chore(deps): update dependency js-yaml to v5 by renovate[bot] · Pull Request #1919 · commercetools/nimbus

renovate · 2026-08-13T00:22:10Z

This PR contains the following updates:

Package	Change	Age	Confidence
js-yaml	`^3.15.0` → `^5.0.0`

Release Notes

nodeca/js-yaml (js-yaml)

`v5.2.3`

Compare Source

Fixed

Prevent prototype fallback when resolving tags and mapping entries, #782.
Resolve !!timestamp years 0000-0099 correctly, #775.
Preserve implicit null mapping values before document markers and reject
unpaired mapping event streams, #784.
Preserve folded scalar values with tab-indented lines when round-tripping a
parsed AST through present(); dump() and loading are unaffected, #780.

`v5.2.2`

Compare Source

Fixed

Quote flow scalars where a colon precedes a flow indicator, #773.

Security

Avoid exponential parsing time for nested flow sequence pairs.

`v5.2.1`

Compare Source

Fixed

Add Map support to !!omap (should work when realMapTag used)

Security

Remove quadratic complexity from !!omap addItem. Regression from v5
(usually not critical, because YAML11_SCHEMA is not default anymore).

`v5.2.0`

Compare Source

Added

Added maxTotalMergeKeys (10000) loader option to limit the total number of
keys processed by YAML merge (<<) across one load() / loadAll() call.
Added maxAliases (-1) loader option to limit the number of YAML aliases per
document.

Removed

maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge
processing.

Fixed

Round-trip of integers with exponential form (>= 1e21)

`v5.1.0`

Compare Source

Added

Collection tags can finalize an incrementally populated carrier into a
different result value.

Changed

[breaking] quoteStyle now selects the preferred quote style; use the
restored forceQuotes option to force quoting non-key strings.

`v5.0.0`

Compare Source

Added

Added named exports for schemas, tags, parser events and AST utilities.
Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution
rules, and added YAML11_SCHEMA.
Added realMapTag for lossless mappings with non-string and complex keys.
Object-based mappings now reject complex keys instead of stringifying them.
Added dump() transform option for changing the generated AST before
rendering.
Added dump() options seqInlineFirst, flowBracketPadding,
flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and
tagBeforeAnchor.
Added formal data layers (events and AST) for modular data pipelines.
- Added low-level parser (to events), presenter and visitor APIs.
Added the YAML Test Suite to the
test set.

Changed

See the migration guide for upgrade notes.
Rewritten in TypeScript and reorganized the public API around flat named
exports.
Reduced the set of exported schemas:
- YAML 1.2 schemas: CORE_SCHEMA (loader default), JSON_SCHEMA,
  FAILSAFE_SCHEMA.
- YAML11_SCHEMA, a combination of all YAML 1.1 tags (YAML 1.1 does not
  specify a schema, only "types").
load/dump default behaviour is now specified exactly via schemas:
- load uses CORE_SCHEMA, without !!merge by default.
- dump uses YAML11_SCHEMA + CORE_SCHEMA for the quoting check, to
  guarantee backward compatibility by default.
!!set is now loaded as a JavaScript Set.
Replaced the Type API with a tags API. Similar, but more precise and
simpler. See examples for details. Tags can be defined via
defineScalarTag(), defineSequenceTag() and defineMappingTag(), or as a
spread + override of an existing tag.
Renamed Schema.extend() to Schema.withTags().
Expanded YAML 1.2 conformance and improved handling of directives, document
markers, block keys, multiline scalars, tag syntax and other things.
load() now throws on empty input instead of returning undefined.
Moved browser builds to the js-yaml/browser export.
Deprecated the loadAll signature with an iterator (still works, but is a
candidate for removal).

Removed

Removed deprecated safeLoad(), safeLoadAll() and safeDump() exports.
Removed DEFAULT_SCHEMA and the nested types export.
Removed loader options onWarning, legacy and listener.
Removed dumper options styles, replacer, noCompatMode, condenseFlow,
quotingType and forceQuotes. Renamed noArrayIndent to seqNoIndent.
Formatting and representation are now configured through presenter options,
schemas and tag definitions. See migration guide on how to replace.
Removed support for importing internal files from lib/.

