Fix spelling: multibyte -> multi-byte in Unicode test subdescription

Agent-Logs-Url: https://github.com/mikefarah/yq/sessions/6e7b304b-5b52-4e89-8bad-ba22813305c7

Co-authored-by: mikefarah <1151925+mikefarah@users.noreply.github.com>

.github/workflows/codeql.yml

@@ -38,11 +38,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v6
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+      uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -53,7 +53,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+      uses: github/codeql-action/autobuild@v4
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -67,4 +67,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+      uses: github/codeql-action/analyze@v4

.github/workflows/docker-release.yml

@@ -14,16 +14,16 @@ jobs:
       IMAGE_NAME: mikefarah/yq
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@v6
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@v4
         with:
           platforms: all
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@v4
         with:
           version: latest
 
@@ -31,13 +31,13 @@ jobs:
         run: echo ${{ steps.buildx.outputs.platforms }} && docker version
 
       - name: Login to Docker Hub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/go.yml

@@ -11,13 +11,13 @@ jobs:
     steps:
 
     - name: Set up Go
-      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      uses: actions/setup-go@v6
       with:
         go-version: '^1.20'
       id: go
 
     - name: Check out code into the Go module directory
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@v6
 
     - name: Get dependencies
       run: |

.github/workflows/release.yml

@@ -8,12 +8,9 @@ on:
 jobs:
   publishGitRelease:
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      id-token: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
         with:
           go-version: '^1.20'
           check-latest: true
@@ -40,22 +37,14 @@ jobs:
             --output=yq.1
             man.md
 
-      - name: Install cosign
-        uses: sigstore/cosign-installer@v3
-
       - name: Cross compile
         run: |
           sudo apt-get install rhash -y
           go install github.com/goreleaser/goreleaser/v2@latest
           ./scripts/xcompile.sh
 
-      - name: Sign checksums
-        run: |
-          cosign sign-blob --yes --output-bundle build/checksums.bundle build/checksums
-          cosign sign-blob --yes --output-bundle build/checksums-bsd.bundle build/checksums-bsd
-
       - name: Release
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
+        uses: softprops/action-gh-release@v1
         with:
           files: build/*
           draft: true

.github/workflows/snap-release.yml

@@ -12,14 +12,14 @@ jobs:
       environment: snap
       runs-on: ubuntu-latest
       steps:
-        - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        - uses: snapcore/action-build@3bdaa03e1ba6bf59a65f84a751d943d549a54e79 # v1.3.0
+        - uses: actions/checkout@v6
+        - uses: snapcore/action-build@v1
           id: build
           env:
             SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.STORE_LOGIN }}
           with:
             snapcraft-args: "remote-build --launchpad-accept-public-upload"
-        - uses: snapcore/action-publish@214b86e5ca036ead1668c79afb81e550e6c54d40 # v1.2.0
+        - uses: snapcore/action-publish@v1
           env:
             SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.STORE_LOGIN }}
           with:

.github/workflows/test-yq.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@v6
       - name: Get test
         id: get_value
         uses: mikefarah/yq@master

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.26.2@sha256:2a2b4b5791cea8ae09caecba7bad0bd9631def96e5fe362e4a5e67009fe4ae61 AS builder
+FROM golang:1.26.1 AS builder
 
 WORKDIR /go/src/mikefarah/yq
 
@@ -10,7 +10,7 @@ RUN ./scripts/acceptance.sh
 
 # Choose alpine as a base image to make this useful for CI, as many
 # CI tools expect an interactive shell inside the container
-FROM alpine:3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659 AS production
+FROM alpine:3 AS production
 LABEL maintainer="Mike Farah <mikefarah@users.noreply.github.com>"
 
 COPY --from=builder /go/src/mikefarah/yq/yq /usr/bin/yq

Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM golang:1.26.2@sha256:2a2b4b5791cea8ae09caecba7bad0bd9631def96e5fe362e4a5e67009fe4ae61
+FROM golang:1.26.1
 
 RUN apt-get update && \
     apt-get install -y npm && \

SECURITY.md

@@ -1,26 +0,0 @@
-# Security Policy
-
-## Reporting a Vulnerability
-
-Please **do not** report security vulnerabilities through public GitHub issues.
-
-Instead, use GitHub's private vulnerability reporting feature:
-👉 https://github.com/mikefarah/yq/security
-
-This allows vulnerabilities to be triaged and addressed confidentially before any public disclosure.
-
-## Scope
-
-### HTTP / TLS / Network vulnerabilities
-
-yq is a command-line YAML/JSON/TOML processor that reads from files or standard input and writes to standard output. **yq does not include any HTTP or network libraries** and makes no network connections at runtime. CVEs related to HTTP, TLS, or networking are therefore **not applicable** to yq.
-
-### Dependency version bumps
-
-yq uses [Dependabot](https://docs.github.com/en/code-security/dependabot) to automatically raise pull requests for:
-
-- Go module dependencies
-- Go toolchain version
-- Docker base images
-
-Please **do not** raise pull requests or issues solely to bump dependency or Go versions — Dependabot handles this automatically and the maintainers merge those PRs regularly.

cmd/root.go

@@ -212,7 +212,6 @@ yq -P -oy sample.json
 
 	rootCmd.PersistentFlags().BoolVarP(&yqlib.ConfiguredSecurityPreferences.DisableEnvOps, "security-disable-env-ops", "", false, "Disable env related operations.")
 	rootCmd.PersistentFlags().BoolVarP(&yqlib.ConfiguredSecurityPreferences.DisableFileOps, "security-disable-file-ops", "", false, "Disable file related operations (e.g. load)")
-	rootCmd.PersistentFlags().BoolVarP(&yqlib.ConfiguredSecurityPreferences.EnableSystemOps, "security-enable-system-operator", "", false, "Enable system operator to allow execution of external commands.")
 
 	rootCmd.AddCommand(
 		createEvaluateSequenceCommand(),

github-action/Dockerfile

@@ -1,4 +1,4 @@
-FROM mikefarah/yq:4@sha256:603ebff15eb308a05f1c5b8b7613179cad859aed3ec9fdd04f2ef5d32345950e
+FROM mikefarah/yq:4
 
