# What changed in yaml

> 11 changes in yaml 2 from its official release notes, upgrade guides and advisories: 1 breaking, 1 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-17. HTML: https://unstale.sh/npm/yaml/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## yaml 2

### Breaking changes

- Recursive merge aliases are limited, changing how YAML documents with recursive merge aliases are handled. (2.9.1) — [release notes](https://github.com/eemeli/yaml/releases/tag/v2.9.1)

### Security

- yaml is vulnerable to Stack Overflow via deeply nested YAML collections (2.8.3) — [security advisory](https://github.com/advisories/GHSA-48C2-RRV3-QJMP)

### New APIs and options

- Adds the trailingComma option for multiline flow formatting. (2.8.3) — [release notes](https://github.com/eemeli/yaml/releases/tag/v2.8.3)

### Behavior and default changes

- Setting maxAliasCount to 0 disables alias resolution. (2.8.4) — [release notes](https://github.com/eemeli/yaml/releases/tag/v2.8.4)

### Fixes and other changes

- Avoids calling Array.prototype.push.apply() with a large source array. (2.9.0) — [release notes](https://github.com/eemeli/yaml/releases/tag/v2.9.0)
- Avoids recursive lexer calls that may exhaust the call stack. (2.9.0) — [release notes](https://github.com/eemeli/yaml/releases/tag/v2.9.0)
- Invalid unicode escapes are now handled. (2.8.4) — [release notes](https://github.com/eemeli/yaml/releases/tag/v2.8.4)
- minFractionDigits is applied only to decimal strings. (2.8.4) — [release notes](https://github.com/eemeli/yaml/releases/tag/v2.8.4)
- Catches stack overflows during node composition. (2.8.3) — [release notes](https://github.com/eemeli/yaml/releases/tag/v2.8.3)
- Empty map values are no longer serialized with double newlines. (2.8.2) — [release notes](https://github.com/eemeli/yaml/releases/tag/v2.8.2)
- Serialization preserves -0 as -0. (2.8.2) — [release notes](https://github.com/eemeli/yaml/releases/tag/v2.8.2)