Skip to content

build(deps): bump js-yaml and @redocly/openapi-core in /extralit-frontend - #306

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/extralit-frontend/multi-a147167944
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/extralit-frontend/multi-a147167944

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 17, 2026

Copy link
Copy Markdown
Contributor

Bumps js-yaml and @redocly/openapi-core. These dependencies needed to be updated together.
Updates js-yaml from 4.2.0 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

  • [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

  • Restore umd builds back to es5.

Removed

  • [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.
Commits
  • 79ca68d 4.3.2 released
  • d90b661 Backport merge limits from v5.4.1
  • 86e91b8 4.3.1 released
  • c3cc4b0 Backport quadratic complexity fix for !!omap
  • 33d05b5 4.3.0 released
  • 663bfab Drop demo publish, to not override new v5 one.
  • 1cb8c7b Add v4-legacy tag for publish
  • 02f27af Restore umd builds back to es5
  • 8be84ed Fix es5 compatibility
  • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
  • Additional commits viewable in compare view

Updates js-yaml from 3.14.2 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

  • [backport] Hard-limit merge sequence size to 100.

Security

  • [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

4.3.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

  • [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

  • Restore umd builds back to es5.

Removed

  • [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.
Commits
  • 79ca68d 4.3.2 released
  • d90b661 Backport merge limits from v5.4.1
  • 86e91b8 4.3.1 released
  • c3cc4b0 Backport quadratic complexity fix for !!omap
  • 33d05b5 4.3.0 released
  • 663bfab Drop demo publish, to not override new v5 one.
  • 1cb8c7b Add v4-legacy tag for publish
  • 02f27af Restore umd builds back to es5
  • 8be84ed Fix es5 compatibility
  • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
  • Additional commits viewable in compare view

Updates @redocly/openapi-core from 1.34.17 to 1.34.21

Release notes

Sourced from @​redocly/openapi-core's releases.

@​redocly/openapi-core@​1.34.21

No release notes provided.

Changelog

Sourced from @​redocly/openapi-core's changelog.

1.34.21 (2026-10-13)

Patch Changes

  • Updated handlebars to 4.7.10, chokidar to 4.0.3, and undici to 6.29.0.
  • Updated @​redocly/respect-core to v1.34.21.

1.34.20 (2026-09-09)

Patch Changes

  • Updated js-yaml to 4.3.2, undici to 6.28.0, redoc to 2.5.3, styled-components to 6.5.3, and the OpenTelemetry packages to 2.11.0.
  • Updated @​redocly/openapi-core to v1.34.20.

1.34.19 (2026-08-10)

Patch Changes

  • Updated js-yaml to the 4.3.1 version to resolve a denial-of-service vulnerability in YAML parsing. Applied NPM audit fix to prevent potential security vulnerabilities.
  • Updated @​redocly/respect-core to v1.34.19.

1.34.18 (2026-07-29)

Patch Changes

  • Updated js-yaml to the 4.3.0 version to resolve a denial-of-service vulnerability in YAML parsing. Applied NPM audit fix to prevent potential security vulnerabilities.
  • Updated @​redocly/openapi-core to v1.34.18.
Commits
  • 013e319 chore: 🔖 release new versions (#3245)
  • d0c77c7 chore: pin hyperfine 1.20.0 for cli v1 (#3246)
  • 3c1efb5 chore(deps): update handlebars, undici, and chokidar in v1 (#3240)
  • b563864 chore: 🔖 release new versions (#3099)
  • c39fcd8 fix: update js-yaml to 4.3.2 and refresh vulnerable dependencies (#3098)
  • 11f4afd chore: 🔖 release new versions (#3033)
  • 84b3c40 fix: update js-yaml to 4.3.1 and refresh vulnerable transitive dependencies (...
  • 4465cbd chore: 🔖 release new versions (#2981)
  • 32c24b3 chore: pin npm to v11 in the release workflow (#2980)
  • 14959f4 fix: update js-yaml to 4.3.0 and refresh vulnerable transitive dependencies (...
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [js-yaml](https://github.com/nodeca/js-yaml) and [@redocly/openapi-core](https://github.com/Redocly/redocly-cli). These dependencies needed to be updated together.

Updates `js-yaml` from 4.2.0 to 4.3.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.2.0...4.3.2)

Updates `js-yaml` from 3.14.2 to 3.15.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.2.0...4.3.2)

Updates `@redocly/openapi-core` from 1.34.17 to 1.34.21
- [Release notes](https://github.com/Redocly/redocly-cli/releases)
- [Changelog](https://github.com/Redocly/redocly-cli/blob/@redocly/[email protected]/docs/changelog.md)
- [Commits](https://github.com/Redocly/redocly-cli/compare/@redocly/[email protected]...@redocly/[email protected])

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.2
  dependency-type: indirect
- dependency-name: js-yaml
  dependency-version: 3.15.2
  dependency-type: indirect
- dependency-name: "@redocly/openapi-core"
  dependency-version: 1.34.21
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot
dependabot Bot requested a review from a team as a code owner October 17, 2026 19:14
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 17, 2026
@vercel

vercel Bot commented Oct 17, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
extralit-frontend Ready Ready Preview Oct 17, 2026 7:16pm UTC

@coderabbitai

coderabbitai Bot commented Oct 17, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 9776fda5-7150-43b6-ba99-e4d96a3d5187

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

This branch was successfully deployed

1 active deployment
Preview — 77fa50ad Deployed Oct 17, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants