Skip to content

Build(deps-dev): Bump the development-dependencies group across 1 directory with 2 updates#42491

Merged
julien-deramond merged 1 commit into
mainfrom
dependabot/npm_and_yarn/development-dependencies-6118126e71
Jun 9, 2026
Merged

Build(deps-dev): Bump the development-dependencies group across 1 directory with 2 updates#42491
julien-deramond merged 1 commit into
mainfrom
dependabot/npm_and_yarn/development-dependencies-6118126e71

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the development-dependencies group with 2 updates in the / directory: js-yaml and rollup.

Updates js-yaml from 4.1.1 to 4.2.0

Changelog

Sourced from js-yaml's changelog.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.
  • Fix digits in YAML named tag handles.

Security

  • Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

  • Backported v4.1.1 fix to v3
Commits

Updates rollup from 4.60.4 to 4.61.0

Release notes

Sourced from rollup's releases.

v4.61.0

4.61.0

2026-06-01

Features

  • Sort entry modules to make chunk hashes deterministic (#6391)

Pull Requests

Changelog

Sourced from rollup's changelog.

4.61.0

2026-06-01

Features

  • Sort entry modules to make chunk hashes deterministic (#6391)

Pull Requests

Commits

@julien-deramond

Copy link
Copy Markdown
Member

@dependabot rebase

@julien-deramond julien-deramond self-requested a review June 9, 2026 19:47
…ectory with 2 updates

Bumps the development-dependencies group with 2 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml) and [rollup](https://github.com/rollup/rollup).


Updates `js-yaml` from 4.1.1 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)

Updates `rollup` from 4.60.4 to 4.61.0
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.60.4...v4.61.0)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: rollup
  dependency-version: 4.61.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Build(deps-dev): Bump the development-dependencies group with 2 updates Build(deps-dev): Bump the development-dependencies group across 1 directory with 2 updates Jun 9, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/development-dependencies-6118126e71 branch from 52c6aa9 to 1110e58 Compare June 9, 2026 19:49
@julien-deramond julien-deramond merged commit 45b505a into main Jun 9, 2026
9 checks passed
@julien-deramond julien-deramond deleted the dependabot/npm_and_yarn/development-dependencies-6118126e71 branch June 9, 2026 20:02
julien-deramond pushed a commit that referenced this pull request Jun 9, 2026
Bumps the development-dependencies group with 2 updates in the / directory: [js-yaml](https://github.com/nodeca/js-yaml) and [rollup](https://github.com/rollup/rollup).

Updates `js-yaml` from 4.1.1 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/commits)

Updates `rollup` from 4.60.4 to 4.61.0
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.60.4...v4.61.0)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: rollup
  dependency-version: 4.61.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant