From 9b87c1bfa172fcc871b2dc88f5a6f8df13238231 Mon Sep 17 00:00:00 2001 From: DmitryAnansky Date: Mon, 22 Jun 2026 18:47:50 +0300 Subject: [PATCH 1/7] fix: resolve numbers with underscore with js-yaml@v4.2.0 --- .changeset/quiet-pets-grin.md | 5 +++ packages/core/src/__tests__/js-yaml.test.ts | 24 +++++++++++++ packages/core/src/js-yaml/index.ts | 39 ++++++++++++++++++--- 3 files changed, 64 insertions(+), 4 deletions(-) create mode 100644 .changeset/quiet-pets-grin.md diff --git a/.changeset/quiet-pets-grin.md b/.changeset/quiet-pets-grin.md new file mode 100644 index 0000000000..2acf42388a --- /dev/null +++ b/.changeset/quiet-pets-grin.md @@ -0,0 +1,5 @@ +--- +'@redocly/openapi-core': patch +--- + +Fixed bundling of strings that look like numbers with underscores (e.g. `'12_34'`). Since js-yaml `4.2.0` such strings were emitted unquoted and could be read back as numbers by YAML 1.1 parsers; they are now kept quoted in the output. diff --git a/packages/core/src/__tests__/js-yaml.test.ts b/packages/core/src/__tests__/js-yaml.test.ts index 71925ea8ea..811e5d360d 100644 --- a/packages/core/src/__tests__/js-yaml.test.ts +++ b/packages/core/src/__tests__/js-yaml.test.ts @@ -66,6 +66,30 @@ describe('js-yaml', () => { expect(parseYaml(stringifyYaml(jsObject))).toEqual(jsObject); }); + it('should keep quotes around strings that look like numbers with underscores', () => { + // Regression test for: js-yaml >=4.2.0 + // no longer quotes such strings on its own, so they must stay quoted here to avoid being + // read back as numbers by YAML 1.1 parsers. Actual numbers must remain unquoted. + expect( + stringifyYaml({ + underscoreNumber: 1234, + underscoreInt: '12_34', + underscoreThousands: '1_000', + underscoreHex: '0x1_2', + underscoreFloat: '1_2.3', + plain: 'hello', + }) + ).toMatchInlineSnapshot(` + "underscoreNumber: 1234 + underscoreInt: '12_34' + underscoreThousands: '1_000' + underscoreHex: '0x1_2' + underscoreFloat: '1_2.3' + plain: hello + " + `); + }); + it('should throw an error for unsupported types', () => { expect(() => stringifyYaml({ foo: () => {} })).toThrow( 'unacceptable kind of an object to dump [object Function]' diff --git a/packages/core/src/js-yaml/index.ts b/packages/core/src/js-yaml/index.ts index 1a0b31b998..2cc0b2f34c 100644 --- a/packages/core/src/js-yaml/index.ts +++ b/packages/core/src/js-yaml/index.ts @@ -1,14 +1,45 @@ +import jsYaml, { + DEFAULT_SCHEMA, + JSON_SCHEMA, + Type, + load, + dump, + type LoadOptions, + type DumpOptions, +} from 'js-yaml'; + +// `types` (the built-in tag instances) is not declared in @types/js-yaml. // TODO: add a type for "types" https://github.com/DefinitelyTyped/DefinitelyTyped/blob/master/types/js-yaml/index.d.ts -// eslint-disable-next-line @typescript-eslint/ban-ts-comment -// @ts-ignore -import { JSON_SCHEMA, types, load, dump, type LoadOptions, type DumpOptions } from 'js-yaml'; +const types = (jsYaml as unknown as { types: Record }).types; const DEFAULT_SCHEMA_WITHOUT_TIMESTAMP = JSON_SCHEMA.extend({ implicit: [types.merge], explicit: [types.binary, types.omap, types.pairs, types.set], }); +// js-yaml >=4.2.0 stopped resolving numbers with underscores (e.g. `12_34`, `1_000`, `0x1_2`, +// `1_2.3`) as numeric scalars (https://github.com/nodeca/js-yaml/issues/627). As a side