chore(deps): bump the npm_and_yarn group across 13 directories with 16 updates

Open dependabot[bot] opened this issue 3 weeks ago • 0 comments

Bumps the npm_and_yarn group with 3 updates in the / directory: tmp, js-yaml and axios. Bumps the npm_and_yarn group with 5 updates in the /examples directory:

Package	From	To
webpack	`5.93.0`	`5.94.0`
webpack-dev-server	`5.0.4`	`5.2.1`
brace-expansion	`1.1.11`	`1.1.12`
js-yaml	`3.14.1`	`3.14.2`
axios	`1.7.4`	`1.13.2`

Bumps the npm_and_yarn group with 8 updates in the /examples/blockly-rtc directory:

Package	From	To
webpack	`5.93.0`	`5.103.0`
webpack-dev-server	`5.0.4`	`5.2.1`
brace-expansion	`1.1.11`	`1.1.12`
brace-expansion	`2.0.1`	`2.0.2`
js-yaml	`4.1.0`	`4.1.1`
cookie	`0.4.2`	`0.7.2`
on-headers	`1.0.2`	`1.1.0`
ws	`7.4.6`	`7.5.10`
parseuri	`0.0.6`	`removed`

Bumps the npm_and_yarn group with 3 updates in the /examples/custom-generator-codelab directory: webpack, webpack-dev-server and on-headers. Bumps the npm_and_yarn group with 3 updates in the /examples/custom-renderer-codelab directory: webpack, webpack-dev-server and on-headers. Bumps the npm_and_yarn group with 6 updates in the /examples/developer-tools directory:

Package	From	To
webpack	`5.93.0`	`5.103.0`
webpack-dev-server	`5.0.4`	`5.2.1`
brace-expansion	`2.0.1`	`2.0.2`
brace-expansion	`1.1.11`	`1.1.12`
tmp	`0.0.33`	`removed`
js-yaml	`3.14.1`	`3.14.2`
on-headers	`1.0.2`	`1.1.0`

Bumps the npm_and_yarn group with 3 updates in the /examples/sample-app directory: webpack, webpack-dev-server and on-headers. Bumps the npm_and_yarn group with 3 updates in the /examples/sample-app-ts directory: webpack, webpack-dev-server and on-headers. Bumps the npm_and_yarn group with 1 update in the /plugins/block-shareable-procedures directory: form-data. Bumps the npm_and_yarn group with 4 updates in the /plugins/dev-scripts directory: brace-expansion, js-yaml, express and on-headers. Bumps the npm_and_yarn group with 2 updates in the /plugins/modal directory: js-yaml and form-data. Bumps the npm_and_yarn group with 2 updates in the /plugins/typed-variable-modal directory: js-yaml and form-data. Bumps the npm_and_yarn group with 1 update in the /plugins/workspace-search directory: form-data.

Removes tmp

Updates js-yaml from 3.14.1 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[3.14.2] - 2025-11-15

Security

Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

Types are now exported as yaml.types.XXX.

Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

Check migration guide to see details for all breaking changes.

Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.

Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.

yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.

yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.

!!binary now always mapped to Uint8Array on load.

Reduced nesting of /lib folder.

Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).

dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.

Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.

Code snippet created in exceptions now contains multiple lines with line numbers.

dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.

dump() with skipInvalid=true now serializes invalid items in collections as null.

Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.

Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

Added .mjs (es modules) support.

Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.

Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

... (truncated)

Commits

9963d36 3.14.2 released
10d3c8e dist rebuild
5278870 fix prototype pollution in merge (<<) (#731)
See full diff in compare view

Updates axios from 1.11.0 to 1.13.2

Release notes

Sourced from axios's releases.

