advanced-security / component-detection-dependency-submission-action

MIT License
8 stars 4 forks source link

Bump yaml from 2.2.2 to 2.4.2 #49

Closed dependabot[bot] closed 4 weeks ago

dependabot[bot] commented 1 month ago

Bumps yaml from 2.2.2 to 2.4.2.

Release notes

Sourced from yaml's releases.

v2.4.2

  • Restrict YAML 1.1 boolean strings to their explicit capitalization (#530)
  • Add sponsorship by Scipress (#536)

v2.4.1

  • cst: Do not drop trailing newline after line comment in block-map if followed by unindented block-seq value (#525)
  • Stringify flow collection comments in parent (#528)
  • Do not skip folding lines after the first in indented block scalars (#529)

v2.4.0

  • Add a command-line tool (#523)
  • Use the lineWidth option for line breaking in flow collections (#522)

v2.3.4

  • Do not throw for carriage return in tag shorthand (#501)

v2.3.3

  • Do not throw error on malformed URI escape in tag (#498)

v2.3.2

  • Fix docs typo (#489)
  • Do not require quotes for implicit keys with flow indicators (#494)
  • Update Prettier to v3 & update ESLint config

v2.3.1

  • Drop npm from package.json "engines" config (#476)

v2.3.0

This release corresponds with the release of yaml-types v0.2.0, an expanding library of custom tags or types for use with yaml.

This release contains no changes from v2.3.0-5, and the notes below include all changes from the v2.3.0-x prereleases.

Custom Tag Improvements

  • Add export of createNode() & createPair() to 'yaml/util' (#457)
  • Add static from() methods to simplify tag development, and otherwise make extending custom collections easier (#467)

TypeScript Improvements

  • Add a second optional generic type argument Strict to Document instances. (#441)
  • Add types exports for TypeScript (#463)
  • Export StringifyContext type from 'yaml/util' (#464)

Other New Features

  • Add a toJS(doc, options?) method to nodes (#451, #458)
  • Set explicit tag during createNode() for non-default tags (#464)

Bugfixes

... (truncated)

Commits
  • f792d1b 2.4.2
  • de120d6 docs: Move sponsor section up
  • 5410c25 ci: Drop tests in EOL Node.js versions
  • 30868a8 chore: Add sponsorship by Scipress (#536)
  • 1c6fd6a fix: Restrict YAML 1.1 boolean strings to their explicit capitalization (#530)
  • 4aa56d3 2.4.1
  • e651ce1 chore: Refresh lockfile
  • 1775f13 test: Drop unused import to satisfy TS
  • 40903db fix(cst): Do not drop trailing newline after line comment in block-map if fol...
  • 46a816e fix: Do not skip folding lines after the first in indented block scalars (fix...
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
dependabot[bot] commented 4 weeks ago

Superseded by #55.