b13737ef70
build(deps): bump github/codeql-action/upload-sarif ( #2803 )
...
Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ) from 4.36.2 to 4.37.5.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...d1ba80a13dd99fba24a470575428917156a28b43 )
---
updated-dependencies:
- dependency-name: github/codeql-action/upload-sarif
dependency-version: 4.37.5
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-19 13:34:12 +10:00
Mike Farah
7862131c9c
Generalising the empty array fix to map
2026-08-03 13:31:47 +10:00
Dustin Persek and GitHub
b74aefd55f
Fix deleting commented empty list YAML output ( #2765 )
2026-08-03 13:20:19 +10:00
2fbc2eab20
fix(has): return false for negative array indices ( #2769 )
...
The sequence branch only checked the upper bound (len > index), so has(-1) returned true even on an empty array. Guard index >= 0.
Co-authored-by: max <max@example.com >
2026-08-03 13:15:14 +10:00
0d4490b875
fix(sort): avoid int64 overflow comparing large integers ( #2771 )
...
The int/int comparator returned int(lhs - rhs); the int64 subtraction overflows for large-magnitude values, giving the wrong sign. Compare directly instead.
Co-authored-by: max <max@example.com >
2026-08-03 13:14:29 +10:00
Hani Harzallah and GitHub
b7c9d01670
fix: preserve correct parent references in explode merge anchor reconstruction ( #2730 )
...
When explode resolves merge anchors (<<:), items copied from the
alias target retained the original parent pointer instead of being
set to the enclosing node being reconstructed. This caused GetPath()
to return wrong paths for children of merge-anchored nodes, making
subsequent merge operations target the wrong LHS keys.
In fixedReconstructAliasedMap, set copied.Parent = node after copy.
In reconstructAliasedMap (non-spec path), replace AddChild (which
creates sequence-style numeric-index entries) with AddKeyValueChild
to properly reconstruct mapping key-value pairs. AddKeyValueChild
also correctly sets parent references via SetParent.
2026-08-03 13:07:34 +10:00
Michael Pursifull and GitHub
a0c6389b58
Guard ExpressionParser initialization with sync.Once ( #2789 )
...
* Guard ExpressionParser initialization with sync.Once
The evaluators call InitExpressionParser on every Evaluate, so two goroutines
could construct a parser at the same time. newParticipleLexer also fills in the
ParticipleTokenType field on each shared participleYqRules entry as it builds
the lexer, which another goroutine could be reading through getYqDefinition.
These are pointer and struct field writes rather than map writes, so the
runtime does not stop the process; it corrupts quietly instead.
The nil check stays inside the Once so a caller that assigns ExpressionParser
itself is still respected.
Fixes #2788
* docs: use UK spelling for initialised in new comments
Matches the existing prose convention in pkg/yqlib (operator_reduce.go,
decoder_ini.go, operator_alternative_test.go). Review feedback on #2789 .
2026-08-03 12:51:40 +10:00
e2e7bfe397
Bump golang.org/x/net from 0.56.0 to 0.57.0 ( #2777 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.56.0 to 0.57.0.
- [Commits](https://github.com/golang/net/compare/v0.56.0...v0.57.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.57.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-03 12:40:13 +10:00
Joeseph Grey and GitHub
86ce5860d5
fix: reject negative indent instead of panicking ( #2746 )
2026-08-03 11:37:58 +10:00
Dev Kumar and GitHub
341734d6ec
Default to yaml when a file's extension is not a recognised format ( #2785 )
...
* Default to yaml for unrecognised file extensions in format auto-detection
* Add test for unrecognised extension defaulting to yaml
2026-08-03 11:37:38 +10:00
Joeseph Grey and GitHub
b7a06d6e1f
fix: parse signed hex and octal integers ( #2749 )
2026-08-03 11:36:24 +10:00
0beddf45fa
Bump golang.org/x/text from 0.38.0 to 0.40.0 ( #2779 )
...
Bumps [golang.org/x/text](https://github.com/golang/text ) from 0.38.0 to 0.40.0.
- [Release notes](https://github.com/golang/text/releases )
- [Commits](https://github.com/golang/text/compare/v0.38.0...v0.40.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/text
dependency-version: 0.40.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-03 11:32:37 +10:00
51b09b9804
Bump golang from 1.26.4 to 1.26.5 ( #2776 )
...
Bumps golang from 1.26.4 to 1.26.5.
---
updated-dependencies:
- dependency-name: golang
dependency-version: 1.26.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-03 11:32:18 +10:00
Joeseph Grey and GitHub
9246871b8b
fix: skip UTF-8 BOM when processing front matter ( #2751 )
...
* fix: skip UTF-8 BOM when processing front matter
--front-matter=process wrapped the file in a bufio.Reader without
skipping a leading UTF-8 BOM, so a BOM before the opening --- meant the
separator was not recognised and the opening --- was dropped from the
output (data loss). Skip the BOM with utfbom.Skip before wrapping the
reader, matching the CSV object decoder.
* refactor: inline UTF-8 BOM skip instead of utfbom dependency
per ccoVeille's review, front matter only needs UTF-8 BOM handling, not
the full utfbom package. replace utfbom.Skip with a small unexported
stripUTF8BOM helper and add a stdin-path regression test alongside the
existing file-path one. utfbom stays in go.mod since decoder_csv_object.go
still uses it for CSV decoding.
2026-08-03 11:29:33 +10:00
54a601cbcd
Bump softprops/action-gh-release from 3.0.0 to 3.0.1 ( #2758 )
...
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release ) from 3.0.0 to 3.0.1.
- [Release notes](https://github.com/softprops/action-gh-release/releases )
- [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md )
- [Commits](https://github.com/softprops/action-gh-release/compare/b4309332981a82ec1c5618f44dd2e27cc8bfbfda...718ea10b132b3b2eba29c1007bb80653f286566b )
---
updated-dependencies:
- dependency-name: softprops/action-gh-release
dependency-version: 3.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-03 11:26:37 +10:00
1b14640bef
Bump docker/setup-qemu-action from 4.1.0 to 4.2.0 ( #2767 )
...
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action ) from 4.1.0 to 4.2.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases )
- [Commits](https://github.com/docker/setup-qemu-action/compare/06116385d9baf250c9f4dcb4858b16962ea869c3...96fe6ef7f33517b61c61be40b68a1882f3264fb8 )
---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
dependency-version: 4.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-03 11:25:02 +10:00
2db3a7d158
Bump actions/checkout from 6.0.3 to 7.0.0 ( #2760 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-03 11:24:54 +10:00
ed123af40e
Bump docker/login-action from 4.2.0 to 4.4.0 ( #2775 )
...
Bumps [docker/login-action](https://github.com/docker/login-action ) from 4.2.0 to 4.4.0.
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/650006c6eb7dba73a995cc03b0b2d7f5ca915bee...af1e73f918a031802d376d3c8bbc3fe56130a9b0 )
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 4.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-03 11:22:20 +10:00
88c884caa7
Bump github.com/pelletier/go-toml/v2 from 2.4.2 to 2.4.3 ( #2778 )
...
Bumps [github.com/pelletier/go-toml/v2](https://github.com/pelletier/go-toml ) from 2.4.2 to 2.4.3.
- [Release notes](https://github.com/pelletier/go-toml/releases )
- [Commits](https://github.com/pelletier/go-toml/compare/v2.4.2...v2.4.3 )
---
updated-dependencies:
- dependency-name: github.com/pelletier/go-toml/v2
dependency-version: 2.4.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-03 11:21:21 +10:00
38642c95ef
Bump github.com/zclconf/go-cty from 1.18.1 to 1.19.0 ( #2780 )
...
Bumps [github.com/zclconf/go-cty](https://github.com/zclconf/go-cty ) from 1.18.1 to 1.19.0.
- [Release notes](https://github.com/zclconf/go-cty/releases )
- [Changelog](https://github.com/zclconf/go-cty/blob/main/CHANGELOG.md )
- [Commits](https://github.com/zclconf/go-cty/compare/v1.18.1...v1.19.0 )
---
updated-dependencies:
- dependency-name: github.com/zclconf/go-cty
dependency-version: 1.19.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-03 11:21:03 +10:00
a67d37793b
Bump golang.org/x/mod from 0.37.0 to 0.38.0 ( #2781 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.37.0 to 0.38.0.
- [Commits](https://github.com/golang/mod/compare/v0.37.0...v0.38.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-version: 0.38.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-03 11:20:42 +10:00
e2f1d5ccf7
Bump go.yaml.in/yaml/v4 from 4.0.0-rc.5 to 4.0.0-rc.6 ( #2759 )
...
Bumps [go.yaml.in/yaml/v4](https://github.com/yaml/go-yaml ) from 4.0.0-rc.5 to 4.0.0-rc.6.
- [Commits](https://github.com/yaml/go-yaml/compare/v4.0.0-rc.5...v4.0.0-rc.6 )
---
updated-dependencies:
- dependency-name: go.yaml.in/yaml/v4
dependency-version: 4.0.0-rc.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-29 16:54:05 +10:00
16f149b351
Bump github.com/pelletier/go-toml/v2 from 2.4.0 to 2.4.2 ( #2762 )
...
Bumps [github.com/pelletier/go-toml/v2](https://github.com/pelletier/go-toml ) from 2.4.0 to 2.4.2.
- [Release notes](https://github.com/pelletier/go-toml/releases )
- [Commits](https://github.com/pelletier/go-toml/compare/v2.4.0...v2.4.2 )
---
updated-dependencies:
- dependency-name: github.com/pelletier/go-toml/v2
dependency-version: 2.4.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-29 16:53:39 +10:00
5da9215306
Bump actions/setup-go from 6.4.0 to 6.5.0 ( #2763 )
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 6.4.0 to 6.5.0.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/4a3601121dd01d1626a1e23e37211e3254c1c06c...924ae3a1cded613372ab5595356fb5720e22ba16 )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-version: 6.5.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-29 16:53:18 +10:00
e95bb7e472
Bump golang.org/x/net from 0.55.0 to 0.56.0 ( #2740 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.55.0 to 0.56.0.
- [Commits](https://github.com/golang/net/compare/v0.55.0...v0.56.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.56.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-23 11:11:00 +10:00
2074319595
Bump golang.org/x/mod from 0.36.0 to 0.37.0 ( #2741 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.36.0 to 0.37.0.
- [Commits](https://github.com/golang/mod/compare/v0.36.0...v0.37.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-version: 0.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-23 10:04:36 +10:00
be992d8add
Bump alpine from a2d49ea to 28bd5fe ( #2752 )
...
Bumps alpine from `a2d49ea` to `28bd5fe`.
---
updated-dependencies:
- dependency-name: alpine
dependency-version: '3'
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-23 10:04:28 +10:00
637bb1fecd
Bump golang from 11fd8f7 to 792443b ( #2753 )
...
Bumps golang from `11fd8f7` to `792443b`.
---
updated-dependencies:
- dependency-name: golang
dependency-version: 1.26.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-23 10:04:05 +10:00
bc23b42789
Bump github.com/pelletier/go-toml/v2 from 2.3.1 to 2.4.0 ( #2754 )
...
Bumps [github.com/pelletier/go-toml/v2](https://github.com/pelletier/go-toml ) from 2.3.1 to 2.4.0.
- [Release notes](https://github.com/pelletier/go-toml/releases )
- [Commits](https://github.com/pelletier/go-toml/compare/v2.3.1...v2.4.0 )
---
updated-dependencies:
- dependency-name: github.com/pelletier/go-toml/v2
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-23 10:03:55 +10:00
8e2c9b612d
Bump golang from 68cb6d6 to 11fd8f7 ( #2738 )
...
