Skip to content

build(deps): bump js-yaml, expo and snyk in /Sample #416

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

build(deps): bump js-yaml, expo and snyk in /Sample #416

wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 14, 2025

Bumps js-yaml to 4.1.1 and updates ancestor dependencies js-yaml, expo and snyk. These dependencies need to be updated together.

Updates js-yaml from 3.14.1 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.

[4.1.0] - 2021-04-15

Added

  • Types are now exported as yaml.types.XXX.
  • Every type now has options property with original arguments kept as they were (see yaml.types.int.options as an example).

Changed

  • Schema.extend() now keeps old type order in case of conflicts (e.g. Schema.extend([ a, b, c ]).extend([ b, a, d ]) is now ordered as abcd instead of cbad).

[4.0.0] - 2021-01-03

Changed

  • Check migration guide to see details for all breaking changes.
  • Breaking: "unsafe" tags !!js/function, !!js/regexp, !!js/undefined are moved to js-yaml-js-types package.
  • Breaking: removed safe* functions. Use load, loadAll, dump instead which are all now safe by default.
  • yaml.DEFAULT_SAFE_SCHEMA and yaml.DEFAULT_FULL_SCHEMA are removed, use yaml.DEFAULT_SCHEMA instead.
  • yaml.Schema.create(schema, tags) is removed, use schema.extend(tags) instead.
  • !!binary now always mapped to Uint8Array on load.
  • Reduced nesting of /lib folder.
  • Parse numbers according to YAML 1.2 instead of YAML 1.1 (01234 is now decimal, 0o1234 is octal, 1:23 is parsed as string instead of base60).
  • dump() no longer quotes :, [, ], (, ) except when necessary, #470, #557.
  • Line and column in exceptions are now formatted as (X:Y) instead of at line X, column Y (also present in compact format), #332.
  • Code snippet created in exceptions now contains multiple lines with line numbers.
  • dump() now serializes undefined as null in collections and removes keys with undefined in mappings, #571.
  • dump() with skipInvalid=true now serializes invalid items in collections as null.
  • Custom tags starting with ! are now dumped as !tag instead of !<!tag>, #576.
  • Custom tags starting with tag:yaml.org,2002: are now shorthanded using !!, #258.

Added

  • Added .mjs (es modules) support.
  • Added quotingType and forceQuotes options for dumper to configure string literal style, #290, #529.
  • Added styles: { '!!null': 'empty' } option for dumper (serializes { foo: null } as "foo: "), #570.
  • Added replacer option (similar to option in JSON.stringify), #339.
  • Custom Tag can now handle all tags or multiple tags with the same prefix, #385.

Fixed

... (truncated)

Commits

Updates expo from 39.0.1 to 54.0.23

Changelog

Sourced from expo's changelog.

Changelog

This is the log of notable changes to the Expo client that are developer-facing. Package-specific changes not released in any SDK will be added here just before the release. Until then, you can find them in changelogs of the individual packages (see packages directory).

Unpublished

📚 3rd party library updates

🛠 Breaking changes

🎉 New features

🐛 Bug fixes

54.0.0 — 2025-09-10

📚 3rd party library updates

  • expo-sqlite
  • expo-camera
    • [Android] Bumped MLKit barcode scanner to 17.3.0 for Android 16KB page size support. (#37454 by @​kudo)

🛠 Breaking changes

  • expo-notifications
  • expo-media-library
    • [Android] Fix getAssetsAsync loading performance, add resolveWithFullInfo option to control whether to load full EXIF data for images. This is a breaking change for Android apps, as it might break the orientation of images in some cases. (#37957 by @​kosmydel).
  • expo-intent-launcher
  • expo-image-picker
    • [Web] Changed web uri to use blob URLs instead of base64 data URLs for better performance. The uri property will now be a blob URL instead of a base64 data URL, while the base64 property behavior remains unchanged. (#37447 by @​hirbod)
    • [ios] The default for preferredAssetRepresentationMode is now .current instead of .automatic. This keeps the asset in its original container/codec (e.g. HEIC instead of JPEG) and is required for the new fast-path. Apps that relied on .automatic re-encoded output can pass preferredAssetRepresentationMode: '.automatic' to restore the old behaviour. (#37569 by @​hirbod)
  • expo-font
  • expo-file-system
    • Make the modern filesystem API the default, move previous one to expo-file-system/legacy. (#38404 by @​aleqsio)
  • expo-document-picker
    • [Web] getDocumentAsync() no longer returns base64 by default. The uri on web now always points to a Blob created via URL.createObjectURL(), which can be used for previews or appended to FormData for uploads. Selecting large files on web is now almost instant, since there’s no base64 conversion by default. If you still need base64, you can pass base64: true in the options. A new base64 field will then be included in the result. (#37443 by @​hirbod)

🎉 New features

... (truncated)

Commits

Updates snyk from 1.465.0 to 1.1300.2

Release notes

Sourced from snyk's releases.

v1.1300.2

1.1300.2 (2025-10-28)

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Bug Fixes

v1.1300.1

1.1300.1 (2025-10-21)

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Features

Bug Fixes

v1.1300.0

1.1300.0 (2025-10-08)

The Snyk CLI is being deployed to different deployment channels, users can select the stability level according to their needs. For details please see this documentation

Features

  • general: Improve SARIF compatibility by adding runAutomationDetails (3e232e5)
  • container: Add support scanning system JARs (54e84d8)
  • container: Add TargetOS to output of container scan (aa55cd9)
  • test: Add support for godot projects (d9fc200)
  • test: Add support for maven metaversions (f321ffa)
  • language-server: Add CVSSv4 Links in IDE Issue Details
  • mcp: Workflow and performance improvements

Bug Fixes

  • container: Fixed crashes when scanning docker images with very large files (72cb040)
  • test: Re-enable support for python 2.7 (02c7fe3)
  • test: Improved error information when using --all-projects (36d14f9)
  • test: Fix a bug due to case-sensitive ignores (b432406)
  • test: Resolve project assets file path dynamically (75a152e)

... (truncated)

Commits
  • da409f0 Merge pull request #6267 from snyk/chore/CLI-1222_update_release
  • 946e17a Merge pull request #6264 from snyk/chore/prepare_1.1300.2
  • f7f0769 chore: update release notes
  • e70a256 chore: update error-catalog
  • be05f96 fix: update x/crypto to fix CVE-2025-47913
  • 619885f Merge pull request #6250 from snyk/chore/sync-release-candidate-with-v1.1300.1
  • abceebc Merge branch 'release/1.1300' into chore/sync-release-candidate-with-v1.1300.1
  • 4d2f8cc Merge pull request #6247 from snyk/release-candidate
  • c9353c0 Merge pull request #6237 from snyk/chore/update-release-candidate
  • 5c3640a fix: error propagation redteam
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by snyk-admin, a new releaser for snyk since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump js-yaml, expo and snyk in /Sample
42662f0 
Bumps [js-yaml](https://github.com/nodeca/js-yaml) to 4.1.1 and updates ancestor dependencies [js-yaml](https://github.com/nodeca/js-yaml), [expo](https://github.com/expo/expo/tree/HEAD/packages/expo) and [snyk](https://github.com/snyk/snyk). These dependencies need to be updated together.


Updates `js-yaml` from 3.14.1 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@3.14.1...4.1.1)

Updates `expo` from 39.0.1 to 54.0.23
- [Changelog](https://github.com/expo/expo/blob/main/CHANGELOG.md)
- [Commits](https://github.com/expo/expo/commits/HEAD/packages/expo)

Updates `snyk` from 1.465.0 to 1.1300.2
- [Release notes](https://github.com/snyk/snyk/releases)
- [Commits](snyk/cli@v1.465.0...v1.1300.2)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: indirect
- dependency-name: expo
  dependency-version: 54.0.23
  dependency-type: direct:production
- dependency-name: snyk
  dependency-version: 1.1300.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 14, 2025
This was referenced Nov 14, 2025
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant