Merge 0cc5c19843 into e95bb7e472

Bump golang.org/x/net from 0.55.0 to 0.56.0 (#2740 )
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.55.0 to 0.56.0. - [Commits](https://github.com/golang/net/compare/v0.55.0...v0.56.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.56.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-06 04:45:39 +00:00 · 2026-06-27 01:46:13 -04:00 · 2026-06-23 11:11:00 +10:00 · 2026-06-23 10:04:36 +10:00 · 2026-06-23 10:04:28 +10:00 · 2026-06-23 10:04:05 +10:00
6 changed files with 68 additions and 26 deletions
--- a/4
+++ b/4
@ -1,4 +1,4 @@
-FROM golang:1.26.4@sha256:11fd8f7f63db3b6fb198797042ba4c40a4a34dc83325d3328ca3bc4bb7726786 AS builder
+FROM golang:1.26.4@sha256:792443b89f65105abba56b9bd5e97f680a80074ac62fc844a584212f8c8102c3 AS builder

 WORKDIR /go/src/mikefarah/yq

@ -10,7 +10,7 @@ RUN ./scripts/acceptance.sh

 # Choose alpine as a base image to make this useful for CI, as many
 # CI tools expect an interactive shell inside the container
-FROM alpine:3@sha256:a2d49ea686c2adfe3c992e47dc3b5e7fa6e6b5055609400dc2acaeb241c829f4 AS production
+FROM alpine:3@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS production
 LABEL maintainer="Mike Farah <mikefarah@users.noreply.github.com>"

 COPY --from=builder /go/src/mikefarah/yq/yq /usr/bin/yq
--- a/Dockerfile.dev
+++ b/Dockerfile.dev
@ -1,4 +1,4 @@
-FROM golang:1.26.4@sha256:11fd8f7f63db3b6fb198797042ba4c40a4a34dc83325d3328ca3bc4bb7726786
+FROM golang:1.26.4@sha256:792443b89f65105abba56b9bd5e97f680a80074ac62fc844a584212f8c8102c3

 COPY scripts/devtools.sh /opt/devtools.sh

--- a/go.mod
+++ b/go.mod
@ -13,15 +13,15 @@ require (
 	github.com/hashicorp/hcl/v2 v2.24.0
 	github.com/jinzhu/copier v0.4.0
 	github.com/magiconair/properties v1.8.10
-	github.com/pelletier/go-toml/v2 v2.3.1
+	github.com/pelletier/go-toml/v2 v2.4.0
 	github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/yuin/gopher-lua v1.1.2
 	github.com/zclconf/go-cty v1.18.1
 	go.yaml.in/yaml/v4 v4.0.0-rc.5
-	golang.org/x/mod v0.36.0
-	golang.org/x/net v0.55.0
+	golang.org/x/mod v0.37.0
+	golang.org/x/net v0.56.0
 	golang.org/x/text v0.38.0
 )

@ -34,7 +34,7 @@ require (
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
 	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
 	golang.org/x/tools v0.45.0 // indirect
 )

--- a/go.sum
+++ b/go.sum
@ -46,8 +46,8 @@ github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWE
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
 github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
-github.com/pelletier/go-toml/v2 v2.3.1 h1:MYEvvGnQjeNkRF1qUuGolNtNExTDwct51yp7olPtrEc=
-github.com/pelletier/go-toml/v2 v2.3.1/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pelletier/go-toml/v2 v2.4.0 h1:Mwu0mAkUKbittDs3/ADDWXqMmq3EOK2VHiuCkV00Row=
+github.com/pelletier/go-toml/v2 v2.4.0/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e h1:aoZm08cpOy4WuID//EZDgcC4zIxODThtZNPirFr42+A=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@ -70,15 +70,15 @@ github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmB
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v4 v4.0.0-rc.5 h1:JVliQq9EGOYaTgMi+k8BhUJyqcGk4ZqeuiN1Cirba9c=
 go.yaml.in/yaml/v4 v4.0.0-rc.5/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
-golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
-golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
-golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
-golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
 golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
 golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
 golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
--- a/pkg/yqlib/operator_traverse_path.go
+++ b/pkg/yqlib/operator_traverse_path.go
@ -111,10 +111,10 @@ func traverseArrayOperator(d *dataTreeNavigator, context Context, expressionNode
 		return Context{}, err
 	}

-	// rhs is a collect expression that will yield indices to retrieve of the arrays
-
+	// rhs is a collect expression that yields the indices to retrieve. It is
+	// evaluated over the whole context, producing one index set per incoming
+	// candidate.
 	rhs, err := d.GetMatchingNodes(context.ReadOnlyClone(), expressionNode.RHS)
-
 	if err != nil {
 		return Context{}, err
 	}
@ -123,16 +123,37 @@ func traverseArrayOperator(d *dataTreeNavigator, context Context, expressionNode
 	if expressionNode.Operation.Preferences != nil {
 		prefs = expressionNode.Operation.Preferences.(traversePreferences)
 	}
-	var indicesToTraverse = rhs.MatchingNodes.Front().Value.(*CandidateNode).Content