effect +// the dumper no longer quotes strings that look like such numbers, so YAML 1.1 parsers read +// them back as numbers, losing type information. +// This implicit type matches those underscore-number-like strings so the dumper quotes them; it +// is only used to influence quoting and never constructs or represents a value. +const underscoreNumberLike = new Type('tag:redocly.com,2026:underscore-number', { + kind: 'scalar', + resolve: (data: unknown): boolean => { + if (typeof data !== 'string' || !data.includes('_')) return false; + const stripped = data.replace(/_/g, ''); + return types.int.resolve(stripped) || types.float.resolve(stripped); + }, + predicate: (): boolean => false, +}); + +// Extend js-yaml's default dump schema (the one `dump` uses when no schema is given) so the +// only added behavior is quoting underscore-number-like strings; everything else, including +// quoting of date-like strings via the timestamp type, is preserved. +const DUMP_SCHEMA = DEFAULT_SCHEMA.extend({ implicit: [underscoreNumberLike] }); + export const parseYaml = (str: string, opts?: LoadOptions): unknown => load(str, { schema: DEFAULT_SCHEMA_WITHOUT_TIMESTAMP, ...opts }); -export const stringifyYaml = (obj: any, opts?: DumpOptions): string => dump(obj, opts); +export const stringifyYaml = (obj: any, opts?: DumpOptions): string => + dump(obj, { schema: DUMP_SCHEMA, ...opts }); From aec4c437c099b35935e5d7280624ec5462ad3a73 Mon Sep 17 00:00:00 2001 From: DmitryAnansky Date: Mon, 22 Jun 2026 19:06:52 +0300 Subject: [PATCH 2/7] fix: migrate to js-yaml v5 --- .changeset/lazy-trees-cheer.md | 14 ++++ package-lock.json | 10 +-- packages/core/package.json | 3 +- packages/core/src/js-yaml/index.ts | 65 ++++++++----------- .../__tests__/no-unresolved-refs.test.ts | 8 +-- .../no-invalid-media-type-examples.test.ts | 2 +- 6 files changed, 48 insertions(+), 54 deletions(-) create mode 100644 .changeset/lazy-trees-cheer.md diff --git a/.changeset/lazy-trees-cheer.md b/.changeset/lazy-trees-cheer.md new file mode 100644 index 0000000000..533d3e33a2 --- /dev/null +++ b/.changeset/lazy-trees-cheer.md @@ -0,0 +1,14 @@ +--- +'@redocly/openapi-core': patch +'@redocly/cli': patch +--- + +Upgraded `js-yaml` from v4 to v5. This fixes bundling of strings that look like numbers with underscores (e.g. `'12_34'`): they are now kept quoted in YAML output instead of being emitted unquoted and read back as numbers by YAML 1.1 parsers. + +**Breaking change:** js-yaml v5 parses YAML more strictly. A multi-line flow collection whose closing bracket is indented to (or below) the level of its parent key is now a parse error. For example, this no longer parses and must be reindented: + +```yaml +example: { 'a': 'test' } # <- move the closing brace to the right of `example:` +``` + +All other scalar resolution (hex/octal/leading-zero integers, capitalized booleans, `~` as null, dates kept as strings) and the handling of empty/comment-only documents are unchanged. diff --git a/package-lock.json b/package-lock.json index 07c4329a5a..77fbe4dae8 100644 --- a/package-lock.json +++ b/package-lock.json @@ -3047,13 +3047,6 @@ "integrity": "sha512-qC4bCqYGy1y/NP7dDVr7KJarn+PbX1nSpwA7JXdu0HxT3QYjO8MJ+cntENtHFVy2dRAyBV23OZ6MxsW1AM1L8g==", "dev": true }, - "node_modules/@types/js-yaml": { - "version": "4.0.9", - "resolved": "https://registry.npmjs.org/@types/js-yaml/-/js-yaml-4.0.9.tgz", - "integrity": "sha512-k4MGaQl5TGo/iipqb2UDG2UwjXziSWkh0uysQelTlJpX1qGlpUZYm8PnO4DxG1qBomtJUdYJ6qR6xdIah10JLg==", - "dev": true, - "license": "MIT" - }, "node_modules/@types/json-pointer": { "version": "1.0.34", "resolved": "https://registry.npmjs.org/@types/json-pointer/-/json-pointer-1.0.34.tgz", @@ -8922,14 +8915,13 @@ "colorette": "^1.2.0", "graphql": "^16.14.1", "js-levenshtein": "^1.1.6", - "js-yaml": "^4.2.0", + "js-yaml": "^5.0.0", "picomatch": "^4.0.4", "pluralize": "^8.0.0", "yaml-ast-parser": "0.0.43" }, "devDependencies": { "@types/js-levenshtein": "^1.1.0", - "@types/js-yaml": "^4.0.3", "@types/picomatch": "^4.0.2", "@types/pluralize": "^0.0.29", "json-schema-to-ts": "^3.1.0", diff --git a/packages/core/package.json b/packages/core/package.json index c8c643b7f8..52f9995c06 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -59,14 +59,13 @@ "colorette": "^1.2.0", "graphql": "^16.14.1", "js-levenshtein": "^1.1.6", - "js-yaml": "^4.2.0", + "js-yaml": "^5.0.0", "picomatch": "^4.0.4", "pluralize": "^8.0.0", "yaml-ast-parser": "0.0.43" }, "devDependencies": { "@types/js-levenshtein": "^1.1.0", - "@types/js-yaml": "^4.0.3", "@types/picomatch": "^4.0.2", "@types/pluralize": "^0.0.29", "json-schema-to-ts": "^3.1.0", diff --git a/packages/core/src/js-yaml/index.ts b/packages/core/src/js-yaml/index.ts index 2cc0b2f34c..ccd53ac367 100644 --- a/packages/core/src/js-yaml/index.ts +++ b/packages/core/src/js-yaml/index.ts @@ -1,45 +1,34 @@ -import jsYaml, { - DEFAULT_SCHEMA, - JSON_SCHEMA, - Type, - load, +import { + CORE_SCHEMA, + mergeTag, + binaryTag, + omapTag, + pairsTag, + setTag, + loadAll, dump, + YAMLException, type LoadOptions, type DumpOptions, } from 'js-yaml'; -// `types` (the built-in tag instances) is not declared in @types/js-yaml. -// TODO: add a type for "types" https://github.com/DefinitelyTyped/DefinitelyTyped/blob/master/types/js-yaml/index.d.ts -const types = (jsYaml as unknown as { types: Record }).types; +const DEFAULT_SCHEMA_WITHOUT_TIMESTAMP = CORE_SCHEMA.withTags( + mergeTag, + binaryTag, + omapTag, + pairsTag, + setTag +); -const DEFAULT_SCHEMA_WITHOUT_TIMESTAMP = JSON_SCHEMA.extend({ - implicit: [types.merge], - explicit: [types.binary, types.omap, types.pairs, types.set], -}); +export const parseYaml = (str: string, opts?: LoadOptions): unknown => { + const documents = loadAll(str, { schema: DEFAULT_SCHEMA_WITHOUT_TIMESTAMP, ...opts }); + if (documents.length === 0) { + return str.trim() === '' ? undefined : null; + } + if (documents.length > 1) { + throw new YAMLException('expected a single document in the stream, but found more'); + } + return documents[0]; +}; -// js-yaml >=4.2.0 stopped resolving numbers with underscores (e.g. `12_34`, `1_000`, `0x1_2`, -// `1_2.3`) as numeric scalars (https://github.com/nodeca/js-yaml/issues/627). As a side effect -// the dumper no longer quotes strings that look like such numbers, so YAML 1.1 parsers read -// them back as numbers, losing type information. -// This implicit type matches those underscore-number-like strings so the dumper quotes them; it -// is only used to influence quoting and never constructs or represents a value. -const underscoreNumberLike = new Type('tag:redocly.com,2026:underscore-number', { - kind: 'scalar', - resolve: (data: unknown): boolean => { - if (typeof data !== 'string' || !data.includes('_')) return false; - const stripped = data.replace(/_/g, ''); - return types.int.resolve(stripped) || types.float.resolve(stripped); - }, - predicate: (): boolean => false, -}); - -// Extend js-yaml's default dump schema (the one `dump` uses when no schema is given) so the -// only added behavior is quoting underscore-number-like strings; everything else, including -// quoting of date-like strings via the timestamp type, is preserved. -const DUMP_SCHEMA = DEFAULT_SCHEMA.extend({ implicit: [underscoreNumberLike] }); - -export const parseYaml = (str: string, opts?: LoadOptions): unknown => - load(str, { schema: DEFAULT_SCHEMA_WITHOUT_TIMESTAMP, ...opts }); - -export const stringifyYaml = (obj: any, opts?: DumpOptions): string => - dump(obj, { schema: DUMP_SCHEMA, ...opts }); +export const stringifyYaml = (obj: any, opts?: DumpOptions): string => dump(obj, opts); diff --git a/packages/core/src/rules/common/__tests__/no-unresolved-refs.test.ts b/packages/core/src/rules/common/__tests__/no-unresolved-refs.test.ts index a0f79005d4..a00c8ff61a 100644 --- a/packages/core/src/rules/common/__tests__/no-unresolved-refs.test.ts +++ b/packages/core/src/rules/common/__tests__/no-unresolved-refs.test.ts @@ -85,12 +85,12 @@ describe('oas3 boolean-parameter-prefixes', () => { "reportOnKey": false, "source": "fixtures/invalid-yaml.yaml", "start": { - "col": 1, - "line": 2, + "col": 8, + "line": 1, }, }, ], - "message": "Failed to parse: unexpected end of the stream within a single quoted scalar in "fixtures/invalid-yaml.yaml" (2:1)", + "message": "Failed to parse: unexpected end of the stream within a single quoted scalar in "fixtures/invalid-yaml.yaml" (1:8)", "ruleId": "no-unresolved-refs", "severity": "error", "suggest": [], @@ -103,7 +103,7 @@ describe('oas3 boolean-parameter-prefixes', () => { "source": "foobar.yaml", }, ], - "message": "Can't resolve $ref: unexpected end of the stream within a single quoted scalar in "fixtures/invalid-yaml.yaml" (2:1)", + "message": "Can't resolve $ref: unexpected end of the stream within a single quoted scalar in "fixtures/invalid-yaml.yaml" (1:8)", "reference": "https://redocly.com/docs/cli/rules/oas/no-unresolved-refs", "ruleId": "no-unresolved-refs", "severity": "error", diff --git a/packages/core/src/rules/oas3/__tests__/no-invalid-media-type-examples.test.ts b/packages/core/src/rules/oas3/__tests__/no-invalid-media-type-examples.test.ts index 4bc4677c53..f1959b3d89 100644 --- a/packages/core/src/rules/oas3/__tests__/no-invalid-media-type-examples.test.ts +++ b/packages/core/src/rules/oas3/__tests__/no-invalid-media-type-examples.test.ts @@ -635,7 +635,7 @@ describe('no-invalid-media-type-examples', () => { example: { "a": "test", "b": "test" - } + } schema: $ref: '#/components/schemas/C' From ee51fffac852d5385e70428e0c9b73682fbab2fb Mon Sep 17 00:00:00 2001 From: DmitryAnansky Date: Mon, 22 Jun 2026 19:12:11 +0300 Subject: [PATCH 3/7] chore: remove changelog --- .changeset/quiet-pets-grin.md | 5 ----- 1 file changed, 5 deletions(-) delete mode 100644 .changeset/quiet-pets-grin.md diff --git a/.changeset/quiet-pets-grin.md b/.changeset/quiet-pets-grin.md deleted file mode 100644 index 2acf42388a..0000000000 --- a/.changeset/quiet-pets-grin.