[dependabot]

Bumps js-yaml from 4.1.0 to 5.5.0.

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

• Updated argparse to v3.
• Updated development dependencies.

Fixed

• Correct percent-encoding of shorthand and verbatim tags.
• Reject ,, ], and } at the start of block plain scalars, #801.
• Report the exact position of non-printable characters in errors, #801.

[5.4.3] - 2026-10-06

Fixed

• Fixed loading a whitespace-only block scalar followed by a less indented line, #802.

[5.4.2] - 2026-09-13

Fixed

• forceQuotes no longer quotes non-string scalars, #798.

[5.4.1] - 2026-08-26

Changed

• Hard-limit merge sequence size to 100.

Security

• Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

[5.4.0] - 2026-08-25

Added

• Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

Changed

• [breaking] Flattened the low-level AST node style representation. Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property. Alias nodes now contain only kind and anchor. This only affects code that directly constructs or edits AST nodes.
• [breaking] The sortKeys option was rewritten using AST mutation to avoid side effects.
• Reworked scalar style selection. This can change formatting without changing

... (truncated)

Commits

• cb62b2d 5.5.0 released
• 87aed90 Deps bump
• 3aec511 Fix error positions for non-printable characters, #801
• 11aa483 Reject flow indicators at the start of block plain scalars, #801
• 339d8e0 Refactor tag encoder and decoder to match the YAML specification
• 7832624 5.4.3 released
• 0cbb471 Fix whitespace-only block scalar followed by a less indented line, close #802
• 30108cc Parse the first block mapping key once (#800)
• 494400b 5.4.2 released
• 6d8adb4 Fix forceQuotes quoting non-string scalars, #798
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[rtibblesbot]

🟢 Reviewing

Last updated: 2026-10-25 20:04 UTC

[rtibblesbot]

PR #118: the generate-automation hook fails under js-yaml 5, so this bump needs a generator migration first.

• Package: js-yaml 4.1.0 → 5.5.0 (adds argparse@^3.0.3)
• Semver: major
• Type: devDependency
• Breaking (5.4.0): sortKeys rewritten; scalar style selection reworked
• Security: 5.4.1 merge-key CPU limits; not reachable here (repo-local inputs only)
• Peer deps: none
• CI: failing; the hook reports drift in five generated workflow files

Under 5.5.0, yaml.dump with DUMP_OPTS (scripts/generate-automation.js:32) changes output:

• Strings come out single-quoted; quotingType: '"' no longer forces double quotes.
• on emits as 'on':.
• unquoteOnKey (:41) only matches "on":, so it misses that key.
• The # zizmor: ignore[dangerous-triggers] suffix in automation-caller.yml is dropped.

Ask: close this PR and file the migration as an issue. The migration is: switch to the v5 scalar style options, make unquoteOnKey match 'on':, and commit the regenerated output.

---

Written by rtibblesbot, an LLM-based coding agent.

[rtibblesbot]

Tracked in #122.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[rtibblesbot]

Quick check on rtibblesbot's review of this PR: react 👍 helpful · 😕 mixed · 👎 not helpful. Reply with anything specific.