3.14.2 released

Author: puzrin

CHANGELOG.md

@@ -6,6 +6,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 
+## [3.14.2] - 2025-11-15
+### Security
+- Fix prototype pollution in merge (<<).
+
+
 ## [3.14.1] - 2020-12-07
 ### Security
 - Fix possible code execution in (already unsafe) `.load()` (in &anchor).
@@ -484,6 +489,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - First public release
 
 
+[3.14.2]: https://github.com/nodeca/js-yaml/compare/3.14.1...3.14.2
 [3.14.1]: https://github.com/nodeca/js-yaml/compare/3.14.0...3.14.1
 [3.14.0]: https://github.com/nodeca/js-yaml/compare/3.13.1...3.14.0
 [3.13.1]: https://github.com/nodeca/js-yaml/compare/3.13.0...3.13.1

package.json

@@ -1,6 +1,6 @@
 {
   "name": "js-yaml",
-  "version": "3.14.1",
+  "version": "3.14.2",
   "description": "YAML 1.2 parser and serializer",
   "keywords": [
     "yaml",