js-yaml
5.5.0 · 15 Oct 2026MIT322.7M / weekRepositoryHomepagenpmAtom feed
Upgrading js-yaml from 4.3.2 to 5.0.0
1 release in betweenevery note read
- 6
- changes to make
- 0
- advisories fixed
- 7
- new
- 0
- fixes
Before you upgrade
Tick each one off as you go- breaking5.0.0
- breaking5.0.0
- breaking5.0.0
- breaking5.0.0
- breaking5.0.0
- deprecated5.0.0
Security
4 advisories still affect 5.0.0
- js-yaml: Exponential parsing time in flow collections leads to denial of servicehigh · GHSA-pm4m-ph32-ghv5
- js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesmoderate · GHSA-r3ph-w7gj-g6xm
- js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMAmoderate · GHSA-724g-mxrg-4qvm
- js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yamlmoderate · GHSA-g796-fgmg-93mv
Upgrading to 5.4.1 clears them.
Release by release
- new
Added named exports for schemas, tags, parser events and AST utilities.
- new
Reworked
JSON_SCHEMAandCORE_SCHEMAwith spec-compliant scalar resolution rules, and addedYAML11_SCHEMA. - new
Added
realMapTagfor lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them. - new
Added
dump()transformoption for changing the generated AST before rendering. - new
Added
dump()optionsseqInlineFirst,flowBracketPadding,flowSkipCommaSpace,flowSkipColonSpace,quoteFlowKeys,quoteStyleandtagBeforeAnchor. - new
Added formal data layers (events and AST) for modular data pipelines.
- new
Added the YAML Test Suite to the test set.
- new
11 other lines we could not sort, mostly version bumps
- 5.0.0
Rewritten in TypeScript and reorganized the public API around flat named exports.
- 5.0.0
YAML 1.2 schemas:
CORE_SCHEMA(loader default),JSON_SCHEMA,FAILSAFE_SCHEMA. - 5.0.0
YAML11_SCHEMA, a combination of all YAML 1.1 tags (YAML 1.1 does not specify a schema, only "types"). - 5.0.0
loadusesCORE_SCHEMA, without!!mergeby default. - 5.0.0
dumpusesYAML11_SCHEMA+CORE_SCHEMAfor the quoting check, to guarantee backward compatibility by default. - 5.0.0
!!setis now loaded as a JavaScriptSet. - 5.0.0
Replaced the
TypeAPI with a tags API. Similar, but more precise and simpler. See examples for details. Tags can be defined viadefineScalarTag(),defineSequenceTag()anddefineMappingTag(), or as a spread + override of an existing tag. - 5.0.0
Renamed
Schema.extend()toSchema.withTags(). - 5.0.0
Expanded YAML 1.2 conformance and improved handling of directives, document markers, block keys, multiline scalars, tag syntax and other things.
- 5.0.0
load()now throws on empty input instead of returningundefined.
1 internal line (docs, tests, tooling) left out.