Skip to content

Bump js-yaml, mocha and yeoman-environment - #272

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-dcb50b6ade
Open

Bump js-yaml, mocha and yeoman-environment#272
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-dcb50b6ade

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps js-yaml to 4.3.1 and updates ancestor dependencies js-yaml, mocha and yeoman-environment. These dependencies need to be updated together.

Updates js-yaml from 3.13.1 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

  • [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

  • Restore umd builds back to es5.

Removed

  • [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.
  • Fix digits in YAML named tag handles.

Security

  • Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

... (truncated)

Commits
  • 86e91b8 4.3.1 released
  • c3cc4b0 Backport quadratic complexity fix for !!omap
  • 33d05b5 4.3.0 released
  • 663bfab Drop demo publish, to not override new v5 one.
  • 1cb8c7b Add v4-legacy tag for publish
  • 02f27af Restore umd builds back to es5
  • 8be84ed Fix es5 compatibility
  • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
  • 6842ef6 doc polish
  • 590dbab 4.2.0 released
  • Additional commits viewable in compare view

Updates mocha from 6.2.0 to 11.8.0

Release notes

Sourced from mocha's releases.

v11.8.0

11.8.0 (2026-08-02)

🌟 Features

  • add --fail-hook-affected-tests option to report skipped tests as failed (#5519) (#6052) (7830309)

🧹 Chores

v11.7.7

11.7.7 (2026-06-13)

🩹 Fixes

v11.7.6

11.7.6 (2026-02-14)

🩹 Fixes

  • make describe().timeout() work (aafe6fd)
  • test: replace wmic usage with native Windows API (#5694) (73ebdfa)

🧹 Chores

v11.7.5

11.7.5 (2025-11-04)

🩹 Fixes

  • swallow more require errors from *ts files (#5498) (d89dbaf)

🧹 Chores

  • run tests on PRs for and pushes to v11.x (#5525) (8b21b38)

... (truncated)

Changelog

Sourced from mocha's changelog.

11.8.0 (2026-08-02)

🌟 Features

  • add --fail-hook-affected-tests option to report skipped tests as failed (#5519) (#6052) (7830309)

🧹 Chores

11.7.7 (2026-06-13)

🩹 Fixes

11.7.6 (2026-02-14)

🩹 Fixes

  • make describe().timeout() work (aafe6fd)
  • test: replace wmic usage with native Windows API (#5694) (73ebdfa)

🧹 Chores

11.7.5 (2025-11-04)

🩹 Fixes

  • swallow more require errors from *ts files (#5498) (d89dbaf)

🧹 Chores

11.7.4 (2025-10-01)

... (truncated)

Commits
  • 90c1bb3 chore(v11.x): release 11.8.0 (#6076)
  • 05aec43 chore(CI): bump Node from 22 to 24 in publish action (#6206)
  • 1f44d5f chore: change site title to Mocha 11, update index note (#6086)
  • 26deb23 chore: add modern Netlify to v11.x branch (#6082)
  • 7830309 feat: add --fail-hook-affected-tests option to report skipped tests as failed...
  • 41f2b95 chore(v11.x): release 11.7.7 (#6068)
  • 3477563 fix: surface ts-node compile errors (#6045)
  • 3765ba0 chore(v11.x): release 11.7.6 (#5632)
  • 73ebdfa fix(test): replace wmic usage with native Windows API (#5694)
  • aafe6fd fix: make describe().timeout() work
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mocha since your current version.


Updates yeoman-environment from 3.19.3 to 6.1.0

Release notes

Sourced from yeoman-environment's releases.

v6.1.0

6.1.0 (2026-04-29)

Features

  • add support to ask customInstallTask (#770) (136e4f4)
  • deps: bump @​yeoman/namespace from 1.0.1 to 2.1.0 (#766) (4a3ae84)
  • extract getFeaturesFromGenerator (#769) (d244f0c)

v6.0.1

What's Changed

Full Changelog: yeoman/environment@v6.0.0...v6.0.1

v6.0.0

🚀 yeoman-environment v6 – Release Notes

  • Switch to @​yeoman/adapter v4 (and inquirer v13) by default. Some behavior changes may happen.

yeoman/environment@v5.1.3...v6.0.0

v5.1.3

  • fix: only fallback to import if requiring fails with esm/async error (#716) e4fb745

yeoman/environment@v5.1.2...v5.1.3

v5.1.2

  • fix: use globbySync to resolve PNPM global node_modules paths (#692) 4317fef

yeoman/environment@v5.1.1...v5.1.2

v5.1.1

  • feat: lookup for generators in pnpm global folder (#680) 2fcd028

yeoman/environment@v5.1.0...v5.1.1

v5.1.0

... (truncated)

Changelog

Sourced from yeoman-environment's changelog.

6.1.0 (2026-04-29)

Features

  • add support to ask customInstallTask (#770) (136e4f4)
  • deps: bump @​yeoman/namespace from 1.0.1 to 2.1.0 (#766) (4a3ae84)
  • extract getFeaturesFromGenerator (#769) (d244f0c)
Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for yeoman-environment since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Most Recent Ignore Conditions Applied to This Pull Request
Dependency Name Ignore Conditions
mocha [> 6.2.0]

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 10, 2026
@ndoschek

ndoschek commented Aug 18, 2026

Copy link
Copy Markdown
Member

@dependabot rebase

@dependabot
Bump js-yaml, mocha and yeoman-environment
e6f4050 
Bumps [js-yaml](https://github.com/nodeca/js-yaml) to 4.3.1 and updates ancestor dependencies [js-yaml](https://github.com/nodeca/js-yaml), [mocha](https://github.com/mochajs/mocha) and [yeoman-environment](https://github.com/yeoman/environment). These dependencies need to be updated together.


Updates `js-yaml` from 3.13.1 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.13.1...4.3.1)

Updates `mocha` from 6.2.0 to 11.8.0
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/v11.8.0/CHANGELOG.md)
- [Commits](mochajs/mocha@v6.2.0...v11.8.0)

Updates `yeoman-environment` from 3.19.3 to 6.1.0
- [Release notes](https://github.com/yeoman/environment/releases)
- [Changelog](https://github.com/yeoman/environment/blob/main/CHANGELOG.md)
- [Commits](yeoman/environment@v3.19.3...v6.1.0)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
- dependency-name: mocha
  dependency-version: 11.8.0
  dependency-type: direct:development
- dependency-name: yeoman-environment
  dependency-version: 6.1.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-dcb50b6ade branch from f27fab5 to e6f4050 Compare August 18, 2026 13:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ndoschek