Skip to content

Conversation

@blaubaer
Copy link
Contributor

PR summary

Since major version 4 of js-yaml usage of yaml.safeLoad will throw an error.
Since the upgrade of ibm-openapi-validator to version 1.37.4 the js-yaml was switched from 3.14.1 to 4.1.1 and now we're getting errors like:

$ npx ibm-openapi-validator openapi.yaml
IBM OpenAPI Validator (validator: 1.37.4), @Copyright IBM Corporation 2017, 2025.

Validation Results for openapi.yaml:

[ERROR] Invalid input file: openapi.yaml. See below for details.
[ERROR] Error: Function yaml.safeLoad is removed in js-yaml 4. Use yaml.load instead, which is now safe by default.

This is fixing this issue.

Important: The tests are already covering this issue. It is not very clear to me why in your build pipeline this was not already covered. Maybe the old version is there still cached?

PR Checklist

General checklist

Please make sure that your PR fulfills the following requirements:

  • The commit message follows the Angular Commit Message Guidelines.
  • Tests for the changes have been added (for bug fixes / features)
  • Docs have been added / updated (for bug fixes / features)
  • Dependencies have been updated as needed
  • .secrets.baseline has been updated as needed
  • npm run update-utilities has been run if any files in packages/utilities/src have been updated

Checklist for adding a new validation rule:

  • Added new validation rule definition (packages/ruleset/src/rules/*.js, index.js)
  • If necessary, added new validation rule implementation (packages/ruleset/src/functions/*.js, updated index.js)
  • Added new rule to default configuration (packages/ruleset/src/ibm-oas.js)
  • Added tests for new rule (packages/ruleset/test/*.test.js)
  • Added docs for new rule (docs/ibm-cloud-rules.md)
  • Added scoring rubric entry for new rule (packages/validator/src/scoring-tool/rubric.js)

@CLAassistant
Copy link

CLAassistant commented Nov 14, 2025

CLA assistant check
All committers have signed the CLA.

Signed-off-by: Gregor Noczinski <gregor@noczinski.eu>
Copy link
Member

@pyrooka pyrooka left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

First off, thank you for the contribution! It's not clear to me why the CI didn't catch this issue. I've checked and nothing was cached in the build, so it's indeed strange.
Anyhow, thanks again for the quick fix!

@pyrooka pyrooka merged commit 22e214a into IBM:main Nov 14, 2025
7 checks passed
ibm-devx-sdk pushed a commit that referenced this pull request Nov 14, 2025
## ibm-openapi-validator [1.37.5](https://github.com/IBM/openapi-validator/compare/ibm-openapi-validator@1.37.4...ibm-openapi-validator@1.37.5) (2025-11-14)

### Bug Fixes

* switch from `yaml.safeLoad` to `yaml.load` ([#771](#771)) ([22e214a](22e214a))
@ibm-devx-sdk
Copy link

🎉 This PR is included in version 1.37.5 🎉

The release is available on npm package (@latest dist-tag)

Your semantic-release bot 📦🚀

@blaubaer blaubaer deleted the fix-yaml-safeLoad branch November 14, 2025 21:24
@ibm-devx-sdk
Copy link

🎉 This PR is included in version 1.33.4 🎉

The release is available on npm package (@latest dist-tag)

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants