js-yaml
5.5.0 · 15 Oct 2026MIT322.7M / weekRepositoryHomepagenpmAtom feed
Upgrading js-yaml from 5.2.0 to 5.5.0
9 releases in betweenevery note read
Before you upgrade
Tick each one off as you go- breaking5.4.0
- breaking5.4.0
- breaking5.3.0
- deprecated5.3.0
Security
Fixes 3 advisories affecting 5.2.0
- js-yaml: Exponential parsing time in flow collections leads to denial of servicehigh · GHSA-pm4m-ph32-ghv5
- js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesmoderate · GHSA-r3ph-w7gj-g6xm
- js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMAmoderate · GHSA-724g-mxrg-4qvm
- 5.4.1
Count empty mappings in merge sequences toward
maxTotalMergeKeysto limit CPU usage, #797. - 5.2.2
Avoid exponential parsing time for nested flow sequence pairs.
- 5.2.1
Remove quadratic complexity from !!omap
addItem. Regression from v5 (usually not critical, because YAML11_SCHEMA is not default anymore).
Release by release
- fixed
Correct percent-encoding of shorthand and verbatim tags.
- fixed
Reject
,,], and}at the start of block plain scalars, #801.
- fixed
- fixed
Fixed loading a whitespace-only block scalar followed by a less indented line, #802.
- fixed
- fixed
forceQuotesno longer quotes non-string scalars, #798.
- fixed
5.4.1nothing new or fixed in the note
- new
Added the
scalarStyleRulesdumper option to customize string formatting. See Scalar styling for details. - new
Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.
- fixed
Accept a byte order mark at the start of each document in a stream, #791.
- fixed
Produce valid flow mappings with
quoteFlowKeysandflowSkipColonSpace, including alias and property-only keys, #786. - fixed
Preserve empty scalar items when converting block sequences to flow style.
- fixed
Do not apply the 1024-character simple-key limit to flow mapping keys.
- fixed
Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.
- new
- new
Added completely new documentation.
- new
Exported
DUMP_SCHEMA, the default schema used by the dumper. - new
Added
YAMLException.throwAt()for throwing an error at a source position. - fixed
Validate
<<sequence items at merge time, so aliased merge sources are checked too. - fixed
Resolve
<<outside of a mapping key as the plain string'<<', matching v4, instead of leaking an internal symbol into the result.
- new
- fixed
Prevent prototype fallback when resolving tags and mapping entries, #782.
- fixed
Resolve
!!timestampyears 0000-0099 correctly, #775. - fixed
Preserve implicit null mapping values before document markers and reject unpaired mapping event streams, #784.
- fixed
Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through
present();dump()and loading are unaffected, #780.
- fixed
- fixed
Quote flow scalars where a colon precedes a flow indicator, #773.
- fixed
6 other lines we could not sort, mostly version bumps
- 5.5.0
Updated
argparseto v3. - 5.5.0
Updated development dependencies.
- 5.4.1
Hard-limit merge sequence size to 100.
- 5.4.0
Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.
- 5.3.0
Changed flat constant exports to grouped exports:
EVENT_ID,SCALAR_STYLE,COLLECTION_STYLE, andCHOMPING_MODE, along with their value types. The old exports are still preserved, but deprecated. - 5.3.0
Made
identifymandatory for custom tag definitions. Useidentify: () => falsefor load-only tags.