js-yaml breaking changes

5.0.0

60 breaking changes, first published June 20, 2026.

• Removed
  Deep imports of internal files under lib/ no longer work; use the public exports instead. github.com
• Removed DEFAULT_SCHEMA
  DEFAULT_SCHEMA is no longer exported; use one of the remaining schemas such as CORE_SCHEMA. npmjs.com
• Removed default.CORE_SCHEMA
  CORE_SCHEMA was removed in js-yaml 5.0.0 npmjs.com
• Removed default.dump
  dump was removed in js-yaml 5.0.0 npmjs.com
• Removed default.DumpOptions
  DumpOptions was removed in js-yaml 5.0.0 npmjs.com
• Removed default.FAILSAFE_SCHEMA
  FAILSAFE_SCHEMA was removed in js-yaml 5.0.0 npmjs.com
• Removed default.JSON_SCHEMA
  JSON_SCHEMA was removed in js-yaml 5.0.0 npmjs.com
• Removed default.load
  load was removed in js-yaml 5.0.0 npmjs.com
• Removed default.loadAll
  loadAll was removed in js-yaml 5.0.0 npmjs.com
• Removed default.LoadOptions
  LoadOptions was removed in js-yaml 5.0.0 npmjs.com

And 50 more in this version.

4.3.2

2 breaking changes, first published August 26, 2026.

• Behavior changed
  Merge sequences larger than 100 entries are now rejected. Documents that relied on bigger merge sequences must be split or reduced. github.com
• Behavior changed maxTotalMergeKeys
  Empty mappings inside merge sequences now count toward the maxTotalMergeKeys limit, so some documents that previously loaded may now be rejected. github.com

4.3.0

1 breaking change, first published June 26, 2026.

• Removed maxMergeSeqLength
  The maxMergeSeqLength loader option was removed and replaced by maxTotalMergeKeys, which limits the total number of keys processed by YAML merge per load call. Switch uses of maxMergeSeqLength to maxTotalMergeKeys. github.com

4.2.0

4 breaking changes, first published May 31, 2026.

• Behavior changed
  Documents with top-level block scalars lacking content indentation now fail to parse. Fix the input YAML to add the indentation. github.com
• Behavior changed
  YAML values containing underscores, such as 1_000, are no longer resolved as numbers. Code that relied on them being numeric must convert them explicitly. github.com
• Behavior changed maxDepth
  Loading YAML nested deeper than the default limit of 100 now throws a dedicated error. Raise maxDepth if deeper documents must load. github.com
• Behavior changed maxMergeSeqLength
  Merge sequences longer than the default limit of 20 are now rejected. Raise maxMergeSeqLength if longer merges must load. github.com

Check your code

These are the changes. To see which of them reach your code, scan a public repository, or have your coding agent call check_code with your manifest or lockfile over MCP. The API reads every change in every version, not only the newest. On Team and up, a fix pull request opens for the changes that reach a connected repository. Nothing merges or deploys.