# What changed in js-yaml

> 97 changes in js-yaml 3 to 5 from its official release notes, upgrade guides and advisories: 36 breaking, 6 deprecations, 9 security, 18 new APIs and options. Each one cited. Sources checked 2026-10-19. HTML: https://unstale.sh/npm/js-yaml/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## js-yaml 5

### Breaking changes

- Reject `,`, `]`, and `}` at the start of block plain scalars. (5.5.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#550---2026-10-16)
- forceQuotes no longer quotes non-string scalars. (5.4.2) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#542---2026-09-13)
- Merge sequence size is hard-limited to 100. (5.4.1) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#541---2026-08-26)
- Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property, and alias nodes contain only kind and anchor. (5.4.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#540---2026-08-25)
- Scalar style selection was reworked and can change formatting without changing loaded values; whitespace-only strings are now double-quoted. (5.4.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#540---2026-08-25)
- Custom tag definitions must provide identify; use `identify: () => false` for load-only tags. (5.3.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#530---2026-08-14)
- Removes the unused `MERGE_KEY` export. (5.3.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#530---2026-08-14)
- Validates `<<` sequence items at merge time, including aliased merge sources. (5.3.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#530---2026-08-14)
- Reject unpaired mapping event streams. (5.2.3) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#523---2026-08-01)
- Removes this loader option; maxTotalMergeKeys replaces it for limiting YAML merge processing. (5.2.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#520---2026-06-26)
- Object-based mappings now reject complex keys instead of stringifying them. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Removes the dumper option `condenseFlow`. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Uses spec-compliant scalar resolution rules and is the default schema for `load`. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Removes the `DEFAULT_SCHEMA` export. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Removes the dumper option `forceQuotes`. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Browser builds are now accessed through the `js-yaml/browser` export. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Reworks the schema with spec-compliant scalar resolution rules. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Removes the loader option `legacy`. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Removes support for importing internal files from `lib/`. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Removes the loader option `listener`. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Throws on empty input instead of returning `undefined`. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Removes the dumper option `noCompatMode`. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Removes the loader option `onWarning`. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Removes the dumper option `quotingType`. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Removes the dumper option `replacer`. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Removes the deprecated `safeDump()` export. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Removes the deprecated `safeLoad()` export. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Removes the deprecated `safeLoadAll()` export. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Renames `Schema.extend()` to `Schema.withTags()`. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Renames the dumper option `noArrayIndent` to `seqNoIndent`. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Loads `!!set` values as JavaScript `Set` instances. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Removes the dumper option `styles`. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Replaces the `Type` API with a more precise and simpler tags API, including helpers to define scalar, sequence, and mapping tags. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Removes the nested `types` export. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)

### Security

- Empty mappings in merge sequences count toward maxTotalMergeKeys to limit CPU usage. (5.4.1) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#541---2026-08-26), [security advisory](https://github.com/advisories/GHSA-R3PH-W7GJ-G6XM)
- js-yaml: Exponential parsing time in flow collections leads to denial of service (5.2.2) — [security advisory](https://github.com/advisories/GHSA-PM4M-PH32-GHV5), [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#522---2026-07-24)
- js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA (5.2.1) — [security advisory](https://github.com/advisories/GHSA-724G-MXRG-4QVM), [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#521---2026-07-02)
- js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml (5.2.0) — [security advisory](https://github.com/advisories/GHSA-G796-FGMG-93MV)
- Adds a loader option, defaulting to 10000, to limit the total number of keys processed by YAML merge across one load() or loadAll() call. (4.3.0, 5.2.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#520---2026-06-26), [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#430-3150---2026-06-27), [security advisory](https://github.com/advisories/GHSA-52CP-R559-CP3M)

### Deprecations

- Provides a grouped constant export in place of flat constant exports; the old exports remain available but are deprecated. (5.3.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#530---2026-08-14)
- Provides a grouped constant export in place of flat constant exports; the old exports remain available but are deprecated. (5.3.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#530---2026-08-14)
- Provides a grouped constant export in place of flat constant exports; the old exports remain available but are deprecated. (5.3.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#530---2026-08-14)
- Flat constant exports are deprecated; use the grouped exports instead. (5.3.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#530---2026-08-14)
- Provides a grouped constant export in place of flat constant exports; the old exports remain available but are deprecated. (5.3.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#530---2026-08-14)
- The `loadAll` signature with an iterator is deprecated, though it still works. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)

