Chore(deps): Bump js-yaml from 4.3.1 to 5.3.0 (#7032)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: shamoon <4887959+shamoon@users.noreply.github.com>

src/utils/config/api-response.js

@@ -1,8 +1,6 @@
 import { promises as fs } from "fs";
 import path from "path";
 
-import yaml from "js-yaml";
-
 import checkAndCopyConfig, { CONF_DIR, getSettings, substituteEnvironmentVars } from "utils/config/config";
 import {
   cleanServiceGroups,
@@ -12,6 +10,7 @@ import {
   servicesFromKubernetes,
 } from "utils/config/service-helpers";
 import { cleanWidgetGroups, widgetsFromConfig } from "utils/config/widget-helpers";
+import { loadYaml } from "utils/config/yaml";
 
 /**
  * Compares services by weight then by name.
@@ -30,7 +29,7 @@ export async function bookmarksResponse() {
   const bookmarksYaml = path.join(CONF_DIR, "bookmarks.yaml");
   const rawFileContents = await fs.readFile(bookmarksYaml, "utf8");
   const fileContents = substituteEnvironmentVars(rawFileContents);
-  const bookmarks = yaml.load(fileContents);
+  const bookmarks = loadYaml(fileContents);
 
   if (!bookmarks) return [];
 

src/utils/config/api-response.test.js

@@ -30,10 +30,7 @@ vi.mock("fs", () => ({
   promises: fs,
 }));
 
-vi.mock("js-yaml", () => ({
-  default: yaml,
-  ...yaml,
-}));
+vi.mock("utils/config/yaml", () => ({ loadYaml: yaml.load }));
 
 vi.mock("utils/config/config", () => config);
 vi.mock("utils/config/widget-helpers", () => widgetHelpers);

src/utils/config/config.check-copy.test.js

@@ -13,7 +13,7 @@ const { fs, yaml } = vi.hoisted(() => ({
 }));
 
 vi.mock("fs", () => fs);
-vi.mock("js-yaml", () => ({ default: yaml, ...yaml }));
+vi.mock("utils/config/yaml", () => ({ loadYaml: yaml.load }));
 
 describe("utils/config/config checkAndCopyConfig", () => {
   const originalEnv = process.env;

src/utils/config/config.js

@@ -1,9 +1,10 @@
 import { copyFileSync, existsSync, mkdirSync, readFileSync } from "fs";
 import { join } from "path";
 
-import yaml from "js-yaml";
 import cache from "memory-cache";
 
+import { loadYaml } from "utils/config/yaml";
+
 const cacheKey = "homepageEnvironmentVariables";
 const homepageVarPrefix = "HOMEPAGE_VAR_";
 const homepageFilePrefix = "HOMEPAGE_FILE_";
@@ -42,7 +43,7 @@ export default function checkAndCopyConfig(config) {
   }
 
   try {
-    yaml.load(readFileSync(configYaml, "utf8"));
+    loadYaml(readFileSync(configYaml, "utf8"));
     return true;
   } catch (e) {
     return { ...e, config };
@@ -85,7 +86,7 @@ export function getSettings() {
   const settingsYaml = join(CONF_DIR, "settings.yaml");
   const rawFileContents = readFileSync(settingsYaml, "utf8");
   const fileContents = substituteEnvironmentVars(rawFileContents);
-  const initialSettings = yaml.load(fileContents) ?? {};
+  const initialSettings = loadYaml(fileContents) ?? {};
 
   if (initialSettings.layout) {
     // support yaml list but old spec was object so convert to that

src/utils/config/docker.js

@@ -1,9 +1,8 @@
 import { readFileSync } from "fs";
 import path from "path";
 
-import yaml from "js-yaml";
-
 import checkAndCopyConfig, { CONF_DIR, substituteEnvironmentVars } from "utils/config/config";
+import { loadYaml } from "utils/config/yaml";
 
 export function getDefaultDockerArgs(platform = process.platform) {
   if (platform !== "win32" && platform !== "darwin") {
@@ -19,7 +18,7 @@ export default function getDockerArguments(server) {
   const configFile = path.join(CONF_DIR, "docker.yaml");
   const rawConfigData = readFileSync(configFile, "utf8");
   const configData = substituteEnvironmentVars(rawConfigData);
-  const servers = yaml.load(configData);
+  const servers = loadYaml(configData);
 
   if (!server) {
     return getDefaultDockerArgs();

src/utils/config/docker.test.js

@@ -21,10 +21,7 @@ vi.mock("fs", () => ({
   readFileSync: fs.readFileSync,
 }));
 
-vi.mock("js-yaml", () => ({
-  default: yaml,
-  ...yaml,
-}));
+vi.mock("utils/config/yaml", () => ({ loadYaml: yaml.load }));
 
 vi.mock("utils/config/config", () => ({
   default: checkAndCopyConfig,

src/utils/config/kubernetes.js

@@ -2,16 +2,16 @@ import { readFileSync } from "fs";
 import path from "path";
 
 import { ApiextensionsV1Api, KubeConfig } from "@kubernetes/client-node";
-import yaml from "js-yaml";
 
 import checkAndCopyConfig, { CONF_DIR, substituteEnvironmentVars } from "utils/config/config";
+import { loadYaml } from "utils/config/yaml";
 
 export function getKubernetes() {
   checkAndCopyConfig("kubernetes.yaml");
   const configFile = path.join(CONF_DIR, "kubernetes.yaml");
   const rawConfigData = readFileSync(configFile, "utf8");
   const configData = substituteEnvironmentVars(rawConfigData);
-  return yaml.load(configData);
+  return loadYaml(configData);
 }
 
 export const getKubeConfig = () => {

src/utils/config/kubernetes.test.js

@@ -32,10 +32,7 @@ vi.mock("fs", () => ({
   readFileSync: fs.readFileSync,
 }));
 
-vi.mock("js-yaml", () => ({
-  default: yaml,
-  ...yaml,
-}));
+vi.mock("utils/config/yaml", () => ({ loadYaml: yaml.load }));
 
 vi.mock("utils/config/config", () => ({
   default: checkAndCopyConfig,

src/utils/config/proxmox.js

@@ -1,14 +1,13 @@
 import { readFileSync } from "fs";
 import path from "path";
 
-import yaml from "js-yaml";
-
 import checkAndCopyConfig, { CONF_DIR, substituteEnvironmentVars } from "utils/config/config";
+import { loadYaml } from "utils/config/yaml";
 
 export function getProxmoxConfig() {
   checkAndCopyConfig("proxmox.yaml");
   const configFile = path.join(CONF_DIR, "proxmox.yaml");
   const rawConfigData = readFileSync(configFile, "utf8");
   const configData = substituteEnvironmentVars(rawConfigData);
-  return yaml.load(configData);
+  return loadYaml(configData);
 }

src/utils/config/proxmox.test.js

@@ -18,10 +18,7 @@ vi.mock("fs", () => ({
   readFileSync: fs.readFileSync,
 }));
 
-vi.mock("js-yaml", () => ({
-  default: yaml,
-  ...yaml,
-}));
+vi.mock("utils/config/yaml", () => ({ loadYaml: yaml.load }));
 
 vi.mock("utils/config/config", () => ({
   default: checkAndCopyConfig,

src/utils/config/service-helpers.js

@@ -2,12 +2,12 @@ import { promises as fs } from "fs";
 import path from "path";
 
 import Docker from "dockerode";
-import yaml from "js-yaml";
 
 import checkAndCopyConfig, { CONF_DIR, getSettings, substituteEnvironmentVars } from "utils/config/config";
 import getDockerArguments from "utils/config/docker";
 import { getKubeConfig } from "utils/config/kubernetes";
 import * as shvl from "utils/config/shvl";
+import { loadYaml } from "utils/config/yaml";
 import kubernetes from "utils/kubernetes/export";
 import createLogger from "utils/logger";
 import { parseVersionForUrl } from "utils/proxy/api-helpers";
@@ -56,7 +56,7 @@ export async function servicesFromConfig() {
   const servicesYaml = path.join(CONF_DIR, "services.yaml");
   const rawFileContents = await fs.readFile(servicesYaml, "utf8");
   const fileContents = substituteEnvironmentVars(rawFileContents);
-  const services = yaml.load(fileContents);
+  const services = loadYaml(fileContents);
   return parseServicesToGroups(services);
 }
 
@@ -66,7 +66,7 @@ export async function servicesFromDocker() {
   const dockerYaml = path.join(CONF_DIR, "docker.yaml");
   const rawDockerFileContents = await fs.readFile(dockerYaml, "utf8");
   const dockerFileContents = substituteEnvironmentVars(rawDockerFileContents);
-  const servers = yaml.load(dockerFileContents);
+  const servers = loadYaml(dockerFileContents);
 
   if (!servers) {
     return [];

src/utils/config/service-helpers.test.js

@@ -70,10 +70,7 @@ vi.mock("fs", () => ({
   promises: fs,
 }));
 
