# Vendored code

## js-yaml 5.5.0

- Package: [`js-yaml`](https://www.npmjs.com/package/js-yaml) by Vitaly Puzrin and contributors (nodeca)
- Version: **5.5.0** (npm `latest`, published 2026-10-15)
- License: MIT (copied as `js-yaml.LICENSE`)
- Source: `https://registry.npmjs.org/js-yaml/-/js-yaml-5.5.0.tgz`
  - tarball integrity: `sha512-paNr4LFIFPjeeSmwNYdrb8FafLLG/Cr2Af3GjbsHJ5CxIjH4r0c2emlmRdAtpPAieP1gRVzk6buBbVP5gBMGAg==` (checked against the registry)

| File | From the tarball | SHA-256 |
|---|---|---|
| `js-yaml.umd.min.js` | `package/dist/browser/js-yaml.umd.min.js` (unmodified, 62,553 bytes) | `02970a652376ad653ff069c606ee7440b0514f52ed94a98426cb52426c8e5a02` |
| `js-yaml.LICENSE` | `package/LICENSE` | `a07bc24468b9654ce76a547d47a2db282d07733b715db4c73a98bd63961f9550` |

The source map named on the bundle's last line is not shipped (it is only requested by browser dev tools).
The bundle was scanned for network and code-evaluation APIs (`fetch`, `XMLHttpRequest`, `WebSocket`,
`import(`, `eval`, `Function(`, URLs): none present. It exposes a `jsyaml` global.

How json.gripe uses it (`../core.js`):

- **Loading YAML**: `jsyaml.loadAll(text, { schema, maxAliases: 1000, json: true })` with
  `schema = CORE_SCHEMA.withTags(realMapTag, exactInt)`. CORE_SCHEMA is the safe YAML 1.2 core schema
  (strings, numbers, booleans, null, lists, maps: no JS-specific types, no timestamps). `realMapTag`
  builds `Map`s so keys like `__proto__` are plain data and key order is kept. `exactInt` is the core int
  tag, except integers too big for a double keep their exact digits.
  The result is also walked with a 5 million value budget, so an alias bomb stops with an error.
- **Writing YAML**: `jsyaml.dump(value, { schema: DUMP_SCHEMA.withTags(realMapTag), lineWidth: -1, noRefs: true })`.
  The input is JSON data only, so the schema only decides quoting: strings that YAML 1.1 would read as
  something else (`yes`, `on`, `2020-01-01`, `123`) get quoted.

To update: download the new tarball, check its integrity against the registry, copy
`dist/browser/js-yaml.umd.min.js` and `LICENSE`, update this file, and rerun the tests.