 COPY entrypoint.sh /entrypoint.sh
 

go.mod

@@ -17,9 +17,9 @@ require (
 	github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
-	github.com/yuin/gopher-lua v1.1.2
+	github.com/yuin/gopher-lua v1.1.1
 	github.com/zclconf/go-cty v1.18.0
-	go.yaml.in/yaml/v4 v4.0.0-rc.4
+	go.yaml.in/yaml/v4 v4.0.0-rc.3
 	golang.org/x/mod v0.34.0
 	golang.org/x/net v0.52.0
 	golang.org/x/text v0.35.0

go.sum

@@ -61,15 +61,15 @@ github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3A
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/yuin/gopher-lua v1.1.2 h1:yF/FjE3hD65tBbt0VXLE13HWS9h34fdzJmrWRXwobGA=
-github.com/yuin/gopher-lua v1.1.2/go.mod h1:7aRmXIWl37SqRf0koeyylBEzJ+aPt8A+mmkQ4f1ntR8=
+github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=
+github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
 github.com/zclconf/go-cty v1.18.0 h1:pJ8+HNI4gFoyRNqVE37wWbJWVw43BZczFo7KUoRczaA=
 github.com/zclconf/go-cty v1.18.0/go.mod h1:qpnV6EDNgC1sns/AleL1fvatHw72j+S+nS+MJ+T2CSg=
 github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940 h1:4r45xpDWB6ZMSMNJFMOjqrGHynW3DIBuR2H9j0ug+Mo=
 github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmBdvvj3nqzfzJ6nTCIwDTPZ56aVGvDrmztiO5g3qrM=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-go.yaml.in/yaml/v4 v4.0.0-rc.4 h1:UP4+v6fFrBIb1l934bDl//mmnoIZEDK0idg1+AIvX5U=
-go.yaml.in/yaml/v4 v4.0.0-rc.4/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
+go.yaml.in/yaml/v4 v4.0.0-rc.3 h1:3h1fjsh1CTAPjW7q/EMe+C8shx5d8ctzZTrLcs/j8Go=
+go.yaml.in/yaml/v4 v4.0.0-rc.3/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
 golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
 golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
 golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=

pkg/yqlib/candidate_node.go

@@ -27,22 +27,6 @@ const (
 	FlowStyle
 )
 
-// EncodeHint controls how a mapping node is serialised by format-specific encoders
-// that distinguish between inline and block/section representations (e.g. TOML, HCL).
-type EncodeHint int
-
-const (
-	// EncodeHintDefault lets the encoder choose the representation (e.g. TOML block
-	// mappings default to [section] headers).
-	EncodeHintDefault EncodeHint = iota
-	// EncodeHintSeparateBlock forces the node to be emitted as a separate block or
-	// table-section header (used by TOML [section] and HCL block decoders).
-	EncodeHintSeparateBlock
-	// EncodeHintInline forces the node to be emitted as an inline / flow table
-	// (used by TOML inline-table decoder and TOML encoder).
-	EncodeHintInline
-)
-
 func createStringScalarNode(stringValue string) *CandidateNode {
 	var node = &CandidateNode{Kind: ScalarNode}
 	node.Value = stringValue
@@ -113,9 +97,9 @@ type CandidateNode struct {
 	// (e.g. top level cross document merge). This property does not propagate to child nodes.
 	EvaluateTogether bool
 	IsMapKey         bool
-	// EncodeHint controls how a mapping node is serialised by format-specific encoders
-	// (e.g. TOML, HCL) that support both inline and block/section representations.
-	EncodeHint EncodeHint
+	// For formats like HCL and TOML: indicates that child entries should be emitted as separate blocks/tables
+	// rather than consolidated into nested mappings (default behaviour)
+	EncodeSeparate bool
 }
 
 func (n *CandidateNode) CreateChild() *CandidateNode {
@@ -427,7 +411,7 @@ func (n *CandidateNode) doCopy(cloneContent bool) *CandidateNode {
 		EvaluateTogether: n.EvaluateTogether,
 		IsMapKey:         n.IsMapKey,
 
-		EncodeHint: n.EncodeHint,
+		EncodeSeparate: n.EncodeSeparate,
 	}
 
 	if cloneContent {
@@ -481,8 +465,8 @@ func (n *CandidateNode) UpdateAttributesFrom(other *CandidateNode, prefs assignP
 		n.Anchor = other.Anchor
 	}
 
-	// Preserve EncodeHint for format-specific encoding hints
-	n.EncodeHint = other.EncodeHint
+	// Preserve EncodeSeparate flag for format-specific encoding hints
+	n.EncodeSeparate = other.EncodeSeparate
 
 	// merge will pickup the style of the new thing
 	// when autocreating nodes

pkg/yqlib/decoder_hcl.go

@@ -226,7 +226,7 @@ func addBlockToMapping(parent *CandidateNode, block *hclsyntax.Block, src []byte
 		// Mark the type node if there are multiple blocks of this type at this level
 		// This tells the encoder to emit them as separate blocks rather than consolidating them
 		if isMultipleBlocksOfType {
-			typeNode.EncodeHint = EncodeHintSeparateBlock
+			typeNode.EncodeSeparate = true
 		}
 	}
 	current = typeNode

pkg/yqlib/decoder_toml.go

@@ -150,10 +150,9 @@ func (dec *tomlDecoder) createInlineTableMap(tomlNode *toml.Node) (*CandidateNod
 	}
 
 	return &CandidateNode{
-		Kind:       MappingNode,
-		Tag:        "!!map",
-		EncodeHint: EncodeHintInline,
-		Content:    content,
+		Kind:    MappingNode,
+		Tag:     "!!map",
+		Content: content,
 	}, nil
 }
 
@@ -346,10 +345,10 @@ func (dec *tomlDecoder) processTable(currentNode *toml.Node) (bool, error) {
 	}
 
 	tableNodeValue := &CandidateNode{
-		Kind:       MappingNode,
-		Tag:        "!!map",
-		Content:    make([]*CandidateNode, 0),
-		EncodeHint: EncodeHintSeparateBlock,
+		Kind:           MappingNode,
+		Tag:            "!!map",
+		Content:        make([]*CandidateNode, 0),
+		EncodeSeparate: true,
 	}
 
