Skip to content

Bump js-yaml, expo and @react-native-tvos/config-tv - #32

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-1524807d22
Open

Bump js-yaml, expo and @react-native-tvos/config-tv#32
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-1524807d22

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 11, 2026

Copy link
Copy Markdown
Contributor

Bumps js-yaml to 4.3.1 and updates ancestor dependencies js-yaml, expo and @react-native-tvos/config-tv. These dependencies need to be updated together.

Updates js-yaml from 4.1.0 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

  • [backport] Remove quadratic complexity from !!omap duplicate key detection.

4.3.0 - 2026-06-27

Added

  • [backport] Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.

Fixed

  • Restore umd builds back to es5.

Removed

  • [backport] maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

[4.2.0] - 2026-06-01

Added

  • Added docs/safety.md with notes about processing untrusted YAML.
  • Added maxDepth (100) loader option. Not a problem, but gives a better exception instead of RangeError on stack overflow.
  • Added maxMergeSeqLength (20) loader option. Not a problem after merge fix, but an additional restriction for safety.
  • Added sourcemaps to dist/ builds.

Changed

  • Stop resolving numbers with underscores as numeric scalars, #627.
  • Switched dev toolchains to Vite / neostandard.
  • Updated demo.
  • Reorganized tests.
  • dist/ files are no longer kept in the repository.

Fixed

  • Fix parsing of properties on the first implicit block mapping key, #62.
  • Fix trailing whitespace handling when folding flow scalar lines, #307.
  • Reject top-level block scalars without content indentation, #280.
  • Ensure numbers survive round-trip, #737.
  • Fix test coverage for issue #221.
  • Fix flow scalar trailing whitespace folding, #307.
  • Fix digits in YAML named tag handles.

Security

  • Fix potential DoS via quadratic complexity in merge - deduplicate repeated elements (makes sense for malformed files > 10K).

[3.14.2] - 2025-11-15

Security

... (truncated)

Commits
  • 86e91b8 4.3.1 released
  • c3cc4b0 Backport quadratic complexity fix for !!omap
  • 33d05b5 4.3.0 released
  • 663bfab Drop demo publish, to not override new v5 one.
  • 1cb8c7b Add v4-legacy tag for publish
  • 02f27af Restore umd builds back to es5
  • 8be84ed Fix es5 compatibility
  • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
  • 6842ef6 doc polish
  • 590dbab 4.2.0 released
  • Additional commits viewable in compare view

Updates expo from 51.0.14 to 57.0.12

Changelog

Sourced from expo's changelog.

Changelog

Unpublished

馃洜 Breaking changes

馃帀 New features

馃悰 Bug fixes

  • [iOS] Fix expo/fetch streaming race between URLSession delegate callbacks and startStreaming() that could deliver an empty body on a 200 response, drop chunks, or leave the body stream open. (#47796 by @鈥媔doyana)
  • Fix expo/fetch body-stream teardown races: aborting via an AbortSignal now rejects the in-flight read with an AbortError instead of hanging forever, and late native events no longer throw The stream is not in a state that permits enqueue/close from outside any consumer try/catch. (#47573 by @鈥媔doyana)
  • [iOS] Fix expo/fetch Response.text() and .arrayBuffer() never settling when the request fails (network drop, abort()) after the response was already delivered. (#48230 by @鈥媧oontek)
  • Fix iOS build against React Native 0.87+ by dropping the legacy architecture (bridge) RCTRootViewFactoryConfiguration setup. (#46641 by @鈥媧oontek)
  • Adopted the UIKit scene-based life cycle on iOS so apps built with the iOS 27 SDK launch correctly. (#46733 by @鈥媋lanjhughes)
  • [iOS] Mark ExpoAppSceneDelegate as unavailable in extensions. (#46799 by @鈥媕akex7)
  • [iOS] Fix Linking.getInitialURL() returning null and deep links being dropped when a URL cold-starts an app on the UIKit scene life cycle. (#47628 by @鈥媡sapeta)
  • [iOS] Mark ExpoAppSceneDelegate as unavailable in iOSApplicationExtension for widgets. (#47894 by @鈥媕akex7)
  • [iOS] Add ExpoBundleConfiguration to derive RCTBundleConfiguration from the normalized bundle URL instead of default shared settings singleton (#48010 by @鈥媖itten)
  • [iOS] Resolve the dev server port from the RCTMetroPort Info.plist key at runtime so bare projects without expo-dev-client connect to their own Metro instance instead of defaulting to 8081. (#48098 by @鈥媋lanjhughes)
  • Fix async imports (import(...)) via asyncRequireModule not a thenable instead of a full promise shape (#48550 by @鈥媖itten)

