Update to js-yaml v4

[pelleknaap]

Updating to js-yaml 4.1.0 will dramatically reduce bundle size (~70%) and only requires replacing two function names.

[pelleknaap]

See #136 for more info

[gr2m]

I published https://www.npmjs.com/package/@gr2m/gray-matter for the time being.

You also need to update test/parse-custom.js and examples/sections.js

[cloudhead]

This fixes a bug with numbers as well: currently, 024 would be treated as octal and result in 20, but according to the YAML spec this is not correct: 0o is the correct prefix. This was fixed in js-yaml v4.

@robertmassaioli any chance this could be merged?

[pixelass]

@jonschlinkert Can we get this merged? We use js-yaml alongside gray-matter (to prevent using several packages for yaml).

Right now we are forced to use v3 of js-yaml until this is merged ❤️

[jonschlinkert]

I don’t want to use js-yaml at all. The yaml package is better IMHO.Sent from my iPhoneOn Apr 27, 2024, at 1:03 AM, Gregor Adams ***@***.***> wrote: @jonschlinkert Can we get this merged? We use js-yaml alongside gray-matter (to prevent using several packages for yaml). Right now we are forced to use v3 of js-yaml until this is merged ❤️ —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you were mentioned.Message ID: ***@***.***>

[pixelass]

@jonschlinkert I fully agree, I removed yaml and switched to js-yaml for the sole reason of preventing duplicate packages for parsing yaml.

It looks like a rather easy refactor: https://github.com/jonschlinkert/gray-matter/blob/master/lib/engines.js#L15-L18

I can see if I can spin up a PR for that, if you're open.

[pixelass]

Looks like someone already did the work and was waiting for a response?

#147

[BigBlueHat]

This should get a bump to js-yaml@^4.1.1 due to the "prototype pollution in merge (<<)" vulnerability in js-yaml versions < v4.1.1.

[slorber]

FYI there's a maintained fork here with this upgrade included: https://github.com/11ty/gray-matter

Already adopted by Eleventy and Docusaurus (see facebook/docusaurus#12181)