chore(deps): Bump js-yaml from 4.1.1 to 4.2.0

[dependabot]

Bumps js-yaml from 4.1.1 to 4.2.0.

Changelog

Sourced from js-yaml's changelog.

[4.2.0] - 2026-06-01

Added

• Added docs/safety.md with notes about processing untrusted YAML.
• Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
• Added a loader option limiting merge sequence length. Not a problem after merge fix, but an additional restriction for safety.
• Added sourcemaps to dist/ builds.

Changed

• Stop resolving numbers with underscores as numeric scalars, #627.
• Switched dev toolchains to Vite / neostandard.
• Updated demo.
• Reorganized tests.
• dist/ files are no longer kept in the repository.

Fixed

• Fix parsing of properties on the first implicit block mapping key, #62.
• Fix trailing whitespace handling when folding flow scalar lines, #307.
• Reject top-level block scalars without content indentation, #280.
• Ensure numbers survive round-trip, #737.
• Fix test coverage for issue #221.
• Fix flow scalar trailing whitespace folding, #307.
• Fix digits in YAML named tag handles.

Security

• Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

• Backported v4.1.1 fix to v3

Commits

• 590dbab 4.2.0 released
• f944dc5 Add package.json funding field
• f692719 Changelog update
• 9971a06 Fix digits in YAML named tag handles
• 464a5b8 Fix flow scalar trailing whitespace folding, close #307
• 1fda4f7 Tests for #567, #565
• 031ad07 Stop resolving numbers with underscores as numeric scalars, #627
• e46d223 CI config update
• 9023fee Add lockfile
• 990e6f4 Docs update
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[greptile-apps]

Greptile Summary

This Dependabot PR bumps js-yaml from 4.1.1 to 4.2.0, picking up a DoS fix for quadratic-complexity merge handling and several parser correctness fixes. Regenerating the lockfile also resolved a newer @voidzero-dev/vite-plus-core@latest, silently upgrading the core build toolchain from 0.1.24 to 0.2.4 — an unintended change bundled into a routine dependency bump.

• js-yaml 4.2.0 includes a security fix (DoS via malformed merge keys) and a behavioral change: YAML values written with underscore separators (e.g. 1_000_000) are now strings, not numbers.
• @voidzero-dev/vite-plus-core was bumped 0.1.24 → 0.2.4 as a side effect of lockfile regeneration; the new version also narrows Node 22 engine support to ^22.18.0, which could affect CI environments on 22.12–22.17.

Important Files Changed

Filename	Overview
packages/lib/package.json	Bumps js-yaml specifier from ^4.1.0 to ^4.2.0; includes a behavioral change for YAML values that use underscore-separated numbers
pnpm-lock.yaml	Locks js-yaml to 4.2.0 as intended, but also bumps @voidzero-dev/vite-plus-core from 0.1.24 to 0.2.4 across all workspace packages — an unintended side effect because vite is declared as npm:@voidzero-dev/vite-plus-core@latest

Comments Outside Diff (1)

1. pnpm-lock.yaml, line 27-40 (link)

   Unintended toolchain bump bundled into this js-yaml PR

   Every workspace package silently picked up @voidzero-dev/vite-plus-core@0.2.4 (from 0.1.24) because vite is declared as npm:@voidzero-dev/vite-plus-core@latest. Regenerating the lockfile to land js-yaml@4.2.0 also resolved the new latest for core. The two upgrades are unrelated; mixing them makes the diff harder to audit and means a build/test regression from the toolchain change would appear in a js-yaml bump PR. Additionally, @voidzero-dev/vite-plus-core@0.2.4 narrows Node 22 support to ^22.18.0 (from >=22.12.0), which could break CI environments running 22.12–22.17.

_{Reviews (1): Last reviewed commit: "chore(deps): Bump js-yaml from 4.1.1 to ..." | Re-trigger Greptile}

[greptile-apps]

Underscore-numeric parsing behavior change in js-yaml 4.2.0

js-yaml@4.2.0 stops resolving numbers written with underscores as numeric scalars (e.g. 1_000_000 is now the string "1_000_000" rather than the integer 1000000). Any YAML the pipeline reads that uses this notation will silently yield strings where code previously received numbers, potentially breaking numeric comparisons or arithmetic downstream. It is worth scanning the YAML files this library parses to confirm none rely on underscore-delimited numbers.