 	// Attach pending head comments to the table
@@ -443,9 +442,9 @@ func (dec *tomlDecoder) processArrayTable(currentNode *toml.Node) (bool, error)
 	hasValue := dec.parser.NextExpression()
 
 	tableNodeValue := &CandidateNode{
-		Kind:       MappingNode,
-		Tag:        "!!map",
-		EncodeHint: EncodeHintSeparateBlock,
+		Kind:           MappingNode,
+		Tag:            "!!map",
+		EncodeSeparate: true,
 	}
 
 	// Attach pending head comments to the array table

pkg/yqlib/doc/operators/headers/system-operators.md

@@ -1,27 +0,0 @@
-# System Operators
-
-The `system` operator allows you to run an external command and use its output as a value in your expression.
-
-**Security warning**: The system operator is disabled by default. You must explicitly pass `--security-enable-system-operator` to use it.
-
-**Note:** When enabled, the system operator can replicate the functionality of `env` and `load`
-operators via external commands. Enabling it effectively overrides `--security-disable-env-ops`
-and `--security-disable-file-ops`.
-
-## Usage
-
-```bash
-yq --security-enable-system-operator --null-input '.field = system("command"; "arg1")'
-```
-
-The operator takes:
-- A command string (required)
-- An argument (or an array of arguments), separated from the command by `;` (optional)
-
-The current matched node's value is serialised and piped to the command via stdin. The command's stdout (with trailing newline stripped) is returned as a string.
-
-## Disabling the system operator
-
-The system operator is disabled by default. When disabled, an error is returned instead of running the command, consistent with `--security-disable-env-ops` and `--security-disable-file-ops`.
-
-Use `--security-enable-system-operator` flag to enable it.

pkg/yqlib/doc/operators/system-operators.md

@@ -1,76 +0,0 @@
-# System Operators
-
-The `system` operator allows you to run an external command and use its output as a value in your expression.
-
-**Security warning**: The system operator is disabled by default. You must explicitly pass `--security-enable-system-operator` to use it.
-
-**Note:** When enabled, the system operator can replicate the functionality of `env` and `load`
-operators via external commands. Enabling it effectively overrides `--security-disable-env-ops`
-and `--security-disable-file-ops`.
-
-## Usage
-
-```bash
-yq --security-enable-system-operator --null-input '.field = system("command"; "arg1")'
-```
-
-The operator takes:
-- A command string (required)
-- An argument (or an array of arguments), separated from the command by `;` (optional)
-
-The current matched node's value is serialised and piped to the command via stdin. The command's stdout (with trailing newline stripped) is returned as a string.
-
-## Disabling the system operator
-
-The system operator is disabled by default. When disabled, an error is returned instead of running the command, consistent with `--security-disable-env-ops` and `--security-disable-file-ops`.
-
-Use `--security-enable-system-operator` flag to enable it.
-
-## system operator returns error when disabled
-Use `--security-enable-system-operator` to enable the system operator.
-
-Given a sample.yml file of:
-```yaml
-country: Australia
-```
-then
-```bash
-yq '.country = system("/usr/bin/echo"; "test")' sample.yml
-```
-will output
-```bash
-Error: system operations are disabled, use --security-enable-system-operator to enable
-```
-
-## Run a command with an argument
-Use `--security-enable-system-operator` to enable the system operator.
-
-Given a sample.yml file of:
-```yaml
-country: Australia
-```
-then
-```bash
-yq --security-enable-system-operator '.country = system("/usr/bin/echo"; "test")' sample.yml
-```
-will output
-```yaml
-country: test
-```
-
-## Run a command without arguments
-Omit the semicolon and args to run the command with no extra arguments.
-
-Given a sample.yml file of:
-```yaml
-a: hello
-```
-then
-```bash
-yq --security-enable-system-operator '.a = system("/usr/bin/echo")' sample.yml
-```
-will output
-```yaml
-a: ""
-```
-

