js-yaml
5.5.0 · 15 Oct 2026MIT322.7M / weekRepositoryHomepagenpmAtom feed
Upgrading js-yaml from 3.15.2 to 5.5.0
19 releases in betweennotes for 12
- 12+
- changes to make
- 0
- advisories fixed
- 16+
- new
- 17+
- fixes
Counted from 12 of 19 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- breaking5.4.0
- breaking5.4.0
- breaking5.3.0
- breaking5.2.0
- breaking5.1.0
- breaking5.0.0
- breaking5.0.0
- breaking5.0.0
- breaking5.0.0
- breaking5.0.0
Security
- 5.4.1
Count empty mappings in merge sequences toward
maxTotalMergeKeysto limit CPU usage, #797. - 5.2.2
Avoid exponential parsing time for nested flow sequence pairs.
- 5.2.1
Remove quadratic complexity from !!omap
addItem. Regression from v5 (usually not critical, because YAML11_SCHEMA is not default anymore).
Release by release
- fixed
Correct percent-encoding of shorthand and verbatim tags.
- fixed
Reject
,,], and}at the start of block plain scalars, #801.
- fixed
- fixed
Fixed loading a whitespace-only block scalar followed by a less indented line, #802.
- fixed
- fixed
forceQuotesno longer quotes non-string scalars, #798.
- fixed
5.4.1nothing new or fixed in the note
- new
Added the
scalarStyleRulesdumper option to customize string formatting. See Scalar styling for details. - new
Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.
- fixed
Accept a byte order mark at the start of each document in a stream, #791.
- fixed
Produce valid flow mappings with
quoteFlowKeysandflowSkipColonSpace, including alias and property-only keys, #786. - fixed
Preserve empty scalar items when converting block sequences to flow style.
- fixed
Do not apply the 1024-character simple-key limit to flow mapping keys.
- fixed
Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.
- new
- new
Added completely new documentation.
- new
Exported
DUMP_SCHEMA, the default schema used by the dumper. - new
Added
YAMLException.throwAt()for throwing an error at a source position. - fixed
Validate
<<sequence items at merge time, so aliased merge sources are checked too. - fixed
Resolve
<<outside of a mapping key as the plain string'<<', matching v4, instead of leaking an internal symbol into the result.
- new
- fixed
Prevent prototype fallback when resolving tags and mapping entries, #782.
- fixed
Resolve
!!timestampyears 0000-0099 correctly, #775. - fixed
Preserve implicit null mapping values before document markers and reject unpaired mapping event streams, #784.
- fixed
Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through
present();dump()and loading are unaffected, #780.
- fixed
- fixed
Quote flow scalars where a colon precedes a flow indicator, #773.
- fixed
17 other lines we could not sort, mostly version bumps
- 5.5.0
Updated
argparseto v3. - 5.5.0
Updated development dependencies.
- 5.4.1
Hard-limit merge sequence size to 100.
- 5.4.0
Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.
- 5.3.0
Changed flat constant exports to grouped exports:
EVENT_ID,SCALAR_STYLE,COLLECTION_STYLE, andCHOMPING_MODE, along with their value types. The old exports are still preserved, but deprecated. - 5.3.0
Made
identifymandatory for custom tag definitions. Useidentify: () => falsefor load-only tags. - 5.0.0
Rewritten in TypeScript and reorganized the public API around flat named exports.
- 5.0.0
YAML 1.2 schemas:
CORE_SCHEMA(loader default),JSON_SCHEMA,FAILSAFE_SCHEMA. - 5.0.0
YAML11_SCHEMA, a combination of all YAML 1.1 tags (YAML 1.1 does not specify a schema, only "types"). - 5.0.0
loadusesCORE_SCHEMA, without!!mergeby default.
1 internal line (docs, tests, tooling) left out.