Skip to content

Chore(deps): Bump js-yaml from 4.2.0 to 4.3.2 - #3962

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/js-yaml-4.3.1
Closed

Chore(deps): Bump js-yaml from 4.2.0 to 4.3.2#3962
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/js-yaml-4.3.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps js-yaml from 4.2.0 to 4.3.2.

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

  • [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

  • Restore umd builds back to es5.

Removed

  • [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.
Commits
  • 79ca68d 4.3.2 released
  • d90b661 Backport merge limits from v5.4.1
  • 86e91b8 4.3.1 released
  • c3cc4b0 Backport quadratic complexity fix for !!omap
  • 33d05b5 4.3.0 released
  • 663bfab Drop demo publish, to not override new v5 one.
  • 1cb8c7b Add v4-legacy tag for publish
  • 02f27af Restore umd builds back to es5
  • 8be84ed Fix es5 compatibility
  • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
  • Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 8, 2026
@dependabot dependabot Bot mentioned this pull request Aug 8, 2026
Closed
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/js-yaml-4.3.1 branch 3 times, most recently from 78f6094 to 37a56a1 Compare August 12, 2026 23:39
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/js-yaml-4.3.1 branch 3 times, most recently from a8609bb to 454f257 Compare August 22, 2026 14:41
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/js-yaml-4.3.1 branch from 454f257 to 1e75189 Compare August 28, 2026 16:52
@dependabot dependabot Bot changed the title Chore(deps): Bump js-yaml from 4.2.0 to 4.3.1 Chore(deps): Bump js-yaml from 4.2.0 to 4.3.2 Aug 28, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/js-yaml-4.3.1 branch from 1e75189 to 3a38a3e Compare September 1, 2026 12:53
@dependabot
Chore(deps): Bump js-yaml from 4.2.0 to 4.3.2
a6111c2 
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.2.0 to 4.3.2.
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.2.0...4.3.2)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/js-yaml-4.3.1 branch from 3a38a3e to a6111c2 Compare September 6, 2026 09:10
@dependabot @github

dependabot Bot commented on behalf of github Sep 9, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #3986.

@dependabot dependabot Bot closed this Sep 9, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/js-yaml-4.3.1 branch September 9, 2026 13:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants