js-yaml

5.5.0 · 15 Oct 2026MIT322.7M / weekRepository Homepage npm Atom feed

Same major only

1 release in betweenevery note read

Other targets from 5.3.0Newest 5.x, Latest5.5.0 Clears its advisory5.4.1

2
changes to make: 0
advisories fixed: 2
new: 5
fixes

Before you upgrade

Tick each one off as you go

Flattened the low-level AST node style representation. Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property. Alias nodes now contain only kind and anchor. This only affects code that directly constructs or edits AST nodes.
breaking5.4.0
The sortKeys option was rewritten using AST mutation to avoid side effects.
breaking5.4.0

Security

1 advisory still affects 5.4.0

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesmoderate · GHSA-r3ph-w7gj-g6xm

Upgrading to 5.4.1 clears it.

Release by release

5.4.0
25 Aug 20262 new · 5 fixes
- new
  Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.
- new
  Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.
- fixed
  Accept a byte order mark at the start of each document in a stream, #791.
- fixed
  Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys, #786.
- fixed
  Preserve empty scalar items when converting block sequences to flow style.
- fixed
  Do not apply the 1024-character simple-key limit to flow mapping keys.
- fixed
  Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.

1 other line we could not sort, mostly version bumps

Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.
5.4.0

Upgrade to 5.4.0

npm install js-yaml@5.4.0

What 5.4.0 needs

Reading 5.4.0's manifest…

Check against your package.json

Which of your other dependencies stand in the way of 5.4.0. Read once, not stored.

After upgrading

Run the type checker, the linter and the tests.
Build, and look for new deprecation warnings.
Update peer dependencies the new version asks for.
1 advisory still affects 5.4.0.