The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".
It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.
Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.
fix: Avoid calling Array.prototype.push.apply() with large source array
fix(lexer): Avoid recursive calls that may exhaust the call stack
v2.8.4
Disable alias resolution with maxAliasCount:0 (#677)
Handle invalid unicode escapes (e1a1a77)
Apply minFractionDigits only to decimal strings (#676)
v2.8.3
Add trailingComma ToString option for multiline flow formatting (#670)
Catch stack overflow during node composition (1e84ebb)
Do not allow seq with single-line collection value on same line with map key (#603)
Improve warning & avoid TypeError on bad YAML 1.1 nodes (#610)
v2.7.0
The library is now available on JSR as @eemeli/yaml and on deno.land/x as yaml. In addition to Node.js and browsers, it should work in Deno, Bun, and Cloudflare Workers.
You can trigger a rebase of this PR by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.
Bumps [yaml](https://github.com/eemeli/yaml) from 2.4.5 to 2.9.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/eemeli/yaml/releases">yaml's releases</a>.</em></p>
<blockquote>
<h2>v2.9.0</h2>
<p>The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of <code>parseDocument()</code> and <code>parseAllDocuments()</code>: I've removed the claim that they'll "never throw".</p>
<p>It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which <code>yaml</code> CVEs have been issued so far.</p>
<p>Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.</p>
<ul>
<li>fix: Avoid calling <code>Array.prototype.push.apply()</code> with large source array</li>
<li>fix(lexer): Avoid recursive calls that may exhaust the call stack</li>
</ul>
<h2>v2.8.4</h2>
<ul>
<li>Disable alias resolution with <code>maxAliasCount:0</code> (<a href="https://redirect.github.com/eemeli/yaml/issues/677">#677</a>)</li>
<li>Handle invalid unicode escapes (e1a1a77)</li>
<li>Apply <code>minFractionDigits</code> only to decimal strings (<a href="https://redirect.github.com/eemeli/yaml/issues/676">#676</a>)</li>
</ul>
<h2>v2.8.3</h2>
<ul>
<li>Add <code>trailingComma</code> ToString option for multiline flow formatting (<a href="https://redirect.github.com/eemeli/yaml/issues/670">#670</a>)</li>
<li>Catch stack overflow during node composition (1e84ebb)</li>
</ul>
<h2>v2.8.2</h2>
<ul>
<li>Serialize -0 as -0 (<a href="https://redirect.github.com/eemeli/yaml/issues/638">#638</a>)</li>
<li>Do not double newlines for empty map values (<a href="https://redirect.github.com/eemeli/yaml/issues/642">#642</a>)</li>
</ul>
<h2>v2.8.1</h2>
<ul>
<li>Preserve empty block literals (<a href="https://redirect.github.com/eemeli/yaml/issues/634">#634</a>)</li>
</ul>
<h2>v2.8.0</h2>
<ul>
<li>Add node cache for faster alias resolution (<a href="https://redirect.github.com/eemeli/yaml/issues/612">#612</a>)</li>
<li>Re-introduce compatibility with Node.js 14.6 (<a href="https://redirect.github.com/eemeli/yaml/issues/614">#614</a>)</li>
<li>Add <code>--merge</code> option to CLI tool (<a href="https://redirect.github.com/eemeli/yaml/issues/611">#611</a>)</li>
<li>Improve error for tag resolution error on null value (<a href="https://redirect.github.com/eemeli/yaml/issues/616">#616</a>)</li>
<li>Allow empty string as plain scalar representation, for failsafe schema (<a href="https://redirect.github.com/eemeli/yaml/issues/616">#616</a>)</li>
<li>docs: include cli example (<a href="https://redirect.github.com/eemeli/yaml/issues/617">#617</a>)</li>
</ul>
<h2>v2.7.1</h2>
<ul>
<li>Do not allow seq with single-line collection value on same line with map key (<a href="https://redirect.github.com/eemeli/yaml/issues/603">#603</a>)</li>
<li>Improve warning & avoid TypeError on bad YAML 1.1 nodes (<a href="https://redirect.github.com/eemeli/yaml/issues/610">#610</a>)</li>
</ul>
<h2>v2.7.0</h2>
<p>The library is now available on JSR as <a href="https://jsr.io/@eemeli/yaml">@eemeli/yaml</a> and on deno.land/x as <a href="https://deno.land/x/yaml">yaml</a>. In addition to Node.js and browsers, it should work in Deno, Bun, and Cloudflare Workers.</p>