Bumps golang from `68cb6d6` to `11fd8f7`.
---
updated-dependencies:
- dependency-name: golang
dependency-version: 1.26.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-16 16:46:10 +10:00
0970cd4b05
Bump alpine from 5b10f43 to a2d49ea ( #2739 )
...
Bumps alpine from `5b10f43` to `a2d49ea`.
---
updated-dependencies:
- dependency-name: alpine
dependency-version: '3'
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-16 16:46:03 +10:00
bf3591a234
Bump golang.org/x/text from 0.37.0 to 0.38.0 ( #2742 )
...
Bumps [golang.org/x/text](https://github.com/golang/text ) from 0.37.0 to 0.38.0.
- [Release notes](https://github.com/golang/text/releases )
- [Commits](https://github.com/golang/text/compare/v0.37.0...v0.38.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/text
dependency-version: 0.38.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-16 16:45:37 +10:00
09f1565d51
Bump github/codeql-action from 4.35.2 to 4.36.2 ( #2743 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.35.2 to 4.36.2.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...8aad20d150bbac5944a9f9d289da16a4b0d87c1e )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.36.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-16 16:29:01 +10:00
13d340ff51
Bump sigstore/cosign-installer from 3.10.1 to 4.1.2 ( #2744 )
...
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer ) from 3.10.1 to 4.1.2.
- [Release notes](https://github.com/sigstore/cosign-installer/releases )
- [Commits](https://github.com/sigstore/cosign-installer/compare/7e8b541eb2e61bf99390e1afd4be13a184e9ebc5...6f9f17788090df1f26f669e9d70d6ae9567deba6 )
---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
dependency-version: 4.1.2
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-16 16:28:52 +10:00
Mike Farah
5cf0adcc5b
Adding some tests
2026-06-09 14:23:11 +10:00
William Floyd and GitHub
30e16a33c3
Fix for #2677 ( #2705 )
...
* Update docs given https://github.com/yaml/go-yaml/pull/348
* Fix for https://github.com/mikefarah/yq/issues/2677
Depends on https://github.com/yaml/go-yaml/pull/348
* Test for https://github.com/mikefarah/yq/issues/2677
* Remove redundant check and add test case for explicit `!!merge` on `*+` traversal
* Bump go.yaml.in/yaml/v4 from 4.0.0-rc.4 to 4.0.0-rc.5
2026-06-09 14:08:47 +10:00
Mike Farah
25dfcf280f
Switch to typos from cspell - no more npm
2026-06-07 20:09:44 +10:00
Mike Farah
91a166e8d8
Pinning using hashes
2026-06-07 19:57:15 +10:00
Mike Farah
f9b0d7e45d
Pinning using hashes
2026-06-07 19:49:39 +10:00
Mike Farah
48a851bf57
Fixing toml docs
2026-06-07 19:47:11 +10:00
Mike Farah
131aa0b7cc
pinning deps
2026-06-07 19:46:58 +10:00
Mike Farah
ef3c14f806
project words
2026-06-07 18:21:59 +10:00
Mike Farah
26434e221e
Process for SHA-pin github action
2026-06-07 18:19:13 +10:00
Mike Farah
0eebc242fb
New workflow for github action
2026-06-07 08:56:21 +10:00
Mike Farah
87a62da881
New workflow for github action
2026-06-07 08:54:17 +10:00
Mike Farah
ef507264e1
New workflow for github action
2026-06-07 08:50:24 +10:00
Mike Farah
2a40eb3d04
Bumping github action docker file
2026-06-07 08:45:27 +10:00
Mike Farah
e3cb1dc7c6
Fixing build
2026-06-07 07:03:26 +10:00
Mike Farah
1b9b4ac518
Bumping version
2026-06-06 20:59:47 +10:00
Mike Farah
9b67d655f1
Portable bump version
2026-06-06 20:59:43 +10:00
