build(deps): bump github/codeql-action/analyze from 4.36.2 to 4.37.8

Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.36.2 to 4.37.8. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.8 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
fix(test): update expected format for unrecognised extension to yaml (#2837 )
2026-08-29 19:44:52 +08:00 · 2026-08-27 03:57:31 +00:00 · 2026-08-25 20:19:22 +10:00 · 2026-08-20 19:07:38 +10:00 · 2026-08-20 19:07:20 +10:00 · 2026-08-20 16:16:13 +10:00
13 changed files with 30 additions and 23 deletions
@@ -69,4 +69,4 @@ jobs:
    #   make release

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+      uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
@@ -24,7 +24,7 @@ jobs:

      - name: Set up Docker Buildx
        id: buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        with:
          version: latest

@@ -28,7 +28,7 @@ jobs:

      - name: Set up Docker Buildx
        id: buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        with:
          version: latest

@@ -48,7 +48,7 @@ jobs:
      - name: Cross compile
        run: |
          sudo apt-get install rhash -y
-          go install github.com/goreleaser/goreleaser/v2@v2.16.0
+          go install github.com/goreleaser/goreleaser/v2@v2.17.1
          ./scripts/xcompile.sh

      - name: Sign checksums
@@ -1,4 +1,4 @@
-FROM golang:1.26.5@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a AS builder
+FROM golang:1.26.6@sha256:0d1d3a794be25f809dd2cb3160d8c73276c4056a9f8242a138e908ddeee7b6b6 AS builder

 WORKDIR /go/src/mikefarah/yq

@@ -1,4 +1,4 @@
-FROM golang:1.26.5@sha256:079e59808d2d252516e27e3f3a9c003740dee7f75e55aa71528766d52bcfc16a
+FROM golang:1.26.6@sha256:0d1d3a794be25f809dd2cb3160d8c73276c4056a9f8242a138e908ddeee7b6b6

 COPY scripts/devtools.sh /opt/devtools.sh

@@ -11,7 +11,7 @@ var (
 	GitDescribe string

 	// Version is main version number that is being run at the moment.
-	Version = "v4.53.4"
+	Version = "v4.53.6"

 	// VersionPrerelease is a pre-release marker for the version. If this is "" (empty string)
 	// then it means that it is a final release. Otherwise, this is a pre-release
@@ -20,9 +20,9 @@ require (
 	github.com/yuin/gopher-lua v1.1.2
 	github.com/zclconf/go-cty v1.19.0
 	go.yaml.in/yaml/v4 v4.0.0-rc.6
-	golang.org/x/mod v0.38.0
-	golang.org/x/net v0.57.0
-	golang.org/x/text v0.40.0
+	golang.org/x/mod v0.40.0
+	golang.org/x/net v0.58.0
+	golang.org/x/text v0.41.0
 )

 require (
@@ -36,7 +36,7 @@ require (
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
 	golang.org/x/sync v0.22.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/tools v0.47.0 // indirect
+	golang.org/x/tools v0.49.0 // indirect
 )

 go 1.25.0
@@ -72,19 +72,19 @@ github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmB
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4=
 go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
-golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
-golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
+golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
+golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
 golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
@@ -1,3 +1,10 @@
+4.53.6:
+  - Fixing release build issue
+  
+4.53.5:
+  - Fixed line wrapping bug (#2824, #2823) Thanks mxey
+  - Bumped dependencies 
+
 4.53.4:
 - Close input files after processing each one (#2796) (#2808) Thanks @MsfPablo
 - Fixed non string HCL string keys (#2795)
@@ -2,7 +2,7 @@

 set -eo pipefail

-# You may need to go install github.com/goreleaser/goreleaser/v2@v2.16.0 first
+# You may need to go install github.com/goreleaser/goreleaser/v2@v2.17.1 first
 GORELEASER="goreleaser build --clean"
 if [ -z "$CI" ] || [[ "${GITHUB_REF_NAME:-}" == draft-* ]]; then
  GORELEASER+=" --snapshot"
@@ -1,5 +1,5 @@
 name: yq
-version: 'v4.53.4'
+version: 'v4.53.6'
 summary: A lightweight and portable command-line data file processor
 description: |
  `yq` uses [jq](https://github.com/stedolan/jq) like syntax but works with yaml, json, xml, csv, properties and TOML files.
@@ -32,6 +32,6 @@ parts:
    build-environment:
      - CGO_ENABLED: 0
    source: https://github.com/mikefarah/yq.git
-    source-tag: v4.53.4
+    source-tag: v4.53.6
    build-snaps:
      - go/latest/stable
@@ -17,7 +17,7 @@ func TestFormatStringFromFilename(t *testing.T) {
 		{"FILE.JSON", "json"},
 		{"file.properties", "properties"},
 		{"file.xml", "xml"},
-		{"file.unknown", "unknown"},
+		{"file.unknown", "yaml"},

 		// filenames without extensions
 		{"file", "yaml"},
Author	SHA1	Message	Date
dependabot[bot]andGitHub	93ccb10657	build(deps): bump github/codeql-action/analyze from 4.36.2 to 4.37.8 Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.36.2 to 4.37.8. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.37.8 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>	2026-08-27 03:57:31 +00:00
SiddharthandGitHub	8b5af0694b	fix(test): update expected format for unrecognised extension to yaml (#2837 ) When unrecognised extensions are passed, FormatStringFromFilename defaults to 'yaml' (as handled in pkg/yqlib/format.go and tested in pkg/yqlib/format_test.go). This updates the test expectation in test/format_test.go for 'file.unknown' to 'yaml' so that go test ./test passes.	2026-08-25 20:19:22 +10:00
Mike Farah	c14f446382	Bumping version	2026-08-20 19:07:38 +10:00
Mike Farah	ed4125b9b1	Fixing release build	2026-08-20 19:07:20 +10:00
Mike Farah	e95064cd01	Bumping version	2026-08-20 16:16:13 +10:00
Mike Farah	1f5d6e6656	Release notes	2026-08-20 16:15:37 +10:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	b1d6df4217	build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.3.0 (#2829 ) Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 4.1.0 to 4.3.0. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5...37fe631027851001ddb9b187196cc803df7f5f0e) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-version: 4.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-20 16:04:20 +10:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	8dc5ae1229	build(deps): bump golang.org/x/mod from 0.38.0 to 0.40.0 (#2831 ) Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.38.0 to 0.40.0. - [Commits](https://github.com/golang/mod/compare/v0.38.0...v0.40.0) --- updated-dependencies: - dependency-name: golang.org/x/mod dependency-version: 0.40.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-20 16:01:28 +10:00
dependabot[bot]GitHubdependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	8a95461ec2	build(deps): bump golang from 1.26.5 to 1.26.6 (#2832 ) Bumps golang from 1.26.5 to 1.26.6. --- updated-dependencies: - dependency-name: golang dependency-version: 1.26.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-20 15:59:50 +10:00
Mike Farah GitHub Cursor Maximilian Gaß	ce3131723a	Pr 2825 (#2836 ) * disable hard line wrapping The formatting defaults of the used YAML library changed. Since yq has no mechanism for the user to override them, change them back to what we used before. * Clamp YAML indent and close dumper after encoding. Clamp indent to the library's 2-9 range, wrap dumper setup errors with %w, and always close the dumper after dump. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Maximilian Gaß <m.gass@babiel.com> Co-authored-by: Cursor <cursoragent@cursor.com>	2026-08-20 15:59:11 +10:00