Skip to content

Bump js-yaml from 3.14.2 to 3.15.2 - #263

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/js-yaml-3.15.2
Closed

dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/js-yaml-3.15.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026 •

Copy link
Copy Markdown
Contributor

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.


Bumps js-yaml from 3.14.2 to 3.15.2.

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

  • Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 21, 2026
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 3.14.2 to 3.15.2.
- [Changelog](https://github.com/nodeca/js-yaml/blob/3.15.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.2...3.15.2)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump js-yaml from 3.14.1 to 3.15.2 Bump js-yaml from 3.14.2 to 3.15.2 Sep 21, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/js-yaml-3.15.2 branch from d87fbe9 to be1e7fa Compare September 21, 2026 08:59
pdziewa added a commit that referenced this pull request Sep 21, 2026
Resolves PR #263, which could not be merged directly because its
lockfile conflicted with master.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@pdziewa

pdziewa commented Sep 21, 2026

Copy link
Copy Markdown
Collaborator

Landed on master in a6636f2. This branch's lockfile conflicted with master, so the bump to 3.15.2 was applied directly instead.

@pdziewa pdziewa closed this Sep 21, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/js-yaml-3.15.2 branch September 21, 2026 09:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant