[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
js-yaml	^4.3.2 → ^5.0.0

---

Release Notes

nodeca/js-yaml (js-yaml)

v5.5.0

Compare Source

Changed

• Updated argparse to v3.
• Updated development dependencies.

Fixed

• Correct percent-encoding of shorthand and verbatim tags.
• Reject ,, ], and } at the start of block plain scalars, #​801.
• Report the exact position of non-printable characters in errors, #​801.

v5.4.3

Compare Source

Fixed

• Fixed loading a whitespace-only block scalar followed by a less indented
  line, #​802.

v5.4.2

Compare Source

Fixed

• forceQuotes no longer quotes non-string scalars, #​798.

v5.4.1

Compare Source

Changed

• Hard-limit merge sequence size to 100.

Security

• Count empty mappings in merge sequences toward maxTotalMergeKeys to limit
  CPU usage, #​797.

v5.4.0

Compare Source

Added

• Added the scalarStyleRules dumper option to customize string formatting.
  See Scalar styling for details.

Changed

• [breaking] Flattened the low-level AST node style representation. Scalar
  and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values;
  explicit tags use the separate tagged property. Alias nodes now contain
  only kind and anchor. This only affects code that directly constructs or
  edits AST nodes.
• [breaking] The sortKeys option was rewritten using AST mutation to avoid
  side effects.
• Reworked scalar style selection. This can change formatting without changing
  loaded values; in particular, whitespace-only strings are now double-quoted.

Fixed

• Accept a byte order mark at the start of each document in a stream, #​791.
• Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace,
  including alias and property-only keys, #​786.
• Preserve empty scalar items when converting block sequences to flow style.
• Do not apply the 1024-character simple-key limit to flow mapping keys.
• Count Unicode code points, rather than UTF-16 code units, for the
  1024-character simple-key limit.
• Add an explicit document-end marker after keep-chomped block scalars when
  needed to preserve trailing newlines.

v5.3.0

Compare Source

This release focuses on reworking the documentation and making small
architectural improvements before moving forward.

Added

• Added completely new documentation.
• Exported DUMP_SCHEMA, the default schema used by the dumper.
• Added YAMLException.throwAt() for throwing an error at a source position.

Changed

• Changed flat constant exports to grouped exports: EVENT_ID, SCALAR_STYLE,
  COLLECTION_STYLE, and CHOMPING_MODE, along with their value types. The old
  exports are still preserved, but deprecated.
• Made identify mandatory for custom tag definitions. Use
  identify: () => false for load-only tags.

Deprecated

• Deprecated flat constant exports. Use grouped ones instead.

Removed

• Removed the MERGE_KEY export (not used anymore after last fixes).

Fixed

• Validate << sequence items at merge time, so aliased merge sources are
  checked too.
• Resolve << outside of a mapping key as the plain string '<<', matching
  v4, instead of leaking an internal symbol into the result.

v5.2.3

Compare Source

Fixed

• Prevent prototype fallback when resolving tags and mapping entries, #​782.
• Resolve !!timestamp years 0000-0099 correctly, #​775.
• Preserve implicit null mapping values before document markers and reject
  unpaired mapping event streams, #​784.
• Preserve folded scalar values with tab-indented lines when round-tripping a
  parsed AST through present(); dump() and loading are unaffected, #​780.

v5.2.2

Compare Source

Fixed

• Quote flow scalars where a colon precedes a flow indicator, #​773.

Security

• Avoid exponential parsing time for nested flow sequence pairs.

v5.2.1

Compare Source

Fixed

• Add Map support to !!omap (should work when realMapTag used)

Security

• Remove quadratic complexity from !!omap addItem. Regression from v5
  (usually not critical, because YAML11_SCHEMA is not default anymore).

v5.2.0

Compare Source

Added

• Added maxTotalMergeKeys (10000) loader option to limit the total number of
  keys processed by YAML merge (<<) across one load() / loadAll() call.
• Added maxAliases (-1) loader option to limit the number of YAML aliases per
  document.

Removed

• maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge
  processing.

Fixed

• Round-trip of integers with exponential form (>= 1e21)

v5.1.0

Compare Source

Added

• Collection tags can finalize an incrementally populated carrier into a
  different result value.

Changed

• [breaking] quoteStyle now selects the preferred quote style; use the
  restored forceQuotes option to force quoting non-key strings.

v5.0.0

Compare Source

Added

• Added named exports for schemas, tags, parser events and AST utilities.
• Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution
  rules, and added YAML11_SCHEMA.
• Added realMapTag for lossless mappings with non-string and complex keys.
  Object-based mappings now reject complex keys instead of stringifying them.
• Added dump() transform option for changing the generated AST before
  rendering.
• Added dump() options seqInlineFirst, flowBracketPadding,
  flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and
  tagBeforeAnchor.
• Added formal data layers (events and AST) for modular data pipelines.
  • Added low-level parser (to events), presenter and visitor APIs.
• Added the YAML Test Suite to the
  test set.

