Packages

js-yaml

5.5.0 · 15 Oct 2026MIT322.7M / weekRepositoryHomepagenpmAtom feed

Upgrading js-yaml from 3.15.2 to 5.5.0

19 releases in betweennotes for 12

4.0.0 has no release note on GitHub or in the repository's changelog, so its breaking changes are missing from the counts below.
12+
changes to make
0
advisories fixed
16+
new
17+
fixes

Counted from 12 of 19 release notes. Advisories are counted from the advisory database, in full.

Before you upgrade

Tick each one off as you go
  • breaking5.4.0
  • breaking5.4.0
  • breaking5.3.0
  • breaking5.2.0
  • breaking5.1.0
  • breaking5.0.0
  • breaking5.0.0
  • breaking5.0.0
  • breaking5.0.0
  • breaking5.0.0

Security

  • Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

    5.4.1
  • Avoid exponential parsing time for nested flow sequence pairs.

    5.2.2
  • Remove quadratic complexity from !!omap addItem. Regression from v5 (usually not critical, because YAML11_SCHEMA is not default anymore).

    5.2.1

Release by release

  1. 5.5.0

    15 Oct 20262 fixes
    • fixed

      Correct percent-encoding of shorthand and verbatim tags.

    • fixed

      Reject ,, ], and } at the start of block plain scalars, #801.

  2. 5.4.3

    5 Oct 20261 fix
    • fixed

      Fixed loading a whitespace-only block scalar followed by a less indented line, #802.

  3. 5.4.2

    13 Sep 20261 fix
    • fixed

      forceQuotes no longer quotes non-string scalars, #798.

  4. 5.4.1nothing new or fixed in the note

  5. 5.4.0

    25 Aug 20262 new · 5 fixes
    • new

      Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

    • new

      Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.

    • fixed

      Accept a byte order mark at the start of each document in a stream, #791.

    • fixed

      Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys, #786.

    • fixed

      Preserve empty scalar items when converting block sequences to flow style.

    • fixed

      Do not apply the 1024-character simple-key limit to flow mapping keys.

    • fixed

      Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.

  6. 5.3.0

    14 Aug 20263 new · 2 fixes
    • new

      Added completely new documentation.

    • new

      Exported DUMP_SCHEMA, the default schema used by the dumper.

    • new

      Added YAMLException.throwAt() for throwing an error at a source position.

    • fixed

      Validate << sequence items at merge time, so aliased merge sources are checked too.

    • fixed

      Resolve << outside of a mapping key as the plain string '<<', matching v4, instead of leaking an internal symbol into the result.

  7. 5.2.3

    1 Aug 20264 fixes
    • fixed

      Prevent prototype fallback when resolving tags and mapping entries, #782.

    • fixed

      Resolve !!timestamp years 0000-0099 correctly, #775.

    • fixed

      Preserve implicit null mapping values before document markers and reject unpaired mapping event streams, #784.

    • fixed

      Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through present(); dump() and loading are unaffected, #780.

  8. 5.2.2

    23 Jul 20261 fix
    • fixed

      Quote flow scalars where a colon precedes a flow indicator, #773.

17 other lines we could not sort, mostly version bumps
  • Updated argparse to v3.

    5.5.0
  • Updated development dependencies.

    5.5.0
  • Hard-limit merge sequence size to 100.

    5.4.1
  • Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.

    5.4.0
  • Changed flat constant exports to grouped exports: EVENT_ID, SCALAR_STYLE, COLLECTION_STYLE, and CHOMPING_MODE, along with their value types. The old exports are still preserved, but deprecated.

    5.3.0
  • Made identify mandatory for custom tag definitions. Use identify: () => false for load-only tags.

    5.3.0
  • Rewritten in TypeScript and reorganized the public API around flat named exports.

    5.0.0
  • YAML 1.2 schemas: CORE_SCHEMA (loader default), JSON_SCHEMA, FAILSAFE_SCHEMA.

    5.0.0
  • YAML11_SCHEMA, a combination of all YAML 1.1 tags (YAML 1.1 does not specify a schema, only "types").

    5.0.0
  • load uses CORE_SCHEMA, without !!merge by default.

    5.0.0

1 internal line (docs, tests, tooling) left out.