pkg/yqlib/doc/usage/toml.md

@@ -384,20 +384,3 @@ ip = "10.0.0.2"
 role = "backend"
 ```
 
-## Encode: Simple mapping produces table section
-Given a sample.yml file of:
-```yaml
-arg:
-  hello: foo
-
-```
-then
-```bash
-yq -o toml '.' sample.yml
-```
-will output
-```toml
-[arg]
-hello = "foo"
-```
-

pkg/yqlib/encoder_hcl.go

@@ -449,8 +449,8 @@ func (he *hclEncoder) encodeBlockIfMapping(body *hclwrite.Body, key string, valu
 		return false
 	}
 
-	// If EncodeHintSeparateBlock is set, emit children as separate blocks regardless of label extraction
-	if valueNode.EncodeHint == EncodeHintSeparateBlock {
+	// If EncodeSeparate is set, emit children as separate blocks regardless of label extraction
+	if valueNode.EncodeSeparate {
 		if handled, _ := he.encodeMappingChildrenAsBlocks(body, key, valueNode); handled {
 			return true
 		}
@@ -537,9 +537,9 @@ func (he *hclEncoder) encodeMappingChildrenAsBlocks(body *hclwrite.Body, blockTy
 		return false, nil
 	}
 
-	// Only emit as separate blocks if EncodeHintSeparateBlock is set
+	// Only emit as separate blocks if EncodeSeparate is true
 	// This allows the encoder to respect the original block structure preserved by the decoder
-	if valueNode.EncodeHint != EncodeHintSeparateBlock {
+	if !valueNode.EncodeSeparate {
 		return false, nil
 	}
 

pkg/yqlib/encoder_toml.go

@@ -69,27 +69,6 @@ func (te *tomlEncoder) CanHandleAliases() bool {
 
 // ---- helpers ----
 
-// tomlKey returns the key quoted if it contains characters that are not valid
-// in a TOML bare key. TOML bare keys may only contain ASCII letters, ASCII
-// digits, underscores, and dashes.
-func tomlKey(key string) string {
-	for _, r := range key {
-		if (r < 'A' || r > 'Z') && (r < 'a' || r > 'z') && (r < '0' || r > '9') && r != '_' && r != '-' {
-			return fmt.Sprintf("%q", key)
-		}
-	}
-	return key
-}
-
-// tomlDottedKey joins path components, quoting any that require it.
-func tomlDottedKey(path []string) string {
-	parts := make([]string, len(path))
-	for i, p := range path {
-		parts[i] = tomlKey(p)
-	}
-	return strings.Join(parts, ".")
-}
-
 func (te *tomlEncoder) writeComment(w io.Writer, comment string) error {
 	if comment == "" {
 		return nil
@@ -169,10 +148,9 @@ func (te *tomlEncoder) encodeTopLevelEntry(w io.Writer, path []string, node *Can
 		}
 		if allMaps {
 			key := path[len(path)-1]
-			quotedKey := tomlKey(key)
 			for _, it := range node.Content {
 				// [[key]] then body
-				if _, err := w.Write([]byte("[[" + quotedKey + "]]\n")); err != nil {
+				if _, err := w.Write([]byte("[[" + key + "]]\n")); err != nil {
 					return err
 				}
 				if err := te.encodeMappingBodyWithPath(w, []string{key}, it); err != nil {
@@ -184,9 +162,12 @@ func (te *tomlEncoder) encodeTopLevelEntry(w io.Writer, path []string, node *Can
 		// Regular array attribute
 		return te.writeArrayAttribute(w, path[len(path)-1], node)
 	case MappingNode:
-		// Use inline table syntax for nodes explicitly marked as TOML inline tables
-		// or YAML flow mappings. All other mappings become readable TOML table sections.
-		if node.EncodeHint == EncodeHintInline || node.Style&FlowStyle != 0 {
+		// Inline table if not EncodeSeparate, else emit separate tables/arrays of tables for children under this path
+		if !node.EncodeSeparate {
+			// If children contain mappings or arrays of mappings, prefer separate sections
+			if te.hasEncodeSeparateChild(node) || te.hasStructuralChildren(node) {
+				return te.encodeSeparateMapping(w, path, node)
+			}
 			return te.writeInlineTableAttribute(w, path[len(path)-1], node)
 		}
 		return te.encodeSeparateMapping(w, path, node)
@@ -204,7 +185,7 @@ func (te *tomlEncoder) writeAttribute(w io.Writer, key string, value *CandidateN
 	}
 
 	// Write the attribute
-	line := tomlKey(key) + " = " + te.formatScalar(value)
+	line := key + " = " + te.formatScalar(value)
 
 	// Add line comment if present
 	if value.LineComment != "" {
@@ -229,7 +210,7 @@ func (te *tomlEncoder) writeArrayAttribute(w io.Writer, key string, seq *Candida
 
 	// Handle empty arrays
 	if len(seq.Content) == 0 {
-		line := tomlKey(key) + " = []"
+		line := key + " = []"
 		if seq.LineComment != "" {
 			lineComment := strings.TrimSpace(seq.LineComment)
 			if !strings.HasPrefix(lineComment, "#") {
@@ -252,7 +233,7 @@ func (te *tomlEncoder) writeArrayAttribute(w io.Writer, key string, seq *Candida
 
 	if hasElementComments {
 		// Write multiline array format with comments
-		if _, err := w.Write([]byte(tomlKey(key) + " = [\n")); err != nil {
+		if _, err := w.Write([]byte(key + " = [\n")); err != nil {
 			return err
 		}
 
@@ -343,7 +324,7 @@ func (te *tomlEncoder) writeArrayAttribute(w io.Writer, key string, seq *Candida
 		}
 	}
 
-	line := tomlKey(key) + " = [" + strings.Join(items, ", ") + "]"
+	line := key + " = [" + strings.Join(items, ", ") + "]"
 
 	// Add line comment if present
 	if seq.LineComment != "" {
@@ -391,21 +372,21 @@ func (te *tomlEncoder) mappingToInlineTable(m *CandidateNode) (string, error) {
 		v := m.Content[i+1]
 		switch v.Kind {
 		case ScalarNode:
-			parts = append(parts, fmt.Sprintf("%s = %s", tomlKey(k), te.formatScalar(v)))
+			parts = append(parts, fmt.Sprintf("%s = %s", k, te.formatScalar(v)))
 		case SequenceNode:
 			// inline array in inline table
 			arr, err := te.sequenceToInlineArray(v)
 			if err != nil {
 				return "", err
 			}
-			parts = append(parts, fmt.Sprintf("%s = %s", tomlKey(k), arr))
+			parts = append(parts, fmt.Sprintf("%s = %s", k, arr))
 		case MappingNode:
 			// nested inline table
 			inline, err := te.mappingToInlineTable(v)
 			if err != nil {
 				return "", err
 			}
-			parts = append(parts, fmt.Sprintf("%s = %s", tomlKey(k), inline))
