js-yaml is a JavaScript YAML 1.2 parser and writer for converting between YAML documents and JavaScript values (load/loadAll for parsing, dump for serializing). It’s useful when you need to read or generate YAML in Node.js or use the included CLI to inspect YAML files from the command line.
Project status
- Actively maintained: Recent GitHub activity and continuous “updates” in mid 2026 (latest listed update 5.2.2 on 2026-07-23, with an upstream push on 2026-07-23) indicate the project is not dormant.
- Update cadence: Updates appear frequent, roughly every 1 to 3 weeks in July 2026 (5.2.2 on 7/23, 5.2.1 on 7/02, and 5.2.0 on 6/26), suggesting an ongoing maintenance stream rather than long gaps.
AI summary generated
Recent updates
5.2.3
The published release notes for version 5.2.3 are missing (no release notes content was provided). The code diff for the upgrade from 4.3.1 to 5.2.3 shows a substantial internal reorganization, including removal of many legacy CommonJS JavaScript source files and updates to benchmarks and documentation.
3.15.1
This release (js-yaml 3.15.1) focuses on security hardening and performance improvements in the YAML loader, specifically around merge key handling (<<), omap duplicate key detection (!!omap), and prototype pollution vectors involving __proto__. It also includes support for the loader option maxTotalMergeKeys, which can cause the loader to throw when merge key processing exceeds a configured limit.
BreakingSecurityFeatures4.3.1
Release 4.3.1 has no release notes provided. The code diff shows a substantial refactor of the package entry point and YAML implementation, along with multiple public API export changes that can affect existing integrations.
Features5.2.2
js-yaml 5.2.2 updates the YAML parser and presenter to fix incorrect handling of plain scalars involving a colon followed by flow indicators in flow contexts, and it hardens parsing to avoid exponential-time behavior on pathological inputs. The repo changelog also notes a security-related performance fix for nested flow sequence pairs, and the test suite was extended to cover both behaviors.
Security5.2.1
Release 5.2.1 contains a change to the YAML !!omap sequence tag implementation. No release notes were provided in the publisher release_notes section, but CHANGELOG.md was updated with fixes around Map handling and omap duplicate-key performance/security.
SecurityFeatures3.15.0
No publisher release notes were provided for 3.15.0. The code diff for this version adds a new loader option to cap merge key processing during YAML merge operations and introduces additional hardening against prototype pollution, including safer handling of __proto__ keys.
BreakingSecurityFeatures4.3.0
Release 4.3.0 has no provided release notes. The code diff shows a major refactor of the library internals and a change to the public exports in index.js, including removal of several deprecated aliases and deprecation-safe entrypoints (safeLoad/safeDump) that now throw at runtime.
5.2.0
No publisher release notes were provided for version 5.2.0. Based on the repository changelog update and the visible diff, this release focuses on adding new loader limits for YAML merge processing and YAML alias counts, plus a fix for integer round-tripping in exponential form.
BreakingFeatures5.1.0
This release (5.1.0) introduces significant internal changes to YAML scalar quoting behavior and to the custom tag infrastructure. It also adds support for collection tags to incrementally populate a carrier and then finalize it into a different result value during parsing.
5.0.0
The publisher-provided release notes for version 5.0.0 are missing. However, the diff shows a major v5 rewrite, removing the previous CommonJS entrypoint and most of the old implementation under lib/, and introducing a new TypeScript-based architecture with flat named exports and new parsing/presentation layers.
Features4.2.0
Release 4.2.0 introduces a major restructuring of the package entrypoint and internal YAML implementation. The public API surface in index.js is rebuilt, deprecated/legacy exports are removed, and some legacy function names now fail immediately with an error directing users to replacement methods.
3.14.2
Release 3.14.2 appears to be a targeted security update. The code changes focus on preventing prototype pollution during YAML mapping merge and related mapping handling, plus minor hardening around alias lookup and build banner comments.
Security4.1.1
Version 4.1.1 primarily patches a prototype pollution vulnerability related to YAML merge (<<). The code changes harden how the loader assigns properties for mapping keys, specifically protecting the special key '__proto__'.
Security4.1.0
No release notes were provided by the publisher for version 4.1.0. The code changes in this diff primarily add a public `yaml.types` export, store the original `options` on each `Type`, and modify schema type compilation to preserve original type order when overriding conflicting types via `Schema.extend()`.
Features4.0.0
Release 4.0.0 was published on 2021-01-03, but no release notes were provided by the publisher. Because the release notes are missing, this analysis cannot reliably identify new features, breaking changes, bug fixes, or security updates from documentation.
3.14.1
Release 3.14.1 is a small patch bump (3.14.0 to 3.14.1) with changes focused on YAML loader alias handling. No release notes were provided by the publisher, but the code diff includes a security-related fix in the loader implementation.
Security3.14.0
Release 3.14.0 updates js-yaml with several behavioral fixes around YAML dumping and stricter input validation in the loader. The repo changelog (added/updated in this diff) documents most items, but the code also includes an additional dumper behavior change affecting when strings containing '#' are quoted.
Features3.13.1
Release 3.13.1 is a small patch update to js-yaml. The changelog indicates a security fix focused on preventing possible code execution during `load()` when unsafe key objects are present.
Security3.13.0
No release notes were provided for 3.13.0, but the code changes include a targeted security/robustness fix in the YAML loader. The loader now rejects nested arrays used as mapping keys instead of risking a hang (and potentially unsafe behavior from implicit string conversion).
Security3.12.2
Release 3.12.2 makes a targeted fix to js-yaml's dumping behavior related to the noArrayIndent option when arrays appear at the root level. The only functional code change is in the dumper logic that computes array indentation.