-vi.mock("js-yaml", () => ({
-  default: yaml,
-  ...yaml,
-}));
+vi.mock("utils/config/yaml", () => ({ loadYaml: yaml.load }));
 
 vi.mock("utils/config/config", () => config);
 vi.mock("dockerode", () => ({ default: Docker }));

src/utils/config/widget-helpers.js

@@ -1,9 +1,8 @@
 import { promises as fs } from "fs";
 import path from "path";
 
-import yaml from "js-yaml";
-
 import checkAndCopyConfig, { CONF_DIR, substituteEnvironmentVars } from "utils/config/config";
+import { loadYaml } from "utils/config/yaml";
 
 export async function widgetsFromConfig() {
   checkAndCopyConfig("widgets.yaml");
@@ -11,7 +10,7 @@ export async function widgetsFromConfig() {
   const widgetsYaml = path.join(CONF_DIR, "widgets.yaml");
   const rawFileContents = await fs.readFile(widgetsYaml, "utf8");
   const fileContents = substituteEnvironmentVars(rawFileContents);
-  const widgets = yaml.load(fileContents);
+  const widgets = loadYaml(fileContents);
 
   if (!widgets) return [];
 

src/utils/config/widget-helpers.test.js

@@ -18,10 +18,7 @@ vi.mock("fs", () => ({
   promises: fs,
 }));
 
-vi.mock("js-yaml", () => ({
-  default: yaml,
-  ...yaml,
-}));
+vi.mock("utils/config/yaml", () => ({ loadYaml: yaml.load }));
 
 vi.mock("utils/config/config", () => config);
 

src/utils/config/yaml.js

@@ -0,0 +1,14 @@
+import * as yaml from "js-yaml";
+
+const EMPTY_DOCUMENT_ERROR = "expected a document, but the input is empty";
+const DEFAULT_SCHEMA = yaml.CORE_SCHEMA.withTags(yaml.timestampTag, yaml.mergeTag);
+
+export function loadYaml(input, options) {
+  try {
+    return yaml.load(input, { schema: DEFAULT_SCHEMA, ...options });
+  } catch (error) {
+    // js-yaml v4 returned undefined for empty and comment-only documents.
+    if (error?.reason === EMPTY_DOCUMENT_ERROR) return undefined;
+    throw error;
+  }
+}

src/utils/config/yaml.test.js

@@ -0,0 +1,31 @@
+import { describe, expect, it } from "vitest";
+
+import { loadYaml } from "./yaml";
+
+describe("utils/config/yaml", () => {
+  it.each(["", "  \n", "# comment only\n"])("loads an empty document from %j as undefined", (input) => {
+    expect(loadYaml(input)).toBeUndefined();
+  });
+
+  it("loads a populated document", () => {
+    expect(loadYaml("title: Homepage\n")).toEqual({ title: "Homepage" });
+  });
+
+  it("preserves v4 merge key behavior", () => {
+    expect(loadYaml("defaults: &defaults\n  href: https://example.com\nservice:\n  <<: *defaults\n")).toEqual({
+      defaults: { href: "https://example.com" },
+      service: { href: "https://example.com" },
+    });
+  });
+
+  it("preserves v4 timestamp behavior without enabling YAML 1.1 booleans", () => {
+    expect(loadYaml("date: 2026-08-21\nenabled: yes\n")).toEqual({
+      date: new Date("2026-08-21T00:00:00.000Z"),
+      enabled: "yes",
+    });
+  });
+
+  it("still rejects invalid YAML", () => {
+    expect(() => loadYaml("value: [\n")).toThrow();
+  });
+});

src/utils/mcp/homepage-mcp.js

@@ -2,9 +2,10 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { createHash, timingSafeEqual } from "node:crypto";
 import { join } from "path";
 
-import yaml from "js-yaml";
+import * as yaml from "js-yaml";
 
 import { CONF_DIR } from "utils/config/config";
+import { loadYaml } from "utils/config/yaml";
 
 const PROTOCOL_VERSION = "2025-11-25";
 const SERVER_INFO = {
@@ -118,7 +119,7 @@ function readConfig(file) {
 }
 
 function parseYamlConfig(file) {
-  const parsed = yaml.load(readConfig(file) || "");
+  const parsed = loadYaml(readConfig(file) || "");
   return parsed ?? [];
 }
 
@@ -128,7 +129,7 @@ function validateYaml(file, content) {
   }
 
   try {
-    yaml.load(content || "");
+    loadYaml(content || "");
     return { valid: true };
   } catch (error) {
     return {