<ul>
<li>Use .ts extension in all relative imports (<a href="https://redirect.github.com/eemeli/yaml/issues/591">#591</a>)</li>
<li>Ignore newline after block seq indicator as space before value (<a href="https://redirect.github.com/eemeli/yaml/issues/590">#590</a>)</li>
<li>Require Node.js 14.18 or later (was 14.6) (<a href="https://redirect.github.com/eemeli/yaml/issues/598">#598</a>)</li>
</ul>
<h2>v2.6.1</h2>
<ul>
<li>Do not strip <code>:00</code> seconds from <code>!!timestamp</code> values (<a href="https://redirect.github.com/eemeli/yaml/issues/578">#578</a>, with thanks to <a href="https://github.com/qraynaud"><code>@qraynaud</code></a>)</li>
<li>Tighten regexp for JSON <code>!!bool</code> (<a href="https://redirect.github.com/eemeli/yaml/issues/587">#587</a>, with thanks to <a href="https://github.com/vra5107"><code>@vra5107</code></a>)</li>
<li>Default to literal block scalar if folded would overflow (<a href="https://redirect.github.com/eemeli/yaml/issues/585">#585</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/eemeli/yaml/commit/ddb21b04cb889722cec8f89dc1b67f19d62d7f7d"><code>ddb21b0</code></a> 2.9.0</li>
<li><a href="https://github.com/eemeli/yaml/commit/167365befdae1f03d53d47a8c6533140a9d48a75"><code>167365b</code></a> docs: Clarify that not all errors can be avoided</li>
<li><a href="https://github.com/eemeli/yaml/commit/6eca2a7087548f86c4edb6a7cf2cdfe548759f06"><code>6eca2a7</code></a> fix: Avoid calling Array.prototype.push.apply() with large source array</li>
<li><a href="https://github.com/eemeli/yaml/commit/0543cd57fd61ea15a58e9f0ec2064b8b408177d8"><code>0543cd5</code></a> fix(lexer): Avoid recursive calls that may exhaust the call stack</li>
<li><a href="https://github.com/eemeli/yaml/commit/ccdf7439587544f64223429498a1d9ec514eaac1"><code>ccdf743</code></a> 2.8.4</li>
<li><a href="https://github.com/eemeli/yaml/commit/f625789dbd971c936ff66fe5c49e368062ae7b41"><code>f625789</code></a> fix: Disable alias resolution with maxAliasCount:0 (<a href="https://redirect.github.com/eemeli/yaml/issues/677">#677</a>)</li>
<li><a href="https://github.com/eemeli/yaml/commit/e1a1a7735ff2e9717b87af36795bcd280f85f55d"><code>e1a1a77</code></a> fix: Handle invalid unicode escapes</li>
<li><a href="https://github.com/eemeli/yaml/commit/a163ea009c57ab9f1054ca39b24b6ef4c1e9fdbe"><code>a163ea0</code></a> style: Satify Prettier</li>
<li><a href="https://github.com/eemeli/yaml/commit/b2a5a6c615673056917aaa04d657802945e81425"><code>b2a5a6c</code></a> fix: Apply minFractionDigits only to decimal strings (<a href="https://redirect.github.com/eemeli/yaml/issues/676">#676</a>)</li>
<li><a href="https://github.com/eemeli/yaml/commit/93c951b3478b4bb061d7b5227fd64f46d3f9df7f"><code>93c951b</code></a> chore: Bump JSR version to v2.8.3 (<a href="https://redirect.github.com/eemeli/yaml/issues/673">#673</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/eemeli/yaml/compare/v2.4.5...v2.9.0">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
You can trigger a rebase of this PR by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/Quinta0/valgo/network/alerts).
</details>
> **Note**
> Automatic rebases have been disabled on this pull request as it has been open for over 30 days.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Bumps yaml from 2.4.5 to 2.9.0.
Release notes
Sourced from yaml's releases.
... (truncated)
Commits
ddb21b02.9.0167365bdocs: Clarify that not all errors can be avoided6eca2a7fix: Avoid calling Array.prototype.push.apply() with large source array0543cd5fix(lexer): Avoid recursive calls that may exhaust the call stackccdf7432.8.4f625789fix: Disable alias resolution with maxAliasCount:0 (#677)e1a1a77fix: Handle invalid unicode escapesa163ea0style: Satify Prettierb2a5a6cfix: Apply minFractionDigits only to decimal strings (#676)93c951bchore: Bump JSR version to v2.8.3 (#673)You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.