Added

Added docs/safety.md with notes about processing untrusted YAML.
Added maxDepth (100) loader option. Not a problem, but gives a better
exception instead of RangeError on stack overflow.
Added maxMergeSeqLength (20) loader option. Not a problem after merge fix,
but an additional restriction for safety.
Added sourcemaps to dist/ builds.

Changed

Stop resolving numbers with underscores as numeric scalars, #627.
Switched dev toolchains to Vite / neostandard.
Updated demo.
Reorganized tests.
dist/ files are no longer kept in the repository.

Fixed

Fix parsing of properties on the first implicit block mapping key, #62.
Fix trailing whitespace handling when folding flow scalar lines, #307.
Reject top-level block scalars without content indentation, #280.
Ensure numbers survive round-trip, #737.
Fix test coverage for issue #221.
Fix flow scalar trailing whitespace folding, #307.
Fix digits in YAML named tag handles.

Security

Fix potential DoS via quadratic complexity in merge - deduplicate repeated
elements (makes sense for malformed files > 10K).

`v4.1.1`

Compare Source

Security

Fix prototype pollution issue in yaml merge (<<) operator.

`v4.1.0`

Compare Source

Added

Types are now exported as yaml.types.XXX.
Every type now has options property with original arguments kept as they were
(see yaml.types.int.options as an example).

Changed

Schema.extend() now keeps old type order in case of conflicts
(e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

`v4.0.0`

Compare Source

Changed

Check migration guide in docs for details of all breaking changes.
Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are
moved to js-yaml-js-types package.
Breaking: removed safe* functions. Use load, loadAll, dump
instead which are all now safe by default.
yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use
yaml.DEFAULT_SCHEMA instead.
yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.
!!binary now always mapped to Uint8Array on load.
Reduced nesting of /lib folder.
Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal,
0o1234 is octal, 1:23 is parsed as string instead of base60).
dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.
Line and column in exceptions are now formatted as (X:Y) instead of
at line X, column Y (also present in compact format), #332.
Code snippet created in exceptions now contains multiple lines with line numbers.
dump() now serializes undefined as null in collections and removes keys with
undefined in mappings, #571.
dump() with skipInvalid=true now serializes invalid items in collections as null.
Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.
Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

Added .mjs (es modules) support.
Added quotingType and forceQuotes options for dumper to configure
string literal style, #290, #529.
Added styles: { '!!null': 'empty' } option for dumper
(serializes { foo: null } as "foo: "), #570.
Added replacer option (similar to option in JSON.stringify), #339.
Custom Tag can now handle all tags or multiple tags with the same prefix, #385.

Fixed

Astral characters are no longer encoded by dump(), #587.
"duplicate mapping key" exception now points at the correct column, #452.
Extra commas in flow collections (e.g. [foo,,bar]) now throw an exception
instead of producing null, #321.
__proto__ key no longer overrides object prototype, #164.
Removed bower.json.
Tags are now url-decoded in load() and url-encoded in dump()
(previously usage of custom non-ascii tags may have led to invalid YAML that can't be parsed).
Anchors now work correctly with empty nodes, #301.
Fix incorrect parsing of invalid block mapping syntax, #418.
Throw an error if block sequence/mapping indent contains a tab, #80.

Configuration

📅 Schedule: (UTC)

Branch creation
- At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
- Only on Sunday and Saturday (* * * * 0,6)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

vercel · 2026-08-13T00:22:11Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
nimbus-documentation	Error		Aug 17, 2026 7:44am
nimbus-storybook	Error		Aug 17, 2026 7:44am

changeset-bot · 2026-08-13T00:22:16Z

⚠️ No Changeset found

Latest commit: a27ddbb

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

misama-ct · 2026-08-18T07:30:39Z

Closing — js-yaml: "^3.15.0" is a security floor within the 3.x line (GHSA-h67p-54hq-rp68), not a version to track forward.

build-and-test fails in docs build:docs:

TypeError: Cannot read properties of undefined (reading 'bind')

Cause: gray-matter@4.0.3 (MDX frontmatter parsing) calls yaml.safeLoad.bind(yaml), and safeLoad was removed in js-yaml v4. Other consumers pinned by this override are all v3-era API too: cosmiconfig@8.3.6, read-yaml-file@1.1.0, webpack-cli@7.2.2, graphemesplit@2.6.0.

Root cause fixed in #1928.

renovate · 2026-08-18T07:31:54Z

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 5.x releases. But if you manually upgrade to 5.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

…downgrade (#1928) Renovate opened seven dependency PRs that must never merge. Six of them (#1917 #1918 #1919 #1920 #1923 #1924) bump pnpm override entries across a major boundary. Those keys are selectors, not package names: "yaml@1" means "consumers resolving to yaml v1 get this patched v1", so raising the value to 2.9.0 forces a v2 API onto v1 consumers. Two are already red in CI ("TypeError: expand is not a function" for brace-expansion@2 -> ^5.0.0, and gray-matter's yaml.safeLoad.bind() for js-yaml ^3.15.0 -> ^5.0.0); the rest are green only because CI never exercises the affected transitive consumers -- the same blind spot that let #1904 ship the minimatch v10 break that #1913 had to revert, and which #1920 now proposes again. Renovate also rewrites floor+cap ranges into bare caps (immutable ">=4.3.9 <5" -> "<6", undici ">=7.28.0 <8" -> "<9"), discarding the security floor that justified the override. Suppress majors on override depTypes. Minor/patch still flow so floors can be raised, and CVE remediation is unaffected because vulnerabilityAlerts already bypasses packageRules. Separately, #1915 proposed a tj-actions/changed-files digest "update" that is really a 7-month downgrade: upstream never moved the floating v47 tag past v47.0.0, so Renovate resolved our newer v47.0.6 pin backwards. Retagging the pin comment to the exact patch restores semver comparison. Audited all nine pinned actions; this was the only one affected. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

renovate Bot added the 🤖 Type: Dependencies label Aug 13, 2026

renovate Bot requested a review from a team as a code owner August 13, 2026 00:22

renovate Bot added the 🤖 Type: Dependencies label Aug 13, 2026

vercel Bot had a problem deploying to Preview – nimbus-documentation August 13, 2026 00:23 Failure

vercel Bot had a problem deploying to Preview – nimbus-storybook August 13, 2026 00:24 Failure

renovate Bot force-pushed the renovate/js-yaml-5.x branch from 3cdcee6 to dd6e058 Compare August 14, 2026 11:23

vercel Bot had a problem deploying to Preview – nimbus-storybook August 14, 2026 11:25 Failure

vercel Bot had a problem deploying to Preview – nimbus-documentation August 14, 2026 11:25 Failure

chore(deps): update dependency js-yaml to v5

a27ddbb

renovate Bot force-pushed the renovate/js-yaml-5.x branch from dd6e058 to a27ddbb Compare August 17, 2026 07:42

vercel Bot had a problem deploying to Preview – nimbus-storybook August 17, 2026 07:44 Failure

vercel Bot had a problem deploying to Preview – nimbus-documentation August 17, 2026 07:44 Failure

misama-ct mentioned this pull request Aug 18, 2026

ci(renovate): stop major bumps on pnpm override bands and tj-actions downgrade #1928

Merged

misama-ct closed this Aug 18, 2026

renovate Bot deleted the renovate/js-yaml-5.x branch August 18, 2026 07:31

Navigation Menu

Uh oh!

chore(deps): update dependency js-yaml to v5 - #1919

chore(deps): update dependency js-yaml to v5#1919
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/js-yaml-5.x

renovate Bot commented Aug 13, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Aug 13, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Aug 13, 2026 •

edited

Loading

Uh oh!

misama-ct commented Aug 18, 2026

Uh oh!

renovate Bot commented Aug 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Fixed

Fixed

Security

Fixed

Security

Added

Removed

Fixed

Added

Changed

Added

Changed

Removed

Added

Changed

Fixed

Security

Security

Added

Changed

Changed

Added

Fixed

Configuration

Uh oh!

vercel Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

misama-ct commented Aug 18, 2026

Uh oh!

renovate Bot commented Aug 18, 2026

Renovate Ignore Notification

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Aug 13, 2026 •

edited

Loading

vercel Bot commented Aug 13, 2026 •

edited

Loading

changeset-bot Bot commented Aug 13, 2026 •

edited

Loading