chore(deps): bump js-yaml from 4.3.0 to 4.3.1 - #31
Conversation
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 4.3.1. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.0...4.3.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Dependabot raised the `js-yaml` resolution in package.json to ^4.3.1 but left
yarn.lock, .pnp.cjs and the committed .yarn/cache entry at 4.3.0, so CI's
`yarn install --immutable --immutable-cache` failed with YN0028 ("the lockfile
would have been modified by this install"). This repo is zero-install, so the
cache zip has to move with the lockfile.
Ran `yarn install` to resolve 4.3.1, then confirmed the full CI sequence
locally: immutable install, prettier --check, eslint, jest (25 tests, 4 suites)
and build.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
joshuanapoli
left a comment
joshuanapoli
left a comment
There was a problem hiding this comment.
Summary
Raises the js-yaml resolution from ^4.3.0 to ^4.3.1. I pushed one commit onto the branch to regenerate the lockfile, which Dependabot had left behind.
Risks
Low.
js-yamlis not a direct dependency — it appears only underresolutionsinpackage.json, pinning a transitive package. We have no first-party YAML parsing call sites.- Patch release within 4.3.x, so no API surface moves.
- The correction I pushed is mechanical: it is the resolver output for the version bump Dependabot already made, not a hand-edited lockfile.
Analysis
Correction. CI failed on this PR with YN0028: The lockfile would have been modified by this install, which is explicitly forbidden. Dependabot raised the resolutions entry in package.json but left yarn.lock, .pnp.cjs and the committed .yarn/cache zip at 4.3.0, and this repo is zero-install under Yarn PnP, so all four have to move together.
Fixed in a dedicated worktree checked out at the Dependabot head, so no in-progress local work was disturbed:
- Ran
yarn install, which resolvedjs-yaml@npm:4.3.1and updatedyarn.lock,.pnp.cjs, and swapped the cache zip. - Re-ran the exact CI sequence locally, all green:
yarn install --immutable --immutable-cache,yarn prettier --check .,yarn eslint .,yarn test(25 tests, 4 suites),yarn build. - Pushed the single commit to the Dependabot branch.
Verification. CI now passes on the branch. Confirmed js-yaml is a resolutions-only pin, and read the 4.3.1 release for interface changes; it is a patch fix with no API change.
1 participant
Bumps js-yaml from 4.3.0 to 4.3.1.
Changelog
Sourced from js-yaml's changelog.
Commits
86e91b84.3.1 releasedc3cc4b0Backport quadratic complexity fix for !!omapDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.