Skip to content

Upgrading js-yaml 4 to 5

Breaking4.3.2 → 5.5.0Breaking16Security7Deprecated2New11Changed9Fixed20Other4

Full comparisonBack to js-yaml
BreakingUpgrade verdict

16 breaking changes and 6 security fixes.

In plain terms
  • The `MERGE_KEY` export no longer exists.
  • The old maxMergeSeqLength setting is gone; use maxTotalMergeKeys instead.
  • The old safe* functions are gone; use load, loadAll and dump instead.
  • The DEFAULT_SCHEMA constant and the nested types export are no longer available.
Must act Top 5 of 24 that need code or config changes

Moves argparse 2.0.1 → 3.0.4. Your build may pick other versions.

What you must change

Breaking16
Removes the MERGE_KEY export.
MERGE_KEY
5.3.0CHANGELOG.mdSummarizedView source
Removes the maxMergeSeqLength option, replaced by maxTotalMergeKeys for limiting YAML merge processing.
maxMergeSeqLengthmaxTotalMergeKeys
5.2.0CHANGELOG.mdSummarizedView source
Removes deprecated safeLoad(), safeLoadAll() and safeDump() exports.
safeLoad()safeLoadAll()safeDump()
5.0.0CHANGELOG.mdSummarizedView source
Removes DEFAULT_SCHEMA and the nested types export.
DEFAULT_SCHEMAtypes
5.0.0CHANGELOG.mdSummarizedView source
Removes loader options onWarning, legacy and listener.
onWarninglegacylistener
5.0.0CHANGELOG.mdSummarizedView source
Removes dumper options styles, replacer, noCompatMode, condenseFlow, quotingType and forceQuotes, and renames noArrayIndent to seqNoIndent.
stylesreplacernoCompatModecondenseFlowquotingTypeforceQuotesnoArrayIndentseqNoIndent
5.0.0CHANGELOG.mdSummarizedView source
Flattens low-level AST node style representation: scalar and collection nodes use SCALAR_STYLE and COLLECTION_STYLE, explicit tags use tagged, alias nodes keep only kind and anchor.
SCALAR_STYLECOLLECTION_STYLEtaggedkindanchor
5.4.0CHANGELOG.mdSummarizedView source
Rewrites the sortKeys option using AST mutation to avoid side effects.
sortKeys
5.4.0CHANGELOG.mdSummarizedView source
Makes identify mandatory for custom tag definitions; use identify: () => false for load-only tags.
identify
5.3.0CHANGELOG.mdSummarizedView source
quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.
quoteStyleforceQuotes
5.1.0CHANGELOG.mdSummarizedView source
Rewrites the package in TypeScript and reorganizes the public API around flat named exports.
5.0.0CHANGELOG.mdSummarizedView source
Reduces the set of exported schemas to CORE_SCHEMA, JSON_SCHEMA, FAILSAFE_SCHEMA and YAML11_SCHEMA.
CORE_SCHEMAJSON_SCHEMAFAILSAFE_SCHEMAYAML11_SCHEMA
5.0.0CHANGELOG.mdSummarizedView source
Replaces the Type API with a tags API using defineScalarTag(), defineSequenceTag() and defineMappingTag().
TypedefineScalarTag()defineSequenceTag()defineMappingTag()
5.0.0CHANGELOG.mdSummarizedView source
Renames Schema.extend() to Schema.withTags().
Schema.extend()Schema.withTags()
5.0.0CHANGELOG.mdSummarizedView source
load() now throws on empty input instead of returning undefined.
load()
5.0.0CHANGELOG.mdSummarizedView source
Removes support for importing internal files from lib/.
lib/
5.0.0CHANGELOG.mdSummarizedView source
Security6
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
maxTotalMergeKeysModerate · CVSS 5.3
5.4.1GitHub AdvisoryOriginalView source
Avoids exponential parsing time for nested flow sequence pairs.
5.2.2CHANGELOG.mdSummarizedView source
js-yaml: Exponential parsing time in flow collections leads to denial of service
High · CVSS 7.5
5.2.2GitHub AdvisoryOriginalView source
Removes quadratic complexity from !!omap addItem, a regression from v5 that is usually not critical since YAML11_SCHEMA is no longer default.
!!omapaddItemYAML11_SCHEMA
5.2.1CHANGELOG.mdSummarizedView source
js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA
Moderate · CVSS 5.3
5.2.1GitHub AdvisoryOriginalView source
js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml
Moderate · CVSS 5.3
5.2.0GitHub AdvisoryOriginalView source

Deprecations to plan for

Deprecated2
Deprecates flat constant exports in favor of grouped ones.
5.3.0CHANGELOG.mdSummarizedView source
Deprecates the loadAll signature with an iterator, which still works but is a candidate for removal.
loadAll
5.0.0CHANGELOG.mdSummarizedView source