chore(deps): Bump js-yaml from 4.1.1 to 4.3.0 by dependabot[bot] · Pull Request #688 · docker/metadata-action

dependabot · 2026-06-28T18:50:13Z

Bumps js-yaml from 4.1.1 to 4.3.0.

Changelog

4.3.0, 3.15.0 - 2026-06-27

Security

Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

Added

Collection tags can finalize an incrementally populated carrier into a different result value.

Changed

[breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

[5.0.0] - 2026-06-20

Added

Added named exports for schemas, tags, parser events and AST utilities.

Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.

Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.

Added dump() transform option for changing the generated AST before rendering.

Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and tagBeforeAnchor.

Added formal data layers (events and AST) for modular data pipelines.

Added low-level parser (to events), presenter and visitor APIs.

Added the YAML Test Suite to the test set.

Changed

See the migration guide for upgrade notes.

Rewritten in TypeScript and reorganized the public API around flat named exports.

... (truncated)

Commits

33d05b5 4.3.0 released
663bfab Drop demo publish, to not override new v5 one.
1cb8c7b Add v4-legacy tag for publish
02f27af Restore umd builds back to es5
8be84ed Fix es5 compatibility
59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
6842ef6 doc polish
590dbab 4.2.0 released
f944dc5 Add package.json funding field
f692719 Changelog update
Additional commits viewable in compare view

dependabot · 2026-07-01T12:02:12Z

A newer version of js-yaml exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

crazy-max · 2026-07-02T07:55:12Z

@dependabot recreate

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.3.0. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.0) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.2.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

…to v6 (#8) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [https://github.com/docker/metadata-action](https://github.com/docker/metadata-action) | action | major | `v5` → `v6` | --- ### Release Notes <details> <summary>docker/metadata-action (https://github.com/docker/metadata-action)</summary> ### [`v6.2.0`](https://github.com/docker/metadata-action/releases/tag/v6.2.0) [Compare Source](docker/metadata-action@v6.1.0...v6.2.0) - Preserve names in esbuild bundle by [@crazy-max](https://github.com/crazy-max) in [#689](docker/metadata-action#689) - Bump [@actions/core](https://github.com/actions/core) from 3.0.0 to 3.0.1 in [#663](docker/metadata-action#663) - Bump [@actions/github](https://github.com/actions/github) from 9.0.0 to 9.1.1 in [#666](docker/metadata-action#666) - Bump [@docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.90.0 to 0.92.0 in [#672](docker/metadata-action#672) [#696](docker/metadata-action#696) - Bump [@sigstore/core](https://github.com/sigstore/core) from 3.1.0 to 3.2.1 in [#690](docker/metadata-action#690) - Bump [@sigstore/verify](https://github.com/sigstore/verify) from 3.1.0 to 3.1.1 in [#693](docker/metadata-action#693) - Bump csv-parse from 6.2.1 to 7.0.0 in [#683](docker/metadata-action#683) - Bump js-yaml from 4.1.1 to 4.3.0 in [#688](docker/metadata-action#688) - Bump moment-timezone from 0.6.1 to 0.6.2 in [#664](docker/metadata-action#664) - Bump semver from 7.7.4 to 7.8.5 in [#665](docker/metadata-action#665) [#695](docker/metadata-action#695) - Bump sigstore from 4.1.0 to 4.1.1 in [#694](docker/metadata-action#694) - Bump tmp from 0.2.5 to 0.2.7 in [#673](docker/metadata-action#673) - Bump undici from 6.25.0 to 6.27.0 in [#686](docker/metadata-action#686) - Bump vite from 7.3.2 to 7.3.6 in [#685](docker/metadata-action#685) **Full Changelog**: <docker/metadata-action@v6.1.0...v6.2.0> ### [`v6.1.0`](https://github.com/docker/metadata-action/releases/tag/v6.1.0) [Compare Source](docker/metadata-action@v6.0.0...v6.1.0) - Bump [@docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.79.0 to 0.90.0 in [#613](docker/metadata-action#613) - Bump brace-expansion from 1.1.12 to 5.0.6 in [#658](docker/metadata-action#658) [#630](docker/metadata-action#630) - Bump csv-parse from 6.1.0 to 6.2.1 in [#617](docker/metadata-action#617) - Bump fast-xml-parser from 5.4.2 to 5.8.0 in [#620](docker/metadata-action#620) - Bump flatted from 3.3.3 to 3.4.2 in [#623](docker/metadata-action#623) - Bump glob from 10.3.15 to 10.5.0 in [#621](docker/metadata-action#621) - Bump handlebars from 4.7.8 to 4.7.9 in [#629](docker/metadata-action#629) - Bump lodash from 4.17.23 to 4.18.1 in [#639](docker/metadata-action#639) - Bump moment-timezone from 0.6.0 to 0.6.1 in [#619](docker/metadata-action#619) - Bump picomatch from 4.0.3 to 4.0.4 in [#626](docker/metadata-action#626) - Bump postcss from 8.5.6 to 8.5.10 in [#649](docker/metadata-action#649) - Bump tar from 6.2.1 to 7.5.15 in [#657](docker/metadata-action#657) - Bump undici from 6.23.0 to 6.25.0 in [#614](docker/metadata-action#614) - Bump vite from 7.3.1 to 7.3.2 in [#637](docker/metadata-action#637) **Full Changelog**: <docker/metadata-action@v6.0.0...v6.1.0> ### [`v6.0.0`](https://github.com/docker/metadata-action/releases/tag/v6.0.0) [Compare Source](docker/metadata-action@v5.10.0...v6.0.0) - Node 24 as default runtime (requires [Actions Runner v2.327.1](https://github.com/actions/runner/releases/tag/v2.327.1) or later) by [@crazy-max](https://github.com/crazy-max) in [#605](docker/metadata-action#605) - List inputs now preserve `#` inside values while still supporting full-line `#` comments by [@crazy-max](https://github.com/crazy-max) in [#607](docker/metadata-action#607) - Switch to ESM and update config/test wiring by [@crazy-max](https://github.com/crazy-max) in [#602](docker/metadata-action#602) - Bump lodash from 4.17.21 to 4.17.23 in [#588](docker/metadata-action#588) - Bump [@actions/core](https://github.com/actions/core) from 1.11.1 to 3.0.0 in [#599](docker/metadata-action#599) - Bump [@actions/github](https://github.com/actions/github) from 6.0.1 to 9.0.0 in [#597](docker/metadata-action#597) - Bump [@docker/actions-toolkit](https://github.com/docker/actions-toolkit) from 0.68.0 to 0.79.0 in [#604](docker/metadata-action#604) - Bump [@isaacs/brace-expansion](https://github.com/isaacs/brace-expansion) from 5.0.0 to 5.0.1 in [#600](docker/metadata-action#600) - Bump semver from 7.7.3 to 7.7.4 in [#603](docker/metadata-action#603) **Full Changelog**: <docker/metadata-action@v5.10.0...v6.0.0> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Rome) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.homelab.devncode.it/marco/vinted-search-mcp/pulls/8

