Packages

js-yaml

5.5.0 · 15 Oct 2026MIT322.7M / weekRepositoryHomepagenpmAtom feed

Upgrading js-yaml from 5.0.0 to 5.4.1

8 releases in betweenevery note read

Other targets from 5.0.0Newest 5.x, Latest5.5.0

Before you upgrade

Tick each one off as you go
  • breaking5.4.0
  • breaking5.4.0
  • breaking5.3.0
  • breaking5.2.0
  • breaking5.1.0
  • deprecated5.3.0

Security

  • Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

    5.4.1
  • Avoid exponential parsing time for nested flow sequence pairs.

    5.2.2
  • Remove quadratic complexity from !!omap addItem. Regression from v5 (usually not critical, because YAML11_SCHEMA is not default anymore).

    5.2.1

Release by release

  1. 5.4.1nothing new or fixed in the note

  2. 5.4.0

    25 Aug 20262 new · 5 fixes
    • new

      Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

    • new

      Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.

    • fixed

      Accept a byte order mark at the start of each document in a stream, #791.

    • fixed

      Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys, #786.

    • fixed

      Preserve empty scalar items when converting block sequences to flow style.

    • fixed

      Do not apply the 1024-character simple-key limit to flow mapping keys.

    • fixed

      Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.

  3. 5.3.0

    14 Aug 20263 new · 2 fixes
    • new

      Added completely new documentation.

    • new

      Exported DUMP_SCHEMA, the default schema used by the dumper.

    • new

      Added YAMLException.throwAt() for throwing an error at a source position.

    • fixed

      Validate << sequence items at merge time, so aliased merge sources are checked too.

    • fixed

      Resolve << outside of a mapping key as the plain string '<<', matching v4, instead of leaking an internal symbol into the result.

  4. 5.2.3

    1 Aug 20264 fixes
    • fixed

      Prevent prototype fallback when resolving tags and mapping entries, #782.

    • fixed

      Resolve !!timestamp years 0000-0099 correctly, #775.

    • fixed

      Preserve implicit null mapping values before document markers and reject unpaired mapping event streams, #784.

    • fixed

      Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through present(); dump() and loading are unaffected, #780.

  5. 5.2.2

    23 Jul 20261 fix
    • fixed

      Quote flow scalars where a colon precedes a flow indicator, #773.

  6. 5.2.1

    2 Jul 20261 new
    • new

      Add Map support to !!omap (should work when realMapTag used)

  7. 5.2.0

    26 Jun 20262 new · 1 fix
    • new

      Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

    • new

      Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

    • fixed

      Round-trip of integers with exponential form (>= 1e21)

  8. 5.1.0

    22 Jun 20261 new
    • new

      Collection tags can finalize an incrementally populated carrier into a different result value.

4 other lines we could not sort, mostly version bumps
  • Hard-limit merge sequence size to 100.

    5.4.1
  • Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.

    5.4.0
  • Changed flat constant exports to grouped exports: EVENT_ID, SCALAR_STYLE, COLLECTION_STYLE, and CHOMPING_MODE, along with their value types. The old exports are still preserved, but deprecated.

    5.3.0
  • Made identify mandatory for custom tag definitions. Use identify: () => false for load-only tags.

    5.3.0