npmpackage.info

Gathering detailed insights and metrics for yaml

Other packages similar to yaml

js-yaml

4.1.0

YAML 1.2 parser and serializer

yaml-eslint-parser

1.3.0

A YAML parser that produces output compatible with ESLint

yaml-front-matter

4.1.1

yaml front matter for JS. Parse yaml or JSON from the beginning of files.

yaml-loader

0.8.1

YAML loader for Webpack

Gathering detailed insights and metrics for yaml

yaml - 2.7.0 | npmpackage.info

yaml

YAML parser and stringifier for JavaScript

2.7.0

1,407

ISC

TypeScript

30.69 kB

6,937,315,544 6.3

Installations

npm install yaml

Developer Guide

BETA

Typescript

Yes

Module System

CommonJS, ESM, UMD

Min. Node Version

>= 14

Node Version

23.4.0

NPM Version

10.9.2 Score

99.5

Supply Chain

100

Quality

81.7

Maintenance

100

Vulnerability

100

License

Pull Requests

Open

2

Total

146

Closed

23

Merged

121

Issues

Open

22

Total

356

Closed

334

Releases

v2.7.0

Updated on Dec 31, 2024

v2.6.1

Updated on Nov 19, 2024

v2.6.0

Updated on Oct 13, 2024

v2.5.1

Updated on Sep 03, 2024

v2.5.0

Updated on Jul 24, 2024

v2.4.5

Updated on Jun 08, 2024

View All 80 releases

Languages

TypeScript

JavaScript

TypeScript (98.67%)

JavaScript (1.33%)

Developer

eemeli

Download Statistics

Total Downloads

6,937,315,544

Last Day

11,908,981

Last Week

63,326,233

Last Month

271,409,285

Last Year

2,593,451,919

GitHub Statistics

ISC License

1,407 Stars

1,512 Commits

120 Forks

13 Watchers

5 Branches

27 Contributors

Updated on Mar 26, 2025

Bundle Size

103.40 kB

Minified

30.69 kB

Minified + Gzipped

Bundlephobia

Maintainers

View All 27 Contributors

Package Meta Information

Latest Version

2.7.0

Package Id

yaml@2.7.0

Unpacked Size

665.16 kB

Size

108.74 kB

File Count

233

NPM Version

10.9.2

Node Version

23.4.0

Published on

Dec 31, 2024

Total Downloads

Cumulative downloads

Total Downloads

6,937,315,544

Last Day

1.2%

11,908,981

Compared to previous day

Last Week

2.1%

63,326,233

Compared to previous week

Last Month

8.1%

271,409,285

Compared to previous month

Last Year

36.6%

2,593,451,919

Compared to previous year

Weekly Downloads

Monthly Downloads

Yearly Downloads

YAML

yaml is a definitive library for YAML, the human friendly data serialization standard. This library:

Supports both YAML 1.1 and YAML 1.2 and all common data schemas,
Passes all of the yaml-test-suite tests,
Can accept any string as input without throwing, parsing as much YAML out of it as it can, and
Supports parsing, modifying, and writing YAML comments and blank lines.

The library is released under the ISC open source license, and the code is available on GitHub. It has no external dependencies and runs on Node.js as well as modern browsers.

For the purposes of versioning, any changes that break any of the documented endpoints or APIs will be considered semver-major breaking changes. Undocumented library internals may change between minor versions, and previous APIs may be deprecated (but not removed).

The minimum supported TypeScript version of the included typings is 3.9; for use in earlier versions you may need to set skipLibCheck: true in your config. This requirement may be updated between minor versions of the library.

For more information, see the project's documentation site: eemeli.org/yaml

To install:

1npm install yaml

Note: These docs are for yaml@2. For v1, see the v1.10.0 tag for the source and eemeli.org/yaml/v1 for the documentation.

The development and maintenance of this library is sponsored by:

API Overview

The API provided by yaml has three layers, depending on how deep you need to go: Parse & Stringify, Documents, and the underlying Lexer/Parser/Composer. The first has the simplest API and "just works", the second gets you all the bells and whistles supported by the library along with a decent AST, and the third lets you get progressively closer to YAML source, if that's your thing.

