Skip to content

chore(deps): bump js-yaml from 4.1.0 to 4.2.0#9344

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/js-yaml-4.2.0
Open

chore(deps): bump js-yaml from 4.1.0 to 4.2.0#9344
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/js-yaml-4.2.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 1, 2026

Copy link
Copy Markdown
Contributor

Bumps js-yaml from 4.1.0 to 4.2.0.

Changelog

Sourced from js-yaml's changelog.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added a loader option limiting merge sequence length. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.
  • Fix digits in YAML named tag handles.

Security

  • Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

  • Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump js-yaml from 4.1.0 to 4.2.0
9dde0ec 
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.0 to 4.2.0.
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.2.0)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.2.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 1, 2026
Copilot AI review requested due to automatic review settings July 1, 2026 19:55
@dependabot dependabot Bot added javascript Pull requests that update javascript code dependencies Pull requests that update a dependency file labels Jul 1, 2026
Copilot AI reviewed Jul 1, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

@github-actions

github-actions Bot commented Jul 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤖 AI PR Validation Report

PR Review Results

Thank you for your submission! Here's detailed feedback on your PR title and body compliance:

✅ PR Title

  • Current: chore(deps): bump js-yaml from 4.1.0 to 4.2.0
  • Issue: None. The title is clear, specific, and accurately describes the dependency update.
  • Recommendation: No change needed.

⚠️ Commit Type

  • Properly selected in substance as a dependency maintenance change (chore).
  • Note: The checklist box is currently unchecked in the PR body. Please mark exactly one commit type checkbox to satisfy the template.

❌ Risk Level

  • The PR body does not have a risk level checkbox selected.
  • Based on the diff, the change is a dependency bump with lockfile updates only, so Low is appropriate.
  • Recommendation: Check exactly one risk level box. If you intend to keep it aligned with the change scope, select Low.

✅ What & Why

  • Current: Dependabot-generated summary explaining the js-yaml upgrade and security/changelog context.
  • Issue: None. This is sufficiently brief and clear for a dependency update.
  • Recommendation: No change needed.

⚠️ Impact of Change

  • This section is present but mostly blank.
  • Recommendation: Even for dependency bumps, add a short impact note so readers know what to expect.
    • Users: No direct user-facing behavior change expected; internal YAML parsing dependency is updated.
    • Developers: Dependency version updated in data-mapper packages and lockfile refreshed.
    • System: Potential security/compatibility improvement from js-yaml 4.2.0; no intended architecture change.

❌ Test Plan

  • No unit tests or E2E tests are present in the diff.
  • The PR body also does not include a manual-testing explanation.
  • Because this is a code/config dependency change, the template expects either tests in the diff or a clear explanation for why they are not applicable.
  • Recommendation: Add one of the following:
    • A checked Unit tests added/updated box if any relevant test updates exist, or
    • A checked Manual testing completed box with a brief note such as: Dependency-only update; no runtime behavior changes and automated tests are not applicable.

✅ Contributors

  • No contributors listed, which is acceptable.
  • Recommendation: Optional. Add contributors only if there were PM/design/engineering collaborators.

✅ Screenshots/Videos

  • Not required for this dependency-only change.
  • Recommendation: No screenshots needed.

Summary Table

Section Status Recommendation
Title ✅ No change needed.
Commit Type ⚠️ Check exactly one commit type; chore fits.
Risk Level ❌ Select Low; it is currently missing.
What & Why ✅ No change needed.
Impact of Change ⚠️ Add a short impact summary.
Test Plan ❌ Add a test checkbox or a clear manual-testing explanation.
Contributors ✅ Optional.
Screenshots/Videos ✅ Not needed.

Please update the PR body to select the required commit type and risk level, and add a brief test/impact explanation for this dependency update.

Last updated: Wed, 01 Jul 2026 19:55:55 GMT

@github-actions

github-actions Bot commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

📊 Coverage Check

No source files changed in this PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code pr-validated

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant