Skip to content

chore(deps): bump js-yaml and react-native - #158

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-e8c43db830
Open

chore(deps): bump js-yaml and react-native#158
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-e8c43db830

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 11, 2026

Copy link
Copy Markdown
Contributor

Bumps js-yaml to 4.3.1 and updates ancestor dependency react-native. These dependencies need to be updated together.

Updates js-yaml from 4.1.1 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

  • [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

  • Restore umd builds back to es5.

Removed

  • [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.
  • Fix digits in YAML named tag handles.

Security

  • Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

... (truncated)

Commits
  • 86e91b8 4.3.1 released
  • c3cc4b0 Backport quadratic complexity fix for !!omap
  • 33d05b5 4.3.0 released
  • 663bfab Drop demo publish, to not override new v5 one.
  • 1cb8c7b Add v4-legacy tag for publish
  • 02f27af Restore umd builds back to es5
  • 8be84ed Fix es5 compatibility
  • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
  • 6842ef6 doc polish
  • 590dbab 4.2.0 released
  • Additional commits viewable in compare view

Updates react-native from 0.83.2 to 0.87.0

Release notes

Sourced from react-native's releases.

0.87.0-rc.4


Hermes V1 dSYMS:

ReactNativeDependencies dSYMs:

ReactNative Core dSYMs:


You can file issues or pick requests against this release here.


To help you upgrade to this version, you can use the Upgrade Helper ⚛️.


View the whole changelog in the CHANGELOG.md file.

0.87.0-rc.3


Hermes V1 dSYMS:

ReactNativeDependencies dSYMs:

ReactNative Core dSYMs:


You can file issues or pick requests against this release here.


... (truncated)

Changelog

Sourced from react-native's changelog.

v0.87.0

Breaking

  • Appearance: Fix return type of useColorScheme() hook (now ColorSchemeName | null) (ef6463c25d by @​huntie)
  • Appearance: useColorScheme() no longer returns 'unspecified' (this was always the case, but is a breaking type change) (8ac88f481a by @​huntie)
  • CLI: The react-native/core-cli-utils package is no longer published. It remains available in the React Native repo as a reference implementation. (9c3fddf9cd by @​huntie)
  • Hermes: Remove Legacy Hermes from C++ code (f9476256bd by @​cipolleschi)
  • JavaScript API: Deep imports to 'react-native/src/private/...' have been restricted, and are no longer visible to TypeScript. These subpaths still exist, but do not have type coverage. (142b6172a9 by @​huntie)
  • JavaScript API: The NativeDialogManagerAndroid export is removed. (a793d21a7e by @​huntie)
  • JavaScript API: The Touchable root export (undocumented) is removed. If you are extending Touchable as a type, please use ViewProps instead. (6fbf3062f9 by @​huntie)
  • JavaScript API: react-native/rn-get-polyfills is removed — please use react-native/js-polyfills (package) (b6a535afee by @​huntie)
  • Jest: react-native/jest-preset is removed — all projects must now migrate to react-native/jest-preset (package) (9ee21ddd9b by @​huntie)
  • Legacy Architecture: Compile out RuntimeScheduler_Legacy under RCT_REMOVE_LEGACY_ARCH (d205267a5f by @​christophpurrer)
  • LogBox: Set max font scaling in LogBox to avoid layout breaking (4aef2b0126 by @​pchalupa)
  • Node: Require Node.js >= 22.13.0 (a0d39e7a9c by @​huntie)
  • React Native DevTools: Remove support for connecting to the standalone react-devtools package via WebSocket. Use React Native DevTools instead. (f1971caa44 by @​huntie)
  • Renderer: Remove RawPropsKey prefix and suffix (67381e157f by @​javache)
  • Runtime: Remove the SceneTracker module from Libraries/Utilities, stop setting the active scene from AppRegistry.runApplication, and pass the app key as an optional second argument to WrapperComponentProvider (bbb5be9b41 by @​rubennorte)
  • ScrollView: Remove deprecated boolean values support for ScrollView keyboardShouldPersistTaps (5bf3e38db2 by @​zoontek)
  • StatusBar: Remove deprecated StatusBar backgroundColor / translucent / networkActivityIndicatorVisible props and setBackgroundColor / setTranslucent / setNetworkActivityIndicatorVisible methods (6b45e579d6 by @​zoontek)
  • Strict TypeScript API: Remove legacy NativeMethods and NativeMethodsMixin types (b724611aec by @​huntie)
  • Strict TypeScript API: React Native's default JavaScript API is now the Strict TypeScript API. Use customConditions: ["react-native-legacy-deep-imports"] to opt out. (c948b61c05 by @​huntie)

Android specific

iOS specific

Added

  • Animated: Support native driven AnimatedValue interpolation easing (57ce6bc585 by @​zeyap)
  • Animated: Remove useNativeDriver under featureflag animatedForceNativeDriver (9cf30b6e4b by @​zeyap)
  • Animated: Remove useNativeDriver under featureflag animatedForceNativeDriver (cffe14ff57 by @​zeyap)
  • Animated: Add optimizedAnimatedPropUpdates feature flag (ed96b22af2 by Bartlomiej Bloniarz)
  • Assets: Introduce react-native/asset-utils package (relocates Android path utils for libraries/frameworks) (41d52189e2 by @​huntie)
  • JavaScript API: Deprecate 'react-native/Libraries/Core/InitializeCore'. Use 'react-native/setup-env' instead. (bfa679f0ea by @​huntie)
  • Legacy Architecture: Gate shared C++ and Android Java/Kotlin legacy view manager interop behind RCT_REMOVE_LEGACY_COMPONENT_INTEROP (9885fe95ef by @​christophpurrer)

... (truncated)

Commits
  • 4bc2473 Release 0.87.0
  • 01f752d Release 0.87.0-rc.4
  • 24353da fix(iOS): keep prebuilt Headers/ in place on a Debug/Release swap (#57814)
  • 329f864 fix(swiftpm): persist --config-command so the in-build sync keeps using it (#...
  • 4dd4d31 Write the prebuilt module-map flag to OTHER_CPLUSPLUSFLAGS too (#57742)
  • f3e11c2 Fix compat with extensionless scripts/* imports (#57718)
  • d8b52df SPM: allow overriding the autolinking config command (#57662)
  • 0cacb90 SPM: fix raw Flow type annotations in bare-node scripts (#57660)
  • 034245a fix(iOS): stage Hermes headers in prebuild compose job so ReactNativeHeaders ...
  • b67c5cf Release 0.87.0-rc.3
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-native since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [js-yaml](https://github.com/nodeca/js-yaml) to 4.3.1 and updates ancestor dependency [react-native](https://github.com/react/react-native/tree/HEAD/packages/react-native). These dependencies need to be updated together.


Updates `js-yaml` from 4.1.1 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.1...4.3.1)

Updates `react-native` from 0.83.2 to 0.87.0
- [Release notes](https://github.com/react/react-native/releases)
- [Changelog](https://github.com/react/react-native/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react-native/commits/v0.87.0/packages/react-native)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
- dependency-name: react-native
  dependency-version: 0.87.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants