Bump eslint-plugin-yml from 1.19.1 to 3.3.0

[dependabot]

Bumps eslint-plugin-yml from 1.19.1 to 3.3.0.

Release notes

Sourced from eslint-plugin-yml's releases.

v3.3.0

Minor Changes

• #582 ef8de6e Thanks @​ota-meshi! - feat(flow-mapping-curly-spacing): add emptyObjects option to control spacing in empty flow-mapping

v3.2.2

Patch Changes

• #579 276e3aa Thanks @​ota-meshi! - update @ota-meshi/ast-token-store to v0.3.0

v3.2.1

Patch Changes

• #575 c09b986 Thanks @​ota-meshi! - fix: update @ota-meshi/ast-token-store to 0.2.1

v3.2.0

Minor Changes

• #573 099cb89 Thanks @​ota-meshi! - feat: use @ota-meshi/ast-token-store

v3.1.2

Patch Changes

• #569 21904d6 Thanks @​ota-meshi! - fix: type bug with eslint v10

v3.1.1

Patch Changes

• #567 5235c42 Thanks @​ota-meshi! - fix: some bug with eslint v10

v3.1.0

Minor Changes

• #564 c8ff016 Thanks @​antfu! - Add ESLint v10 compatibility while maintaining v9 support
  • Migrated from deprecated isSpaceBetweenTokens() to isSpaceBetween() API
  • All changes are backward compatible with ESLint v9

v3.0.0

Major Changes

• #543 12df7f4 Thanks @​copilot-swe-agent! - Use language config in shareable configs. The shareable configs now use the new ESLint v9 language config API (language: "yml/yaml") instead of the legacy parser approach (languageOptions: { parser }). This is a breaking change that aligns with ESLint's language plugin architecture.

v2.0.2

Patch Changes

• #539 0fc8d41 Thanks @​ota-meshi! - fix: add fake scopeManager for SourceCode API compatibility

v2.0.1

Patch Changes

... (truncated)

Changelog

Sourced from eslint-plugin-yml's changelog.

3.3.0

Minor Changes

• #582 ef8de6e Thanks @​ota-meshi! - feat(flow-mapping-curly-spacing): add emptyObjects option to control spacing in empty flow-mapping

3.2.2

Patch Changes

• #579 276e3aa Thanks @​ota-meshi! - update @ota-meshi/ast-token-store to v0.3.0

3.2.1

Patch Changes

• #575 c09b986 Thanks @​ota-meshi! - fix: update @ota-meshi/ast-token-store to 0.2.1

3.2.0

Minor Changes

• #573 099cb89 Thanks @​ota-meshi! - feat: use @ota-meshi/ast-token-store

3.1.2

Patch Changes

• #569 21904d6 Thanks @​ota-meshi! - fix: type bug with eslint v10

3.1.1

Patch Changes

• #567 5235c42 Thanks @​ota-meshi! - fix: some bug with eslint v10

3.1.0

Minor Changes

• #564 c8ff016 Thanks @​antfu! - Add ESLint v10 compatibility while maintaining v9 support
  • Migrated from deprecated isSpaceBetweenTokens() to isSpaceBetween() API
  • All changes are backward compatible with ESLint v9

3.0.0

Major Changes

• #543 12df7f4 Thanks @​copilot-swe-agent! - Use language config in shareable configs. The shareable configs now use the new ESLint v9 language config API (language: "yml/yaml") instead of the legacy parser approach (languageOptions: { parser }). This is a breaking change that aligns with ESLint's language plugin architecture.

... (truncated)

Commits

• 9012e23 Version Packages (#583)
• ef8de6e feat(flow-mapping-curly-spacing): add emptyObjects option to control spacin...
• 5a30909 Version Packages (#581)
• 276e3aa update @ota-meshi/ast-token-store to v0.3.0 (#579)
• 4b8a15e chore(deps): update dependency eslint-plugin-jsonc to v3 (#577)
• 93ffddc chore(deps): update dependency eslint-plugin-node-dependencies to v2 (#578)
• a391d17 Version Packages (#576)
• 00ae242 chore: fix typo in changeset
• c09b986 fix: update @ota-meshi/ast-token-store to 0.2.1 (#575)
• fc8e5b6 Version Packages (#574)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@ericcornelissen, here's a summary of what's notable in this update from 1.19.1 → 3.3.0:

---

⚠️ Breaking Changes

This update spans two major versions, each with important breaking changes:

v2.0.0:

• ESM-only: The package was converted to ESM-only — it now uses "type": "module" and only exports ESM modules. CommonJS require() is no longer supported; users must use ES modules (import) to load this plugin.
• Node.js version floor: Support for Node.js versions older than 20.19.0 was dropped. The new supported versions are ^20.19.0 || ^22.13.0 || >=24.
• Transitive: yaml-eslint-parser was updated to v2.

v3.0.0:

• Shareable config API change: Shareable configs now use the new ESLint v9 language config API (language: "yml/yaml") instead of the legacy parser approach (languageOptions: { parser }). This is a breaking change that aligns with ESLint's language plugin architecture.

---

✨ Noteworthy New Features

• ESLint v10 compatibility (v3.1.0): Migration from deprecated isSpaceBetweenTokens() to isSpaceBetween() API, backward-compatible with ESLint v9.
• New emptyObjects option (v3.3.0) on the yml/flow-mapping-curly-spacing rule, giving you control over spacing in empty flow-mappings like {}.
• Improved sort-keys rule that now calculates the minimum edit distance for sorting and reports the optimal sorting direction.
• Similarly improved sort-sequence-values for minimum edit distance sorting.

---

🔒 Security / Maliciousness

No direct vulnerabilities have been found for eslint-plugin-yml in Snyk's vulnerability database (this applies to both the old and new versions). No signs of maliciousness were found. Note that the recent CVE-2025-54313 supply chain attack affected eslint-config-prettier and eslint-plugin-prettier — entirely unrelated packages.

---

📌 Action Items to Consider

1. Check if you use require() to load this plugin — if so, you'll need to switch to import.
2. Verify your Node.js version is >=20.19.0.
3. Check your ESLint config — if you use a shareable config from this plugin (e.g., plugin:yml/recommended), the new v3.0.0 approach uses language: "yml/yaml" and may behave differently if your ESLint setup doesn't support the language plugin API (requires ESLint v9+).