Merge 1f89111452 into 8e2c9b612d

Bump golang from 68cb6d6 to 11fd8f7 (#2738 )
Bumps golang from `68cb6d6` to `11fd8f7`. --- updated-dependencies: - dependency-name: golang dependency-version: 1.26.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-03 19:05:38 +00:00 · 2026-06-17 10:55:49 +02:00 · 2026-06-16 16:46:10 +10:00 · 2026-06-16 16:46:03 +10:00 · 2026-06-16 16:45:37 +10:00 · 2026-06-16 16:29:01 +10:00
9 changed files with 48 additions and 19 deletions
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@ -44,7 +44,7 @@ jobs:

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
      with:
        languages: ${{ matrix.language }}
        # If you wish to specify custom queries, you can do so here or in a config file.
@ -55,7 +55,7 @@ jobs:
    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
    # If this step fails, then you should remove it and run the build manually (see below)
    - name: Autobuild
-      uses: github/codeql-action/autobuild@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+      uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2

    # ℹ️ Command-line programs to run using the OS shell.
    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@ -69,4 +69,4 @@ jobs:
    #   make release

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@ -43,7 +43,7 @@ jobs:
            man.md

      - name: Install cosign
-        uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Cross compile
        run: |
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@ -73,6 +73,6 @@ jobs:
      # Upload the results to GitHub's code scanning dashboard (optional).
      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
      - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
        with:
          sarif_file: results.sarif
--- a/4
+++ b/4
@ -1,4 +1,4 @@
-FROM golang:1.26.4@sha256:68cb6d68bed024785b69195b89af7ac7a444f27791435f98647edff595aa0479 AS builder
+FROM golang:1.26.4@sha256:11fd8f7f63db3b6fb198797042ba4c40a4a34dc83325d3328ca3bc4bb7726786 AS builder

 WORKDIR /go/src/mikefarah/yq

@ -10,7 +10,7 @@ RUN ./scripts/acceptance.sh

 # Choose alpine as a base image to make this useful for CI, as many
 # CI tools expect an interactive shell inside the container
-FROM alpine:3@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11 AS production
+FROM alpine:3@sha256:a2d49ea686c2adfe3c992e47dc3b5e7fa6e6b5055609400dc2acaeb241c829f4 AS production
 LABEL maintainer="Mike Farah <mikefarah@users.noreply.github.com>"

 COPY --from=builder /go/src/mikefarah/yq/yq /usr/bin/yq
--- a/Dockerfile.dev
+++ b/Dockerfile.dev
@ -1,4 +1,4 @@
-FROM golang:1.26.4@sha256:68cb6d68bed024785b69195b89af7ac7a444f27791435f98647edff595aa0479
+FROM golang:1.26.4@sha256:11fd8f7f63db3b6fb198797042ba4c40a4a34dc83325d3328ca3bc4bb7726786

 COPY scripts/devtools.sh /opt/devtools.sh

--- a/go.mod
+++ b/go.mod
@ -22,7 +22,7 @@ require (
 	go.yaml.in/yaml/v4 v4.0.0-rc.5
 	golang.org/x/mod v0.36.0
 	golang.org/x/net v0.55.0
-	golang.org/x/text v0.37.0
+	golang.org/x/text v0.38.0
 )

 require (
@ -33,9 +33,9 @@ require (
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
-	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sync v0.21.0 // indirect
 	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/tools v0.44.0 // indirect
+	golang.org/x/tools v0.45.0 // indirect
 )

 go 1.25.0
--- a/go.sum
+++ b/go.sum
@ -74,15 +74,15 @@ golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
 golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
 golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
 golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
 golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
-golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
-golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
+golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
+golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
+golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
+golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
--- a/pkg/yqlib/operator_anchors_aliases.go
+++ b/pkg/yqlib/operator_anchors_aliases.go
@ -183,7 +183,9 @@ func fixedReconstructAliasedMap(node *CandidateNode) error {
 				})

 				for _, item := range itemsToAdd {
-					newContent = append(newContent, item.Copy())
+					copied := item.Copy()
+					copied.Parent = node
+					newContent = append(newContent, copied)
 				}
 			}
 		}
@ -226,8 +228,12 @@ func reconstructAliasedMap(node *CandidateNode, context Context) error {
 		}
 	}
 	node.Content = make([]*CandidateNode, 0)
+	entries := make([]*CandidateNode, 0, newContent.Len())
 	for newEl := newContent.Front(); newEl != nil; newEl = newEl.Next() {
-		node.AddChild(newEl.Value.(*CandidateNode))
+		entries = append(entries, newEl.Value.(*CandidateNode))
+	}
+	for i := 0; i < len(entries); i += 2 {
+		node.AddKeyValueChild(entries[i], entries[i+1])
 	}
 	return nil
 }
--- a/pkg/yqlib/operator_anchors_aliases_test.go
+++ b/pkg/yqlib/operator_anchors_aliases_test.go
@ -234,6 +234,29 @@ var fixedAnchorOperatorScenarios = []expressionScenario{
 			"D0, P[], (!!map)::a:\n    b: 42\nb: 42\n",
 		},
 	},
+	{
+		skipDoc:     true,
+		description: "Merge after explode preserves correct parent references",
+		document:    `opensearch: &opensearch-cluster
+  ip2geo:
+    enabled: false
+
+opensearch-client:
+  <<: *opensearch-cluster
+  nodeGroup: client
+  opensearchJavaOpts: "-Xmx1024m -Xms1024m"`,
+		document2: `opensearch: &opensearch-cluster
+  ip2geo:
+    enabled: true
+
+opensearch-client:
+  <<: *opensearch-cluster
+  opensearchJavaOpts: "-Xmx1536m -Xms1536m"`,
+		expression: `(select(fi == 0) | explode(.)) * (select(fi == 1) | explode(.))`,
+		expected: []string{
+			"D0, P[], (!!map)::opensearch:\n    ip2geo:\n        enabled: true\nopensearch-client:\n    ip2geo:\n        enabled: true\n    nodeGroup: client\n    opensearchJavaOpts: \"-Xmx1536m -Xms1536m\"\n",
+		},
+	},
 }

 var badAnchorOperatorScenarios = []expressionScenario{
Author	SHA1	Message	Date
Hani Harzallah	93bcb2f7eb	Merge `1f89111452` into `8e2c9b612d`	2026-06-17 10:55:49 +02:00
dependabot[bot]	8e2c9b612d	Bump golang from `68cb6d6` to `11fd8f7` (#2738 ) Bumps golang from `68cb6d6` to `11fd8f7`. --- updated-dependencies: - dependency-name: golang dependency-version: 1.26.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-16 16:46:10 +10:00
dependabot[bot]	0970cd4b05	Bump alpine from `5b10f43` to `a2d49ea` (#2739 ) Bumps alpine from `5b10f43` to `a2d49ea`. --- updated-dependencies: - dependency-name: alpine dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-16 16:46:03 +10:00
dependabot[bot]	bf3591a234	Bump golang.org/x/text from 0.37.0 to 0.38.0 (#2742 ) Bumps [golang.org/x/text](https://github.com/golang/text) from 0.37.0 to 0.38.0. - [Release notes](https://github.com/golang/text/releases) - [Commits](https://github.com/golang/text/compare/v0.37.0...v0.38.0) --- updated-dependencies: - dependency-name: golang.org/x/text dependency-version: 0.38.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-16 16:45:37 +10:00
dependabot[bot]	09f1565d51	Bump github/codeql-action from 4.35.2 to 4.36.2 (#2743 ) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.36.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](`95e58e9a2c...8aad20d150`) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.36.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-16 16:29:01 +10:00
dependabot[bot]	13d340ff51	Bump sigstore/cosign-installer from 3.10.1 to 4.1.2 (#2744 ) Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.10.1 to 4.1.2. - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](`7e8b541eb2...6f9f177880`) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-version: 4.1.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-16 16:28:52 +10:00
vomba	1f89111452	fix: preserve correct parent references in explode merge anchor reconstruction When explode resolves merge anchors (<<:), items copied from the alias target retained the original parent pointer instead of being set to the enclosing node being reconstructed. This caused GetPath() to return wrong paths for children of merge-anchored nodes, making subsequent merge operations target the wrong LHS keys. In fixedReconstructAliasedMap, set copied.Parent = node after copy. In reconstructAliasedMap (non-spec path), replace AddChild (which creates sequence-style numeric-index entries) with AddKeyValueChild to properly reconstruct mapping key-value pairs. AddKeyValueChild also correctly sets parent references via SetParent.	2026-06-08 09:39:43 +02:00