yaml
2.9.1ISC
- 2.9.1 is the latest, published 11 September 2026.
- 2 security advisories, all fixed.
- 2.x: 33 releases since 6 April 2022, 1 in the last 90 days.
Security advisories
Grouped by the version that fixes them, so one upgrade reads as one step.
Fixed in 2.8.3 · 1 advisory
- MODERATEyaml is vulnerable to Stack Overflow via deeply nested YAML collectionsGHSA-48c2-rrv3-qjmp
Fixed in 2.2.2 · 1 advisory
- HIGHUncaught Exception in yamlGHSA-f9xv-q969-pqx4
Releases in the last 90 days
Feed of releases and advisoriesEvery stable release, newest first. Notes are quoted as the maintainers published them.
2.9.1
11 September 2026Limit recursive merge aliases (#685, #713)
Limit recursive merge aliases (#685, #713)
Simplify line unfolding during quoted string parsing
Major versions
- 2.xsince 6 April 2022 · latest 2.9.1 · 33 releases
- 1.xsince 19 September 2018 · latest 1.10.3 · 28 releases
- 0.xsince 15 April 2011 · latest 0.3.0 · 8 releases
Quality and security signals
What npm and deps.dev say about the latest release. Signals, not a verdict.
Reading npm and deps.dev…
Registry facts last checked 15 October 2026. Releases and advisories last read 15 October 2026.
Know when your own dependencies move
Inlinr tracks your coding time automatically. Switch dependency tracking on for a project and it reads that repository's manifest to show what is behind and what has been deprecated — off by default, one project at a time.