Skip to content

build(deps): bump js-yaml, documentation, prettier-eslint and prettier-eslint-cli - #200

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-3239fc8d72
Closed

build(deps): bump js-yaml, documentation, prettier-eslint and prettier-eslint-cli#200
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-3239fc8d72

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 22, 2026

Copy link
Copy Markdown
Contributor

Bumps js-yaml to 4.2.0 and updates ancestor dependencies js-yaml, documentation, prettier-eslint and prettier-eslint-cli. These dependencies need to be updated together.

Updates js-yaml from 4.1.0 to 4.2.0

Changelog

Sourced from js-yaml's changelog.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.
  • Fix digits in YAML named tag handles.

Security

  • Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

  • Backported v4.1.1 fix to v3

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.
Commits

Updates documentation from 13.2.5 to 14.0.3

Release notes

Sourced from documentation's releases.

v14.0.0

chore(release): 14.0.0

Changelog

Sourced from documentation's changelog.

14.0.3 (2024-01-30)

Bug Fixes

14.0.2 (2023-05-19)

Bug Fixes

14.0.1 (2022-12-14)

Improvements

  • chore: upgrade git-url-parse to 13.1.0 to fix vulnerabilities #1565

14.0.0 (2022-08-19)

14.0.0-alpha.1 (2022-08-07)

Features

  • ✨ update Babel, copy list of plugins from Prettier (3f187d7)

14.0.0-alpha.0 (2022-08-05)

⚠ BREAKING CHANGES

  • all Extensions should contains '.' so that mean if you have just 'ts' then need to convert to '.ts'
  • external parameter was removed Migration plan propose to move all external resources to input usages Motivation: packages has many inputs which describe in package.json so that mean need each time to parse all package.json of external resources to understand which entry point need to pick. But it is base on guesses because entry point may could not contains a documentation and the best way to handle it manually.
  • The serve parameter was removed, you can use any other tools which could be refresh and store your html site The private parameter has removed, use a access
  • documentation.js will now require node 14 or later.

Bug Fixes

  • add micromark dependencies fixed #1381 (3ba8165)
  • add TS and TSX as default extensions fixed #1377 (f0cb1c0)
  • external was removed as prefer of input usages (e3c59d7)
  • html report, it is return html if output is not defined (0975871)

... (truncated)

Commits
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates prettier-eslint from 13.0.0 to 17.1.1

Release notes

Sourced from prettier-eslint's releases.

v17.1.1

Patch Changes

  • #1214 38cdf17 Thanks @​JounQin! - Improve repeated formatting performance by caching ESLint instances and resolved configs, and by skipping expensive log serialization unless verbose logging is enabled.

v17.1.0

Minor Changes

  • #1210 ffc5d0a Thanks @​JounQin! - Migrate to pure ESM, replace Jest with Vitest, and drop legacy helper dependencies.

v17.0.1

Patch Changes

v17.0.0

Major Changes

Patch Changes

v17.0.0-alpha.1

Patch Changes

New Contributors

Full Changelog: prettier/prettier-eslint@v17.0.0-alpha.0...v17.0.0-alpha.1

v17.0.0-alpha.0

Major Changes

Full Changelog: prettier/prettier-eslint@v16.4.2...v17.0.0-alpha.0

v16.4.2

Patch Changes

New Contributors

... (truncated)

Changelog

Sourced from prettier-eslint's changelog.

17.1.1

Patch Changes

  • #1214 38cdf17 Thanks @​JounQin! - Improve repeated formatting performance by caching ESLint instances and resolved configs, and by skipping expensive log serialization unless verbose logging is enabled.

17.1.0

Minor Changes

  • #1210 ffc5d0a Thanks @​JounQin! - Migrate to pure ESM, replace Jest with Vitest, and drop legacy helper dependencies.

17.0.1

Patch Changes

17.0.0

Major Changes

Patch Changes

17.0.0-alpha.1

Patch Changes

17.0.0-alpha.0

Major Changes

16.4.2

Patch Changes

16.4.1

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for prettier-eslint since your current version.


