chore(deps): bump js-yaml and @nestjs/swagger

[dependabot]

Bumps js-yaml to 5.4.2 and updates ancestor dependency @nestjs/swagger. These dependencies need to be updated together.

Updates js-yaml from 5.3.0 to 5.4.2

Changelog

Sourced from js-yaml's changelog.

[5.4.2] - 2026-09-13

Fixed

• forceQuotes no longer quotes non-string scalars, #798.

[5.4.1] - 2026-08-26

Changed

• Hard-limit merge sequence size to 100.

Security

• Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

[5.4.0] - 2026-08-25

Added

• Added the scalarStyleRules dumper option to customize string formatting. See Scalar styling for details.

Changed

• [breaking] Flattened the low-level AST node style representation. Scalar and collection nodes now use SCALAR_STYLE and COLLECTION_STYLE values; explicit tags use the separate tagged property. Alias nodes now contain only kind and anchor. This only affects code that directly constructs or edits AST nodes.
• [breaking] The sortKeys option was rewritten using AST mutation to avoid side effects.
• Reworked scalar style selection. This can change formatting without changing loaded values; in particular, whitespace-only strings are now double-quoted.

Fixed

• Accept a byte order mark at the start of each document in a stream, #791.
• Produce valid flow mappings with quoteFlowKeys and flowSkipColonSpace, including alias and property-only keys, #786.
• Preserve empty scalar items when converting block sequences to flow style.
• Do not apply the 1024-character simple-key limit to flow mapping keys.
• Count Unicode code points, rather than UTF-16 code units, for the 1024-character simple-key limit.
• Add an explicit document-end marker after keep-chomped block scalars when needed to preserve trailing newlines.

Commits

• 494400b 5.4.2 released
• 6d8adb4 Fix forceQuotes quoting non-string scalars, #798
• e5a3ba0 5.4.1 released
• e54dea3 Hard-limit merge sequence size to 100
• dfd3a29 Cleanup 6a8e05f, #797
• 6a8e05f fix: count empty merge sources against maxTotalMergeKeys (#797)
• 6b4ff5e 5.4.0 released
• 3b3625e Update changelog
• 4f25a74 Fix file name
• 3bd003b Expose new scalar styling API
• Additional commits viewable in compare view

Updates @nestjs/swagger from 11.4.7 to 12.0.2

Release notes

Sourced from @​nestjs/swagger's releases.

12.0.2

What's Changed

• fix(plugin): treat single literal types as enums by @​y-hsgw in nestjs/swagger#4097
• fix(deps): update dependency es-toolkit to v1.52.0 by @​renovate[bot] in nestjs/swagger#4081
• fix(swagger): merge standard schema query params with @​ApiQuery by @​TadejPolajnar in nestjs/swagger#4090
• fix(plugin): keep the source package specifier for workspace imports by @​mhalikosen in nestjs/swagger#4086
• fix: resolve @​fastify/static through a bundler-visible dynamic import by @​kamilmysliwiec in nestjs/swagger#4115
• fix(standard-schema): promote schema description to parameter object by @​tjsousa in nestjs/swagger#4140
• fix: declare typescript as an optional peer dependency by @​lazerg in nestjs/swagger#4134
• fix(deps): update dependency swagger-ui-dist to v5.33.0 by @​renovate[bot] in nestjs/swagger#4128
• fix(deps): update dependency @​microsoft/tsdoc to v0.17.0 by @​renovate[bot] in nestjs/swagger#4124
• feat: support the HTTP QUERY method (RFC 10008) by @​gentritabazi in nestjs/swagger#4007
• fix(swagger-ui): preserve $ characters when building swagger-ui-init.js by @​csulit in nestjs/swagger#4119

New Contributors

• @​mhalikosen made their first contribution in nestjs/swagger#4087
• @​TadejPolajnar made their first contribution in nestjs/swagger#4090
• @​tjsousa made their first contribution in nestjs/swagger#4140
• @​lazerg made their first contribution in nestjs/swagger#4134
• @​gentritabazi made their first contribution in nestjs/swagger#4007
• @​csulit made their first contribution in nestjs/swagger#4119

Full Changelog: nestjs/swagger@12.0.1...12.0.2

Release 12.0.1

12.0.1 (2026-08-28)

Bug fixes

• #4082 fix: esm hoist static imports (@​kamilmysliwiec)

Dependencies

• #4077 chore(deps): update dependency swagger-ui-dist to v5.32.14 (@​renovate[bot])

Committers: 1

• Kamil Mysliwiec (@​kamilmysliwiec)

Release 12.0.0

What's Changed

@nestjs/swagger is now a native ES module, requires Nest 12, and changes how nullable schemas are spelled in the generated document.

ESM migration

The package is published as pure ESM ("type": "module", compiled with NodeNext) behind a proper exports map. The legacy root index.ts / plugin.js / plugin.ts shims are gone, and deep imports into build internals are no longer resolvable — import from the package root (@nestjs/swagger) or from @nestjs/swagger/plugin.

require(esm) — CommonJS still works

You do not need to convert your app to ESM. Thanks to Node's require(esm) support, a CommonJS app can keep doing const { SwaggerModule } = require('@nestjs/swagger'). The CLI plugin entry (@nestjs/swagger/plugin) also keeps a require condition so nest-cli.json setups load it unchanged.

This is why the package now declares "engines": { "node": "^20.19.0 || >=22.12.0" } — those are the Node versions where require(esm) is available without a flag.

... (truncated)

Commits

• 8f00eb9 chore(): release v12.0.2
• bfb2315 fix(swagger-ui): preserve $ characters when building swagger-ui-init.js (#4119)
• 2bea96a feat: support the HTTP QUERY method (RFC 10008) (#4007)
• 752e5c7 chore(deps): update dependency supertest to v7.3.0 (#4142)
• 4faed70 fix(deps): update dependency @​microsoft/tsdoc to v0.17.0 (#4124)
• d0e7976 fix(deps): update dependency swagger-ui-dist to v5.33.0 (#4128)
• abce2be fix: declare typescript as an optional peer dependency (#4134)
• 234c20c fix(standard-schema): promote schema description to parameter object (#4140)
• 9652868 chore(deps): update dependency oxlint to v1.85.0 (#4141)
• 92ee181 chore(deps): update nest monorepo to v12.0.4 (#4138)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Skipping auto-merge: not-patch-or-minor (version-update:semver-major). A human should review this bump.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.