Skip to content

deps: Bump js-yaml from 4.3.1 to 5.4.1 #1558

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 2 commits into
base: main
Choose a base branch
from
Open

deps: Bump js-yaml from 4.3.1 to 5.4.1 #1558

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4d07c49
deps: Bump js-yaml from 4.3.1 to 5.4.1
dependabot[bot] Aug 31, 2026
a1dec9b
fix: API changes
d3xter666 Aug 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions internal/benchmark/lib/ConfigurationLoader.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
import yaml from "js-yaml";
import {load as yamlLoad} from "js-yaml";
import Configuration from "./benchmark/Configuration.js";

/**
Expand Down Expand Up @@ -37,7 +37,7 @@ export default class ConfigurationLoader {

let parsedYaml;
try {
parsedYaml = yaml.load(fileContents);
parsedYaml = yamlLoad(fileContents);
} catch (error) {
throw new Error(`Failed to parse YAML configuration: ${error.message}`);
}
Expand Down
2 changes: 1 addition & 1 deletion internal/benchmark/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,6 @@
},
"devDependencies": {
"eslint": "^10.9.1",
"js-yaml": "^4.3.1"
"js-yaml": "^5.4.1"
}
}
74 changes: 71 additions & 3 deletions package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions packages/cli/lib/cli/commands/init.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,15 +12,15 @@ initCommand.handler = async function() {
const {default: init} = await import("../../init/init.js");
const {default: path} = await import("node:path");
const {writeFile} = await import("node:fs/promises");
const {default: jsYaml} = await import("js-yaml");
const {dump: jsYamlDump} = await import("js-yaml");

const yamlPath = path.resolve("./ui5.yaml");
if (await exists(yamlPath)) {
throw new Error("Initialization not possible: ui5.yaml already exists");
}

const projectConfig = await init();
const yaml = jsYaml.dump(projectConfig, {quotingType: `"`});
const yaml = jsYamlDump(projectConfig, {quoteStyle: "double"});

await writeFile(yamlPath, yaml);
process.stdout.write(`Wrote ui5.yaml to ${yamlPath}:`);
Expand Down
4 changes: 2 additions & 2 deletions packages/cli/lib/framework/updateYaml.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
import path from "node:path";
import {readFile, writeFile} from "node:fs/promises";
import {loadAll, dump} from "js-yaml";
import {loadAll, dump, CORE_SCHEMA} from "js-yaml";
import {fromYaml, getPosition, getValue, getKind} from "data-with-position";
import {getLogger} from "@ui5/logger";

Expand Down Expand Up @@ -149,7 +149,7 @@ function formatValue(value, indent) {
return string;
} else if (Array.isArray(value)) {
const indentString = " ".repeat(indent);
const string = dump(value);
const string = dump(value, {schema: CORE_SCHEMA});
const arr = string.split("\n");
arr.pop();
return "\n" + indentString + arr.join("\n" + indentString) + "\n";
Expand Down
2 changes: 1 addition & 1 deletion packages/cli/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@
"chalk": "^6.0.0",
"data-with-position": "^0.5.0",
"import-local": "^3.2.0",
"js-yaml": "^4.3.1",
"js-yaml": "^5.4.1",
"open": "^11.0.1",
"pretty-hrtime": "^1.0.3",
"semver": "^7.8.5",
Expand Down
3 changes: 2 additions & 1 deletion packages/cli/test/lib/cli/commands/init.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,8 @@ test.serial("Writes ui5.yaml to fs", async (t) => {

t.is(fsWriteFileStub.getCall(0).args[0], ui5YamlPath, "Passes yaml path to write the yaml file to");
t.is(fsWriteFileStub.getCall(0).args[1], ui5Yaml, "Passes yaml content to write to fs");
t.deepEqual(jsyamlDumpStub.getCall(0).args[1], {quotingType: `"`}, "Enforce usage of double quotes in yaml files");
t.deepEqual(jsyamlDumpStub.getCall(0).args[1],
{quoteStyle: "double"}, "Enforce usage of double quotes in yaml files");
});

test.serial("Error: throws if ui5.yaml already exists", async (t) => {
Expand Down
10 changes: 4 additions & 6 deletions packages/project/lib/graph/Module.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ import fs from "graceful-fs";
import path from "node:path";
import {promisify} from "node:util";
const readFile = promisify(fs.readFile);
import jsyaml from "js-yaml";
import {loadAll as jsyamlLoadAll, CORE_SCHEMA as jsyamlCoreSchema} from "js-yaml";
import {createReader} from "@ui5/fs/resourceFactory";
import Specification from "../specifications/Specification.js";
import {validate} from "../validation/validator.js";
Expand Down Expand Up @@ -318,12 +318,10 @@ class Module {
let configs;

try {
// Using loadAll with DEFAULT_SAFE_SCHEMA instead of safeLoadAll to pass "filename".
// safeLoadAll doesn't handle its parameters properly.
// See https://github.com/nodeca/js-yaml/issues/456 and https://github.com/nodeca/js-yaml/pull/381
configs = jsyaml.loadAll(configFile, undefined, {
// Using loadAll with CORE_SCHEMA (equivalent of v4's DEFAULT_SAFE_SCHEMA) to pass "filename".
configs = jsyamlLoadAll(configFile, undefined, {

@matz3 matz3 Aug 31, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment was already outdated, and with the upgrade to js-yaml v4, it was already removed: SAP/ui5-project#380

However, it seems that another PR (SAP/ui5-project#457), that was started before the upgrade did re-introduce the code/comment again, and referenced jsyaml.DEFAULT_SAFE_SCHEMA which already in js-yaml v4 is undefined, so the default was used.

Are you sure that the CORE_SCHEMA is equivalent to DEFAULT_SAFE_SCHEMA, or rather the default schema of v4, as DEFAULT_SAFE_SCHEMA did not exist anymore in js-yaml v4?

One important aspect of yaml parsing is merge keys (<<:). This is widely used by custom task/middleware configuration (e.g. https://github.com/ui5-community/ui5-ecosystem-showcase/tree/main/packages/ui5-tooling-modules).
We should keep that stable, and it looks like we do not have any tests that verify it.

filename: configPath,
schema: jsyaml.DEFAULT_SAFE_SCHEMA
schema: jsyamlCoreSchema
});
} catch (err) {
if (err.name === "YAMLException") {
Expand Down
4 changes: 2 additions & 2 deletions packages/project/lib/graph/helpers/createWorkspace.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ async function readWorkspaceConfigFile(filePath) {
} = await import("graceful-fs");
const {promisify} = await import("node:util");
const readFile = promisify(fs.readFile);
const jsyaml = await import("js-yaml");
const {loadAll: jsyamlLoadAll} = await import("js-yaml");

let fileContent;
try {
Expand All @@ -87,7 +87,7 @@ async function readWorkspaceConfigFile(filePath) {
}
let configs;
try {
configs = jsyaml.loadAll(fileContent, undefined, {
configs = jsyamlLoadAll(fileContent, undefined, {
filename: filePath,
});
} catch (err) {
Expand Down
2 changes: 1 addition & 1 deletion packages/project/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,7 @@
"escape-string-regexp": "^5.0.0",
"globby": "^14.1.0",
"graceful-fs": "^4.2.11",
"js-yaml": "^4.3.1",
"js-yaml": "^5.4.1",
"lockfile": "^1.0.4",
"make-fetch-happen": "^15.0.6",
"micromatch": "^4.0.8",
Expand Down
Loading