Updates prettier-eslint-cli from 5.0.1 to 9.2.1

Release notes

Sourced from prettier-eslint-cli's releases.

v9.2.1

Patch Changes

  • #478 cf3522a Thanks @​JounQin! - Align file discovery with ESLint ignore semantics, including config/default ignores and basePath handling.

v9.2.0

Minor Changes

v9.1.0

Minor Changes

v9.0.0

Major Changes

Patch Changes

v9.0.0-alpha.2

Patch Changes

v9.0.0-alpha.1

Patch Changes

v9.0.0-alpha.0

Major Changes

Full Changelog: prettier/prettier-eslint-cli@v8.0.1...v9.0.0-alpha.0

v8.0.1

Patch Changes

... (truncated)

Changelog

Sourced from prettier-eslint-cli's changelog.

9.2.1

Patch Changes

  • #478 cf3522a Thanks @​JounQin! - Align file discovery with ESLint ignore semantics, including config/default ignores and basePath handling.

9.2.0

Minor Changes

9.1.0

Minor Changes

9.0.0

Major Changes

Patch Changes

9.0.0-alpha.2

Patch Changes

9.0.0-alpha.1

Patch Changes

9.0.0-alpha.0

Major Changes

... (truncated)

Commits
  • 29f6306 chore: release prettier-eslint-cli (#479)
  • 772023f fix(deps): update all dependencies (#480)
  • cf3522a fix: align ignore handling with ESLint ConfigArray semantics (#478)
  • 7654b6f chore: release prettier-eslint-cli (#477)
  • e72f7d5 refactor: simplify formatting internals (#476)
  • 72294d1 chore: release prettier-eslint-cli (#474)
  • 48bbff2 Migrate to pure ESM with tsc and Vitest (#475)
  • 6aac5b1 feat: migrate source to TypeScript with 100% compatibility (#473)
  • 449fa17 docs: remove implemented roadmap tasks
  • 9b22de8 chore: release prettier-eslint-cli (#471)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for prettier-eslint-cli since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

…r-eslint-cli

Bumps [js-yaml](https://github.com/nodeca/js-yaml) to 4.2.0 and updates ancestor dependencies [js-yaml](https://github.com/nodeca/js-yaml), [documentation](https://github.com/documentationjs/documentation), [prettier-eslint](https://github.com/prettier/prettier-eslint) and [prettier-eslint-cli](https://github.com/prettier/prettier-eslint-cli). These dependencies need to be updated together.


Updates `js-yaml` from 4.1.0 to 4.2.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.2.0)

Updates `documentation` from 13.2.5 to 14.0.3
- [Release notes](https://github.com/documentationjs/documentation/releases)
- [Changelog](https://github.com/documentationjs/documentation/blob/master/CHANGELOG.md)
- [Commits](documentationjs/documentation@v13.2.5...v14.0.3)

Updates `prettier-eslint` from 13.0.0 to 17.1.1
- [Release notes](https://github.com/prettier/prettier-eslint/releases)
- [Changelog](https://github.com/prettier/prettier-eslint/blob/master/CHANGELOG.md)
- [Commits](prettier/prettier-eslint@v13.0.0...v17.1.1)

Updates `prettier-eslint-cli` from 5.0.1 to 9.2.1
- [Release notes](https://github.com/prettier/prettier-eslint-cli/releases)
- [Changelog](https://github.com/prettier/prettier-eslint-cli/blob/master/CHANGELOG.md)
- [Commits](prettier/prettier-eslint-cli@v5.0.1...v9.2.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.2.0
  dependency-type: indirect
- dependency-name: documentation
  dependency-version: 14.0.3
  dependency-type: direct:production
- dependency-name: prettier-eslint
  dependency-version: 17.1.1
  dependency-type: direct:development
- dependency-name: prettier-eslint-cli
  dependency-version: 9.2.1
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 22, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 1, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #201.

@dependabot dependabot Bot closed this Jul 1, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/multi-3239fc8d72 branch July 1, 2026 01:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants