0.0
Security
Fixes 7 advisories affecting 3.10.0
- js-yaml has prototype pollution in merge (<<)moderate · GHSA-mh29-5h37-fv8m
- js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourceshigh · GHSA-2883-xcg3-v3hh
- Denial of Service in js-yamlmoderate · GHSA-2pr6-76vf-7546
- js-yaml: YAML merge-key chains can force quadratic CPU consumptionhigh · GHSA-52cp-r559-cp3m
- JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backportedhigh · GHSA-5p4m-2wfm-xmqj
- Code Injection in js-yamlhigh · GHSA-8j8c-7jfh-h6hx
- JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliasesmoderate · GHSA-h67p-54hq-rp68
- 5.4.1
Count empty mappings in merge sequences toward
maxTotalMergeKeysto limit CPU usage, #797. - 5.2.2
Avoid exponential parsing time for nested flow sequence pairs.
- 5.2.1
Remove quadratic complexity from !!omap
addItem. Regression from v5 (usually not critical, because YAML11_SCHEMA is not default anymore).
Release by release
- fixed
Correct percent-encoding of shorthand and verbatim tags.
- fixed
Reject
,,], and}at the start of block plain scalars, #801.
- fixed
- fixed
Fixed loading a whitespace-only block scalar followed by a less indented line, #802.
- fixed
- fixed
forceQuotesno longer quotes non-string scalars, #798.
- fixed
5.4.1nothing new or fixed in the note
- new
Added the
scalarStyleRulesdumper option to customize string formatting. See Scalar styling for details. - new
Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.
- fixed
Accept a byte order mark at the start of each document in a stream, #791.
- fixed
Produce valid flow mappings with
quoteFlowKeysandflowSkipColonSpace, including alias and property-only keys, #786. - fixed
Preserve empty scalar items when converting block sequences to flow style.
- fixed
Do not apply the 1024-character simple-key limit to flow mapping keys.
- fixed
Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.
- new
- new
Added completely new documentation.
- new
Exported
DUMP_SCHEMA, the default schema used by the dumper. - new
Added
YAMLException.throwAt()for throwing an error at a source position. - fixed
Validate
<<sequence items at merge time, so aliased merge sources are checked too. - fixed
Resolve
<<outside of a mapping key as the plain string'<<', matching v4, instead of leaking an internal symbol into the result.
- new
- fixed
Prevent prototype fallback when resolving tags and mapping entries, #782.
- fixed
Resolve
!!timestampyears 0000-0099 correctly, #775. - fixed
Preserve implicit null mapping values before document markers and reject unpaired mapping event streams, #784.
- fixed
Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through
present();dump()and loading are unaffected, #780.
- fixed
- fixed
Quote flow scalars where a colon precedes a flow indicator, #773.
- fixed
17 other lines we could not sort, mostly version bumps
- 5.5.0
Updated
argparseto v3. - 5.5.0
Updated development dependencies.
- 5.4.1
Hard-limit merge sequence size to 100.
- 5.4.0
Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.
- 5.3.0
Changed flat constant exports to grouped exports:
EVENT_ID,SCALAR_STYLE,COLLECTION_STYLE, andCHOMPING_MODE, along with their value types. The old exports are still preserved, but deprecated. - 5.3.0
Made
identifymandatory for custom tag definitions. Useidentify: () => falsefor load-only tags. - 5.0.0
Rewritten in TypeScript and reorganized the public API around flat named exports.
- 5.0.0
YAML 1.2 schemas:
CORE_SCHEMA(loader default),JSON_SCHEMA,FAILSAFE_SCHEMA. - 5.0.0
YAML11_SCHEMA, a combination of all YAML 1.1 tags (YAML 1.1 does not specify a schema, only "types"). - 5.0.0
loadusesCORE_SCHEMA, without!!mergeby default.
1 internal line (docs, tests, tooling) left out.