+			parts = append(parts, fmt.Sprintf("%s = %s", k, inline))
 		default:
 			return "", fmt.Errorf("unsupported inline table value kind: %v", v.Kind)
 		}
@@ -418,7 +399,7 @@ func (te *tomlEncoder) writeInlineTableAttribute(w io.Writer, key string, m *Can
 	if err != nil {
 		return err
 	}
-	_, err = w.Write([]byte(tomlKey(key) + " = " + inline + "\n"))
+	_, err = w.Write([]byte(key + " = " + inline + "\n"))
 	return err
 }
 
@@ -440,7 +421,7 @@ func (te *tomlEncoder) writeTableHeader(w io.Writer, path []string, m *Candidate
 	}
 
 	// Write table header [a.b.c]
-	header := "[" + tomlDottedKey(path) + "]\n"
+	header := "[" + strings.Join(path, ".") + "]\n"
 	_, err := w.Write([]byte(header))
 	return err
 }
@@ -448,8 +429,7 @@ func (te *tomlEncoder) writeTableHeader(w io.Writer, path []string, m *Candidate
 // encodeSeparateMapping handles a mapping that should be encoded as table sections.
 // It emits the table header for this mapping if it has any content, then processes children.
 func (te *tomlEncoder) encodeSeparateMapping(w io.Writer, path []string, m *CandidateNode) error {
-	// Check if this mapping has any non-mapping, non-array-of-tables children (i.e., attributes).
-	// Inline mapping children also count as attributes since they render as key = { ... }.
+	// Check if this mapping has any non-mapping, non-array-of-tables children (i.e., attributes)
 	hasAttrs := false
 	for i := 0; i < len(m.Content); i += 2 {
 		v := m.Content[i+1]
@@ -457,10 +437,6 @@ func (te *tomlEncoder) encodeSeparateMapping(w io.Writer, path []string, m *Cand
 			hasAttrs = true
 			break
 		}
-		if v.Kind == MappingNode && (v.EncodeHint == EncodeHintInline || v.Style&FlowStyle != 0) {
-			hasAttrs = true
-			break
-		}
 		if v.Kind == SequenceNode {
 			// Check if it's NOT an array of tables
 			allMaps := true
@@ -488,14 +464,18 @@ func (te *tomlEncoder) encodeSeparateMapping(w io.Writer, path []string, m *Cand
 		return nil
 	}
 
-	// No attributes, just nested table structures - process children recursively
+	// No attributes, just nested structures - process children
 	for i := 0; i < len(m.Content); i += 2 {
 		k := m.Content[i].Value
 		v := m.Content[i+1]
 		switch v.Kind {
 		case MappingNode:
+			// Emit [path.k]
 			newPath := append(append([]string{}, path...), k)
-			if err := te.encodeSeparateMapping(w, newPath, v); err != nil {
+			if err := te.writeTableHeader(w, newPath, v); err != nil {
+				return err
+			}
+			if err := te.encodeMappingBodyWithPath(w, newPath, v); err != nil {
 				return err
 			}
 		case SequenceNode:
@@ -508,7 +488,7 @@ func (te *tomlEncoder) encodeSeparateMapping(w io.Writer, path []string, m *Cand
 				}
 			}
 			if allMaps {
-				key := tomlDottedKey(append(append([]string{}, path...), k))
+				key := strings.Join(append(append([]string{}, path...), k), ".")
 				for _, it := range v.Content {
 					if _, err := w.Write([]byte("[[" + key + "]]\n")); err != nil {
 						return err
@@ -533,6 +513,39 @@ func (te *tomlEncoder) encodeSeparateMapping(w io.Writer, path []string, m *Cand
 	return nil
 }
 
+func (te *tomlEncoder) hasEncodeSeparateChild(m *CandidateNode) bool {
+	for i := 0; i < len(m.Content); i += 2 {
+		v := m.Content[i+1]
+		if v.Kind == MappingNode && v.EncodeSeparate {
+			return true
+		}
+	}
+	return false
+}
+
+func (te *tomlEncoder) hasStructuralChildren(m *CandidateNode) bool {
+	for i := 0; i < len(m.Content); i += 2 {
+		v := m.Content[i+1]
+		// Only consider it structural if mapping has EncodeSeparate or is non-empty
+		if v.Kind == MappingNode && v.EncodeSeparate {
+			return true
+		}
+		if v.Kind == SequenceNode {
+			allMaps := true
+			for _, it := range v.Content {
+				if it.Kind != MappingNode {
+					allMaps = false
+					break
+				}
+			}
+			if allMaps {
+				return true
+			}
+		}
+	}
+	return false
+}
+
 // encodeMappingBodyWithPath encodes attributes and nested arrays of tables using full dotted path context
 func (te *tomlEncoder) encodeMappingBodyWithPath(w io.Writer, path []string, m *CandidateNode) error {
 	// First, attributes (scalars and non-map arrays)
@@ -573,7 +586,7 @@ func (te *tomlEncoder) encodeMappingBodyWithPath(w io.Writer, path []string, m *
 				}
 			}
 			if allMaps {
-				dotted := tomlDottedKey(append(append([]string{}, path...), k))
+				dotted := strings.Join(append(append([]string{}, path...), k), ".")
 				for _, it := range v.Content {
 					if _, err := w.Write([]byte("[[" + dotted + "]]\n")); err != nil {
 						return err
@@ -586,21 +599,13 @@ func (te *tomlEncoder) encodeMappingBodyWithPath(w io.Writer, path []string, m *
 		}
 	}
 
-	// Finally, child mappings: inline-hint or flow-style ones become inline table attributes,
-	// while all others are emitted as separate sub-table sections.
+	// Finally, child mappings that are not marked EncodeSeparate get inlined as attributes
 	for i := 0; i < len(m.Content); i += 2 {
 		k := m.Content[i].Value
 		v := m.Content[i+1]
-		if v.Kind == MappingNode {
-			if v.EncodeHint == EncodeHintInline || v.Style&FlowStyle != 0 {
-				if err := te.writeInlineTableAttribute(w, k, v); err != nil {
-					return err
-				}
-			} else {
-				subPath := append(append([]string{}, path...), k)
-				if err := te.encodeSeparateMapping(w, subPath, v); err != nil {
-					return err
-				}
+		if v.Kind == MappingNode && !v.EncodeSeparate {
+			if err := te.writeInlineTableAttribute(w, k, v); err != nil {
+				return err
 			}
 		}
 	}

pkg/yqlib/lexer_participle.go

@@ -96,8 +96,6 @@ var participleYqRules = []*participleYqRule{
 	simpleOp("load_?str|str_?load", loadStringOpType),
 	{"LoadYaml", `load`, loadOp(NewYamlDecoder(LoadYamlPreferences)), 0},
 
-	simpleOp("system", systemOpType),
-
 	{"SplitDocument", `splitDoc|split_?doc`, opToken(splitDocumentOpType), 0},
 
 	simpleOp("select", selectOpType),

pkg/yqlib/lib_test.go

@@ -24,7 +24,7 @@ type parseSnippetScenario struct {
 var parseSnippetScenarios = []parseSnippetScenario{
 	{
 		snippet:       ":",
-		expectedError: "yaml: while parsing a block mapping at <unknown position>: did not find expected key",
+		expectedError: "yaml: did not find expected key",
 	},
 	{
 		snippet: "",

pkg/yqlib/operation.go

@@ -164,8 +164,6 @@ var stringInterpolationOpType = &operationType{Type: "STRING_INT", NumArgs: 0, P
 var loadOpType = &operationType{Type: "LOAD", NumArgs: 1, Precedence: 52, Handler: loadOperator, CheckForPostTraverse: true}
 var loadStringOpType = &operationType{Type: "LOAD_STRING", NumArgs: 1, Precedence: 52, Handler: loadStringOperator}
 
-var systemOpType = &operationType{Type: "SYSTEM", NumArgs: 1, Precedence: 50, Handler: systemOperator}
-
 var keysOpType = &operationType{Type: "KEYS", NumArgs: 0, Precedence: 52, Handler: keysOperator, CheckForPostTraverse: true}
 
 var collectObjectOpType = &operationType{Type: "COLLECT_OBJECT", NumArgs: 0, Precedence: 50, Handler: collectObjectOperator}

pkg/yqlib/operator_multiply_test.go

@@ -553,7 +553,7 @@ var multiplyOperatorScenarios = []expressionScenario{
 		document:   document,
 		expression: `.b * .c`,
 		expected: []string{
-			"D0, P[b], (!!map)::{name: dog, \"<<\": *cat}\n",
+			"D0, P[b], (!!map)::{name: dog, <<: *cat}\n",
 		},
 	},
 	{

pkg/yqlib/operator_system.go

@@ -1,146 +0,0 @@
-package yqlib
-
-import (
-	"bytes"
-	"container/list"
-	"fmt"
-	"os/exec"
-	"strings"
-)
-
-func resolveSystemArgs(argsNode *CandidateNode) ([]string, error) {
-	if argsNode == nil {
-		return nil, nil
-	}
-
-	if argsNode.Kind == SequenceNode {
-		args := make([]string, 0, len(argsNode.Content))
-		for _, child := range argsNode.Content {
-			// Only non-null scalar children are valid arguments.
-			if child == nil {
-				continue
-			}
-			if child.Kind != ScalarNode || child.Tag == "!!null" {
-				return nil, fmt.Errorf("system operator: argument must be a non-null scalar; got kind=%v tag=%v", child.Kind, child.Tag)
-			}
-			args = append(args, child.Value)
-		}
-		if len(args) == 0 {
-			return nil, nil
-		}
-		return args, nil
-	}
-
-	// Single-argument case: only accept a non-null scalar node.
-	if argsNode.Tag == "!!null" {
-		return nil, nil
-	}
-	if argsNode.Kind != ScalarNode {
-		return nil, fmt.Errorf("system operator: args must be a non-null scalar or sequence of non-null scalars; got kind=%v tag=%v", argsNode.Kind, argsNode.Tag)
-	}
-	return []string{argsNode.Value}, nil
-}
-
-func resolveCommandNode(commandNodes Context) (string, error) {
-	if commandNodes.MatchingNodes.Front() == nil {
-		return "", fmt.Errorf("system operator: command expression returned no results")
-	}
-	if commandNodes.MatchingNodes.Len() > 1 {
-		log.Debugf("system operator: command expression returned %d results, using first", commandNodes.MatchingNodes.Len())
-	}
-	cmdNode := commandNodes.MatchingNodes.Front().Value.(*CandidateNode)
-	if cmdNode.Kind != ScalarNode || cmdNode.guessTagFromCustomType() != "!!str" {
-		return "", fmt.Errorf("system operator: command must be a string scalar")
-	}
-	if cmdNode.Value == "" {
-		return "", fmt.Errorf("system operator: command must be a non-empty string")
-	}
-	return cmdNode.Value, nil
-}
-
-func systemOperator(d *dataTreeNavigator, context Context, expressionNode *ExpressionNode) (Context, error) {
-	if !ConfiguredSecurityPreferences.EnableSystemOps {
-		return Context{}, fmt.Errorf("system operations are disabled, use --security-enable-system-operator to enable")
-	}
-
-	// determine at parse time whether we have (command; args) or just (command)
-	hasArgs := expressionNode.RHS.Operation.OperationType == blockOpType
-
-	var results = list.New()
-
-	for el := context.MatchingNodes.Front(); el != nil; el = el.Next() {
-		candidate := el.Value.(*CandidateNode)
-		nodeContext := context.SingleReadonlyChildContext(candidate)
-
-		var command string
-		var args []string
-
-		if hasArgs {
-			block := expressionNode.RHS
-			commandNodes, err := d.GetMatchingNodes(nodeContext, block.LHS)
-			if err != nil {
-				return Context{}, err
-			}
-			command, err = resolveCommandNode(commandNodes)
-			if err != nil {
-				return Context{}, err
-			}
-
-			argsNodes, err := d.GetMatchingNodes(nodeContext, block.RHS)
-			if err != nil {
-				return Context{}, err
-			}
-			if argsNodes.MatchingNodes.Len() > 1 {
-				log.Debugf("system operator: args expression returned %d results, using first", argsNodes.MatchingNodes.Len())
-			}
-			if argsNodes.MatchingNodes.Front() != nil {
-				args, err = resolveSystemArgs(argsNodes.MatchingNodes.Front().Value.(*CandidateNode))
-				if err != nil {
-					return Context{}, err
-				}
-			}
-		} else {
-			commandNodes, err := d.GetMatchingNodes(nodeContext, expressionNode.RHS)
-			if err != nil {
-				return Context{}, err
-			}
-			command, err = resolveCommandNode(commandNodes)
-			if err != nil {
-				return Context{}, err
-			}
-		}
-
-		var stdin bytes.Buffer
-		encoded, err := encodeToYamlString(candidate)
-		if err != nil {
-			return Context{}, err
-		}
-		stdin.WriteString(encoded)
-
-		// #nosec G204 - intentional: user must explicitly enable this operator
-		cmd := exec.Command(command, args...)
-		cmd.Stdin = &stdin
-		var stderr bytes.Buffer
-		cmd.Stderr = &stderr
-
-		output, err := cmd.Output()
-		if err != nil {
-			stderrStr := strings.TrimSpace(stderr.String())
-			if stderrStr != "" {
-				return Context{}, fmt.Errorf("system command '%v' failed: %w\nstderr: %v", command, err, stderrStr)