dependabot Bot added bot dependencies labels Jun 28, 2026

dependabot Bot changed the title ~~chore(deps): Bump js-yaml from 4.1.1 to 4.2.0~~ chore(deps): Bump js-yaml from 4.1.1 to 4.3.0 Jul 2, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/js-yaml-4.2.0 branch from f282065 to a2ac675 Compare July 2, 2026 07:56

[dependabot skip] chore: update generated content

662982e

crazy-max approved these changes Jul 2, 2026

View reviewed changes

crazy-max merged commit d90dd46 into master Jul 2, 2026
41 checks passed

dependabot Bot deleted the dependabot/npm_and_yarn/js-yaml-4.2.0 branch July 2, 2026 08:00

coderabbitai Bot mentioned this pull request Sep 16, 2026

chore: updating actions pgvillage-tools/pgav#1

Merged

Navigation Menu

chore(deps): Bump js-yaml from 4.1.1 to 4.3.0 - #688

chore(deps): Bump js-yaml from 4.1.1 to 4.3.0#688
crazy-max merged 2 commits into
masterfrom
dependabot/npm_and_yarn/js-yaml-4.2.0

dependabot Bot commented on behalf of github Jun 28, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jul 1, 2026

Uh oh!

crazy-max commented Jul 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Jun 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

4.3.0, 3.15.0 - 2026-06-27

Security

[5.2.0] - 2026-06-26

Added

Removed

Fixed

[5.1.0] - 2026-06-23

Added

Changed

[5.0.0] - 2026-06-20

Added

Changed

Uh oh!

dependabot Bot commented on behalf of github Jul 1, 2026

Uh oh!

crazy-max commented Jul 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jun 28, 2026 •

edited

Loading