js-yaml is a JavaScript YAML 1.2 parser and writer for converting between YAML documents and JavaScript values (load/loadAll for parsing, dump for serializing). It’s useful when you need to read or generate YAML in Node.js or use the included CLI to inspect YAML files from the command line.
Project status
- Actively maintained: The upstream last push was 2026-08-26, and the source has had multiple updates across several versions in the same day (3.15.2, 4.3.2, 5.4.0 to 5.4.1), indicating ongoing maintenance rather than dormancy.
- Update cadence: Recent activity shows tight cadence in August 2026 (updates on Aug 14, Aug 25, Aug 26, and Aug 1), with frequent security and behavior hardening, rather than sporadic releases.
AI summary generated
Recent updates
3.15.2
js-yaml 3.15.2 adds safeguards around YAML merge processing (the << operator), including a new loader option, maxTotalMergeKeys, plus a hard cap on merge sequence length. It also adds additional prototype pollution resistance for __proto__ handling during parsing/merging. No publisher release notes were provided in the supplied release_notes field, so the behavioral impact below is inferred directly from the code diff.
BreakingSecurityFeatures4.3.2
Release 4.3.2 contains no published release notes, so changes must be inferred from the code diff. The library appears to have undergone a significant internal refactor and public export reshaping compared to 3.15.2.
5.4.1
Publisher release notes for 5.4.1 were not provided (release notes section is empty). Based on CHANGELOG.md, 5.4.1 focuses on merge handling limits, specifically hard-limiting merge sequence size and tightening CPU-abuse protections around YAML merge processing.
Security5.4.0
No publisher release notes were provided for version 5.4.0. The actual code changes introduce a major AST model refactor (node style now uses SCALAR_STYLE and COLLECTION_STYLE enums plus a separate tagged boolean), rework scalar style selection, and move/reshape certain serialization behaviors such as sortKeys.
5.3.0
Release 5.3.0 introduces a substantial internal refactor around event/style constants and schema-based tag resolution, including new grouped enums like EVENT_ID and SCALAR_STYLE. Release notes were not provided, so several externally visible export and typing changes are likely undocumented.
Features5.2.3
The published release notes for version 5.2.3 are missing (no release notes content was provided). The code diff for the upgrade from 4.3.1 to 5.2.3 shows a substantial internal reorganization, including removal of many legacy CommonJS JavaScript source files and updates to benchmarks and documentation.
3.15.1
This release (js-yaml 3.15.1) focuses on security hardening and performance improvements in the YAML loader, specifically around merge key handling (<<), omap duplicate key detection (!!omap), and prototype pollution vectors involving __proto__. It also includes support for the loader option maxTotalMergeKeys, which can cause the loader to throw when merge key processing exceeds a configured limit.
BreakingSecurityFeatures4.3.1
Release 4.3.1 has no release notes provided. The code diff shows a substantial refactor of the package entry point and YAML implementation, along with multiple public API export changes that can affect existing integrations.
Features5.2.2
js-yaml 5.2.2 updates the YAML parser and presenter to fix incorrect handling of plain scalars involving a colon followed by flow indicators in flow contexts, and it hardens parsing to avoid exponential-time behavior on pathological inputs. The repo changelog also notes a security-related performance fix for nested flow sequence pairs, and the test suite was extended to cover both behaviors.
Security5.2.1
Release 5.2.1 contains a change to the YAML !!omap sequence tag implementation. No release notes were provided in the publisher release_notes section, but CHANGELOG.md was updated with fixes around Map handling and omap duplicate-key performance/security.
SecurityFeatures3.15.0
No publisher release notes were provided for 3.15.0. The code diff for this version adds a new loader option to cap merge key processing during YAML merge operations and introduces additional hardening against prototype pollution, including safer handling of __proto__ keys.
BreakingSecurityFeatures4.3.0
Release 4.3.0 has no provided release notes. The code diff shows a major refactor of the library internals and a change to the public exports in index.js, including removal of several deprecated aliases and deprecation-safe entrypoints (safeLoad/safeDump) that now throw at runtime.
5.2.0
No publisher release notes were provided for version 5.2.0. Based on the repository changelog update and the visible diff, this release focuses on adding new loader limits for YAML merge processing and YAML alias counts, plus a fix for integer round-tripping in exponential form.
BreakingFeatures5.1.0
This release (5.1.0) introduces significant internal changes to YAML scalar quoting behavior and to the custom tag infrastructure. It also adds support for collection tags to incrementally populate a carrier and then finalize it into a different result value during parsing.
5.0.0
The publisher-provided release notes for version 5.0.0 are missing. However, the diff shows a major v5 rewrite, removing the previous CommonJS entrypoint and most of the old implementation under lib/, and introducing a new TypeScript-based architecture with flat named exports and new parsing/presentation layers.
Features4.2.0
Release 4.2.0 introduces a major restructuring of the package entrypoint and internal YAML implementation. The public API surface in index.js is rebuilt, deprecated/legacy exports are removed, and some legacy function names now fail immediately with an error directing users to replacement methods.
3.14.2
Release 3.14.2 appears to be a targeted security update. The code changes focus on preventing prototype pollution during YAML mapping merge and related mapping handling, plus minor hardening around alias lookup and build banner comments.
Security4.1.1
Version 4.1.1 primarily patches a prototype pollution vulnerability related to YAML merge (<<). The code changes harden how the loader assigns properties for mapping keys, specifically protecting the special key '__proto__'.
Security4.1.0
No release notes were provided by the publisher for version 4.1.0. The code changes in this diff primarily add a public `yaml.types` export, store the original `options` on each `Type`, and modify schema type compilation to preserve original type order when overriding conflicting types via `Schema.extend()`.
Features4.0.0
Release 4.0.0 was published on 2021-01-03, but no release notes were provided by the publisher. Because the release notes are missing, this analysis cannot reliably identify new features, breaking changes, bug fixes, or security updates from documentation.