A command-line tool is also included.

Parse & Stringify

1import { parse, stringify } from 'yaml'

Documents

1import {
2  Document,
3  isDocument,
4  parseAllDocuments,
5  parseDocument
6} from 'yaml'

Content Nodes

1import {
2  isAlias, isCollection, isMap, isNode,
3  isPair, isScalar, isSeq, Scalar,
4  visit, visitAsync, YAMLMap, YAMLSeq
5} from 'yaml'

Parsing YAML

1import { Composer, Lexer, Parser } from 'yaml'

YAML.parse

1# file.yml
2YAML:
3  - A human-readable data serialization language
4  - https://en.wikipedia.org/wiki/YAML
5yaml:
6  - A complete JavaScript implementation
7  - https://www.npmjs.com/package/yaml

1import fs from 'fs'
2import YAML from 'yaml'
3
4YAML.parse('3.14159')
5// 3.14159
6
7YAML.parse('[ true, false, maybe, null ]\n')
8// [ true, false, 'maybe', null ]
9
10const file = fs.readFileSync('./file.yml', 'utf8')
11YAML.parse(file)
12// { YAML:
13//   [ 'A human-readable data serialization language',
14//     'https://en.wikipedia.org/wiki/YAML' ],
15//   yaml:
16//   [ 'A complete JavaScript implementation',
17//     'https://www.npmjs.com/package/yaml' ] }

YAML.stringify

1import YAML from 'yaml'
2
3YAML.stringify(3.14159)
4// '3.14159\n'
5
6YAML.stringify([true, false, 'maybe', null])
7// `- true
8// - false
9// - maybe
10// - null
11// `
12
13YAML.stringify({ number: 3, plain: 'string', block: 'two\nlines\n' })
14// `number: 3
15// plain: string
16// block: |
17//   two
18//   lines
19// `

Browser testing provided by:

High

7.5/10

Summary

Uncaught Exception in yaml

Affected Versions

>= 2.0.0-5, < 2.2.2

Patched Versions

2.2.2

10

Maintained

Determines if the project is "actively maintained".

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Security-Policy

Determines if the project has published a security policy.

10

License

Determines if the project has defined a license.

10

Fuzzing

Determines if the project uses fuzzing.

10

SAST

Determines if the project uses static code analysis.

9

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

3

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 3

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/browsers.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/browsers.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/browsers.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/browsers.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/browsers.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/browsers.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/browsers.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/browsers.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/browsers.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/browsers.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/deno.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/deno.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/deno.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/deno.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/jsr-publish.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/jsr-publish.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/nodejs.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/nodejs.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/typescript.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/typescript.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/typescript.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/eemeli/yaml/typescript.yml/main?enable=pin
Warn: npmCommand not pinned by hash: .github/workflows/typescript.yml:25
Warn: npmCommand not pinned by hash: .github/workflows/typescript.yml:29
Warn: npmCommand not pinned by hash: .github/workflows/typescript.yml:33
Info: 0 out of 13 GitHub-owned GitHubAction dependencies pinned
Info: 0 out of 4 third-party GitHubAction dependencies pinned
Info: 5 out of 8 npmCommand dependencies pinned

0

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

Score

6.3

/10

Last Scanned on 2025-03-24

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More

Other packages similar to yaml

Other packages similar to yaml

yaml

Installations

Developer Guide

Yes

CommonJS, ESM, UMD

>= 14

23.4.0

10.9.2

Score

Pull Requests

2

146

23

121

Issues

22

356

334

Releases

Languages

Developer

Download Statistics

GitHub Statistics

Bundle Size

103.40 kB

30.69 kB

Maintainers

Package Meta Information

Total Downloads

6,937,315,544

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dev Dependencies

YAML

API Overview

Parse & Stringify

Documents

Content Nodes

Parsing YAML

YAML.parse

YAML.stringify

10

10

10

10

10

10

10

9

3

0

0

0

0

6.3

/10