FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Bump js-yaml from 4.3.1 to 5.4.3 by dependabot[bot] · Pull Request #8054 · coder/code-server · GitHub

  1. coder
  2. code-server

Repository navigation

Bump js-yaml from 4.3.1 to 5.4.3 - #8054

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/js-yaml-5.4.3
ConversationCommits (1)ChecksFiles changed
Open

Bump js-yaml from 4.3.1 to 5.4.3#8054
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/js-yaml-5.4.3

Conversation

dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor

Bumps js-yaml from 4.3.1 to 5.4.3.

Changelog

Sourced from js-yaml's changelog.

[5.4.3] - 2026-10-06

Fixed

  • Fixed loading a whitespace-only block scalar followed by a less indented line, #802.

[5.4.2] - 2026-09-13

Fixed

  • forceQuotes no longer quotes non-string scalars, #798.

[5.4.1] - 2026-08-26

Changed

  • Hard-limit merge sequence size to 100.

Security

  • Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

[5.4.0] - 2026-08-25

Added

  • Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

Changed

  • [breaking] Flattened the low-level AST node style representation. Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property. Alias nodes now contain only kind and anchor. This only affects code that directly constructs or edits AST nodes.
  • [breaking] The sortKeys option was rewritten using AST mutation to avoid side effects.
  • Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.

Fixed

  • Accept a byte order mark at the start of each document in a stream, #791.
  • Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys, #786.
  • Preserve empty scalar items when converting block sequences to flow style.
  • Do not apply the 1024-character simple-key limit to flow mapping keys.
  • Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.
  • Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bump js-yaml from 4.3.1 to 5.4.3
6a84513 
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.3.1 to 5.4.3.
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.3.1...5.4.3)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 5.4.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
dependabot Bot requested a review from a team as a code owner October 14, 2026 01:04
dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 14, 2026

jcarver989 commented Oct 19, 2026

Copy link
Copy Markdown

Hi @code-asher! I'm a fellow human (not a clanker). Your time as an open-source maintainer is super valuable. To help save you time when reviewing this PR, I ran an analysis tool that I work on (PatchWave). It combines static analysis + AI to determine if dependency upgrades are safe to merge. You can see the results below. Hope it helps!

This PR is safe to merge

code-server was already on js-yaml 5.4.1 before this lockfile-only PR, and its only application use is the still-supported named load API; the PR bumps that copy to 5.4.3 and ESLint's separate v4 copy from 4.3.1 to 4.3.2 (a merge-processing DoS mitigation). The unit and end-to-end checks passed, and the registry records show the same upstream repository and signing key.

✅ Safe to merge (1)
Dependency Update
js-yaml 4.3.1 → 5.4.3

You can see the full report here

This branch has not been deployed

No deployments
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

Back | FazBrowse Home | New Git URL