### New APIs and options

- Adds a dumper option to customize string formatting. (5.4.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#540---2026-08-25)
- Exports the default schema used by the dumper, allowing developers to use it directly. (5.3.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#530---2026-08-14)
- Adds a method for throwing an error at a source position. (5.3.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#530---2026-08-14)
- Adds a loader option, defaulting to -1, to limit the number of YAML aliases per document. (5.2.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#520---2026-06-26)
- Adds the `flowBracketPadding` dumper option. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Adds the `flowSkipColonSpace` dumper option. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Adds the `flowSkipCommaSpace` dumper option. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Adds the `quoteFlowKeys` dumper option. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Adds the `quoteStyle` dumper option. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Adds the `seqInlineFirst` dumper option. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Adds the `tagBeforeAnchor` dumper option. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Adds an option to change the generated AST before rendering. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Adds a low-level parser that produces events. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Adds the presenter API for modular data pipelines. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Adds a tag for lossless mappings with non-string and complex keys. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Adds the visitor API for modular data pipelines. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Adds a schema combining all YAML 1.1 tags. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)

### Behavior and default changes

- Collection tags can finalize an incrementally populated carrier into a different result value. (5.1.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#510---2026-06-23)
- quoteStyle now selects the preferred quote style; use forceQuotes to force quoting non-key strings. (5.1.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#510---2026-06-23)

### Fixes and other changes

- Errors report the exact position of non-printable characters. (5.5.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#550---2026-10-16)
- Correct percent-encoding of shorthand and verbatim tags. (5.5.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#550---2026-10-16)
- Fixed loading a whitespace-only block scalar followed by a less indented line. (5.4.3) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#543---2026-10-06)
- Accepts a byte order mark at the start of each document in a stream. (5.4.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#540---2026-08-25)
- Preserves empty scalar items when converting block sequences to flow style. (5.4.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#540---2026-08-25)
- Produces valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys. (5.4.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#540---2026-08-25)
- The 1024-character simple-key limit no longer applies to flow mapping keys. (5.4.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#540---2026-08-25)
- Counts Unicode code points rather than UTF-16 code units for the 1024-character simple-key limit. (5.4.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#540---2026-08-25)
- The option was rewritten using AST mutation to avoid side effects. (5.4.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#540---2026-08-25)
- Adds an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines. (5.4.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#540---2026-08-25)
- Resolves `<<` outside of a mapping key as the plain string `'<<'`, matching v4. (5.3.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#530---2026-08-14)
- Preserve implicit null mapping values before document markers. (5.2.3) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#523---2026-08-01)
- Preserve folded scalar values with tab-indented lines when round-tripping a parsed AST through present(); dump() and loading are unaffected. (5.2.3) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#523---2026-08-01)
- Prevent prototype fallback when resolving tags and mapping entries. (5.2.3) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#523---2026-08-01)
- Resolve years 0000–0099 correctly. (5.2.3) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#523---2026-08-01)
- Flow scalars are quoted when a colon precedes a flow indicator. (5.2.2) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#522---2026-07-24)
- !!omap now supports Map when realMapTag is used. (5.2.1) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#521---2026-07-02)
- Fixes round-tripping of integers with exponential form at or above 1e21. (5.2.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#520---2026-06-26)
- The restored forceQuotes option forces quoting of non-key strings. (5.1.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#510---2026-06-23)
- Uses `YAML11_SCHEMA` and `CORE_SCHEMA` for the quoting check to guarantee backward compatibility by default. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)
- Expands YAML 1.2 conformance and improves handling of directives, document markers, block keys, multiline scalars, and tag syntax. (5.0.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#500---2026-06-20)

## js-yaml 4

### Breaking changes

- Numbers with underscores are no longer resolved as numeric scalars. (4.2.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#420---2026-06-01)
- Rejects top-level block scalars without content indentation. (4.2.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#420---2026-06-01)

### Security

- Deduplicates repeated elements to fix potential denial of service from quadratic merge complexity on malformed files larger than 10K. (4.2.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#420---2026-06-01), [security advisory](https://github.com/advisories/GHSA-H67P-54HQ-RP68)
- Adds a loader option to limit merge sequence length as an additional safety restriction. (4.2.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#420---2026-06-01)
- js-yaml has prototype pollution in merge (<<) (3.14.2, 4.1.1) — [security advisory](https://github.com/advisories/GHSA-MH29-5H37-FV8M), [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#411---2025-11-12)

### New APIs and options

- Adds a loader option with a default of 100 to provide a better exception than RangeError on stack overflow. (4.2.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#420---2026-06-01)

### Tooling

- Adds sourcemaps to dist builds. (4.2.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#420---2026-06-01)

### Fixes and other changes

- Fixes trailing whitespace handling when folding flow scalar lines. (4.2.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#420---2026-06-01)
- Fixes parsing of properties on the first implicit block mapping key. (4.2.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#420---2026-06-01)
- Ensures numbers survive round-trip. (4.2.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#420---2026-06-01)
- Fixes handling of digits in YAML named tag handles. (4.2.0) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#420---2026-06-01)

## js-yaml 3

### Security

- Backported the v4.1.1 security fix to v3. (3.14.2) — [release notes](https://github.com/nodeca/js-yaml/blob/cb62b2dbbaa0b3e7379d83a5d69d8d52d21b6efb/CHANGELOG.md#3142---2025-11-15)