-			}
-			return Context{}, fmt.Errorf("system command '%v' failed: %w", command, err)
-		}
-
-		result := string(output)
-		if strings.HasSuffix(result, "\r\n") {
-			result = result[:len(result)-2]
-		} else if strings.HasSuffix(result, "\n") {
-			result = result[:len(result)-1]
-		}
-		newNode := candidate.CreateReplacement(ScalarNode, "!!str", result)
-		results.PushBack(newNode)
-	}
-
-	return context.ChildContext(results), nil
-}

pkg/yqlib/operator_system_test.go

@@ -1,123 +0,0 @@
-package yqlib
-
-import (
-	"os/exec"
-	"testing"
-)
-
-func findExec(t *testing.T, name string) string {
-	t.Helper()
-	path, err := exec.LookPath(name)
-	if err != nil {
-		t.Skipf("skipping: %v not found: %v", name, err)
-	}
-	return path
-}
-
-var systemOperatorDisabledScenarios = []expressionScenario{
-	{
-		description:    "system operator returns error when disabled",
-		subdescription: "Use `--security-enable-system-operator` to enable the system operator.",
-		document:       "country: Australia",
-		expression:     `.country = system("/usr/bin/echo"; "test")`,
-		expectedError:  "system operations are disabled, use --security-enable-system-operator to enable",
-	},
-}
-
-func TestSystemOperatorDisabledScenarios(t *testing.T) {
-	originalEnableSystemOps := ConfiguredSecurityPreferences.EnableSystemOps
-	defer func() {
-		ConfiguredSecurityPreferences.EnableSystemOps = originalEnableSystemOps
-	}()
-
-	ConfiguredSecurityPreferences.EnableSystemOps = false
-
-	for _, tt := range systemOperatorDisabledScenarios {
-		testScenario(t, &tt)
-	}
-	documentOperatorScenarios(t, "system-operators", systemOperatorDisabledScenarios)
-}
-
-func TestSystemOperatorEnabledScenarios(t *testing.T) {
-	echoPath := findExec(t, "echo")
-	falsePath := findExec(t, "false")
-
-	originalEnableSystemOps := ConfiguredSecurityPreferences.EnableSystemOps
-	defer func() {
-		ConfiguredSecurityPreferences.EnableSystemOps = originalEnableSystemOps
-	}()
-
-	ConfiguredSecurityPreferences.EnableSystemOps = true
-
-	scenarios := []expressionScenario{
-		{
-			description:    "Run a command with an argument",
-			subdescription: "Use `--security-enable-system-operator` to enable the system operator.",
-			yqFlags:        "--security-enable-system-operator",
-			document:       "country: Australia",
-			expression:     `.country = system("` + echoPath + `"; "test")`,
-			expected: []string{
-				"D0, P[], (!!map)::country: test\n",
-			},
-		},
-		{
-			description:    "Run a command without arguments",
-			subdescription: "Omit the semicolon and args to run the command with no extra arguments.",
-			yqFlags:        "--security-enable-system-operator",
-			document:       "a: hello",
-			expression:     `.a = system("` + echoPath + `")`,
-			expected: []string{
-				"D0, P[], (!!map)::a: \"\"\n",
-			},
-		},
-		{
-			description:    "Run a command with multiple arguments",
-			subdescription: "Pass an array of arguments.",
-			skipDoc:        true,
-			document:       "a: hello",
-			expression:     `.a = system("` + echoPath + `"; ["foo", "bar"])`,
-			expected: []string{
-				"D0, P[], (!!map)::a: foo bar\n",
-			},
-		},
-		{
-			description: "Command and args are evaluated per matched node",
-			skipDoc:     true,
-			document:    "cmd: " + echoPath + "\narg: hello",
-			expression:  `.result = system(.cmd; .arg)`,
-			expected: []string{
-				"D0, P[], (!!map)::cmd: " + echoPath + "\narg: hello\nresult: hello\n",
-			},
-		},
-		{
-			description:   "Command failure returns error",
-			skipDoc:       true,
-			document:      "a: hello",
-			expression:    `.a = system("` + falsePath + `")`,
-			expectedError: "system command '" + falsePath + "' failed: exit status 1",
-		},
-		{
-			description:   "Null command returns error",
-			skipDoc:       true,
-			document:      "a: hello",
-			expression:    `.a = system(null)`,
-			expectedError: "system operator: command must be a string scalar",
-		},
-		{
-			description: "System operator processes multiple matched nodes",
-			skipDoc:     true,
-			document:    "a: first",
-			document2:   "a: second",
-			expression:  `.a = system("` + echoPath + `"; "replaced")`,
-			expected: []string{
-				"D0, P[], (!!map)::a: replaced\n",
-				"D0, P[], (!!map)::a: replaced\n",
-			},
-		},
-	}
-
-	for _, tt := range scenarios {
-		testScenario(t, &tt)
-	}
-	appendOperatorDocumentScenario(t, "system-operators", scenarios)
-}

pkg/yqlib/operators_test.go

@@ -31,7 +31,6 @@ type expressionScenario struct {
 	dontFormatInputForDoc bool // dont format input doc for documentation generation
 	requiresFormat        string
 	skipForGoccy          bool
-	yqFlags               string // extra yq flags to include in generated doc command snippets
 }
 
 var goccyTesting = false
@@ -357,22 +356,14 @@ func documentInput(w *bufio.Writer, s expressionScenario) (string, string) {
 
 		writeOrPanic(w, "then\n")
 
-		flagsPrefix := ""
-		if s.yqFlags != "" {
-			flagsPrefix = s.yqFlags + " "
-		}
 		if s.expression != "" {
-			writeOrPanic(w, fmt.Sprintf("```bash\n%vyq %v%v'%v' %v\n```\n", envCommand, flagsPrefix, command, strings.ReplaceAll(s.expression, "'", `'\''`), files))
+			writeOrPanic(w, fmt.Sprintf("```bash\n%vyq %v'%v' %v\n```\n", envCommand, command, strings.ReplaceAll(s.expression, "'", `'\''`), files))
 		} else {
-			writeOrPanic(w, fmt.Sprintf("```bash\n%vyq %v%v%v\n```\n", envCommand, flagsPrefix, command, files))
+			writeOrPanic(w, fmt.Sprintf("```bash\n%vyq %v%v\n```\n", envCommand, command, files))
 		}
 	} else {
 		writeOrPanic(w, "Running\n")
-		flagsPrefix := ""
-		if s.yqFlags != "" {
-			flagsPrefix = s.yqFlags + " "
-		}
-		writeOrPanic(w, fmt.Sprintf("```bash\n%vyq %v%v--null-input '%v'\n```\n", envCommand, flagsPrefix, command, s.expression))
+		writeOrPanic(w, fmt.Sprintf("```bash\n%vyq %v--null-input '%v'\n```\n", envCommand, command, s.expression))
 	}
 	return formattedDoc, formattedDoc2
 }

pkg/yqlib/security_prefs.go

@@ -1,13 +1,11 @@
 package yqlib
 
 type SecurityPreferences struct {
-	DisableEnvOps   bool
-	DisableFileOps  bool
-	EnableSystemOps bool
+	DisableEnvOps  bool
+	DisableFileOps bool
 }
 
 var ConfiguredSecurityPreferences = SecurityPreferences{
-	DisableEnvOps:   false,
-	DisableFileOps:  false,
-	EnableSystemOps: false,
+	DisableEnvOps:  false,
+	DisableFileOps: false,
 }

pkg/yqlib/toml_test.go

@@ -287,18 +287,6 @@ var expectedSubArrays = `array:
           - {}
 `
 
-// Keys with special characters that require quoting in TOML
-var rtSpecialKeyInlineTable = `host = { "http://sealos.hub:5000" = { capabilities = ["pull", "resolve", "push"], skip_verify = true } }
-`
-
-var rtSpecialKeyTableSection = `["/tmp/blah"]
-value = "hello"
-`
-
-var rtSpecialKeyDottedTableSection = `[servers."http://localhost:8080"]
-ip = "127.0.0.1"
-`
-
 var tomlScenarios = []formatScenario{
 	{
 		skipDoc:      true,
@@ -626,58 +614,6 @@ var tomlScenarios = []formatScenario{
 		expected:     tomlTableWithComments,
 		scenarioType: "roundtrip",
 	},
-	// Encode (YAML → TOML) scenarios - verify readable table sections are produced
-	{
-		description:  "Encode: Simple mapping produces table section",
-		input:        "arg:\n  hello: foo\n",
-		expected:     "[arg]\nhello = \"foo\"\n",
-		scenarioType: "encode",
-	},
-	{
-		skipDoc:      true,
-		description:  "Encode: Nested mappings produce nested table sections",
-		input:        "a:\n  b:\n    c: val\n",
-		expected:     "[a.b]\nc = \"val\"\n",
-		scenarioType: "encode",
-	},
-	{
-		skipDoc:      true,
-		description:  "Encode: Mixed scalars and nested mapping",
-		input:        "a:\n  hello: foo\n  nested:\n    key: val\n",
-		expected:     "[a]\nhello = \"foo\"\n\n[a.nested]\nkey = \"val\"\n",
-		scenarioType: "encode",
-	},
-	{
-		skipDoc:      true,
-		description:  "Encode: YAML flow mapping stays inline",
-		input:        "arg: {hello: foo}\n",
-		expected:     "arg = { hello = \"foo\" }\n",
-		scenarioType: "encode",
-	},
-	{
-		skipDoc:      true,
-		description:  "Roundtrip: key with special characters in inline table",
-		input:        rtSpecialKeyInlineTable,
-		expression:   ".",
-		expected:     rtSpecialKeyInlineTable,
-		scenarioType: "roundtrip",
-	},
-	{
-		skipDoc:      true,
-		description:  "Roundtrip: key with special characters in table section",
-		input:        rtSpecialKeyTableSection,
-		expression:   ".",
-		expected:     rtSpecialKeyTableSection,
-		scenarioType: "roundtrip",
-	},
-	{
-		skipDoc:      true,
-		description:  "Roundtrip: special character key in dotted table section header",
-		input:        rtSpecialKeyDottedTableSection,
-		expression:   ".",
-		expected:     rtSpecialKeyDottedTableSection,
-		scenarioType: "roundtrip",
-	},
 }
 
 func testTomlScenario(t *testing.T, s formatScenario) {
@@ -693,8 +629,6 @@ func testTomlScenario(t *testing.T, s formatScenario) {
 		}
 	case "roundtrip":
 		test.AssertResultWithContext(t, s.expected, mustProcessFormatScenario(s, NewTomlDecoder(), NewTomlEncoder()), s.description)
-	case "encode":
-		test.AssertResultWithContext(t, s.expected, mustProcessFormatScenario(s, NewYamlDecoder(ConfiguredYamlPreferences), NewTomlEncoder()), s.description)
 	}
 }
 
@@ -720,28 +654,6 @@ func documentTomlDecodeScenario(w *bufio.Writer, s formatScenario) {
 	writeOrPanic(w, fmt.Sprintf("```yaml\n%v```\n\n", mustProcessFormatScenario(s, NewTomlDecoder(), NewYamlEncoder(ConfiguredYamlPreferences))))
 }
 
-func documentTomlEncodeScenario(w *bufio.Writer, s formatScenario) {
-	writeOrPanic(w, fmt.Sprintf("## %v\n", s.description))
-
-	if s.subdescription != "" {
-		writeOrPanic(w, s.subdescription)
-		writeOrPanic(w, "\n\n")
-	}
-
-	writeOrPanic(w, "Given a sample.yml file of:\n")
-	writeOrPanic(w, fmt.Sprintf("```yaml\n%v\n```\n", s.input))
-
-	writeOrPanic(w, "then\n")
-	expression := s.expression
-	if expression == "" {
-		expression = "."
-	}
-	writeOrPanic(w, fmt.Sprintf("```bash\nyq -o toml '%v' sample.yml\n```\n", expression))
-	writeOrPanic(w, "will output\n")
-
-	writeOrPanic(w, fmt.Sprintf("```toml\n%v```\n\n", mustProcessFormatScenario(s, NewYamlDecoder(ConfiguredYamlPreferences), NewTomlEncoder())))
-}
-
 func documentTomlRoundtripScenario(w *bufio.Writer, s formatScenario) {
 	writeOrPanic(w, fmt.Sprintf("## %v\n", s.description))
 
@@ -775,8 +687,6 @@ func documentTomlScenario(_ *testing.T, w *bufio.Writer, i interface{}) {
 		documentTomlDecodeScenario(w, s)
 	case "roundtrip":
 		documentTomlRoundtripScenario(w, s)
-	case "encode":
-		documentTomlEncodeScenario(w, s)
 
 	default:
 		panic(fmt.Sprintf("unhandled scenario type %q", s.scenarioType))

release_instructions.txt

@@ -8,15 +8,6 @@
 - git push --tags
 - use github actions to publish docker and make github release
 - check github updated yq action in marketplace
-- update github-action/Dockerfile to pin the newly published docker image digest:
-    skopeo inspect docker://docker.io/mikefarah/yq:4 | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['Digest'])"
-  then update the FROM line in github-action/Dockerfile with the new digest:
-    FROM mikefarah/yq:4@sha256:<new-digest>
-
-// release artifacts are signed with cosign keyless signing (Sigstore)
-// users can verify with:
-//   cosign verify-blob --bundle checksums.bundle checksums
-// install cosign: brew install cosign  OR  go install github.com/sigstore/cosign/v2/cmd/cosign@latest
 
 
 - snapcraft