js-yaml
5.5.0 · 15 Oct 2026MIT322.7M / weekRepositoryHomepagenpmAtom feed
Upgrading js-yaml from 3.12.2 to 3.13.0
1 release in betweennotes for 0
- ?
- changes to make
- 1
- advisory fixed
- ?
- new
- ?
- fixes
Counted from 0 of 1 release notes. Advisories are counted from the advisory database, in full.
Security
6 advisories still affect 3.13.0
- js-yaml has prototype pollution in merge (<<)moderate · GHSA-mh29-5h37-fv8m
- js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourceshigh · GHSA-2883-xcg3-v3hh
- js-yaml: YAML merge-key chains can force quadratic CPU consumptionhigh · GHSA-52cp-r559-cp3m
Upgrading to 3.15.2 clears them.
Fixes 1 advisory affecting 3.12.2
- Denial of Service in js-yamlmoderate · GHSA-2pr6-76vf-7546