Skip to content

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Nov 15, 2025

Bumps js-yaml to 4.1.1 and updates ancestor dependency rclnodejs. These dependencies need to be updated together.

Updates js-yaml from 4.1.0 to 4.1.1

Changelog

Sourced from js-yaml's changelog.

[4.1.1] - 2025-11-12

Security

  • Fix prototype pollution issue in yaml merge (<<) operator.
Commits

Updates rclnodejs from 0.27.4 to 1.6.0

Release notes

Sourced from rclnodejs's releases.

rclnodejs v1.6.0

Release Notes for rclnodejs v1.6.0 (2025-10-30)

🚀 Major Features

JSON-Safe Message Serialization (#1308)

  • New Public API: Added serializationMode option to createSubscription()
    • 'default' - Native rclnodejs behavior
    • 'plain' - Converts TypedArrays to regular arrays (JSON-compatible)
    • 'json' - Full JSON-safe mode (handles TypedArrays, BigInt, NaN, Infinity)
  • New Utility Functions:
    • rclnodejs.toJSONSafe(obj) - Converts objects to JSON-friendly format
    • rclnodejs.toJSONString(obj) - Directly converts to JSON string
  • Problem Solved: Sensor messages with TypedArrays now work correctly with JSON.stringify(), web APIs, and logging workflows
  • Fully backward compatible - existing code continues to work unchanged

📦 Dependency Cleanup

Removed external dependencies and replaced with native implementations:

  • Removed compare-versions (#1303) - Implemented custom version comparison
  • Removed fs-extra (#1302) - Using Node.js built-in fs module with custom utilities
  • Removed doT template engine (#1297) - Replaced with native JavaScript template literals
  • Removed terser (#1293) - Simplified to regex-based whitespace cleanup
  • Removed is-close (#1295) - Implemented custom floating-point comparison

Result: Lighter package with fewer third-party dependencies, improved maintainability

🔧 Node.js Compatibility

Node.js v25 Support (#1313, #1314, #1315)

  • Removed deprecated SlowBuffer - Eliminated Node.js v6 era compatibility code that was causing errors in v25

🏗️ Code Modernization

Template Engine Migration (#1297)

  • Migrated from doT templates to native ES6 template literals
  • Benefits: Better performance, improved maintainability, reduced dependencies

🔄 CI/CD Improvements

  • GitHub Actions Updates (#1291): Upgraded setup-node action to v6.0.0
  • Multi-version Testing: Expanded Node.js version coverage (v24, v25) across different platforms

Full Changelog: RobotWebTools/rclnodejs@1.5.2...1.6.0

🙏 Acknowledgments

Thanks to all contributors who helped identify issues and improve this release!

rclnodejs v1.5.2

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [js-yaml](https://github.com/nodeca/js-yaml) to 4.1.1 and updates ancestor dependency [rclnodejs](https://github.com/RobotWebTools/rclnodejs). These dependencies need to be updated together.


Updates `js-yaml` from 4.1.0 to 4.1.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.1.1)

Updates `rclnodejs` from 0.27.4 to 1.6.0
- [Release notes](https://github.com/RobotWebTools/rclnodejs/releases)
- [Commits](RobotWebTools/rclnodejs@0.27.4...1.6.0)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 4.1.1
  dependency-type: indirect
- dependency-name: rclnodejs
  dependency-version: 1.6.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 15, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant