
Security News
Crates.io Users Targeted by Phishing Emails
The Rust Security Response WG is warning of phishing emails from rustfoundation.dev targeting crates.io users.
The 'yaml-lint' npm package is a tool for validating YAML files. It checks for syntax errors and ensures that the YAML content is properly formatted. This is particularly useful for developers who work with YAML configuration files and need to ensure their correctness.
Linting YAML files
This feature allows you to lint a YAML string to check for syntax errors. If the YAML content is valid, it will log 'YAML is valid'. If there are any errors, it will catch them and log 'YAML is invalid' along with the error details.
const yamlLint = require('yaml-lint');
const yamlContent = `
foo: bar
baz: qux
`;
yamlLint.lint(yamlContent)
.then(() => {
console.log('YAML is valid');
})
.catch((error) => {
console.error('YAML is invalid:', error);
});
Linting YAML files from the filesystem
This feature allows you to lint a YAML file from the filesystem. It reads the file content and checks for syntax errors. If the file is valid, it will log 'YAML file is valid'. If there are any errors, it will catch them and log 'YAML file is invalid' along with the error details.
const yamlLint = require('yaml-lint');
const fs = require('fs');
const yamlFilePath = 'path/to/your/file.yaml';
fs.readFile(yamlFilePath, 'utf8', (err, data) => {
if (err) throw err;
yamlLint.lint(data)
.then(() => {
console.log('YAML file is valid');
})
.catch((error) => {
console.error('YAML file is invalid:', error);
});
});
The 'js-yaml' package is a YAML parser and dumper for JavaScript. It can parse YAML strings into JavaScript objects and serialize JavaScript objects into YAML strings. Unlike 'yaml-lint', 'js-yaml' focuses more on parsing and serializing YAML rather than just linting.
The 'yaml' package is another YAML parser and stringifier for JavaScript. It provides a comprehensive set of features for working with YAML, including parsing, stringifying, and schema validation. It offers more advanced features compared to 'yaml-lint', which is primarily focused on linting.
The 'yaml-js' package is a pure JavaScript YAML parser and serializer. It provides basic functionality for parsing and serializing YAML, similar to 'js-yaml' and 'yaml'. It is less focused on linting and more on general YAML manipulation.
A simple (CLI) tool to lint YAML files
npm install --save-dev yaml-lint
const yamlLint = require('yaml-lint');
yamlLint
.lint('test: 123')
.then(() => {
console.log('Valid YAML file.');
})
.catch((error) => {
console.error('Invalid YAML file.', error);
});
npm install -g yaml-lint
yamllint test.yaml
YAML Lint is configured using the following options via a configuration file, environment variables, and/or command-line arguments.
First of all, YAML Lint looks for a JSON file called .yaml-lint.json
within the current working directory.
{
"schema": "CORE_SCHEMA",
"ignore": "dir/*.yaml"
}
Afterwards, YAML Lint will take environment variables into account.
YAMLLINT_SCHEMA=CORE_SCHEMA YAMLLINT_IGNORE=dir/*.yaml yamllint
Concluding, YAML Lint will take command-line arguments into account.
yamllint --schema=CORE_SCHEMA --ignore=dir/*.yaml
(All options are merged into a single configuration using the hierarchy described above.)
schema
(string)Specifies a schema to use
DEFAULT_SCHEMA
All supported YAML typesFAILSAFE_SCHEMA
Only strings, arrays, and plain objects (http://www.yaml.org/spec/1.2/spec.html#id2802346)JSON_SCHEMA
All JSON-supported types (http://www.yaml.org/spec/1.2/spec.html#id2803231)CORE_SCHEMA
Same as JSON_SCHEMA
(http://www.yaml.org/spec/1.2/spec.html#id2804923)ignore
(string or array of strings)Specifies one or multiple glob patterns to ignore
yamllint **/*.(yaml|yml) --ignore=foobar.yml --ignore=dir/*.yaml
nocase
rule to prevent problems on WindowsCopyright (c) 2022 Thomas Rasshofer
Licensed under the MIT license.
See LICENSE for more info.
FAQs
A simple (CLI) tool to lint YAML files
The npm package yaml-lint receives a total of 261,556 weekly downloads. As such, yaml-lint popularity was classified as popular.
We found that yaml-lint demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
The Rust Security Response WG is warning of phishing emails from rustfoundation.dev targeting crates.io users.
Product
Socket now lets you customize pull request alert headers, helping security teams share clear guidance right in PRs to speed reviews and reduce back-and-forth.
Product
Socket's Rust support is moving to Beta: all users can scan Cargo projects and generate SBOMs, including Cargo.toml-only crates, with Rust-aware supply chain checks.