Skip to content

Bump YamlDotNet from 16.3.0 to 18.1.0 - #391

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/src/main/YamlDotNet-18.1.0
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/src/main/YamlDotNet-18.1.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026 •

Copy link
Copy Markdown
Contributor

Updated YamlDotNet from 16.3.0 to 18.1.0.

Release notes

Sourced from YamlDotNet's releases.

18.1.0

What's Changed

New Contributors

Full Changelog: aaubry/YamlDotNet@v18.0.0...v18.1.0

18.0.0

What's Changed

  • Add a parse method wrapper and caching to fix AoT compilation by @​EdwardCooke in Add a parse method wrapper and caching to fix AoT compilation aaubry/YamlDotNet#1103
    BREAKING CHANGE This is a breaking change in the TypeInspectorSkeleton class and the ITypeInspector interface by adding 2 methods . Quick fix to resolve those breaking changes in your own custom TypeInspector is to return false on the HasParseMethod method and return null or throw an exception on the Parse method.

Full Changelog: aaubry/YamlDotNet@v17.1.0...v18.0.0

17.1.0

What's Changed

  • Security improvements by @​EdwardCooke in Security improvements aaubry/YamlDotNet#1102
    There was a potential breaking change for large yaml files in the MergingParser. You may need to specify the optional parameter for maximum events to be processed. It default to 100k events which is a very large yaml file.

Full Changelog: aaubry/YamlDotNet@v17.0.0...v17.1.0

17.0.0

What's Changed

New Contributors

Full Changelog: aaubry/YamlDotNet@v16.3.0...v17.0.0

Commits viewable in compare view.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 31, 2026
Copilot AI lite review requested due to automatic review settings August 31, 2026 16:56
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 31, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the NuGet dependency management to use YamlDotNet 18.1.0 (from 11.2.1) via the central Packages.props file, bringing in upstream security and behavioral changes that will affect YAML parsing/deserialization across the language server and sync components.

Changes:

  • Bump YamlDotNet from 11.2.1 to 18.1.0 in central package versions (src/Packages.props).

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread src/Packages.props
<PackageReference Update="System.CommandLine" Version="2.0.0-beta4.22272.1" />
<PackageReference Update="System.Text.Json" Version="$(AspNetCoreVersion)" />
<PackageReference Update="YamlDotNet" Version="11.2.1" />
<PackageReference Update="YamlDotNet" Version="18.1.0" />
---
updated-dependencies:
- dependency-name: YamlDotNet
  dependency-version: 18.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump YamlDotNet from 11.2.1 to 18.1.0 Bump YamlDotNet from 16.3.0 to 18.1.0 Sep 24, 2026
Copilot AI review requested due to automatic review settings September 24, 2026 01:48
@dependabot
dependabot Bot force-pushed the dependabot/nuget/src/main/YamlDotNet-18.1.0 branch from 0c6e0e5 to 3f789cd Compare September 24, 2026 01:48

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

No unresolved review comments remain.

Review effort: Lite
Findings: 1 Medium severity

Open (1)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant