npmpackage.info

Gathering detailed insights and metrics for yaml

Other packages similar to yaml

js-yaml

4.1.0

YAML 1.2 parser and serializer

yaml-eslint-parser

1.3.0

A YAML parser that produces output compatible with ESLint

yaml-front-matter

4.1.1

yaml front matter for JS. Parse yaml or JSON from the beginning of files.

yaml-loader

0.8.1

YAML loader for Webpack

Gathering detailed insights and metrics for yaml

yaml - 2.8.0 | npmpackage.info

yaml

YAML parser and stringifier for JavaScript

2.8.0

1,499

ISC

TypeScript

667.40 kB

8,014,356,193 6.7

Installations

npm install yaml

Developer Guide

BETA

Typescript

Yes

Module System

CommonJS, ESM, UMD

Min. Node Version

>= 14.6

Node Version

23.11.0

NPM Version

10.9.2 Score

99.5

Supply Chain

100

Quality

80.8

Maintenance

100

Vulnerability

100

License

Pull Requests

Open

3

Total

154

Closed

26

Merged

125

Issues

Open

19

Total

367

Closed

348

Releases

v2.8.0

Updated on May 15, 2025

v2.7.1

Updated on Mar 29, 2025

v2.7.0

Updated on Dec 31, 2024

v2.6.1

Updated on Nov 19, 2024

v2.6.0

Updated on Oct 13, 2024

v2.5.1

Updated on Sep 03, 2024

View All 82 releases

Languages

TypeScript

JavaScript

TypeScript (98.65%)

JavaScript (1.35%)

Developer

eemeli

Download Statistics

Total Downloads

8,014,356,193

Last Day

11,956,925

Last Week

74,199,919

Last Month

339,543,602

Last Year

2,992,951,252

GitHub Statistics

ISC License

1,499 Stars

1,530 Commits

129 Forks

13 Watchers

4 Branches

29 Contributors

Updated on Jul 18, 2025

Maintainers

View All 29 Contributors

Package Meta Information

Latest Version

2.8.0

Package Id

yaml@2.8.0

Unpacked Size

667.40 kB

Size

109.08 kB

File Count

233

NPM Version

10.9.2

Node Version

23.11.0

Published on

May 15, 2025

Total Downloads

Cumulative downloads

Total Downloads

8,014,356,193

Last Day

22.1%

11,956,925

Compared to previous day

Last Week

0.3%

74,199,919

Compared to previous week

Last Month

10.6%

339,543,602

Compared to previous month

Last Year

43.6%

2,992,951,252

Compared to previous year

Weekly Downloads

Monthly Downloads

Yearly Downloads

YAML

yaml is a definitive library for YAML, the human friendly data serialization standard. This library:

Supports both YAML 1.1 and YAML 1.2 and all common data schemas,
Passes all of the yaml-test-suite tests,
Can accept any string as input without throwing, parsing as much YAML out of it as it can, and
Supports parsing, modifying, and writing YAML comments and blank lines.

The library is released under the ISC open source license, and the code is available on GitHub. It has no external dependencies and runs on Node.js as well as modern browsers.

For the purposes of versioning, any changes that break any of the documented endpoints or APIs will be considered semver-major breaking changes. Undocumented library internals may change between minor versions, and previous APIs may be deprecated (but not removed).

The minimum supported TypeScript version of the included typings is 3.9; for use in earlier versions you may need to set skipLibCheck: true in your config. This requirement may be updated between minor versions of the library.

For more information, see the project's documentation site: eemeli.org/yaml

To install:

1npm install yaml
2# or
3deno add jsr:@eemeli/yaml

Note: These docs are for yaml@2. For v1, see the v1.10.0 tag for the source and eemeli.org/yaml/v1 for the documentation.

The development and maintenance of this library is sponsored by:

API Overview

The API provided by yaml has three layers, depending on how deep you need to go: Parse & Stringify, Documents, and the underlying Lexer/Parser/Composer. The first has the simplest API and "just works", the second gets you all the bells and whistles supported by the library along with a decent AST, and the third lets you get progressively closer to YAML source, if that's your thing.

A command-line tool is also included.

Parse & Stringify

1import { parse, stringify } from 'yaml'

Documents

1import {
2  Document,
3  isDocument,
4  parseAllDocuments,
5  parseDocument
6} from 'yaml'

Content Nodes

1import {
2  isAlias, isCollection, isMap, isNode,
3  isPair, isScalar, isSeq, Scalar,
4  visit, visitAsync, YAMLMap, YAMLSeq
5} from 'yaml'

Parsing YAML

1import { Composer, Lexer, Parser } from 'yaml'

YAML.parse

1# file.yml
2YAML:
3  - A human-readable data serialization language
4  - https://en.wikipedia.org/wiki/YAML
5yaml:
6  - A complete JavaScript implementation
7  - https://www.npmjs.com/package/yaml

1import fs from 'fs'
2import YAML from 'yaml'
3
4YAML.parse('3.14159')
5// 3.14159
6
7YAML.parse('[ true, false, maybe, null ]\n')
8// [ true, false, 'maybe', null ]
9
10const file = fs.readFileSync('./file.yml', 'utf8')
11YAML.parse(file)
12// { YAML:
13//   [ 'A human-readable data serialization language',
14//     'https://en.wikipedia.org/wiki/YAML' ],
15//   yaml:
16//   [ 'A complete JavaScript implementation',
17//     'https://www.npmjs.com/package/yaml' ] }

YAML.stringify

1import YAML from 'yaml'
2
3YAML.stringify(3.14159)
4// '3.14159\n'
5
6YAML.stringify([true, false, 'maybe', null])
7// `- true
8// - false
9// - maybe
10// - null
11// `
12
13YAML.stringify({ number: 3, plain: 'string', block: 'two\nlines\n' })
14// `number: 3
15// plain: string
16// block: |
17//   two
18//   lines
19// `

Browser testing provided by:

High

7.5/10

Summary

Uncaught Exception in yaml

Affected Versions

>= 2.0.0-5, < 2.2.2

Patched Versions

2.2.2

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Maintained

Determines if the project is "actively maintained".

10

Security-Policy

Determines if the project has published a security policy.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

License

Determines if the project has defined a license.

10

Fuzzing

Determines if the project uses fuzzing.

10

SAST

Determines if the project uses static code analysis.

9

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

3

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 3

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/browsers.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/browsers.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/browsers.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/browsers.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/browsers.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/browsers.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/browsers.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/browsers.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/browsers.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/browsers.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/deno.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/deno.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/deno.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/deno.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/jsr-publish.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/jsr-publish.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:60: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:62: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:69: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:80: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:82: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:87: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/typescript.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/typescript.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/typescript.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/typescript.yml/main?enable=pin
Warn: npmCommand not pinned by hash: .github/workflows/nodejs.yml:51
Warn: npmCommand not pinned by hash: .github/workflows/nodejs.yml:66
Warn: npmCommand not pinned by hash: .github/workflows/nodejs.yml:68
Warn: npmCommand not pinned by hash: .github/workflows/nodejs.yml:86
Warn: npmCommand not pinned by hash: .github/workflows/typescript.yml:25
Warn: npmCommand not pinned by hash: .github/workflows/typescript.yml:29
Warn: npmCommand not pinned by hash: .github/workflows/typescript.yml:33
Info: 0 out of 21 GitHub-owned GitHubAction dependencies pinned
Info: 0 out of 4 third-party GitHubAction dependencies pinned
Info: 8 out of 15 npmCommand dependencies pinned

3

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

1

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

Score

6.7

/10

Last Scanned on 2025-07-14

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More

Other packages similar to yaml

Other packages similar to yaml

yaml

Installations

Developer Guide

Yes

CommonJS, ESM, UMD

>= 14.6

23.11.0

10.9.2

Score

Pull Requests

3

154

26

125

Issues

19

367

348

Releases

Languages

Developer

Download Statistics

GitHub Statistics

Maintainers

Package Meta Information

Total Downloads

8,014,356,193

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dev Dependencies

YAML

API Overview

Parse & Stringify

Documents

Content Nodes

Parsing YAML

YAML.parse

YAML.stringify

10

10

10

10

10

10

10

9

3

3

1

0

0

6.7

/10