Release v1.13.2

Release notes:

Bug Fixes

http: fix 'socket hang up' bug for keep-alive requests when using timeouts; (#7206) (8d37233)

http: use default export for http2 module to support stubs; (#7196) (0588880)

Performance Improvements

http: fix early loop exit; (#7202) (12c314b)

Contributors to this release

Dmitriy Mozgovoy

Kasper Isager Dalsgarð

Release v1.13.1

Release notes:

Bug Fixes

http: fixed a regression that caused the data stream to be interrupted for responses with non-OK HTTP statuses; (#7193) (bcd5581)

Contributors to this release

Anchal Singh

Dmitriy Mozgovoy

Release v1.13.0

Release notes:

Bug Fixes

fetch: prevent TypeError when config.env is undefined (#7155) (015faec)

resolve issue #7131 (added spacing in mergeConfig.js) (#7133) (9b9ec98)

Features

http: add HTTP2 support; (#7150) (d676df7)

Contributors to this release

Dmitriy Mozgovoy

Noritaka Kobayashi

Aviraj2929

prasoon patel

Samyak Dandge

Anchal Singh

Rahul Kumar

Amit Verma

... (truncated)

Changelog

Sourced from axios's changelog.

1.13.2 (2025-11-04)

Bug Fixes

http: fix 'socket hang up' bug for keep-alive requests when using timeouts; (#7206) (8d37233)

http: use default export for http2 module to support stubs; (#7196) (0588880)

Performance Improvements

http: fix early loop exit; (#7202) (12c314b)

Contributors to this release

Dmitriy Mozgovoy

Kasper Isager Dalsgarð

1.13.1 (2025-10-28)

Bug Fixes

http: fixed a regression that caused the data stream to be interrupted for responses with non-OK HTTP statuses; (#7193) (bcd5581)

Contributors to this release

Anchal Singh

Dmitriy Mozgovoy

1.13.0 (2025-10-27)

Bug Fixes

fetch: prevent TypeError when config.env is undefined (#7155) (015faec)

resolve issue #7131 (added spacing in mergeConfig.js) (#7133) (9b9ec98)

Features

http: add HTTP2 support; (#7150) (d676df7)

Contributors to this release

Dmitriy Mozgovoy

Noritaka Kobayashi

Aviraj2929

prasoon patel

Samyak Dandge

... (truncated)

Commits

08b84b5 chore(release): v1.13.2 (#7207)
8d37233 fix(http): fix 'socket hang up' bug for keep-alive requests when using timeou...
12c314b perf(http): fix early loop exit; (#7202)
f6d79e7 chore(sponsor): update sponsor block (#7203)
0588880 fix(http): use default export for http2 module to support stubs; (#7196)
1ef8e72 chore(release): v1.13.1 (#7194)
bcd5581 fix(http): fixed a regression that caused the data stream to be interrupted f...
c9b3371 chore: enhance styling and responsiveness in client.html (#7173)
9ead04d [Release] v1.13.0 (#7189)
d000fbf fix(http2): fix possible race condition when handling http2 stream on almost ...
Additional commits viewable in compare view

Updates js-yaml from 3.14.1 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[3.14.2] - 2025-11-15

Security

Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

Types are now exported as yaml.types.XXX.

Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

Check migration guide to see details for all breaking changes.

Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.

Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.

yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.

yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.

!!binary now always mapped to Uint8Array on load.

Reduced nesting of /lib folder.

Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).

dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.

Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.

Code snippet created in exceptions now contains multiple lines with line numbers.

dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.

dump() with skipInvalid=true now serializes invalid items in collections as null.

Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.

Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

Added .mjs (es modules) support.

Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.

Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

... (truncated)

Commits

9963d36 3.14.2 released
10d3c8e dist rebuild
5278870 fix prototype pollution in merge (<<) (#731)
See full diff in compare view

Updates axios from 1.11.0 to 1.13.2

Release notes

Sourced from axios's releases.

Release v1.13.2

Release notes:

Bug Fixes

http: fix 'socket hang up' bug for keep-alive requests when using timeouts; (#7206) (8d37233)

http: use default export for http2 module to support stubs; (#7196) (0588880)

Performance Improvements

http: fix early loop exit; (#7202) (12c314b)

Contributors to this release

Dmitriy Mozgovoy

Kasper Isager Dalsgarð

Release v1.13.1

Release notes:

Bug Fixes

http: fixed a regression that caused the data stream to be interrupted for responses with non-OK HTTP statuses; (#7193) (bcd5581)

Contributors to this release

Anchal Singh

Dmitriy Mozgovoy

Release v1.13.0

Release notes:

Bug Fixes

fetch: prevent TypeError when config.env is undefined (#7155) (015faec)

resolve issue #7131 (added spacing in mergeConfig.js) (#7133) (9b9ec98)

Features

http: add HTTP2 support; (#7150) (d676df7)

Contributors to this release

Dmitriy Mozgovoy

Noritaka Kobayashi

Aviraj2929

prasoon patel

Samyak Dandge

Anchal Singh

Rahul Kumar

Amit Verma

... (truncated)

Changelog

Sourced from axios's changelog.

1.13.2 (2025-11-04)

Bug Fixes

http: fix 'socket hang up' bug for keep-alive requests when using timeouts; (#7206) (8d37233)

http: use default export for http2 module to support stubs; (#7196) (0588880)

Performance Improvements

http: fix early loop exit; (#7202) (12c314b)

Contributors to this release

Dmitriy Mozgovoy

Kasper Isager Dalsgarð

1.13.1 (2025-10-28)

Bug Fixes

http: fixed a regression that caused the data stream to be interrupted for responses with non-OK HTTP statuses; (#7193) (bcd5581)

Contributors to this release

Anchal Singh

Dmitriy Mozgovoy

1.13.0 (2025-10-27)

Bug Fixes

fetch: prevent TypeError when config.env is undefined (#7155) (015faec)

resolve issue #7131 (added spacing in mergeConfig.js) (#7133) (9b9ec98)

Features

http: add HTTP2 support; (#7150) (d676df7)

Contributors to this release

Dmitriy Mozgovoy

Noritaka Kobayashi

Aviraj2929

prasoon patel

Samyak Dandge

... (truncated)

Commits

08b84b5 chore(release): v1.13.2 (#7207)
8d37233 fix(http): fix 'socket hang up' bug for keep-alive requests when using timeou...
12c314b perf(http): fix early loop exit; (#7202)
f6d79e7 chore(sponsor): update sponsor block (#7203)
0588880 fix(http): use default export for http2 module to support stubs; (#7196)
1ef8e72 chore(release): v1.13.1 (#7194)
bcd5581 fix(http): fixed a regression that caused the data stream to be interrupted f...
c9b3371 chore: enhance styling and responsiveness in client.html (#7173)
9ead04d [Release] v1.13.0 (#7189)
d000fbf fix(http2): fix possible race condition when handling http2 stream on almost ...
Additional commits viewable in compare view

Updates tmp from 0.0.33 to 0.2.5

Changelog

Sourced from tmp's changelog.

v0.2.2 (2024-02-28)

:bug: Bug Fix

#278 Closes #268: Revert "fix #246: remove any double quotes or single quotes… (@mbargiel)

:memo: Documentation

#279 Closes #266: move paragraph on graceful cleanup to the head of the documentation (@silkentrance)

Committers: 5

Carsten Klein (@silkentrance)

Dave Nicolson (@dnicolson)

KARASZI István (@raszi)

Maxime Bargiel (@mbargiel)

@robertoaceves

v0.2.1 (2020-04-28)

:rocket: Enhancement

#252 Closes #250: introduce tmpdir option for overriding the system tmp dir (@silkentrance)

:house: Internal

#253 Closes #191: generate changelog from pull requests using lerna-changelog (@silkentrance)

Committers: 1

Carsten Klein (@silkentrance)

v0.2.0 (2020-04-25)

:rocket: Enhancement

#234 feat: stabilize tmp for v0.2.0 release (@silkentrance)

:bug: Bug Fix

#231 Closes #230: regression after fix for #197 (@silkentrance)

#220 Closes #197: return sync callback when using the sync interface, otherwise return the async callback (@silkentrance)

#193 Closes #192: tmp must not exit the process on its own (@silkentrance)

:memo: Documentation

#221 Gh 206 document name option (@silkentrance)

:house: Internal

#226 Closes #212: enable direct name option test (@silkentrance)

#225 Closes #211: existing tests must clean up after themselves (@silkentrance)

#224 Closes #217: name tests must use tmpName (@silkentrance)

#223 Closes #214: refactor tests and lib (@silkentrance)

#198 Update dependencies to latest versions (@matsev)

... (truncated)

Commits

See full diff in compare view

Updates js-yaml from 3.14.1 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[3.14.2] - 2025-11-15

Security

Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

Types are now exported as yaml.types.XXX.

Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

Check migration guide to see details for all breaking changes.

Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.

Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.

yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.

yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.

!!binary now always mapped to Uint8Array on load.

Reduced nesting of /lib folder.

Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).

dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.

Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.

Code snippet created in exceptions now contains multiple lines with line numbers.

dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.

dump() with skipInvalid=true now serializes invalid items in collections as null.

Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.

Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

Added .mjs (es modules) support.

Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.

Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

... (truncated)

Commits

9963d36 3.14.2 released
10d3c8e dist rebuild
5278870 fix prototype pollution in merge (<<) (#731)
See full diff in compare view

Updates js-yaml from 3.14.1 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[3.14.2] - 2025-11-15

Security

Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

Types are now exported as yaml.types.XXX.

Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

Check migration guide to see details for all breaking changes.

Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.

Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.

yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.

yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.

!!binary now always mapped to Uint8Array on load.

Reduced nesting of /lib folder.

Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).

dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.

Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.

Code snippet created in exceptions now contains multiple lines with line numbers.

dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.

dump() with skipInvalid=true now serializes invalid items in collections as null.

Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.

Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

Added .mjs (es modules) support.

Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.

Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

... (truncated)

Commits

9963d36 3.14.2 released
10d3c8e dist rebuild
5278870 fix prototype pollution in merge (<<) (#731)
See full diff in compare view

Updates tmp from 0.0.33 to 0.2.5

Changelog

Sourced from tmp's changelog.

v0.2.2 (2024-02-28)

:bug: Bug Fix

#278 Closes #268: Revert "fix #246: remove any double quotes or single quotes… (@mbargiel)

:memo: Documentation

#279 Closes #266: move paragraph on graceful cleanup to the head of the documentation (@silkentrance)

Committers: 5

Carsten Klein (@silkentrance)

Dave Nicolson (@dnicolson)

KARASZI István (@raszi)

Maxime Bargiel (@mbargiel)

@robertoaceves

v0.2.1 (2020-04-28)

:rocket: Enhancement

#252 Closes #250: introduce tmpdir option for overriding the system tmp dir (@silkentrance)

:house: Internal

#253 Closes #191: generate changelog from pull requests using lerna-changelog (@silkentrance)

Committers: 1

Carsten Klein (@silkentrance)

v0.2.0 (2020-04-25)

:rocket: Enhancement

#234 feat: stabilize tmp for v0.2.0 release (@silkentrance)

:bug: Bug Fix

#231 Closes #230: regression after fix for #197 (@silkentrance)

#220 Closes #197: return sync callback when using the sync interface, otherwise return the async callback (@silkentrance)

#193 Closes #192: tmp must not exit the process on its own (@silkentrance)

:memo: Documentation

#221 Gh 206 document name option (@silkentrance)

:house: Internal

#226 Closes #212: enable direct name option test (@silkentrance)

#225 Closes #211: existing tests must clean up after themselves (@silkentrance)

#224 Closes #217: name tests must use tmpName (@silkentrance)

#223 Closes #214: refactor tests and lib (@silkentrance)

#198 Update dependencies to latest versions (@matsev)

... (truncated)

Commits

See full diff in compare view

Updates js-yaml from 3.14.1 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[3.14.2] - 2025-11-15

Security

Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

Types are now exported as yaml.types.XXX.

Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

Check migration guide to see details for all breaking changes.

Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.

Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.

yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.

yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.

!!binary now always mapped to Uint8Array on load.

Reduced nesting of /lib folder.

Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).

dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.

Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.

Code snippet created in exceptions now contains multiple lines with line numbers.

dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.

dump() with skipInvalid=true now serializes invalid items in collections as null.

Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.

Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

Added .mjs (es modules) support.

Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.

Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.

... (truncated)

Commits

9963d36 3.14.2 released
10d3c8e dist rebuild
5278870 fix prototype pollution in merge (<<) (#731)
See full diff in compare view

Updates js-yaml from 3.14.1 to 3.14.2

Changelog

Sourced from js-yaml's changelog.

[3.14.2] - 2025-11-15

Security

Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

Types are now exported as yaml.types.XXX.

Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

Check migration guide to see details for all breaking changes.

Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.

Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.

yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.

yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.

!!binary now always mapped to Uint8Array on load.

Reduced nesting of /lib folder.

Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).

dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.

Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), Description has been truncated

Dec 04 '25 23:12 dependabot[bot]