rosa/carcer
Watch
1
0
Fork
You've already forked carcer
 0
Code Issues 1 Pull requests 2 Projects Releases Packages Wiki Activity Actions

fix(deps): update dependency js-yaml to v5 #8

Open
rosa wants to merge 1 commit from renovate/js-yaml-5.x into v4
pull from: renovate/js-yaml-5.x
merge into: rosa:v4
Conversation 0 Commits 1 Files changed 2 +28 -6
rosa commented 2026-06-20 20:01:37 +00:00
Owner
Copy link

This PR contains the following updates:

Package Change Age Confidence
js-yaml ^4.1.0 → ^5.0.0 age confidence

Release Notes

nodeca/js-yaml (js-yaml)

v5.4.1

Compare Source

Changed
  • Hard-limit merge sequence size to 100.
Security
  • Count empty mappings in merge sequences toward maxTotalMergeKeys to limit
    CPU usage, #​797.

v5.4.0

Compare Source

Added
  • Added the scalarStyleRules dumper option to customize string formatting.
    See Scalar styling for details.
Changed
  • [breaking] Flattened the low-level AST node style representation. Scalar
    and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values;
    explicit tags use the separate tagged property. Alias nodes now contain
    only kind and anchor. This only affects code that directly constructs or
    edits AST nodes.
  • [breaking] The sortKeys option was rewritten using AST mutation to avoid
    side effects.
  • Reworked scalar style selection. This can change formatting without changing
    loaded values; in particular, whitespace-only strings are now double-quoted.
Fixed
  • Accept a byte order mark at the start of each document in a stream, #​791.
  • Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace,
    including alias and property-only keys, #​786.
  • Preserve empty scalar items when converting block sequences to flow style.
  • Do not apply the 1024-character simple-key limit to flow mapping keys.
  • Count Unicode code points, rather than UTF-16 code units, for the
    1024-character simple-key limit.
  • Add an explicit document-end marker after keep-chomped block scalars when
    needed to preserve trailing newlines.

v5.3.0

Compare Source

This release focuses on reworking the documentation and making small
architectural improvements before moving forward.

Added
  • Added completely new documentation.
  • Exported DUMP_SCHEMA, the default schema used by the dumper.
  • Added YAMLException.throwAt() for throwing an error at a source position.
Changed
  • Changed flat constant exports to grouped exports: EVENT_ID, SCALAR_STYLE,
    COLLECTION_STYLE, and CHOMPING_MODE, along with their value types. The old
    exports are still preserved, but deprecated.
  • Made identify mandatory for custom tag definitions. Use
    identify: () => false for load-only tags.
Deprecated
  • Deprecated flat constant exports. Use grouped ones instead.
Removed
  • Removed the MERGE_KEY export (not used anymore after last fixes).
Fixed
  • Validate << sequence items at merge time, so aliased merge sources are
    checked too.
  • Resolve << outside of a mapping key as the plain string '<<', matching
    v4, instead of leaking an internal symbol into the result.

v5.2.3

Compare Source

Fixed
  • Prevent prototype fallback when resolving tags and mapping entries, #​782.
  • Resolve !!timestamp years 0000-0099 correctly, #​775.
  • Preserve implicit null mapping values before document markers and reject
    unpaired mapping event streams, #​784.
  • Preserve folded scalar values with tab-indented lines when round-tripping a
    parsed AST through present(); dump() and loading are unaffected, #​780.

v5.2.2

Compare Source

Fixed
  • Quote flow scalars where a colon precedes a flow indicator, #​773.
Security
  • Avoid exponential parsing time for nested flow sequence pairs.

v5.2.1

Compare Source

Fixed
  • Add Map support to !!omap (should work when realMapTag used)
Security
  • Remove quadratic complexity from !!omap addItem. Regression from v5
    (usually not critical, because YAML11_SCHEMA is not default anymore).

v5.2.0

Compare Source

Added
  • Added maxTotalMergeKeys (10000) loader option to limit the total number of
    keys processed by YAML merge (<<) across one load() / loadAll() call.
  • Added maxAliases (-1) loader option to limit the number of YAML aliases per
    document.
Removed
  • maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge
    processing.
Fixed
  • Round-trip of integers with exponential form (>= 1e21)

v5.1.0

Compare Source

Added
  • Collection tags can finalize an incrementally populated carrier into a
    different result value.
Changed
  • [breaking] quoteStyle now selects the preferred quote style; use the
    restored forceQuotes option to force quoting non-key strings.

v5.0.0

Compare Source

Added
  • Added named exports for schemas, tags, parser events and AST utilities.
  • Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution
    rules, and added YAML11_SCHEMA.
  • Added realMapTag for lossless mappings with non-string and complex keys.
    Object-based mappings now reject complex keys instead of stringifying them.
  • Added dump() transform option for changing the generated AST before
    rendering.
  • Added dump() options seqInlineFirst, flowBracketPadding,
    flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and
    tagBeforeAnchor.
  • Added formal data layers (events and AST) for modular data pipelines.
    • Added low-level parser (to events), presenter and visitor APIs.
  • Added the YAML Test Suite to the
    test set.
Changed
  • See the migration guide for upgrade notes.
  • Rewritten in TypeScript and reorganized the public API around flat named
    exports.
  • Reduced the set of exported schemas:
    • YAML 1.2 schemas: CORE_SCHEMA (loader default), JSON_SCHEMA,
      FAILSAFE_SCHEMA.
    • YAML11_SCHEMA, a combination of all YAML 1.1 tags (YAML 1.1 does not
      specify a schema, only "types").
  • load/dump default behaviour is now specified exactly via schemas:
    • load uses CORE_SCHEMA, without !!merge by default.
    • dump uses YAML11_SCHEMA + CORE_SCHEMA for the quoting check, to
      guarantee backward compatibility by default.
  • !!set is now loaded as a JavaScript Set.
  • Replaced the Type API with a tags API. Similar, but more precise and
    simpler. See examples for details. Tags can be defined via
    defineScalarTag(), defineSequenceTag() and defineMappingTag(), or as a
    spread + override of an existing tag.
  • Renamed Schema.extend() to Schema.withTags().
  • Expanded YAML 1.2 conformance and improved handling of directives, document
    markers, block keys, multiline scalars, tag syntax and other things.
  • load() now throws on empty input instead of returning undefined.
  • Moved browser builds to the js-yaml/browser export.
  • Deprecated the loadAll signature with an iterator (still works, but is a
    candidate for removal).
Removed
  • Removed deprecated safeLoad(), safeLoadAll() and safeDump() exports.
  • Removed DEFAULT_SCHEMA and the nested types export.
  • Removed loader options onWarning, legacy and listener.
  • Removed dumper options styles, replacer, noCompatMode, condenseFlow,
    quotingType and forceQuotes. Renamed noArrayIndent to seqNoIndent.
    Formatting and representation are now configured through presenter options,
    schemas and tag definitions. See migration guide on how to replace.
  • Removed support for importing internal files from lib/.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [js-yaml](https://github.com/nodeca/js-yaml) | [`^4.1.0` → `^5.0.0`](https://renovatebot.com/diffs/npm/js-yaml/4.3.2/5.4.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/js-yaml/5.4.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/js-yaml/4.3.2/5.4.1?slim=true) | --- ### Release Notes <details> <summary>nodeca/js-yaml (js-yaml)</summary> ### [`v5.4.1`](https://github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#541---2026-08-26) [Compare Source](https://github.com/nodeca/js-yaml/compare/5.4.0...5.4.1) ##### Changed - Hard-limit merge sequence size to 100. ##### Security - Count empty mappings in merge sequences toward `maxTotalMergeKeys` to limit CPU usage, [#&#8203;797](https://github.com/nodeca/js-yaml/issues/797). ### [`v5.4.0`](https://github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#540---2026-08-25) [Compare Source](https://github.com/nodeca/js-yaml/compare/5.3.0...5.4.0) ##### Added - Added the `scalarStyleRules` dumper option to customize string formatting. See [Scalar styling](docs/scalar_styling.md) for details. ##### Changed - \[breaking] Flattened the low-level AST node style representation. Scalar and collection nodes now use `SCALAR_STYLE` and `COLLECTION_STYLE` values; explicit tags use the separate `tagged` property. Alias nodes now contain only `kind` and `anchor`. This only affects code that directly constructs or edits AST nodes. - \[breaking] The `sortKeys` option was rewritten using AST mutation to avoid side effects. - Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted. ##### Fixed - Accept a byte order mark at the start of each document in a stream, [#&#8203;791](https://github.com/nodeca/js-yaml/issues/791). - Produce valid flow mappings with `quoteFlowKeys` and `flowSkipColonSpace`, including alias and property-only