Packages

js-yaml

5.5.0 · 15 Oct 2026MIT322.7M / weekRepositoryHomepagenpmAtom feed

Upgrading js-yaml from 5.2.1 to 5.5.0

8 releases in betweenevery note read

Other targets from 5.2.1Clears its 2 advisories5.4.1

Before you upgrade

Tick each one off as you go
  • breaking5.4.0
  • breaking5.4.0
  • breaking5.3.0
  • deprecated5.3.0

Security

  • Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

    5.4.1
  • Avoid exponential parsing time for nested flow sequence pairs.

    5.2.2

Release by release

  1. 5.5.0

    15 Oct 20262 fixes
    • fixed

      Correct percent-encoding of shorthand and verbatim tags.

    • fixed

      Reject ,, ], and } at the start of block plain scalars, #801.

  2. 5.4.3

    5 Oct 20261 fix
    • fixed

      Fixed loading a whitespace-only block scalar followed by a less indented line, #802.

  3. 5.4.2

    13 Sep 20261 fix
    • fixed

      forceQuotes no longer quotes non-string scalars, #798.

  4. 5.4.1nothing new or fixed in the note

  5. 5.4.0

    25 Aug 20262 new · 5 fixes
    • new

      Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

    • new

      Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.

    • fixed

      Accept a byte order mark at the start of each document in a stream, #791.

    • fixed

      Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys, #786.

    • fixed

      Preserve empty scalar items when converting block sequences to flow style.

    • fixed

      Do not apply the 1024-character simple-key limit to flow mapping keys.

    • fixed

      Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.

  6. 5.3.0

    14 Aug 20263 new · 2 fixes
    • new

      Added completely new documentation.

    • new

      Exported DUMP_SCHEMA, the default schema used by the dumper.

    • new

      Added YAMLException.throwAt() for throwing an error at a source position.

    • fixed

      Validate << sequence items at merge time, so aliased merge sources are checked too.

    • fixed

      Resolve << outside of a mapping key as the plain string '<<', matching v4, instead of leaking an internal symbol into the result.

  7. 5.2.3

    1 Aug 20264 fixes
    • fixed

      Prevent prototype fallback when resolving tags and mapping entries, #782.

    • fixed

      Resolve !!timestamp years 0000-0099 correctly, #775.

    • fixed

      Preserve implicit null mapping values before document markers and reject unpaired mapping event streams, #784.

    • fixed

      Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through present(); dump() and loading are unaffected, #780.

  8. 5.2.2

    23 Jul 20261 fix
    • fixed

      Quote flow scalars where a colon precedes a flow indicator, #773.

6 other lines we could not sort, mostly version bumps
  • Updated argparse to v3.

    5.5.0
  • Updated development dependencies.

    5.5.0
  • Hard-limit merge sequence size to 100.

    5.4.1
  • Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.

    5.4.0
  • Changed flat constant exports to grouped exports: EVENT_ID, SCALAR_STYLE, COLLECTION_STYLE, and CHOMPING_MODE, along with their value types. The old exports are still preserved, but deprecated.

    5.3.0
  • Made identify mandatory for custom tag definitions. Use identify: () => false for load-only tags.

    5.3.0