Bumpsjs-yaml to 4.1.1 and updates ancestor dependency@angular-devkit/build-angular. These dependencies need to be updated together.
Updatesjs-yaml from 3.14.1 to 4.1.1
Changelog
Sourced fromjs-yaml's changelog.
[4.1.1] - 2025-11-12
Security
- Fix prototype pollution issue in yaml merge (<<) operator.
[4.1.0] - 2021-04-15
Added
- Types are now exported as
yaml.types.XXX. - Every type now has
options property with original arguments kept as they were(seeyaml.types.int.options as an example).
Changed
Schema.extend() now keeps old type order in case of conflicts(e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered asabcd instead ofcbad).
[4.0.0] - 2021-01-03
Changed
- Checkmigration guide to see details for all breaking changes.
- Breaking: "unsafe" tags
!!js/function,!!js/regexp,!!js/undefined aremoved tojs-yaml-js-types package. - Breaking: removed
safe* functions. Useload,loadAll,dumpinstead which are all now safe by default. yaml.DEFAULT_SAFE_SCHEMA andyaml.DEFAULT_FULL_SCHEMA are removed, useyaml.DEFAULT_SCHEMA instead.yaml.Schema.create(schema, tags) is removed, useschema.extend(tags) instead.!!binary now always mapped toUint8Array on load.- Reduced nesting of
/lib folder. - Parse numbers according to YAML 1.2 instead of YAML 1.1 (
01234 is now decimal,0o1234 is octal,1:23 is parsed as string instead of base60). dump() no longer quotes:,[,],(,) except when necessary,#470,#557.- Line and column in exceptions are now formatted as
(X:Y) instead ofat line X, column Y (also present in compact format),#332. - Code snippet created in exceptions now contains multiple lines with line numbers.
dump() now serializesundefined asnull in collections and removes keys withundefined in mappings,#571.dump() withskipInvalid=true now serializes invalid items in collections as null.- Custom tags starting with
! are now dumped as!tag instead of!<!tag>,#576. - Custom tags starting with
tag:yaml.org,2002: are now shorthanded using!!,#258.
Added
- Added
.mjs (es modules) support. - Added
quotingType andforceQuotes options for dumper to configurestring literal style,#290,#529. - Added
styles: { '!!null': 'empty' } option for dumper(serializes{ foo: null } as "foo:"),#570. - Added
replacer option (similar to option in JSON.stringify),#339. - Custom
Tag can now handle all tags or multiple tags with the same prefix,#385.
Fixed
... (truncated)
Commits
Updates@angular-devkit/build-angular from 14.1.0 to 20.3.10
Release notes
Sourced from@angular-devkit/build-angular's releases.
20.3.10
@schematics/angular
| Commit | Description |
|---|
 | correcttsconfig.spec.json include for spec files |
@angular/build
| Commit | Description |
|---|
 | do not remove@angular/localize when having external packages (#31721) |
20.3.9
@angular/ssr
| Commit | Description |
|---|
 | improve locale handling in app-engine |
 | improve route matching for wildcard routes |
20.3.8
@angular-devkit/build-angular
| Commit | Description |
|---|
 | expand jest and jest-environment-jsdom to allow version 30 |
@angular/build
| Commit | Description |
|---|
 | add adapters to new reporter |
 | ensure locale data plugin runs before other plugins |
 | handle redirects from guards during prerendering |
20.3.7
@angular-devkit/schematics
| Commit | Description |
|---|
 | respect--force option when schematic containshost.create |
@angular/build
| Commit | Description |
|---|
 | resolve Angular locale data namespace in esbuild |
 | updatevite to7.11.1 |
@angular/ssr
| Commit | Description |
|---|
 | correctly handle routes with matrix parameters |
 | ensure server-side navigation triggers a redirect |
20.3.6
@angular/ssr
| Commit | Description |
|---|
 | prevent malicious URL from overriding host |
... (truncated)
Changelog
Sourced from@angular-devkit/build-angular's changelog.