keys, [#&#8203;786](https://github.com/nodeca/js-yaml/issues/786). - Preserve empty scalar items when converting block sequences to flow style. - Do not apply the 1024-character simple-key limit to flow mapping keys. - Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit. - Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines. ### [`v5.3.0`](https://github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#530---2026-08-14) [Compare Source](https://github.com/nodeca/js-yaml/compare/5.2.3...5.3.0) This release focuses on reworking the documentation and making small architectural improvements before moving forward. ##### Added - Added completely new documentation. - Exported `DUMP_SCHEMA`, the default schema used by the dumper. - Added `YAMLException.throwAt()` for throwing an error at a source position. ##### Changed - Changed flat constant exports to grouped exports: `EVENT_ID`, `SCALAR_STYLE`, `COLLECTION_STYLE`, and `CHOMPING_MODE`, along with their value types. The old exports are still preserved, but deprecated. - Made `identify` mandatory for custom tag definitions. Use `identify: () => false` for load-only tags. ##### Deprecated - Deprecated flat constant exports. Use grouped ones instead. ##### Removed - Removed the `MERGE_KEY` export (not used anymore after last fixes). ##### Fixed - Validate `<<` sequence items at merge time, so aliased merge sources are checked too. - Resolve `<<` outside of a mapping key as the plain string `'<<'`, matching v4, instead of leaking an internal symbol into the result. ### [`v5.2.3`](https://github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#523---2026-08-01) [Compare Source](https://github.com/nodeca/js-yaml/compare/5.2.2...5.2.3) ##### Fixed - Prevent prototype fallback when resolving tags and mapping entries, [#&#8203;782](https://github.com/nodeca/js-yaml/issues/782). - Resolve `!!timestamp` years 0000-0099 correctly, [#&#8203;775](https://github.com/nodeca/js-yaml/issues/775). - Preserve implicit null mapping values before document markers and reject unpaired mapping event streams, [#&#8203;784](https://github.com/nodeca/js-yaml/issues/784). - Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through `present()`; `dump()` and loading are unaffected, [#&#8203;780](https://github.com/nodeca/js-yaml/issues/780). ### [`v5.2.2`](https://github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#522---2026-07-24) [Compare Source](https://github.com/nodeca/js-yaml/compare/5.2.1...5.2.2) ##### Fixed - Quote flow scalars where a colon precedes a flow indicator, [#&#8203;773](https://github.com/nodeca/js-yaml/issues/773). ##### Security - Avoid exponential parsing time for nested flow sequence pairs. ### [`v5.2.1`](https://github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#521---2026-07-02) [Compare Source](https://github.com/nodeca/js-yaml/compare/5.2.0...5.2.1) ##### Fixed - Add `Map` support to !!omap (should work when `realMapTag` used) ##### Security - Remove quadratic complexity from !!omap `addItem`. Regression from v5 (usually not critical, because YAML11\_SCHEMA is not default anymore). ### [`v5.2.0`](https://github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#520---2026-06-26) [Compare Source](https://github.com/nodeca/js-yaml/compare/5.1.0...5.2.0) ##### Added - Added `maxTotalMergeKeys` (10000) loader option to limit the total number of keys processed by YAML merge (`<<`) across one `load()` / `loadAll()` call. - Added `maxAliases` (-1) loader option to limit the number of YAML aliases per document. ##### Removed - `maxMergeSeqLength` replaced with `maxTotalMergeKeys` for limiting YAML merge processing. ##### Fixed - Round-trip of integers with exponential form (>= `1e21`) ### [`v5.1.0`](https://github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#510---2026-06-23) [Compare Source](https://github.com/nodeca/js-yaml/compare/5.0.0...5.1.0) ##### Added - Collection tags can finalize an incrementally populated carrier into a different result value. ##### Changed - \[breaking] `quoteStyle` now selects the preferred quote style; use the restored `forceQuotes` option to force quoting non-key strings. ### [`v5.0.0`](https://github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#500---2026-06-20) [Compare Source](https://github.com/nodeca/js-yaml/compare/4.3.2...5.0.0) ##### Added - Added named exports for schemas, tags, parser events and AST utilities. - Reworked `JSON_SCHEMA` and `CORE_SCHEMA` with spec-compliant scalar resolution rules, and added `YAML11_SCHEMA`. - Added `realMapTag` for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them. - Added `dump()` `transform` option for changing the generated AST before rendering. - Added `dump()` options `seqInlineFirst`, `flowBracketPadding`, `flowSkipCommaSpace`, `flowSkipColonSpace`, `quoteFlowKeys`, `quoteStyle` and `tagBeforeAnchor`. - Added formal data layers (events and AST) for modular data pipelines. - Added low-level parser (to events), presenter and visitor APIs. - Added the [YAML Test Suite](https://github.com/yaml/yaml-test-suite) to the test set. ##### Changed - See the [migration guide](docs/migrate_v4_to_v5.md) for upgrade notes. - Rewritten in TypeScript and reorganized the public API around flat named exports. - Reduced the set of exported schemas: - YAML 1.2 schemas: `CORE_SCHEMA` (loader default), `JSON_SCHEMA`, `FAILSAFE_SCHEMA`. - `YAML11_SCHEMA`, a combination of all YAML 1.1 tags (YAML 1.1 does not specify a schema, only "types"). - `load`/`dump` default behaviour is now specified exactly via schemas: - `load` uses `CORE_SCHEMA`, without `!!merge` by default. - `dump` uses `YAML11_SCHEMA` + `CORE_SCHEMA` for the quoting check, to guarantee backward compatibility by default. - `!!set` is now loaded as a JavaScript `Set`. - Replaced the `Type` API with a tags API. Similar, but more precise and simpler. See examples for details. Tags can be defined via `defineScalarTag()`, `defineSequenceTag()` and `defineMappingTag()`, or as a spread + override of an existing tag. - Renamed `Schema.extend()` to `Schema.withTags()`. - Expanded YAML 1.2 conformance and improved handling of directives, document markers, block keys, multiline scalars, tag syntax and other things. - `load()` now throws on empty input instead of returning `undefined`. - Moved browser builds to the `js-yaml/browser` export. - Deprecated the `loadAll` signature with an iterator (still works, but is a candidate for removal). ##### Removed - Removed deprecated `safeLoad()`, `safeLoadAll()` and `safeDump()` exports. - Removed `DEFAULT_SCHEMA` and the nested `types` export. - Removed loader options `onWarning`, `legacy` and `listener`. - Removed dumper options `styles`, `replacer`, `noCompatMode`, `condenseFlow`, `quotingType` and `forceQuotes`. Renamed `noArrayIndent` to `seqNoIndent`. Formatting and representation are now configured through presenter options, schemas and tag definitions. See migration guide on how to replace. - Removed support for importing internal files from `lib/`. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMzMuNCIsInVwZGF0ZWRJblZlciI6IjQzLjI4OC4wIiwidGFyZ2V0QnJhbmNoIjoidjQiLCJsYWJlbHMiOlsicmVub3ZhdGUiXX0=-->
fix(deps): update dependency js-yaml to v5
Some checks failed
ci/woodpecker/push/build Pipeline failed
Details
ci/woodpecker/pr/build Pipeline failed
Details
44169ca59a
rosa force-pushed renovate/js-yaml-5.x from 44169ca59a
Some checks failed
ci/woodpecker/push/build Pipeline failed
Details
ci/woodpecker/pr/build Pipeline failed
Details
to 38287463dc
Some checks failed
ci/woodpecker/pr/build Pipeline is pending
Details
ci/woodpecker/push/build Pipeline failed
Details
2026-07-04 04:03:48 +00:00 Compare
rosa force-pushed renovate/js-yaml-5.x from 38287463dc
Some checks failed
ci/woodpecker/pr/build Pipeline is pending
Details
ci/woodpecker/push/build Pipeline failed
Details
to 5718dc948a
Some checks failed
ci/woodpecker/pr/build Pipeline failed
Details
ci/woodpecker/push/build Pipeline failed
Details
2026-08-08 00:02:08 +00:00 Compare
rosa force-pushed renovate/js-yaml-5.x from 5718dc948a
Some checks failed
ci/woodpecker/pr/build Pipeline failed
Details
ci/woodpecker/push/build Pipeline failed
Details
to 02b1aeff38
Some checks failed
ci/woodpecker/push/build Pipeline failed
Details
ci/woodpecker/pr/build Pipeline failed
Details
2026-09-03 04:03:03 +00:00 Compare
Some checks failed
ci/woodpecker/push/build Pipeline failed
Details
ci/woodpecker/pr/build Pipeline failed
Details
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/js-yaml-5.x:renovate/js-yaml-5.x
git switch renovate/js-yaml-5.x

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch v4
git merge --no-ff renovate/js-yaml-5.x
git switch renovate/js-yaml-5.x
git rebase v4
git switch v4
git merge --ff-only renovate/js-yaml-5.x
git switch renovate/js-yaml-5.x
git rebase v4
git switch v4
git merge --no-ff renovate/js-yaml-5.x
git switch v4
git merge --squash renovate/js-yaml-5.x
git switch v4
git merge --ff-only renovate/js-yaml-5.x
git switch v4
git merge renovate/js-yaml-5.x
git push origin v4
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
rosa/carcer!8
No description provided.