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@redocly/openapi-core': patch ---- - -Fixed bundling of strings that look like numbers with underscores (e.g. `'12_34'`). Since js-yaml `4.2.0` such strings were emitted unquoted and could be read back as numbers by YAML 1.1 parsers; they are now kept quoted in the output. From e7f80d95c4afae6465b60a5b769dbfc6419faee1 Mon Sep 17 00:00:00 2001 From: DmitryAnansky Date: Tue, 23 Jun 2026 12:25:49 +0300 Subject: [PATCH 4/7] chore: update tests and js-yaml --- package-lock.json | 2 +- packages/core/package.json | 2 +- packages/core/src/__tests__/js-yaml.test.ts | 24 ------------------- tests/e2e/bundle/primitive-types/openapi.yaml | 2 ++ tests/e2e/bundle/primitive-types/snapshot.txt | 2 ++ 5 files changed, 6 insertions(+), 26 deletions(-) diff --git a/package-lock.json b/package-lock.json index 77fbe4dae8..7919715ad7 100644 --- a/package-lock.json +++ b/package-lock.json @@ -8915,7 +8915,7 @@ "colorette": "^1.2.0", "graphql": "^16.14.1", "js-levenshtein": "^1.1.6", - "js-yaml": "^5.0.0", + "js-yaml": "^5.1.0", "picomatch": "^4.0.4", "pluralize": "^8.0.0", "yaml-ast-parser": "0.0.43" diff --git a/packages/core/package.json b/packages/core/package.json index 52f9995c06..e73f71e904 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -59,7 +59,7 @@ "colorette": "^1.2.0", "graphql": "^16.14.1", "js-levenshtein": "^1.1.6", - "js-yaml": "^5.0.0", + "js-yaml": "^5.1.0", "picomatch": "^4.0.4", "pluralize": "^8.0.0", "yaml-ast-parser": "0.0.43" diff --git a/packages/core/src/__tests__/js-yaml.test.ts b/packages/core/src/__tests__/js-yaml.test.ts index 811e5d360d..71925ea8ea 100644 --- a/packages/core/src/__tests__/js-yaml.test.ts +++ b/packages/core/src/__tests__/js-yaml.test.ts @@ -66,30 +66,6 @@ describe('js-yaml', () => { expect(parseYaml(stringifyYaml(jsObject))).toEqual(jsObject); }); - it('should keep quotes around strings that look like numbers with underscores', () => { - // Regression test for: js-yaml >=4.2.0 - // no longer quotes such strings on its own, so they must stay quoted here to avoid being - // read back as numbers by YAML 1.1 parsers. Actual numbers must remain unquoted. - expect( - stringifyYaml({ - underscoreNumber: 1234, - underscoreInt: '12_34', - underscoreThousands: '1_000', - underscoreHex: '0x1_2', - underscoreFloat: '1_2.3', - plain: 'hello', - }) - ).toMatchInlineSnapshot(` - "underscoreNumber: 1234 - underscoreInt: '12_34' - underscoreThousands: '1_000' - underscoreHex: '0x1_2' - underscoreFloat: '1_2.3' - plain: hello - " - `); - }); - it('should throw an error for unsupported types', () => { expect(() => stringifyYaml({ foo: () => {} })).toThrow( 'unacceptable kind of an object to dump [object Function]' diff --git a/tests/e2e/bundle/primitive-types/openapi.yaml b/tests/e2e/bundle/primitive-types/openapi.yaml index 1e7cb6bf50..92d6cf1de8 100644 --- a/tests/e2e/bundle/primitive-types/openapi.yaml +++ b/tests/e2e/bundle/primitive-types/openapi.yaml @@ -37,3 +37,5 @@ paths: object: key1: 1 key2: 2 + underscoreNumberTransformedToString: 12_34 + underscoreNumberString: '12_34' diff --git a/tests/e2e/bundle/primitive-types/snapshot.txt