20.3.10 (2025-11-12)
@schematics/angular
| Commit | Type | Description |
|---|
| c854a719b | fix | correcttsconfig.spec.json include for spec files |
@angular/build
| Commit | Type | Description |
|---|
| b3908f68e | fix | do not remove@angular/localize when having external packages (#31721) |
21.0.0-rc.1 (2025-11-05)
@angular/cli
| Commit | Type | Description |
|---|
| dfb4242b3 | fix | add vitest to version command output |
@schematics/angular
| Commit | Type | Description |
|---|
| f89750b27 | fix | addaddImports option to jasmine-vitest schematic |
| 515b09c4f | fix | add Vitest config generation and runner checks |
| 0e83fe1a8 | fix | add warnings and improve Karma config generation |
| b91fa31f2 | fix | align Karma project generation with unified unit-test builder |
@angular/build
| Commit | Type | Description |
|---|
| 62938e799 | fix | update vitest to 4.0.6 and remove coverage workaround |
@angular/ssr
| Commit | Type | Description |
|---|
| 5d76d84e6 | fix | improve locale handling in app-engine |
| 4a3cfdfce | fix | improve route matching for wildcard routes |
... (truncated)
Commits
904ef7a release: cut the v20.3.10 releasec854a71 fix(@schematics/angular): correcttsconfig.spec.json include for spec filesb3908f6 fix(@angular/build): do not remove@angular/localize when having external p...6fbd106 build: migrate license file handling towrite_source_file7c11e07 refactor: fix several typos (#31716)2c0cafa release: cut the v20.3.9 releasebddf211 docs: clarifyoutputMode description in application schema683697e fix(@angular/ssr): improve route matching for wildcard routes08e07e3 fix(@angular/ssr): improve locale handling in app-engine4ac89c5 release: cut the v20.3.8 release- Additional commits viewable incompare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting@dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR@dependabot recreate will recreate this PR, overwriting any edits that have been made to it@dependabot merge will merge this PR after your CI passes on it@dependabot squash and merge will squash and merge this PR after your CI passes on it@dependabot cancel merge will cancel a previously requested merge and block automerging@dependabot reopen will reopen this PR if it is closed@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from theSecurity Alerts page.
Bumpsjs-yaml to 4.1.1 and updates ancestor dependency@angular-devkit/build-angular. These dependencies need to be updated together.
Updates
js-yamlfrom 3.14.1 to 4.1.1Changelog
Sourced fromjs-yaml's changelog.
... (truncated)
Commits
cc482e74.1.1 released50968b8dist rebuildd092d86lint fix383665ffix prototype pollution in merge (<<)0d3ca7aREADME.md: HTTP => HTTPS (#678)49baadddoc: 'empty' style option for !!nullba3460eFix demo link (#618)2cef47b4.1.0 released810b149dist rebuild2b5620eExport built-in types, type override now preserves orderUpdates
@angular-devkit/build-angularfrom 14.1.0 to 20.3.10Release notes
Sourced from
@angular-devkit/build-angular's releases.... (truncated)
Changelog
Sourced from
@angular-devkit/build-angular's changelog.... (truncated)
Commits
904ef7arelease: cut the v20.3.10 releasec854a71fix(@schematics/angular): correcttsconfig.spec.jsoninclude for spec filesb3908f6fix(@angular/build): do not remove@angular/localizewhen having external p...6fbd106build: migrate license file handling towrite_source_file7c11e07refactor: fix several typos (#31716)2c0cafarelease: cut the v20.3.9 releasebddf211docs: clarifyoutputModedescription in application schema683697efix(@angular/ssr): improve route matching for wildcard routes08e07e3fix(@angular/ssr): improve locale handling in app-engine4ac89c5release: cut the v20.3.8 releaseDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from theSecurity Alerts page.