js-yaml
5.5.0 · 15 Oct 2026MIT322.7M / weekRepositoryHomepagenpmAtom feed
Upgrading js-yaml from 5.0.0 to 5.1.0
1 release in betweenevery note read
- 1
- change to make
- 0
- advisories fixed
- 1
- new
- 0
- fixes
Before you upgrade
Tick each one off as you go- breaking5.1.0
Security
4 advisories still affect 5.1.0
- js-yaml: Exponential parsing time in flow collections leads to denial of servicehigh · GHSA-pm4m-ph32-ghv5
- js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesmoderate · GHSA-r3ph-w7gj-g6xm
- js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMAmoderate · GHSA-724g-mxrg-4qvm
- js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yamlmoderate · GHSA-g796-fgmg-93mv
Upgrading to 5.4.1 clears them.
Release by release
- new
Collection tags can finalize an incrementally populated carrier into a different result value.
- new