Skip to content

chore(deps): bump js-yaml from 4.3.0 to 5.2.2#102

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/js-yaml-5.2.1
Open

chore(deps): bump js-yaml from 4.3.0 to 5.2.2#102
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/js-yaml-5.2.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 6, 2026

Copy link
Copy Markdown
Contributor

Bumps js-yaml from 4.3.0 to 5.2.2.

Changelog

Sourced from js-yaml's changelog.

[5.2.2] - 2026-07-24

Fixed

  • Quote flow scalars where a colon precedes a flow indicator, #773.

Security

  • Avoid exponential parsing time for nested flow sequence pairs.

[5.2.1] - 2026-07-02

Fixed

  • Add Map support to !!omap (should work when realMapTag used)

Security

  • Remove quadratic complexity from !!omap addItem. Regression from v5 (usually not critical, because YAML11_SCHEMA is not default anymore).
Commits

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 6, 2026
Copilot AI review requested due to automatic review settings July 6, 2026 08:35
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 6, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

@github-actions

github-actions Bot commented Jul 6, 2026

Copy link
Copy Markdown

@coderabbitai review
@copilot review
Adversarial review request: evaluate security, policy bypass paths, and regression risk.

@github-actions github-actions Bot removed the dependencies Pull requests that update a dependency file label Jul 6, 2026
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.0 to 5.2.2.
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.3.0...5.2.2)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 5.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title chore(deps): bump js-yaml from 4.2.0 to 5.2.1 chore(deps): bump js-yaml from 4.3.0 to 5.2.2 Jul 26, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/js-yaml-5.2.1 branch from 54d94d8 to f5de8c1 Compare July 26, 2026 09:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant