-
Notifications
You must be signed in to change notification settings - Fork 5
build(deps): bump js-yaml from 5.3.0 to 5.4.0 in /server in the all-minors group - #2251
build(deps): bump js-yaml from 5.3.0 to 5.4.0 in /server in the all-minors group #2251dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the all-minors group in /server with 1 update: [js-yaml](https://github.com/nodeca/js-yaml). Updates `js-yaml` from 5.3.0 to 5.4.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@5.3.0...5.4.0) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-minors ... Signed-off-by: dependabot[bot] <support@github.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, straightforward dependency version bump.
What was reviewed: confirmed server/package.json's js-yaml range change (^5.3.0 → ^5.4.0) is consistently reflected in server/package-lock.json (both the dependencies block and the resolved package entry, including matching version and integrity hash). No other lockfile entries were touched and no application source code was modified.
Extended reasoning...
Overview
The diff touches only server/package.json and server/package-lock.json, bumping the js-yaml dependency range from ^5.3.0 to ^5.4.0. This is a Dependabot-authored minor version bump PR.
Security risks
None identified. js-yaml is a YAML parsing library; the changelog for 5.4.0 lists dumper/formatting fixes and a couple of AST-representation breaking changes that only affect code directly constructing/editing AST nodes, which this codebase does not do (it uses standard load/dump). No auth, crypto, or permission code is touched.
Level of scrutiny
Low. This is exactly the kind of mechanical, self-contained change (version range + lockfile regeneration) that the approval guidelines call out as approvable without requiring a human to look closely.
Other factors
Verified the lockfile change is internally consistent (version bump and integrity hash pair match the new version, and the dependencies range in the manifest matches the lockfile's top-level requirement). No unrelated lockfile churn was found in the diff.
Looks like js-yaml is updatable in another way, so this is no longer needed.
Uh oh!
There was an error while loading. Please reload this page.
Bumps the all-minors group in /server with 1 update: js-yaml.
Updates
js-yamlfrom 5.3.0 to 5.4.0Changelog
Sourced from js-yaml's changelog.
Commits
6b4ff5e5.4.0 released3b3625eUpdate changelog4f25a74Fix file name3bd003bExpose new scalar styling APIfbb3e9dRemove regex lookbehind for ES2015 compatibilityd43c185FixflowSkipColonSpaceby forcingquoteFlowKeysa5fdb31Add automatic double quoting for whitespace-only strings, close #53425dcf77Fix keep-chomped scalar test expectations9f50a42Fix open-ended tracking for document end markers31aad6dFix simple key length limit for astral charactersDependabot compatibility score
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions