Skip to content

Upgrading js-yaml 3 to 4

Breaking3.15.2 → 4.3.2Breaking7Security9New10Changed9Fixed13Other7

Full comparisonBack to js-yaml
BreakingUpgrade verdict

7 breaking changes and 8 security fixes.

In plain terms
  • The separate safe loading and dumping functions are gone; the regular functions are now safe.
  • Two schema constants are gone; use the single default schema.
  • This release changes several APIs and behaviors; check the migration guide before upgrading.
  • JavaScript-specific YAML tags are no longer built in; install the separate js-yaml-js-types package if you need them.
Must act Top 5 of 15 that need code or config changes

Drops esprima.

Installs 1 package in all (was 3).

What you must change

Breaking7
Removes safe* functions; use load, loadAll and dump, which are now safe by default.
safeLoadsafeLoadAllsafeDumploadloadAlldump
4.0.0CHANGELOG.mdSummarizedView source
Removes yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA; use yaml.DEFAULT_SCHEMA instead.
yaml.DEFAULT_SAFE_SCHEMAyaml.DEFAULT_FULL_SCHEMAyaml.DEFAULT_SCHEMA
4.0.0CHANGELOG.mdSummarizedView source
Breaking changes are documented in the migration guide.
4.0.0CHANGELOG.mdSummarizedView source
Moves "unsafe" tags !!js/function, !!js/regexp and !!js/undefined to the js-yaml-js-types package.
!!js/function!!js/regexp!!js/undefined
4.0.0CHANGELOG.mdSummarizedView source
Removes yaml.Schema.create(schema, tags); use schema.extend(tags) instead.
yaml.Schema.create()schema.extend()
4.0.0CHANGELOG.mdSummarizedView source
!!binary is now always mapped to Uint8Array on load.
!!binaryUint8Array
4.0.0CHANGELOG.mdSummarizedView source
Parses numbers per YAML 1.2: 01234 is decimal, 0o1234 is octal, and 1:23 is a string instead of base60.
4.0.0CHANGELOG.mdSummarizedView source
Security8
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
High · CVSS 7.5
4.3.2GitHub AdvisoryOriginalView source
JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
High · CVSS 7.5
4.3.1GitHub AdvisoryOriginalView source
Backports the maxTotalMergeKeys option.
maxTotalMergeKeys
4.3.0CHANGELOG.mdSummarizedView source
js-yaml: YAML merge-key chains can force quadratic CPU consumption
High · CVSS 7.5
4.3.0GitHub AdvisoryOriginalView source
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
Moderate · CVSS 5.3
4.2.0GitHub AdvisoryOriginalView source
Fixes a prototype pollution issue in the yaml merge (<<) operator.
<<
4.1.1CHANGELOG.mdSummarizedView source
js-yaml has prototype pollution in merge (<<)
Moderate · CVSS 5.3
4.1.1GitHub AdvisoryOriginalView source
The __proto__ key no longer overrides the object prototype.
__proto__
4.0.0CHANGELOG.mdSummarizedView source