From cf4c28a72921e6a05bfd9cf18f1b6c13a2c41c7e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 15 Jul 2026 21:56:54 +0000 Subject: [PATCH 1/6] build(deps): bump js-yaml from 4.2.0 to 5.2.1 Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.2.0 to 5.2.1. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](https://github.com/nodeca/js-yaml/compare/4.2.0...5.2.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.2.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- package-lock.json | 33 ++++++++++++++++++++++++++++----- package.json | 2 +- 2 files changed, 29 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index 66077374..8ade4f8f 100644 --- a/package-lock.json +++ b/package-lock.json @@ -15,7 +15,7 @@ "@slack/web-api": "^8.0.0", "@slack/webhook": "^8.0.0", "flat": "^6.0.1", - "js-yaml": "^4.2.0", + "js-yaml": "^5.2.1", "markup-js": "^1.5.21", "undici": "^8.7.0" }, @@ -481,6 +481,29 @@ "js-yaml": "^4.1.1" } }, + "node_modules/@changesets/parse/node_modules/js-yaml": { + "version": "4.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz", + "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==", + "dev": true, + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], + "license": "MIT", + "dependencies": { + "argparse": "^2.0.1" + }, + "bin": { + "js-yaml": "bin/js-yaml.js" + } + }, "node_modules/@changesets/pre": { "version": "2.0.2", "resolved": "https://registry.npmjs.org/@changesets/pre/-/pre-2.0.2.tgz", @@ -1707,9 +1730,9 @@ "license": "ISC" }, "node_modules/js-yaml": { - "version": "4.2.0", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz", - "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==", + "version": "5.2.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.1.tgz", + "integrity": "sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==", "funding": [ { "type": "github", @@ -1725,7 +1748,7 @@ "argparse": "^2.0.1" }, "bin": { - "js-yaml": "bin/js-yaml.js" + "js-yaml": "bin/js-yaml.mjs" } }, "node_modules/jsonfile": { diff --git a/package.json b/package.json index 8975a394..99a9b041 100644 --- a/package.json +++ b/package.json @@ -48,7 +48,7 @@ "@slack/web-api": "^8.0.0", "@slack/webhook": "^8.0.0", "flat": "^6.0.1", - "js-yaml": "^4.2.0", + "js-yaml": "^5.2.1", "markup-js": "^1.5.21", "undici": "^8.7.0" }, From 2aa886c3715d6a3300921151828b207a68a8c7d5 Mon Sep 17 00:00:00 2001 From: Eden Zimbelman Date: Wed, 15 Jul 2026 15:16:59 -0700 Subject: [PATCH 2/6] test: adopt spec-compliant multiline YAML parsing for js-yaml@5 The stricter parser in js-yaml@5 rejects continuation lines within a quoted scalar that are not indented to the node level. Update the multiline payloads in the regression test and integration workflow to the spec-valid form and declare the parsing change as a major bump. --- .changeset/bump-js-yaml-5x.md | 9 +++++++++ .github/workflows/integration.yml | 2 +- test/content.spec.js | 2 +- 3 files changed, 11 insertions(+), 2 deletions(-) create mode 100644 .changeset/bump-js-yaml-5x.md diff --git a/.changeset/bump-js-yaml-5x.md b/.changeset/bump-js-yaml-5x.md new file mode 100644 index 00000000..afaf5879 --- /dev/null +++ b/.changeset/bump-js-yaml-5x.md @@ -0,0 +1,9 @@ +--- +"@slack/slack-github-action": major +--- + +build(deps): bump js-yaml from 4.2.0 to 5.2.1 + +The stricter, spec-compliant parser rejects continuation lines within a quoted +scalar that are not indented to the node level. Multiline payloads that relied +on the prior leniency must indent continuation lines or use a block scalar. diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml index bc0188ec..1e5227db 100644 --- a/.github/workflows/integration.yml +++ b/.github/workflows/integration.yml @@ -114,7 +114,7 @@ jobs: channel: ${{ secrets.SLACK_CHANNEL_ID }} text: ":checkered_flag: A multiline message wraps across lines - with a blank line before " + with a blank line before " - name: "test(api): confirm the multiline message was posted" run: test -n "$MULTILINE_OUTPUT_TS" diff --git a/test/content.spec.js b/test/content.spec.js index 7704afd0..072f6a52 100644 --- a/test/content.spec.js +++ b/test/content.spec.js @@ -77,7 +77,7 @@ describe("content", () => { it("parses multiline YAML from the input payload", async () => { mocks.core.getInput .withArgs("payload") - .returns('channel: C0123456789\ntext: "first line\n\nsecond line"'); + .returns('channel: C0123456789\ntext: "first line\n\n second line"'); const config = new Config(mocks.core); const expected = { channel: "C0123456789", From f0cba75e819357fe95f56ebf56754e55f80070e6 Mon Sep 17 00:00:00 2001 From: Eden Zimbelman Date: Wed, 15 Jul 2026 15:24:58 -0700 Subject: [PATCH 3/6] docs: cite the YAML line prefixes spec in the changeset Reference the s-flow-line-prefix(n) indentation rule so the breaking change points at the spec section that motivates it. --- .changeset/bump-js-yaml-5x.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.changeset/bump-js-yaml-5x.md b/.changeset/bump-js-yaml-5x.md index afaf5879..074798f6 100644 --- a/.changeset/bump-js-yaml-5x.md +++ b/.changeset/bump-js-yaml-5x.md @@ -6,4 +6,6 @@ build(deps): bump js-yaml from 4.2.0 to 5.2.1 The stricter, spec-compliant parser rejects continuation lines within a quoted scalar that are not indented to the node level. Multiline payloads that relied -on the prior leniency must indent continuation lines or use a block scalar. +on the prior leniency must indent continuation lines or use a block scalar. See +the YAML [line prefixes](https://yaml.org/spec/1.2.2/#63-line-prefixes) spec for +the `s-flow-line-prefix(n)` indentation rule. From c4a9faeba34cfe4e61482f4fcdf87f644e5a2c6c Mon Sep 17 00:00:00 2001 From: Eden Zimbelman Date: Wed, 15 Jul 2026 15:26:40 -0700 Subject: [PATCH 4/6] docs: show a minimal before/after diff in the changeset Illustrate the required indentation fix so readers can map the parsing error to the exact one-line change in their payload. --- .changeset/bump-js-yaml-5x.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.changeset/bump-js-yaml-5x.md b/.changeset/bump-js-yaml-5x.md index 074798f6..83cfa11a 100644 --- a/.changeset/bump-js-yaml-5x.md +++ b/.changeset/bump-js-yaml-5x.md @@ -9,3 +9,10 @@ scalar that are not indented to the node level. Multiline payloads that relied on the prior leniency must indent continuation lines or use a block scalar. See the YAML [line prefixes](https://yaml.org/spec/1.2.2/#63-line-prefixes) spec for the `s-flow-line-prefix(n)` indentation rule. + +```diff + text: "first line + +- second line" ++ second line" +``` From c66c267392e483c782c6f02a9dcb851302aa24a4 Mon Sep 17 00:00:00 2001 From: Eden Zimbelman Date: Wed, 15 Jul 2026 15:38:01 -0700 Subject: [PATCH 5/6] docs: fix typos in the changeset Correct "indentiation" and "compilant" so the release notes read cleanly. --- .changeset/bump-js-yaml-5x.md | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/.changeset/bump-js-yaml-5x.md b/.changeset/bump-js-yaml-5x.md index 83cfa11a..0319cc6f 100644 --- a/.changeset/bump-js-yaml-5x.md +++ b/.changeset/bump-js-yaml-5x.md @@ -2,15 +2,14 @@ "@slack/slack-github-action": major --- -build(deps): bump js-yaml from 4.2.0 to 5.2.1 +build: parse yaml with more strict multiline indentation rules -The stricter, spec-compliant parser rejects continuation lines within a quoted -scalar that are not indented to the node level. Multiline payloads that relied -on the prior leniency must indent continuation lines or use a block scalar. See -the YAML [line prefixes](https://yaml.org/spec/1.2.2/#63-line-prefixes) spec for -the `s-flow-line-prefix(n)` indentation rule. +Internal dependencies of [`js-yaml@v5`](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md#500---2026-06-20) make YAML parsing more strict and compliant with the YAML specification. Indentation is now required for values that span multiple lines against the base value. + +See the YAML [line prefixes](https://yaml.org/spec/1.2.2/#63-line-prefixes) spec for the `s-flow-line-prefix(n)` indentation rule. ```diff + channel: "C0123" text: "first line - second line" From 7f55331840cff6b8b299d3f037cbba42c2d0586d Mon Sep 17 00:00:00 2001 From: Eden Zimbelman Date: Wed, 15 Jul 2026 15:41:15 -0700 Subject: [PATCH 6/6] docs: tie the changeset spec link to the diff example Reword the line prefixes reference to lead into the illustrated fix instead of naming the raw production. --- .changeset/bump-js-yaml-5x.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.changeset/bump-js-yaml-5x.md b/.changeset/bump-js-yaml-5x.md index 0319cc6f..c035e50d 100644 --- a/.changeset/bump-js-yaml-5x.md +++ b/.changeset/bump-js-yaml-5x.md @@ -6,7 +6,7 @@ build: parse yaml with more strict multiline indentation rules Internal dependencies of [`js-yaml@v5`](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md#500---2026-06-20) make YAML parsing more strict and compliant with the YAML specification. Indentation is now required for values that span multiple lines against the base value. -See the YAML [line prefixes](https://yaml.org/spec/1.2.2/#63-line-prefixes) spec for the `s-flow-line-prefix(n)` indentation rule. +See the YAML [line prefixes](https://yaml.org/spec/1.2.2/#63-line-prefixes) spec for the expected indentation rule: ```diff channel: "C0123"