chore(deps): bump yaml and lint-staged

[dependabot]

Bumps yaml to 2.9.0 and updates ancestor dependency lint-staged. These dependencies need to be updated together.

Updates yaml from 2.3.4 to 2.9.0

Release notes

Sourced from yaml's releases.

v2.9.0

The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

• fix: Avoid calling Array.prototype.push.apply() with large source array
• fix(lexer): Avoid recursive calls that may exhaust the call stack

v2.8.4

• Disable alias resolution with maxAliasCount:0 (#677)
• Handle invalid unicode escapes (e1a1a77)
• Apply minFractionDigits only to decimal strings (#676)

v2.8.3

• Add trailingComma ToString option for multiline flow formatting (#670)
• Catch stack overflow during node composition (1e84ebb)

v2.8.2

• Serialize -0 as -0 (#638)
• Do not double newlines for empty map values (#642)

v2.8.1

• Preserve empty block literals (#634)

v2.8.0

• Add node cache for faster alias resolution (#612)
• Re-introduce compatibility with Node.js 14.6 (#614)
• Add --merge option to CLI tool (#611)
• Improve error for tag resolution error on null value (#616)
• Allow empty string as plain scalar representation, for failsafe schema (#616)
• docs: include cli example (#617)

v2.7.1

• Do not allow seq with single-line collection value on same line with map key (#603)
• Improve warning & avoid TypeError on bad YAML 1.1 nodes (#610)

v2.7.0

The library is now available on JSR as @​eemeli/yaml and on deno.land/x as yaml. In addition to Node.js and browsers, it should work in Deno, Bun, and Cloudflare Workers.

• Use .ts extension in all relative imports (#591)
• Ignore newline after block seq indicator as space before value (#590)
• Require Node.js 14.18 or later (was 14.6) (#598)

v2.6.1

• Do not strip :00 seconds from !!timestamp values (#578, with thanks to @​qraynaud)
• Tighten regexp for JSON !!bool (#587, with thanks to @​vra5107)
• Default to literal block scalar if folded would overflow (#585)

... (truncated)

Commits

• ddb21b0 2.9.0
• 167365b docs: Clarify that not all errors can be avoided
• 6eca2a7 fix: Avoid calling Array.prototype.push.apply() with large source array
• 0543cd5 fix(lexer): Avoid recursive calls that may exhaust the call stack
• ccdf743 2.8.4
• f625789 fix: Disable alias resolution with maxAliasCount:0 (#677)
• e1a1a77 fix: Handle invalid unicode escapes
• a163ea0 style: Satify Prettier
• b2a5a6c fix: Apply minFractionDigits only to decimal strings (#676)
• 93c951b chore: Bump JSR version to v2.8.3 (#673)
• Additional commits viewable in compare view

Updates lint-staged from 15.2.2 to 15.5.2

Release notes

Sourced from lint-staged's releases.

v15.5.2

Patch Changes

• #1544 5561321 Thanks @​YimingIsCOLD! - Correctly handle colon (:) characters in staged filenames.

v15.5.1

Patch Changes

• #1533 5d53534 Thanks @​iiroj! - Improve listing of staged files so that lint-staged doesn't crash when encountering an uninitialized submodule. This should result in less errors like:

  ✖ Failed to get staged files!
  

v15.5.0

Minor Changes

• #1526 630af5f Thanks @​iiroj! - Lint-staged no longer resets to the original state when preventing an empty git commit. This happens when your configured tasks reset all the staged changes, typically when trying to commit formatting changes which conflict with your linter setup like ESLint or Prettier.

  Example with Prettier

  By default Prettier prefers double quotes.

  Previously

  1. Stage file.js with only double quotes " changed to '
  2. Run git commit -am "I don't like double quotes"
  3. Lint-staged runs prettier --write file.js, converting all the ' back to "
  4. Because there are now no changes, lint-staged fails, cancels the commit, and resets back to the original state
  5. Commit was not done, original state is restored and single quotes ' are staged

  Now

  1. Stage file.js with only double-quotes " changed to '
  2. Run git commit -am "I don't like double quotes"
  3. Lint-staged runs prettier --write file.js, converting all the ' back to "
  4. Because there are now no changes, lint-staged fails and cancels the commit
  5. Commit was not done, and there are no staged changes

v15.4.3

Patch Changes

• #1512 cbfed1d Thanks @​tarik02! - Adjust TypeScript types for the default export so that it can be used as a value without error TS2693.

v15.4.2

Patch Changes

• #1509 8827ebf Thanks @​iiroj! - Change lint-staged's dependencies to use caret (^) ranges instead of tilde (~). This makes it easier for package managers to perform dependency management when minor-level updates are also permitted instead of just patch-level.

v15.4.1

Patch Changes

... (truncated)

Changelog

Sourced from lint-staged's changelog.

15.5.2

Patch Changes

• #1544 5561321 Thanks @​YimingIsCOLD! - Correctly handle colon (:) characters in staged filenames.

15.5.1

Patch Changes

• #1533 5d53534 Thanks @​iiroj! - Improve listing of staged files so that lint-staged doesn't crash when encountering an uninitialized submodule. This should result in less errors like:

  ✖ Failed to get staged files!
  

15.5.0

Minor Changes

• #1526 630af5f Thanks @​iiroj! - Lint-staged no longer resets to the original state when preventing an empty git commit. This happens when your configured tasks reset all the staged changes, typically when trying to commit formatting changes which conflict with your linter setup like ESLint or Prettier.

  Example with Prettier

  By default Prettier prefers double quotes.

  Previously

  1. Stage file.js with only double quotes " changed to '
  2. Run git commit -am "I don't like double quotes"
  3. Lint-staged runs prettier --write file.js, converting all the ' back to "
  4. Because there are now no changes, lint-staged fails, cancels the commit, and resets back to the original state
  5. Commit was not done, original state is restored and single quotes ' are staged

  Now

  1. Stage file.js with only double-quotes " changed to '
  2. Run git commit -am "I don't like double quotes"
  3. Lint-staged runs prettier --write file.js, converting all the ' back to "
  4. Because there are now no changes, lint-staged fails and cancels the commit
  5. Commit was not done, and there are no staged changes

15.4.3

Patch Changes

• #1512 cbfed1d Thanks @​tarik02! - Adjust TypeScript types for the default export so that it can be used as a value without error TS2693.

15.4.2

... (truncated)

Commits

• 8e91302 chore(changeset): release
• 64148fd Merge pull request #1545 from lint-staged/revert-v16-changes
• 46f47b2 Revert "build(deps): update dependencies"
• 9472af9 Revert "build(execa): upgrade execa@9.5.2, require Node.js ^18.19.0 || >=20.5.0"
• 9e17c9c Revert "chore: remove validation of deprecated advanced config options"
• 6fda79a Revert "feat: remove --shell flag support"
• e1ea676 Revert "feat: replace execa with nano-spawn"
• 5561321 fix: handle colon characters in staged filenames (#1544)
• dcc9a51 feat: replace execa with nano-spawn
• 2fa909d feat: remove --shell flag support
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.