chore(deps): update dependency yaml@1 to v2 - #1924
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Bundle Size ReportLast updated: 2026-08-17 07:46:07 UTC
Baseline source: comment-chain |
|
Tip All tests passed and all changes approved!🟢 UI Tests: 1207 tests unchanged |
3c8f70f to
15c5f76
Compare
|
Closing — It also collides with the adjacent entry that already governs the 2.x line: "yaml@1": "1.10.3"
"yaml@2": ">=2.8.3"Renovate reads the key Root cause fixed in #1928. |
Renovate Ignore NotificationBecause you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR. |
…downgrade (#1928) Renovate opened seven dependency PRs that must never merge. Six of them (#1917 #1918 #1919 #1920 #1923 #1924) bump pnpm override entries across a major boundary. Those keys are selectors, not package names: "yaml@1" means "consumers resolving to yaml v1 get this patched v1", so raising the value to 2.9.0 forces a v2 API onto v1 consumers. Two are already red in CI ("TypeError: expand is not a function" for brace-expansion@2 -> ^5.0.0, and gray-matter's yaml.safeLoad.bind() for js-yaml ^3.15.0 -> ^5.0.0); the rest are green only because CI never exercises the affected transitive consumers -- the same blind spot that let #1904 ship the minimatch v10 break that #1913 had to revert, and which #1920 now proposes again. Renovate also rewrites floor+cap ranges into bare caps (immutable ">=4.3.9 <5" -> "<6", undici ">=7.28.0 <8" -> "<9"), discarding the security floor that justified the override. Suppress majors on override depTypes. Minor/patch still flow so floors can be raised, and CVE remediation is unaffected because vulnerabilityAlerts already bypasses packageRules. Separately, #1915 proposed a tj-actions/changed-files digest "update" that is really a 7-month downgrade: upstream never moved the floating v47 tag past v47.0.0, so Renovate resolved our newer v47.0.6 pin backwards. Retagging the pin comment to the exact patch restores semver comparison. Audited all nine pinned actions; this was the only one affected. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
1 participant
This PR contains the following updates:
1.10.3→2.9.0Release Notes
eemeli/yaml (yaml@1)
v2.9.0Compare Source
The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of
parseDocument()andparseAllDocuments(): I've removed the claim that they'll "never throw".It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which
yamlCVEs have been issued so far.Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.
Array.prototype.push.apply()with large source arrayv2.8.4Compare Source
maxAliasCount:0(#677)e1a1a77)minFractionDigitsonly to decimal strings (#676)v2.8.3Compare Source
trailingCommaToString option for multiline flow formatting (#670)1e84ebb)v2.8.2Compare Source
v2.8.1Compare Source
v2.8.0Compare Source
--mergeoption to CLI tool (#611)v2.7.1Compare Source
v2.7.0Compare Source
The library is now available on JSR as @eemeli/yaml and on deno.land/x as yaml. In addition to Node.js and browsers, it should work in Deno, Bun, and Cloudflare Workers.
v2.6.1Compare Source
:00seconds from!!timestampvalues (#578, with thanks to @qraynaud)!!bool(#587, with thanks to @vra5107)v2.6.0Compare Source
!!merge <<keys (#580)stringKeysparse option (#581)v2.5.1Compare Source
v2.5.0Compare Source
--indentoption to CLI tool (#559, with thanks to @danielbayley)...(#558)minContentWidthif greater thanlineWidth(#562)Collection.maxFlowStringSingleLineLength(#522, #421)v2.4.5Compare Source
v2.4.4Compare Source
With special thanks to @RedCMD for finding and reporting all of the following:
[]{}immediately after:with plain key (#550)?explicit-key contents (#551)v2.4.3Compare Source
-.NaNor+.nanas NaN (#546)#within%TAGprefixes with trailing#commentsv2.4.2Compare Source
v2.4.1Compare Source
v2.4.0Compare Source
lineWidthoption for line breaking in flow collections (#522)v2.3.4Compare Source
v2.3.3Compare Source
v2.3.2Compare Source
v2.3.1Compare Source
"engines"config (#476)v2.3.0Compare Source
This release corresponds with the release of
yaml-typesv0.2.0, an expanding library of custom tags or types for use withyaml.This release contains no changes from v2.3.0-5, and the notes below include all changes from the v2.3.0-x prereleases.
