Repository navigation
chore(deps): bump js-yaml from 4.1.1 to 4.3.2 - #530
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.1 to 4.3.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.2/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.1...4.3.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
| "immutable": "^3.8.3", | ||
| "is": "^3.3.0", | ||
| "js-yaml": "^4.1.0", | ||
| "js-yaml": "^4.3.2", |
There was a problem hiding this comment.
🟡 Underscored strings lose their type
js-yaml 4.3 emits numeric-looking strings containing underscores without quotes. The front-matter parser uses js-yaml 3, which converts those scalars into numbers. Page.toText() therefore changes attribute types when generated text is parsed again.
Learn more
HonKit serializes page attributes with the upgraded dumper in Page.toText(). It parses the resulting front matter through parsePageFromString, whose front-matter dependency still uses js-yaml 3. Version 4.3 stopped treating underscores as numeric syntax, so its dumper no longer quotes strings that only look numeric to version 3. The version 3 parser then resolves those unquoted values as numbers.
Example: An attribute value of "1_000" is emitted as value: 1_000. Parsing that page produces numeric 1000 instead of string "1_000".
Recommended fix: Keep serialization compatible with the version 3 front-matter parser, for example by forcing string quotes in Page.toText(). Add a round-trip test covering decimal, float, hexadecimal, and date-like strings containing underscores.
Was this helpful? React with 👍 or 👎 to provide feedback.
Bumps js-yaml from 4.1.1 to 4.3.2.
Changelog
Sourced from js-yaml's changelog.
... (truncated)
Commits
79ca68d4.3.2 releasedd90b661Backport merge limits from v5.4.186e91b84.3.1 releasedc3cc4b0Backport quadratic complexity fix for !!omap33d05b54.3.0 released663bfabDrop demo publish, to not override new v5 one.1cb8c7bAdd v4-legacy tag for publish02f27afRestore umd builds back to es58be84edFix es5 compatibility59423c6ReplacemaxMergeSeqLengthoption withmaxTotalMergeKeys(more robust). Ba...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.