Changed

• See the migration guide for upgrade notes.
• Rewritten in TypeScript and reorganized the public API around flat named
  exports.
• Reduced the set of exported schemas:
  • YAML 1.2 schemas: CORE_SCHEMA (loader default), JSON_SCHEMA,
    FAILSAFE_SCHEMA.
  • YAML11_SCHEMA, a combination of all YAML 1.1 tags (YAML 1.1 does not
    specify a schema, only "types").
• load/dump default behaviour is now specified exactly via schemas:
  • load uses CORE_SCHEMA, without !!merge by default.
  • dump uses YAML11_SCHEMA + CORE_SCHEMA for the quoting check, to
    guarantee backward compatibility by default.
• !!set is now loaded as a JavaScript Set.
• Replaced the Type API with a tags API. Similar, but more precise and
  simpler. See examples for details. Tags can be defined via
  defineScalarTag(), defineSequenceTag() and defineMappingTag(), or as a
  spread + override of an existing tag.
• Renamed Schema.extend() to Schema.withTags().
• Expanded YAML 1.2 conformance and improved handling of directives, document
  markers, block keys, multiline scalars, tag syntax and other things.
• load() now throws on empty input instead of returning undefined.
• Moved browser builds to the js-yaml/browser export.
• Deprecated the loadAll signature with an iterator (still works, but is a
  candidate for removal).

Removed

• Removed deprecated safeLoad(), safeLoadAll() and safeDump() exports.
• Removed DEFAULT_SCHEMA and the nested types export.
• Removed loader options onWarning, legacy and listener.
• Removed dumper options styles, replacer, noCompatMode, condenseFlow,
  quotingType and forceQuotes. Renamed noArrayIndent to seqNoIndent.
  Formatting and representation are now configured through presenter options,
  schemas and tag definitions. See migration guide on how to replace.
• Removed support for importing internal files from lib/.

---

Configuration

📅 Schedule: (in timezone Europe/Paris)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[izo]

Revue — js-yaml 4.3.2 → 5.5.0

Verdict : à adapter (adaptations mineures, aucun blocage). Le point critique tient : le frontmatter reste lu en YAML 1.2 core, une date reste une chaîne, et les fixtures de la spec passent toutes. Mais la PR change trois comportements visibles de parseFrontmatter sans le dire, et elle part d'une base antérieure à la 0.20.0.

Ce qui a été lancé

	branche renovate/js-yaml-5.x (9e32c2a, base 0.19.x)	la même fusionnée sur main (d0bb6ac, 0.20.0)
npm ci	ok, js-yaml@5.5.0 seul	ok, js-yaml@5.5.0 seul
typecheck	0 erreur	0 erreur
test:unit	26 fichiers, 577 passés, 1 sauté	27 fichiers, 604 passés, 1 sauté
fixtures:check	192 fichiers conformes à 18f48de	207 fichiers conformes à 51cbf73
test:e2e	59 passés	64 passés

La fusion sur main se fait sans conflit (package.json, package-lock.json).

Le point critique : YAML 1.2 core

src/ingest/frontmatter.ts appelle load(…, { schema: CORE_SCHEMA }). En v5, CORE_SCHEMA existe toujours (export nommé), il a été « réécrit avec les règles de résolution de la spec », et il devient même le défaut de load. Vérifié : date: 2024-02-30 → '2024-02-30' (string), 2024-03-01 → string, true/3 typés comme avant. Le bundle ESM de js-yaml 5 n'importe aucun module : /ingest reste importable dans un Worker.

Comparaison v4 / v5 sous CORE_SCHEMA

Les 95 blocs de frontmatter des fixtures et du demo-site se parsent à l'identique (une seule différence : le texte d'erreur de invalid-frontmatter-invalid, dont le diagnostic reste frontmatter-invalid). Sur 36 cas limites, 8 diffèrent. Trois touchent le validateur :

Entrée	v4	v5
bloc vide ---\n--- ou commentaire seul	invalid, « bloc de frontmatter vide »	invalid, « expected a document, but the input is empty » (load() lève sur une entrée vide, d'après le changelog 5.0.0)
clé complexe ? [a, b]\n: c	ok, { "a,b": "c" }	invalid : « object-based map does not support complex keys »
n: 0b101	ok, 5	ok, "0b101". Conforme au 1.2 core, qui n'a pas d'entier binaire

Les clés dupliquées restent rejetées (duplicated mapping key). Les deux derniers changements vont dans le sens de la spec : le validateur juge le texte écrit. Le premier est une régression de message : le diagnostic frontmatter-invalid devient « Frontmatter illisible : expected a document… », en anglais. Aucun test ne couvre ce cas, d'où les suites vertes.

Adaptations demandées avant fusion

1. Rebaser sur main (0.20.0), pour que la CI rejoue les 207 fixtures et non les 192 de la base actuelle.
2. Garder le message du bloc vide : tester lines.slice(1, end) vide ou fait seulement de blancs et de commentaires avant load(), ou intercepter ce cas, et ajouter le test qui manque (---\n---).
3. Retirer @types/js-yaml des devDependencies : la v5 embarque ses types (dist/js-yaml.d.ts), le paquet @types v4 ne sert plus à rien.
4. Entrée au CHANGELOG (Modifié) : la mise à jour est sans effet sur le corpus réel, mais une clé complexe rend désormais frontmatter-invalid, et un 0b… reste une chaîne. Profiter de cette entrée pour corriger la note de la 0.19.0 et CLAUDE.md § Frontmatter : Astro 7.4 ne dépend plus de js-yaml (npm ls js-yaml : notre dépendance directe seule). L'argument « la 4.3 qu'Astro tire déjà, dédupliquée » ne vaut plus, et il ne gêne donc pas la v5.

Rien n'a été poussé sur cette branche.

---

Generated by Claude Code