Custom Tag Improvements
createNode()&createPair()to'yaml/util'(#457)from()methods to simplify tag development, and otherwise make extending custom collections easier (#467)TypeScript Improvements
StricttoDocumentinstances. (#441)StringifyContexttype from'yaml/util'(#464)Other New Features
toJS(doc, options?)method to nodes (#451, #458)createNode()for non-default tags (#464)Bugfixes
v2.2.2Compare Source
This patch release includes a fix for an error that could be thrown in
parseDocumentfor degenerate input. Otherwise, it's a patch release uplifting a few fixes from the ongoing v2.3 work to v2.2:v2.2.1Compare Source
v2.2.0Compare Source
New Features
flowCollectionPaddingtoString option (#420)Bugfixes
v2.1.3Compare Source
v2.1.2Compare Source
v2.1.1Compare Source
No changes in executable code, only TS types.
v2.1.0Compare Source
Fixes for TypeScript users. Arguably this could've been a patch release as well.
_directivesto resolve type conflict with ToString options (#389)v2.0.1Compare Source
v2.0.0Compare Source
This update has been in the works for the last year and a half. Its prerelease versions have been thoroughly tested by a wide number of users, and I think it's finally ready for "actual" release, for use in the mythical "production".
The breaking changes introduced here are mostly originating from the v1 CST parser having become a rather difficult beast to work with. So it's here rewritten pretty much completely, now with a lexer as a first stage. Along the way, the whole project was rewritten in TypeScript and the export paths and options refactored pretty deeply.
If you've been using the library just via its
parse(),parseDocument()andstringify()functions, then it's quite likely that none of the changes affect your experience in any way. However, if you've been doing something more involved, then I would strongly recommend that you review the library's documentation site for the v2 docs.Going forward, it's finally time to start experimenting with new YAML spec features that may eventually be included in YAML 1.3 and later. Those will be made available by specifying the
version: 'next'option. However, beware! Any features available this way may be removed or have their API broken by any minor release of this library, and no compatibility guarantees with other libraries are given. In general, semver compatibility is guaranteed for features that are explicitly included in the documentation; everything else should be considered as internal implementation details.The following is an overview of the breaking changes and new features introduced in each of the prerelease steps leading up to this release; the individual releases' notes and the PRs will contain more detail, along with specific migration guides.
BREAKING CHANGES
v2.0.0-0
set()in mappings & sequences (#185)v2.0.0-1
resolve()API (#201)v2.0.0-3
'yaml/parse-cst'endpoint (#223)v2.0.0-4
'yaml/types'and some of'yaml/util'into'yaml'(#234)typeproperty from all but Scalar nodes (#240)v2.0.0-5
tokensnamespace asCST(#252)[start, value-end, node-end](#259)error.offsetwitherror.pos: [number, number](#260)v2.0.0-6
v2.0.0-9
v2.0.0-10
doc.directivesnow indicates it as optional (#344)v2.0.0-11
YAML.defaultOptionsis removed (#346)directives.markeris renamed asdirectives.docStart(#371)v2.0.0
New Features
v2.0.0-0
set()&setIn()on doc with empty contents (#174)defaultKeyTypeoption for finer control of scalar output (#179)v2.0.0-1
asBigIntoption for sexagesimal integer valuesv2.0.0-3
logLeveloption (#215)visit(node, visitor)to'yaml'(#225)v2.0.0-4
'yaml/util'that weren't exposed beforev2.0.0-5
v2.0.0-6
uniqueKeysoption (#271)COMMENT_SPACEerror; useMISSING_CHARfor it insteadv2.0.0-7
<<merge keys, in addition to alias valuesv2.0.0-8
aliasDuplicateObjects(#299)clone()methods to Document, Directives, Schema and all Nodes (#304)v2.0.0-9
keepSoureTokenparse option, addingsrcTokenvalues to Nodes (#309)customTagsis defined (#325)v2.0.0-10
v2.0.0-11
directives.docEnd, for...marker (#371)YAML.visitAsync()(#372)v2.0.0
'next'YAML versionConfiguration
📅 Schedule: (UTC)
* 0-4,22-23 * * 1-5)* * * * 0,6)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.