-	log.Debugf("indicesToTraverse %v", len(indicesToTraverse))
-
-	//now we traverse the result of the lhs against the indices we found
-	result, err := traverseNodesWithArrayIndices(lhs, indicesToTraverse, prefs)
-	if err != nil {
-		return Context{}, err
+	results := list.New()
+	if lhs.MatchingNodes.Len() == rhs.MatchingNodes.Len() {
+		// One index set per LHS node (both derive from the same context):
+		// traverse each LHS node with its own index set. Previously only the
+		// first index set was used, so a context-dependent index like `$o[.]`
+		// over a `keys[]` stream dropped every match but the first (#2593).
+		rhsEl := rhs.MatchingNodes.Front()
+		for lhsEl := lhs.MatchingNodes.Front(); lhsEl != nil; lhsEl = lhsEl.Next() {
+			indicesToTraverse := rhsEl.Value.(*CandidateNode).Content
+			result, err := traverseNodesWithArrayIndices(context.SingleChildContext(lhsEl.Value.(*CandidateNode)), indicesToTraverse, prefs)
+			if err != nil {
+				return Context{}, err
+			}
+			results.PushBackList(result.MatchingNodes)
+			rhsEl = rhsEl.Next()
+		}
+	} else {
+		// LHS collapsed to a single node (e.g. a variable) while the index
+		// varies per candidate: traverse the LHS against every index set.
+		for rhsEl := rhs.MatchingNodes.Front(); rhsEl != nil; rhsEl = rhsEl.Next() {
+			indicesToTraverse := rhsEl.Value.(*CandidateNode).Content
+			result, err := traverseNodesWithArrayIndices(lhs, indicesToTraverse, prefs)
+			if err != nil {
+				return Context{}, err
+			}
+			results.PushBackList(result.MatchingNodes)
+		}
 	}
-	return context.ChildContext(result.MatchingNodes), nil
+
+	return context.ChildContext(results), nil
 }

 func traverseNodesWithArrayIndices(context Context, indicesToTraverse []*CandidateNode, prefs traversePreferences) (Context, error) {
--- a/pkg/yqlib/operator_traverse_path_test.go
+++ b/pkg/yqlib/operator_traverse_path_test.go
@ -675,6 +675,27 @@ var traversePathOperatorScenarios = []expressionScenario{
 		expression:    ". = (.x = 1)",
 		expectedError: "alias cycle detected",
 	},
+	{
+		// Regression test for https://github.com/mikefarah/yq/issues/2593
+		// A context-dependent index (here the streamed key) must be applied
+		// per candidate; previously only the first index was used.
+		skipDoc:    true,
+		document:   `["a","b"]`,
+		expression: `. as $o | keys[] | $o[.]`,
+		expected: []string{
+			"D0, P[0], (!!str)::a\n",
+			"D0, P[1], (!!str)::b\n",
+		},
+	},
+	{
+		skipDoc:    true,
+		document:   `{"x": 1, "y": 2}`,
+		expression: `. as $o | keys[] | $o[.]`,
+		expected: []string{
+			"D0, P[x], (!!int)::1\n",
+			"D0, P[y], (!!int)::2\n",
+		},
+	},
 }

 func TestTraversePathOperatorScenarios(t *testing.T) {
Author	SHA1	Message	Date
Joeseph Grey	755dd15055	Merge `0cc5c19843` into `e95bb7e472`	2026-06-27 01:46:13 -04:00
dependabot[bot]	e95bb7e472	Bump golang.org/x/net from 0.55.0 to 0.56.0 (#2740 ) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.55.0 to 0.56.0. - [Commits](https://github.com/golang/net/compare/v0.55.0...v0.56.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.56.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-23 11:11:00 +10:00
dependabot[bot]	2074319595	Bump golang.org/x/mod from 0.36.0 to 0.37.0 (#2741 ) Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.36.0 to 0.37.0. - [Commits](https://github.com/golang/mod/compare/v0.36.0...v0.37.0) --- updated-dependencies: - dependency-name: golang.org/x/mod dependency-version: 0.37.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-23 10:04:36 +10:00
dependabot[bot]	be992d8add	Bump alpine from `a2d49ea` to `28bd5fe` (#2752 ) Bumps alpine from `a2d49ea` to `28bd5fe`. --- updated-dependencies: - dependency-name: alpine dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-23 10:04:28 +10:00
dependabot[bot]	637bb1fecd	Bump golang from `11fd8f7` to `792443b` (#2753 ) Bumps golang from `11fd8f7` to `792443b`. --- updated-dependencies: - dependency-name: golang dependency-version: 1.26.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-23 10:04:05 +10:00
dependabot[bot]	bc23b42789	Bump github.com/pelletier/go-toml/v2 from 2.3.1 to 2.4.0 (#2754 ) Bumps [github.com/pelletier/go-toml/v2](https://github.com/pelletier/go-toml) from 2.3.1 to 2.4.0. - [Release notes](https://github.com/pelletier/go-toml/releases) - [Commits](https://github.com/pelletier/go-toml/compare/v2.3.1...v2.4.0) --- updated-dependencies: - dependency-name: github.com/pelletier/go-toml/v2 dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-23 10:03:55 +10:00
StressTestor	0cc5c19843	fix: apply per-candidate index when traversing arrays/maps by a streamed index `$o[.]` over a streamed context (e.g. `keys[] \| $o[.]`) only returned the first match. The index expression yields one index set per incoming candidate, but traverseArrayOperator used only the first set (rhs.MatchingNodes.Front()), dropping the rest. Pair each index set with its candidate: when the LHS has one node per candidate (e.g. `.[] \| .[idx]`) each node is traversed with its own index set; when the LHS collapses to a single node (a variable) it is traversed against every index set. Covers both arrays and maps. Fixes #2593.	2026-06-15 16:00:44 -06:00