From b13737ef7087657e86f20391327a6f8fed3848ed Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 19 Aug 2026 13:34:12 +1000 Subject: [PATCH 1/6] build(deps): bump github/codeql-action/upload-sarif (#2803) Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.36.2 to 4.37.5. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...d1ba80a13dd99fba24a470575428917156a28b43) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.5 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 73de9837..22525d70 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -73,6 +73,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard (optional). # Commenting out will disable upload of results to your repo's Code Scanning dashboard - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/upload-sarif@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5 with: sarif_file: results.sarif From 0a64318a22d25374183fd75699d0d2077674c779 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 19 Aug 2026 13:34:22 +1000 Subject: [PATCH 2/6] build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#2801) Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 2.4.3 to 2.4.4. - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/4eaacf0543bb3f2c246792bd56e8cdeffafb205a...2d1146689b8cda280b9bc96326124645441f03bc) --- updated-dependencies: - dependency-name: ossf/scorecard-action dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 22525d70..9ecb17ac 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -39,7 +39,7 @@ jobs: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4 with: results_file: results.sarif results_format: sarif From e65fe663bf7679f6a3b98ad759bb1f80c4a3c22d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 19 Aug 2026 13:34:41 +1000 Subject: [PATCH 3/6] build(deps): bump github.com/magiconair/properties (#2799) Bumps [github.com/magiconair/properties](https://github.com/magiconair/properties) from 1.8.10 to 1.18.11. - [Release notes](https://github.com/magiconair/properties/releases) - [Commits](https://github.com/magiconair/properties/compare/v1.8.10...v1.18.11) --- updated-dependencies: - dependency-name: github.com/magiconair/properties dependency-version: 1.18.11 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 2ebd547f..96915efd 100644 --- a/go.mod +++ b/go.mod @@ -12,7 +12,7 @@ require ( github.com/goccy/go-yaml v1.19.2 github.com/hashicorp/hcl/v2 v2.24.0 github.com/jinzhu/copier v0.4.0 - github.com/magiconair/properties v1.8.10 + github.com/magiconair/properties v1.18.11 github.com/pelletier/go-toml/v2 v2.4.3 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e github.com/spf13/cobra v1.10.2 diff --git a/go.sum b/go.sum index e99d3473..b45ed73f 100644 --- a/go.sum +++ b/go.sum @@ -40,8 +40,8 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8= github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg= -github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE= -github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0= +github.com/magiconair/properties v1.18.11 h1:j5ozYZl0zCjG7ahMDH0GWIobOvvUzT0BdAguG0ViKy0= +github.com/magiconair/properties v1.18.11/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0= github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE= github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= From d6543ac3fecbebc7c1f1a68052b3bce67cf34350 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 19 Aug 2026 13:34:49 +1000 Subject: [PATCH 4/6] build(deps): bump github.com/alecthomas/repr from 0.5.2 to 0.5.4 (#2798) Bumps [github.com/alecthomas/repr](https://github.com/alecthomas/repr) from 0.5.2 to 0.5.4. - [Commits](https://github.com/alecthomas/repr/compare/v0.5.2...v0.5.4) --- updated-dependencies: - dependency-name: github.com/alecthomas/repr dependency-version: 0.5.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 96915efd..7fcb643a 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/mikefarah/yq/v4 require ( github.com/a8m/envsubst v1.4.3 github.com/alecthomas/participle/v2 v2.1.4 - github.com/alecthomas/repr v0.5.2 + github.com/alecthomas/repr v0.5.4 github.com/dimchansky/utfbom v1.1.1 github.com/elliotchance/orderedmap v1.8.0 github.com/fatih/color v1.19.0 diff --git a/go.sum b/go.sum index b45ed73f..720f6f45 100644 --- a/go.sum +++ b/go.sum @@ -6,8 +6,8 @@ github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8v github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k= github.com/alecthomas/participle/v2 v2.1.4 h1:W/H79S8Sat/krZ3el6sQMvMaahJ+XcM9WSI2naI7w2U= github.com/alecthomas/participle/v2 v2.1.4/go.mod h1:8tqVbpTX20Ru4NfYQgZf4mP18eXPTBViyMWiArNEgGI= -github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs= -github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4= +github.com/alecthomas/repr v0.5.4 h1:OVP7JEcuzU9CCDsT6STCr3rg17oQfWILtPWd2EG0uN4= +github.com/alecthomas/repr v0.5.4/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4= github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY= github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4= github.com/apparentlymart/go-textseg/v17 v17.0.1 h1:bpMXRgQ5cEoRNuQke1a80/Nl6w3G5eoIbWo9f3gXkAs= From 5c302ee313dab3cb22a09397e0a24b3fa06f8501 Mon Sep 17 00:00:00 2001 From: MsfPablo <129399053+MsfPablo@users.noreply.github.com> Date: Wed, 19 Aug 2026 05:43:22 +0200 Subject: [PATCH 5/6] perf: use io.WriteString in writeString to avoid heap allocation (#2809) writeString converted every string to []byte before calling io.Writer.Write, which Go escape analysis reports as escaping to the heap. io.WriteString uses the io.StringWriter fast path when available (the standard printer writer is a *bufio.Writer) and falls back to Write([]byte(txt)) otherwise. Fixes #2807 Co-authored-by: Pablo Garcia --- pkg/yqlib/utils.go | 2 +- pkg/yqlib/utils_test.go | 41 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 42 insertions(+), 1 deletion(-) create mode 100644 pkg/yqlib/utils_test.go diff --git a/pkg/yqlib/utils.go b/pkg/yqlib/utils.go index 2843e42d..e4036f03 100644 --- a/pkg/yqlib/utils.go +++ b/pkg/yqlib/utils.go @@ -50,7 +50,7 @@ func readStream(filename string) (io.Reader, error) { } func writeString(writer io.Writer, txt string) error { - _, errorWriting := writer.Write([]byte(txt)) + _, errorWriting := io.WriteString(writer, txt) return errorWriting } diff --git a/pkg/yqlib/utils_test.go b/pkg/yqlib/utils_test.go new file mode 100644 index 00000000..fc1b0026 --- /dev/null +++ b/pkg/yqlib/utils_test.go @@ -0,0 +1,41 @@ +package yqlib + +import ( + "bufio" + "bytes" + "io" + "testing" + + "github.com/mikefarah/yq/v4/test" +) + +// plainWriter only implements io.Writer, so io.WriteString must fall back to Write. +type plainWriter struct { + buf bytes.Buffer +} + +func (w *plainWriter) Write(p []byte) (int, error) { + return w.buf.Write(p) +} + +func TestWriteStringToStringWriter(t *testing.T) { + var buf bytes.Buffer + writer := bufio.NewWriter(&buf) + test.AssertResult(t, nil, writeString(writer, "hello world")) + test.AssertResult(t, nil, writer.Flush()) + test.AssertResult(t, "hello world", buf.String()) +} + +func TestWriteStringToPlainWriter(t *testing.T) { + writer := &plainWriter{} + test.AssertResult(t, nil, writeString(writer, "hello world")) + test.AssertResult(t, "hello world", writer.buf.String()) +} + +func TestWriteStringDoesNotAllocate(t *testing.T) { + writer := bufio.NewWriter(io.Discard) + allocations := testing.AllocsPerRun(100, func() { + _ = writeString(writer, "hello world") + }) + test.AssertResult(t, 0.0, allocations) +} From 6a182b6a3091d1baf0645978afacd0b066808ced Mon Sep 17 00:00:00 2001 From: Mike Farah Date: Wed, 19 Aug 2026 13:50:34 +1000 Subject: [PATCH 6/6] Fixing HCL non string key issue #2795 --- pkg/yqlib/decoder_hcl.go | 8 +++----- pkg/yqlib/hcl_test.go | 35 +++++++++++++++++++++++++++++++++++ pkg/yqlib/toml_test.go | 2 +- 3 files changed, 39 insertions(+), 6 deletions(-) diff --git a/pkg/yqlib/decoder_hcl.go b/pkg/yqlib/decoder_hcl.go index 11cd0030..321f1156 100644 --- a/pkg/yqlib/decoder_hcl.go +++ b/pkg/yqlib/decoder_hcl.go @@ -300,8 +300,7 @@ func convertHclExprToNode(expr hclsyntax.Expression, src []byte) *CandidateNode it := v.ElementIterator() for it.Next() { key, val := it.Element() - keyStr := key.AsString() - keyNode := createStringScalarNode(keyStr) + keyNode := convertCtyValueToNode(key) valNode := convertCtyValueToNode(val) m.AddKeyValueChild(keyNode, valNode) } @@ -338,8 +337,7 @@ func convertHclExprToNode(expr hclsyntax.Expression, src []byte) *CandidateNode } continue } - keyStr := keyVal.AsString() - keyNode := createStringScalarNode(keyStr) + keyNode := convertCtyValueToNode(keyVal) valNode := convertHclExprToNode(item.ValueExpr, src) m.AddKeyValueChild(keyNode, valNode) } @@ -460,7 +458,7 @@ func convertCtyValueToNode(v cty.Value) *CandidateNode { it := v.ElementIterator() for it.Next() { key, val := it.Element() - keyNode := createStringScalarNode(key.AsString()) + keyNode := convertCtyValueToNode(key) valNode := convertCtyValueToNode(val) m.AddKeyValueChild(keyNode, valNode) } diff --git a/pkg/yqlib/hcl_test.go b/pkg/yqlib/hcl_test.go index a8f22065..08618446 100644 --- a/pkg/yqlib/hcl_test.go +++ b/pkg/yqlib/hcl_test.go @@ -176,6 +176,41 @@ var hclFormatScenarios = []formatScenario{ expected: "obj: {a: 1, b: \"two\"}\n", scenarioType: "decode", }, + { + description: "object with integer keys", + skipDoc: true, + input: `obj = { 1 = "one", 2 = "two" }`, + expected: "obj: {1: \"one\", 2: \"two\"}\n", + scenarioType: "decode", + }, + { + description: "object with boolean keys", + skipDoc: true, + input: `obj = { (true) = "yes", (false) = "no" }`, + expected: "obj: {true: \"yes\", false: \"no\"}\n", + scenarioType: "decode", + }, + { + description: "object with float keys", + skipDoc: true, + input: `obj = { (3.14) = "pi" }`, + expected: "obj: {3.14: \"pi\"}\n", + scenarioType: "decode", + }, + { + description: "object with mixed scalar keys", + skipDoc: true, + input: `obj = { a = 1, 1 = "one", (true) = "yes" }`, + expected: "obj: {a: 1, 1: \"one\", true: \"yes\"}\n", + scenarioType: "decode", + }, + { + description: "nested object with integer keys", + skipDoc: true, + input: `config = { levels = { 1 = "debug", 2 = "info" } }`, + expected: "config: {levels: {1: \"debug\", 2: \"info\"}}\n", + scenarioType: "decode", + }, { description: "nested block", skipDoc: true, diff --git a/pkg/yqlib/toml_test.go b/pkg/yqlib/toml_test.go index d36c10cd..634dd15c 100644 --- a/pkg/yqlib/toml_test.go +++ b/pkg/yqlib/toml_test.go @@ -369,7 +369,7 @@ var tomlScenarios = []formatScenario{ skipDoc: true, description: "blank", input: `A = "hello`, - expectedError: `bad file 'sample.yml': basic string not terminated by "`, + expectedError: `bad file 'sample.yml': unterminated basic string`, scenarioType: "decode-error", }, {