npm / js-yaml
js-yaml
What changed in js-yaml 3 to 5, from its official release notes, upgrade guides and advisories. Also covers @types/js-yaml. Sources checked 2026-10-19.
36 breaking9 security6 deprecations18 new APIs and options2 behavior and defaults1 tooling25 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initjs-yaml 585 changes
Breaking changes 34
Reject
,,], and}at the start of block plain scalars.forceQuotes no longer quotes non-string scalars.
Merge sequence size is hard-limited to 100.
Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property, and alias nodes contain only kind and anchor.
Scalar style selection was reworked and can change formatting without changing loaded values; whitespace-only strings are now double-quoted.
Custom tag definitions must provide identify; use
identify: () => falsefor load-only tags.Removes the unused
MERGE_KEYexport.Validates
<<sequence items at merge time, including aliased merge sources.Reject unpaired mapping event streams.
Removes this loader option; maxTotalMergeKeys replaces it for limiting YAML merge processing.
Object-based mappings now reject complex keys instead of stringifying them.
Removes the dumper option
condenseFlow.Uses spec-compliant scalar resolution rules and is the default schema for
load.Removes the
DEFAULT_SCHEMAexport.Removes the dumper option
forceQuotes.Browser builds are now accessed through the
js-yaml/browserexport.Reworks the schema with spec-compliant scalar resolution rules.
Removes the loader option
legacy.Removes support for importing internal files from
lib/.Removes the loader option
listener.Throws on empty input instead of returning
undefined.Removes the dumper option
noCompatMode.Removes the loader option
onWarning.Removes the dumper option
quotingType.Removes the dumper option
replacer.Removes the deprecated
safeDump()export.Removes the deprecated
safeLoad()export.Removes the deprecated
safeLoadAll()export.Renames
Schema.extend()toSchema.withTags().Renames the dumper option
noArrayIndenttoseqNoIndent.Loads
!!setvalues as JavaScriptSetinstances.Removes the dumper option
styles.Replaces the
TypeAPI with a more precise and simpler tags API, including helpers to define scalar, sequence, and mapping tags.Removes the nested
typesexport.
Security 5
Empty mappings in merge sequences count toward maxTotalMergeKeys to limit CPU usage.
js-yaml: Exponential parsing time in flow collections leads to denial of service
js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA
js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml
Adds a loader option, defaulting to 10000, to limit the total number of keys processed by YAML merge across one load() or loadAll() call.
Deprecations 6
Provides a grouped constant export in place of flat constant exports; the old exports remain available but are deprecated.
Provides a grouped constant export in place of flat constant exports; the old exports remain available but are deprecated.
Provides a grouped constant export in place of flat constant exports; the old exports remain available but are deprecated.
Flat constant exports are deprecated; use the grouped exports instead.
Provides a grouped constant export in place of flat constant exports; the old exports remain available but are deprecated.
The
loadAllsignature with an iterator is deprecated, though it still works.
New APIs and options 17
Adds a dumper option to customize string formatting.
Exports the default schema used by the dumper, allowing developers to use it directly.
Adds a method for throwing an error at a source position.
Adds a loader option, defaulting to -1, to limit the number of YAML aliases per document.
Adds the
flowBracketPaddingdumper option.Adds the
flowSkipColonSpacedumper option.Adds the
flowSkipCommaSpacedumper option.Adds the
quoteFlowKeysdumper option.Adds the
quoteStyledumper option.Adds the
seqInlineFirstdumper option.Adds the
tagBeforeAnchordumper option.Adds an option to change the generated AST before rendering.
Adds a low-level parser that produces events.
Adds the presenter API for modular data pipelines.
Adds a tag for lossless mappings with non-string and complex keys.
Adds the visitor API for modular data pipelines.
Adds a schema combining all YAML 1.1 tags.
Behavior and default changes 2
Collection tags can finalize an incrementally populated carrier into a different result value.
quoteStyle now selects the preferred quote style; use forceQuotes to force quoting non-key strings.
Fixes and other changes 21
Errors report the exact position of non-printable characters.
Correct percent-encoding of shorthand and verbatim tags.
Fixed loading a whitespace-only block scalar followed by a less indented line.
Accepts a byte order mark at the start of each document in a stream.
Preserves empty scalar items when converting block sequences to flow style.
Produces valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys.
The 1024-character simple-key limit no longer applies to flow mapping keys.
Counts Unicode code points rather than UTF-16 code units for the 1024-character simple-key limit.
The option was rewritten using AST mutation to avoid side effects.
Adds an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.
Resolves
<<outside of a mapping key as the plain string'<<', matching v4.Preserve implicit null mapping values before document markers.
Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through present(); dump() and loading are unaffected.
Prevent prototype fallback when resolving tags and mapping entries.
Resolve years 0000–0099 correctly.
Flow scalars are quoted when a colon precedes a flow indicator.
!!omap now supports Map when realMapTag is used.
Fixes round-tripping of integers with exponential form at or above 1e21.
The restored forceQuotes option forces quoting of non-key strings.
Uses
YAML11_SCHEMAandCORE_SCHEMAfor the quoting check to guarantee backward compatibility by default.Expands YAML 1.2 conformance and improves handling of directives, document markers, block keys, multiline scalars, and tag syntax.
js-yaml 411 changes
Breaking changes 2
Numbers with underscores are no longer resolved as numeric scalars.
Rejects top-level block scalars without content indentation.
Security 3
Deduplicates repeated elements to fix potential denial of service from quadratic merge complexity on malformed files larger than 10K.
Adds a loader option to limit merge sequence length as an additional safety restriction.
js-yaml has prototype pollution in merge (<<)
New APIs and options 1
Adds a loader option with a default of 100 to provide a better exception than RangeError on stack overflow.
Tooling 1
Adds sourcemaps to dist builds.
Fixes and other changes 4
Fixes trailing whitespace handling when folding flow scalar lines.
Fixes parsing of properties on the first implicit block mapping key.
Ensures numbers survive round-trip.
Fixes handling of digits in YAML named tag handles.
js-yaml 31 changes
Security 1
Backported the v4.1.1 security fix to v3.