馃挕 Others

  • [Android] ExpoReactHostFactory now passes host handlers' DevSupportManagerFactory to ReactHostImpl. (#47637 by @鈥媋lanjhughes)
  • [macOS] Fix build by guarding the bundleConfiguration override, which requires react-native 0.84+. (#48494 by @鈥媔ntergalacticspacehighway)
  • Restore RCTHostRuntimeDelegate conformance for react-native-macos (#46420 by @鈥媑abrieldonadel)
  • Add explicit react-native/Libraries/Core/InitializeCore import to native runtime entrypoint (#46344 by @鈥媖itten)
  • [Internal] Update logbox imports (#46640 by @鈥媖itten)
  • Re-export more expo-modules-core APIs (#45987 by @鈥媁enszel)
  • Update URL and URLSearchParams implementation to support IDNA/TR-46 and improve performance. Spec-adherence has increased and few gaps should now be noticeable compared to browsers (#47813 by @鈥媖itten)
  • [Internal] Add getBundleOrigin, exposed as expo/internal/bundle-origin (#48275 by @鈥媖itten)
  • [Internal] Derive getDevServer from the bundle URL internally and expose getBundleUrl helper (#48278 by @鈥媖itten)

57.0.9 - 2026-07-29

This version does not introduce any user-facing changes.

57.0.8 - 2026-07-22

馃悰 Bug fixes

57.0.7 - 2026-07-17

馃悰 Bug fixes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by alanhughes, a new releaser for expo since your current version.


Updates @react-native-tvos/config-tv from 0.0.10 to 0.1.6

Release notes

Sourced from @鈥媟eact-native-tvos/config-tv's releases.

config-tv@0.1.6

What's Changed

New Contributors

Full Changelog: https://github.com/react-native-tvos/config-tv/compare/config-tv@0.1.5...config-tv@0.1.6

config-tv@0.1.5

What's Changed

New Contributors

Full Changelog: https://github.com/react-native-tvos/config-tv/compare/config-tv@0.1.4...config-tv@0.1.5

config-tv@0.1.4

What's Changed

Full Changelog: https://github.com/react-native-tvos/config-tv/compare/config-tv@0.1.3...config-tv@0.1.4

config-tv@0.1.3

What's Changed

New Contributors

Full Changelog: https://github.com/react-native-tvos/config-tv/compare/config-tv@0.1.1...config-tv@0.1.3

config-tv@0.1.1

What's Changed

Full Changelog: https://github.com/react-native-tvos/config-tv/compare/config-tv@0.1.0...config-tv@0.1.1

config-tv@0.1.0

What's Changed

... (truncated)

Commits
  • 62758a8 Bump config-tv version (0.1.6)
  • 0ecfe46 feat: fall back to iOS deployment target for tvOS deployment target (#39)
  • ed077a5 fix: Move glob dependency and remove unused imports (#38)
  • dda160c Bump config-tv version (0.1.5)
  • e446937 fix: ensure tvOS icon assets are used in Xcode project (#37)
  • 85a300b Clarify 'androidTVBanner' usage in README.md (#36)
  • 8566960 Fix image dimensions in README for Apple TV assets (#35)
  • dafe93d Bump config-tv version (0.1.4)
  • 7eeeb0d fix: remove unneeded podspec source for TV (#33)
  • 4f2ab94 Bump config-tv version (0.1.3)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [js-yaml](https://github.com/nodeca/js-yaml) to 4.3.1 and updates ancestor dependencies [js-yaml](https://github.com/nodeca/js-yaml), [expo](https://github.com/expo/expo/tree/HEAD/packages/expo) and [@react-native-tvos/config-tv](https://github.com/react-native-tvos/config-tv/tree/HEAD/packages/config-tv). These dependencies need to be updated together.


Updates `js-yaml` from 4.1.0 to 4.3.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.3.1)

Updates `expo` from 51.0.14 to 57.0.12
- [Changelog](https://github.com/expo/expo/blob/main/packages/expo/CHANGELOG.md)
- [Commits](https://github.com/expo/expo/commits/HEAD/packages/expo)

Updates `@react-native-tvos/config-tv` from 0.0.10 to 0.1.6
- [Release notes](https://github.com/react-native-tvos/config-tv/releases)
- [Commits](https://github.com/react-native-tvos/config-tv/commits/config-tv@0.1.6/packages/config-tv)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.3.1
  dependency-type: indirect
- dependency-name: expo
  dependency-version: 57.0.12
  dependency-type: direct:production
- dependency-name: "@react-native-tvos/config-tv"
  dependency-version: 0.1.6
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants