fix: migrate to js-yaml v5#2908
Conversation
🦋 Changeset detectedLatest commit: 4e09911 The changes in this PR will be included in the next version bump. This PR includes changesets to release 3 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Coverage Report
File Coverage
|
||||||||||||||||||||||||||||||||||||||
|
📦 A new experimental 🧪 version v0.0.0-snapshot.1782145948 of Redocly CLI has been published for testing. Install with NPM: npm install @redocly/cli@0.0.0-snapshot.1782145948 |
| }, | ||
| ], | ||
| "message": "Can't resolve $ref: unexpected end of the stream within a single quoted scalar in "fixtures/invalid-yaml.yaml" (2:1)", | ||
| "message": "Can't resolve $ref: unexpected end of the stream within a single quoted scalar in "fixtures/invalid-yaml.yaml" (1:8)", |
There was a problem hiding this comment.
Please test this in the VSCE.
2639e3f to
8ed7d77
Compare
|
Performance Benchmark fails due to indentation, already notified the OAS description owners. |
DmitryAnansky
added
snapshot
|
📦 A new experimental 🧪 version v0.0.0-snapshot.1782209756 of Redocly CLI has been published for testing. Install with NPM: npm install @redocly/cli@0.0.0-snapshot.1782209756 |
a078710 to
e777d9d
Compare
Performance Benchmark (Lower is Faster)
Warning This PR may introduce a performance regression vs the latest released version:
|
vadyvas
added
snapshot
|
📦 A new experimental 🧪 version v0.0.0-snapshot.1784280563 of Redocly CLI has been published for testing. Install with NPM: npm install @redocly/cli@0.0.0-snapshot.1784280563 |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit e4aecb4. Configure here.
| return str.trim() === '' ? undefined : null; | ||
| } | ||
| if (documents.length > 1) { | ||
| throw new YAMLException('expected a single document in the stream, but found more'); |
There was a problem hiding this comment.
Multi-doc YAML loses error location
Low Severity
When parseYaml sees more than one YAML document, it throws a hand-written YAMLException without a (line:col) suffix. YamlParseError parses location from that suffix, so unresolved-ref and parse diagnostics for multi-document streams get NaN line/column instead of pointing at the extra --- separator.
Reviewed by Cursor Bugbot for commit e4aecb4. Configure here.
There was a problem hiding this comment.
not a regression: js-yaml v4 load() threw the same exception
per the oas/AsyncAPI specs a description is a single document
e4aecb4 to
5f7d2b5
Compare
Co-authored-by: Jacek Łękawa <164185257+JLekawa@users.noreply.github.com>
5f7d2b5 to
4e09911
Compare
5 participants
What/Why/How?
Upgraded
js-yamlfrom v4 to v5. This fixes bundling of strings that look like numbers with underscores (e.g.'12_34'): they are now kept quoted in YAML output instead of being emitted unquoted and read back as numbers by YAML 1.1 parsers.Breaking change: js-yaml v5 parses YAML more strictly. A multi-line flow collection whose closing bracket is indented to (or below) the level of its parent key is now a parse error. For example, this no longer parses and must be reindented:
All other scalar resolution (hex/octal/leading-zero integers, capitalized booleans,
~as null, dates kept as strings) and the handling of empty/comment-only documents are unchanged.Reference
#2906
Alternative
#2907
Testing
Screenshots (optional)
Check yourself
Security
Note
Medium Risk
Touches the central YAML parse/stringify path used for linting, resolving refs, and bundling; stricter parsing can break previously accepted OpenAPI YAML layouts.
Overview
Upgrades
js-yamlfrom4.2.0to5.2.1in@redocly/openapi-coreand adapts the internal YAML wrapper so lint, resolve, and bundle behavior stay aligned with the new API.The wrapper now builds its schema with
CORE_SCHEMA.withTags(instead ofJSON_SCHEMA.extend) and parses vialoadAll, enforcing a single document per stream and preserving empty vs comment-only handling.@types/js-yamlis dropped because v5 ships its own types.Bundle output keeps quoted strings that look like underscore numbers (e.g.
'12_34') instead of stripping quotes and re-emitting them as bare scalars. E2E coverage was extended for that case.Behavior change for users: v5 parses YAML more strictly—multi-line flow collections whose closing
}/]is not indented deeper than the parent key now fail to parse (tests were adjusted for valid indentation). Parse errors are reported at the offending token rather than at end-of-file.Reviewed by Cursor Bugbot for commit 4e09911. Bugbot is set up for automated code reviews on this repo. Configure here.