fix(deps): update dependency js-yaml to v5#9919
Conversation
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #9919 +/- ##
==========================================
+ Coverage 79.41% 79.44% +0.02%
==========================================
Files 922 924 +2
Lines 74029 74053 +24
Branches 23830 23836 +6
==========================================
+ Hits 58791 58828 +37
+ Misses 15238 15225 -13
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: de4d3783b0
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
de4d378 to
b3b66b2
Compare
b3b66b2 to
983c44f
Compare
983c44f to
1c7ff61
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 38763ab874
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
Add a shared loadYaml helper (src/util/yamlLoad.ts, mirrored in the web UI) that restores merge-key support (<<:) and returns undefined for empty, whitespace-only, or comment-only documents instead of throwing, matching js-yaml v4 behavior. Use it at every call site that parses user-authored YAML: configs, tests files, vars files, provider configs, assertions, prompts, redteam configs, the server provider config, and uploaded/typed YAML in the web UI and docs-site validator.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 037f72b86d
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
…elpers - Build loadYaml on yaml.loadAll, which returns [] for empty documents, instead of catching and string-matching the empty-input YAMLException; multi-document streams still throw like v4's load. - Drop the web UI's mirrored helper: import the backend loadYaml through the established @promptfoo vite alias instead. - Mirror the helper into the site workspace (site/src/utils/yaml.ts) so the config validator handles comment-only input and stops rebuilding the merge schema on every keystroke. - Mock the loadYaml seam in backend suites instead of automocking js-yaml for load, removing call-shape assertions on the helper's internal js-yaml invocation. - Route scripts/generateCitation.ts through loadYaml for consistency.
mldangelo-oai
left a comment
mldangelo-oai
left a comment
There was a problem hiding this comment.
Approved after dependency GAP analysis, repo updates, local validation, and green CI.
mldangelo-oai
left a comment
mldangelo-oai
left a comment
There was a problem hiding this comment.
Approved at exact head 25b8489 after js-yaml v5 GAP analysis; additive current-main merge; preservation of imports, merge keys, empty documents, binary/timestamp/omap/pairs/set semantics; focused backend/site tests with 100% yamlLoad coverage; full builds/typechecks; clean install and lock idempotence; no-cache merged-YAML eval; resolved review threads; and green CI including the coverage ratchet.
1 participant
This PR contains the following updates:
^4.1.1→^5.0.0^4.1.1→^5.0.0Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Release Notes
nodeca/js-yaml (js-yaml)
v5.0.0Compare Source
Added
JSON_SCHEMAandCORE_SCHEMAwith spec-compliant scalar resolutionrules, and added
YAML11_SCHEMA.realMapTagfor lossless mappings with non-string and complex keys.Object-based mappings now reject complex keys instead of stringifying them.
dump()transformoption for changing the generated AST beforerendering.
dump()optionsseqInlineFirst,flowBracketPadding,flowSkipCommaSpace,flowSkipColonSpace,quoteFlowKeys,quoteStyleandtagBeforeAnchor.test set.
Changed
exports.
CORE_SCHEMA(loader default),JSON_SCHEMA,FAILSAFE_SCHEMA.YAML11_SCHEMA, a combination of all YAML 1.1 tags (YAML 1.1 does notspecify a schema, only "types").
load/dumpdefault behaviour is now specified exactly via schemas:loadusesCORE_SCHEMA, without!!mergeby default.dumpusesYAML11_SCHEMA+CORE_SCHEMAfor the quoting check, toguarantee backward compatibility by default.
!!setis now loaded as a JavaScriptSet.TypeAPI with a tags API. Similar, but more precise andsimpler. See examples for details. Tags can be defined via
defineScalarTag(),defineSequenceTag()anddefineMappingTag(), or as aspread + override of an existing tag.
Schema.extend()toSchema.withTags().markers, block keys, multiline scalars, tag syntax and other things.
load()now throws on empty input instead of returningundefined.js-yaml/browserexport.loadAllsignature with an iterator (still works, but is acandidate for removal).
Removed
safeLoad(),safeLoadAll()andsafeDump()exports.DEFAULT_SCHEMAand the nestedtypesexport.onWarning,legacyandlistener.styles,replacer,noCompatMode,condenseFlow,quotingTypeandforceQuotes. RenamednoArrayIndenttoseqNoIndent.Formatting and representation are now configured through presenter options,
schemas and tag definitions. See migration guide on how to replace.
lib/.Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.
Migration notes (manual changes on top of the Renovate bump)
js-yaml v5 is a major rewrite with several breaking changes that affect this repo. The following was done to keep behavior identical to v4 for users:
Module format — v5 is native ESM with no default export. All
import yaml from 'js-yaml'default imports were converted to namespace/named imports (including the plugin skill scripts andscripts/generateCitation.ts, which crashed at module instantiation on CI).Merge keys — v5's default load schema (
CORE_SCHEMA) no longer resolves YAML merge keys (<<: *anchor), which promptfoo configs, tests files, vars files, provider configs, and assertion files rely on. A sharedloadYamlhelper (src/util/yamlLoad.ts, mirrored atsrc/app/src/utils/yaml.tsfor the web UI) restores merge keys viaCORE_SCHEMA.withTags(mergeTag)and is now used at every call site that parses user-authored YAML — including thegenerate assertions/dataset --writeandredteam generate --writepaths, which would otherwise silently rewrite configs with a literal"<<"key.Empty documents — v5 throws
YAMLExceptionon empty, whitespace-only, or comment-only input where v4 returnedundefined(a plaintrim()guard misses the comment-only case).loadYamlcatches exactly that exception and returnsundefined, so empty config/vars/test files and an empty~/.promptfoo/promptfoo.yamlkeep working.Test mocks — v5's sealed ESM namespace breaks
vi.spyOn(yaml, 'dump')andvi.mockfactories that only provide adefaultexport; affected tests now use spy-able module mocks with real implementations.Verification — full backend suite (789 files), full web UI suite (280 files),
tsc, and a realnpm run local -- evalagainst a config using<<:anchors in both the provider config and afile://tests.yaml(all 4 cases pass with merged vars/assertions). New regression tests:test/util/yamlLoad.test.ts,src/app/src/utils/yaml.test.ts.