b/tests/e2e/bundle/primitive-types/snapshot.txt index b1b5f89da5..3b97134cf7 100644 --- a/tests/e2e/bundle/primitive-types/snapshot.txt +++ b/tests/e2e/bundle/primitive-types/snapshot.txt @@ -35,6 +35,8 @@ paths: object: key1: 1 key2: 2 + underscoreNumberTransformedToString: 12_34 // yaml 1.2.0+ + underscoreNumberString: '12_34' components: {} bundling openapi.yaml using configuration for api 'main'... From 3cfa9e4c2fdaa1e1ddd2f7e1ca4f2f4aa9c4c7d3 Mon Sep 17 00:00:00 2001 From: DmitryAnansky Date: Tue, 23 Jun 2026 12:32:11 +0300 Subject: [PATCH 5/7] chore: update snapshot --- tests/e2e/bundle/primitive-types/snapshot.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/e2e/bundle/primitive-types/snapshot.txt b/tests/e2e/bundle/primitive-types/snapshot.txt index 3b97134cf7..a49ba63548 100644 --- a/tests/e2e/bundle/primitive-types/snapshot.txt +++ b/tests/e2e/bundle/primitive-types/snapshot.txt @@ -35,7 +35,7 @@ paths: object: key1: 1 key2: 2 - underscoreNumberTransformedToString: 12_34 // yaml 1.2.0+ + underscoreNumberTransformedToString: '12_34' underscoreNumberString: '12_34' components: {} From a6303221026ffafc2a1bae8e0f1f416d9c4b7da9 Mon Sep 17 00:00:00 2001 From: Vadym Vasylyshyn <51933329+vadyvas@users.noreply.github.com> Date: Fri, 17 Jul 2026 12:16:25 +0300 Subject: [PATCH 6/7] chore: update to v5.2.1 --- .changeset/lazy-trees-cheer.md | 12 +++------- package-lock.json | 25 ++++++++++++++++++++- packages/core/package.json | 2 +- packages/core/src/__tests__/js-yaml.test.ts | 12 ++++++++++ 4 files changed, 40 insertions(+), 11 deletions(-) diff --git a/.changeset/lazy-trees-cheer.md b/.changeset/lazy-trees-cheer.md index 533d3e33a2..5bd888fbab 100644 --- a/.changeset/lazy-trees-cheer.md +++ b/.changeset/lazy-trees-cheer.md @@ -3,12 +3,6 @@ '@redocly/cli': patch --- -Upgraded `js-yaml` from v4 to v5. This fixes bundling of strings that look like numbers with underscores (e.g. `'12_34'`): they are now kept quoted in YAML output instead of being emitted unquoted and read back as numbers by YAML 1.1 parsers. - -**Breaking change:** js-yaml v5 parses YAML more strictly. A multi-line flow collection whose closing bracket is indented to (or below) the level of its parent key is now a parse error. For example, this no longer parses and must be reindented: - -```yaml -example: { 'a': 'test' } # <- move the closing brace to the right of `example:` -``` - -All other scalar resolution (hex/octal/leading-zero integers, capitalized booleans, `~` as null, dates kept as strings) and the handling of empty/comment-only documents are unchanged. +Updated js-yaml from `4.2.0` to `5.2.1`. +Fixed bundling of strings that look like numbers with underscores (e.g. `'12_34'`) so they stay quoted in the output. +**Note**: YAML parsing is now stricter: a multi-line flow collection whose closing bracket is not indented deeper than its parent key is now a parse error, and parse errors are reported at the offending token instead of the end of the document. diff --git a/package-lock.json b/package-lock.json index 7919715ad7..9ddbcbbfa1 100644 --- a/package-lock.json +++ b/package-lock.json @@ -4868,6 +4868,7 @@ "version": "4.2.0", "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "dev": true, "funding": [ { "type": "github", @@ -8915,7 +8916,7 @@ "colorette": "^1.2.0", "graphql": "^16.14.1", "js-levenshtein": "^1.1.6", - "js-yaml": "^5.1.0", + "js-yaml": "^5.2.1", "picomatch": "^4.0.4", "pluralize": "^8.0.0", "yaml-ast-parser": "0.0.43" @@ -8949,6 +8950,28 @@ "url": "https://github.com/sponsors/epoberezkin" } }, + "packages/core/node_modules/js-yaml": { + "version": "5.2.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.1.tgz", + "integrity": "sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], + "license": "MIT", + "dependencies": { + "argparse": "^2.0.1" + }, + "bin": { + "js-yaml": "bin/js-yaml.mjs" + } + }, "packages/core/node_modules/picomatch": { "version": "4.0.4", "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz", diff --git a/packages/core/package.json b/packages/core/package.json index e73f71e904..d13cd05116 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -59,7 +59,7 @@ "colorette": "^1.2.0", "graphql": "^16.14.1", "js-levenshtein": "^1.1.6", - "js-yaml": "^5.1.0", + "js-yaml": "^5.2.1", "picomatch": "^4.0.4", "pluralize": "^8.0.0", "yaml-ast-parser": "0.0.43" diff --git a/packages/core/src/__tests__/js-yaml.test.ts b/packages/core/src/__tests__/js-yaml.test.ts index 71925ea8ea..93770fe6eb 100644 --- a/packages/core/src/__tests__/js-yaml.test.ts +++ b/packages/core/src/__tests__/js-yaml.test.ts @@ -71,4 +71,16 @@ describe('js-yaml', () => { 'unacceptable kind of an object to dump [object Function]' ); }); + + it('should return a nullish value instead of throwing for empty or comment-only input', () => { + expect(parseYaml('')).toBeUndefined(); + expect(parseYaml(' \n ')).toBeUndefined(); + expect(parseYaml('# just a comment\n')).toBeNull(); + }); + + it('throws when the stream contains more than one document', () => { + expect(() => parseYaml('a: 1\n---\nb: 2\n')).toThrow( + 'expected a single document in the stream, but found more' + ); + }); }); From 4e09911a56af0bae913a4d53155fa3c3d58e40f4 Mon Sep 17 00:00:00 2001 From: Vadym Vasylyshyn <51933329+vadyvas@users.noreply.github.com> Date: Mon, 20 Jul 2026 17:11:51 +0300 Subject: [PATCH 7/7] chore: update changeset MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Jacek Łękawa <164185257+JLekawa@users.noreply.github.com> --- .changeset/lazy-trees-cheer.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.changeset/lazy-trees-cheer.md b/.changeset/lazy-trees-cheer.md index 5bd888fbab..f7f1f08cd2 100644 --- a/.changeset/lazy-trees-cheer.md +++ b/.changeset/lazy-trees-cheer.md @@ -4,5 +4,8 @@ --- Updated js-yaml from `4.2.0` to `5.2.1`. -Fixed bundling of strings that look like numbers with underscores (e.g. `'12_34'`) so they stay quoted in the output. -**Note**: YAML parsing is now stricter: a multi-line flow collection whose closing bracket is not indented deeper than its parent key is now a parse error, and parse errors are reported at the offending token instead of the end of the document. +Fixed an issue where strings that look like numbers with underscores (for example `'12_34'`) had quotation marks removed by the `bundle` command. +These strings stay quoted in the output. + +**Note**: YAML parsing is stricter: a multi-line flow collection whose closing bracket is not indented deeper than its parent key is now a parse error. +Parse errors are reported at the offending token instead of the end of the document.