fix: migrate to js-yaml v5#2908
Conversation
🦋 Changeset detectedLatest commit: 5f7d2b5 The changes in this PR will be included in the next version bump. This PR includes changesets to release 3 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Coverage Report
File Coverage
|
||||||||||||||||||||||||||||||||||||||
|
📦 A new experimental 🧪 version v0.0.0-snapshot.1782145948 of Redocly CLI has been published for testing. Install with NPM: npm install @redocly/cli@0.0.0-snapshot.1782145948 |
| }, | ||
| ], | ||
| "message": "Can't resolve $ref: unexpected end of the stream within a single quoted scalar in "fixtures/invalid-yaml.yaml" (2:1)", | ||
| "message": "Can't resolve $ref: unexpected end of the stream within a single quoted scalar in "fixtures/invalid-yaml.yaml" (1:8)", |
There was a problem hiding this comment.
Please test this in the VSCE.
2639e3f to
8ed7d77
Compare
|
Performance Benchmark fails due to indentation, already notified the OAS description owners. |
DmitryAnansky
added
snapshot
|
📦 A new experimental 🧪 version v0.0.0-snapshot.1782209756 of Redocly CLI has been published for testing. Install with NPM: npm install @redocly/cli@0.0.0-snapshot.1782209756 |
a078710 to
e777d9d
Compare
Performance Benchmark (Lower is Faster)
Warning This PR may introduce a performance regression vs the latest released version:
|
vadyvas
added
snapshot
|
📦 A new experimental 🧪 version v0.0.0-snapshot.1784280563 of Redocly CLI has been published for testing. Install with NPM: npm install @redocly/cli@0.0.0-snapshot.1784280563 |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit e4aecb4. Configure here.
| return str.trim() === '' ? undefined : null; | ||
| } | ||
| if (documents.length > 1) { | ||
| throw new YAMLException('expected a single document in the stream, but found more'); |
There was a problem hiding this comment.
Multi-doc YAML loses error location
Low Severity
When parseYaml sees more than one YAML document, it throws a hand-written YAMLException without a (line:col) suffix. YamlParseError parses location from that suffix, so unresolved-ref and parse diagnostics for multi-document streams get NaN line/column instead of pointing at the extra --- separator.
Reviewed by Cursor Bugbot for commit e4aecb4. Configure here.
There was a problem hiding this comment.
not a regression: js-yaml v4 load() threw the same exception
per the oas/AsyncAPI specs a description is a single document
Co-authored-by: Jacek Łękawa <164185257+JLekawa@users.noreply.github.com>
e4aecb4 to
5f7d2b5
Compare
5 participants
What/Why/How?
Upgraded
js-yamlfrom v4 to v5. This fixes bundling of strings that look like numbers with underscores (e.g.'12_34'): they are now kept quoted in YAML output instead of being emitted unquoted and read back as numbers by YAML 1.1 parsers.Breaking change: js-yaml v5 parses YAML more strictly. A multi-line flow collection whose closing bracket is indented to (or below) the level of its parent key is now a parse error. For example, this no longer parses and must be reindented:
All other scalar resolution (hex/octal/leading-zero integers, capitalized booleans,
~as null, dates kept as strings) and the handling of empty/comment-only documents are unchanged.Reference
#2906
Alternative
#2907
Testing
Screenshots (optional)
Check yourself
Security
Note
Medium Risk
Touches core YAML parse/stringify used across lint and bundle; v5’s stricter parsing can break previously accepted OpenAPI YAML, though scalar/bundle fixes are intentional.
Overview
Upgrades
js-yamlfrom 4.2.0 to 5.2.1 in@redocly/openapi-coreand adapts theparseYamlwrapper to the v5 API:CORE_SCHEMA.withTagsreplacesJSON_SCHEMA.extend, parsing usesloadAllwith an explicit single-document rule (multi-document streams throw), and empty vs comment-only input is handled without throwing.@types/js-yamlis dropped because v5 ships its own types.Bundle output now keeps values like
'12_34'quoted so they are not re-read as numeric literals with underscores; e2eprimitive-typescoverage was updated for that behavior.Behavior change for users: YAML parsing is stricter in v5—e.g. a multi-line flow mapping whose closing
}is not indented past its parent key fails to parse (tests were adjusted accordingly). Parse errors are reported at the offending token (line/column), not only at end-of-file, which updates some lint snapshot messages.Reviewed by Cursor Bugbot for commit 5f7d2b5. Bugbot is set up for automated code reviews on this repo. Configure here.