From 08ca6659de577288190f17ec851786b87711d2a5 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 31 Jul 2026 05:59:35 +0000
Subject: [PATCH 1/2] fix(deps): update dependency js-yaml to v5

---
 bun.lock     | 4 ++--
 package.json | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/bun.lock b/bun.lock
index 0f6198d22..baafe1e62 100644
--- a/bun.lock
+++ b/bun.lock
@@ -17,7 +17,7 @@
         "execa": "5.x.x",
         "fs-extra": "11.x.x",
         "globby": "16.x.x",
-        "js-yaml": "4.x.x",
+        "js-yaml": "5.x",
         "jsonpointer": "5.x.x",
         "micromatch": "4.x.x",
         "object-traversal": "1.x.x",
@@ -508,7 +508,7 @@
 
     "js-tokens": ["js-tokens@10.0.0", "", {}, "sha512-lM/UBzQmfJRo9ABXbPWemivdCW8V2G8FHaHdypQaIy523snUjog0W71ayWXTjiR+ixeMyVHN2XcpnTd/liPg/Q=="],
 
-    "js-yaml": ["js-yaml@4.3.0", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q=="],
+    "js-yaml": ["js-yaml@5.2.2", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.mjs" } }, "sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw=="],
 
     "jsesc": ["jsesc@3.1.0", "", { "bin": { "jsesc": "bin/jsesc" } }, "sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA=="],
 
diff --git a/package.json b/package.json
index 481bbb707..479631b49 100644
--- a/package.json
+++ b/package.json
@@ -36,7 +36,7 @@
     "execa": "5.x.x",
     "fs-extra": "11.x.x",
     "globby": "16.x.x",
-    "js-yaml": "4.x.x",
+    "js-yaml": "5.x",
     "jsonpointer": "5.x.x",
     "micromatch": "4.x.x",
     "object-traversal": "1.x.x",

From 025d6d70494b59f46b69dc07d3f926342a1c11a1 Mon Sep 17 00:00:00 2001
From: Mads Jon Nielsen <madsjon@gmail.com>
Date: Fri, 31 Jul 2026 11:06:45 +0200
Subject: [PATCH 2/2] fix(deps): port custom tag and schema to the js-yaml 5
 api

Type and DEFAULT_SCHEMA are gone, so !reference uses defineSequenceTag
and the schema is rebuilt from CORE_SCHEMA with the v4 default tags,
including mergeTag which CORE_SCHEMA omits.
---
 src/parser.ts | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/parser.ts b/src/parser.ts
index 3d03561cf..699ba806a 100644
--- a/src/parser.ts
+++ b/src/parser.ts
@@ -333,13 +333,14 @@ export class Parser {
             }
         }
 
-        const referenceType = new yaml.Type("!reference", {
-            kind: "sequence",
-            construct: function (data) {
-                return {referenceData: data};
+        const referenceType = yaml.defineSequenceTag<unknown[], {referenceData: unknown[]}>("!reference", {
+            create: () => [],
+            addItem: (carrier, item) => {
+                carrier.push(item);
             },
+            finalize: (carrier) => ({referenceData: carrier}),
         });
-        const schema = yaml.DEFAULT_SCHEMA.extend([referenceType]);
+        const schema = yaml.CORE_SCHEMA.withTags(yaml.mergeTag, yaml.timestampTag, yaml.binaryTag, yaml.omapTag, yaml.pairsTag, yaml.setTag, referenceType);
         let fileData;
 
         try {