Bumping version

Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 4.1.0 to 4.3.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5...37fe631027851001ddb9b187196cc803df7f5f0e)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/ISSUE_TEMPLATE/bug_report_v4.md

@@ -34,13 +34,13 @@ The command you ran:
 yq eval-all 'select(fileIndex==0) | .a.b.c' data1.yml data2.yml
 ```
 
-**Actual behavior**
+**Actual behaviour**
 
 ```yaml
 cat: meow
 ```
 
-**Expected behavior**
+**Expected behaviour**
 
 ```yaml
 this: should really work

.github/workflows/codeql.yml

@@ -20,6 +20,8 @@ on:
   schedule:
     - cron: '24 3 * * 1'
 
+permissions: {}
+
 jobs:
   analyze:
     name: Analyze
@@ -38,11 +40,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -53,7 +55,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v4
+      uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -67,4 +69,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2

.github/workflows/docker-githubaction.yml

@@ -0,0 +1,107 @@
+name: Release Docker GitHub Action
+
+on:
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  publishGithubActionDocker:
+    environment: dockerhub
+    env:
+      IMAGE_NAME: mikefarah/yq
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+        with:
+          platforms: all
+
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        with:
+          version: latest
+
+      - name: Verify Dockerfile base image digest matches yq:4
+        run: |
+          PINNED_DIGEST=$(grep -oE 'sha256:[a-f0-9]{64}' github-action/Dockerfile | head -1)
+          if [ -z "${PINNED_DIGEST}" ]; then
+            echo "::error::Could not find a sha256 digest in github-action/Dockerfile"
+            exit 1
+          fi
+
+          LATEST_DIGEST=$(docker buildx imagetools inspect "${IMAGE_NAME}:4" --format '{{printf "%s" .Manifest.Digest}}')
+
+          echo "Dockerfile pins: ${PINNED_DIGEST}"
+          echo "mikefarah/yq:4 is:  ${LATEST_DIGEST}"
+
+          if [ "${PINNED_DIGEST}" != "${LATEST_DIGEST}" ]; then
+            echo "::error::github-action/Dockerfile digest does not match the current mikefarah/yq:4 image"
+            echo "Update the FROM line in github-action/Dockerfile to:"
+            echo "  FROM mikefarah/yq:4@${LATEST_DIGEST}"
+            exit 1
+          fi
+
+      - name: Resolve version from yq:4
+        run: |
+          IMAGE_VERSION=$(docker run --rm "${IMAGE_NAME}:4" --version | awk '{print $NF}' | sed 's/^v//')
+          if [ -z "${IMAGE_VERSION}" ]; then
+            echo "::error::Could not determine yq version from ${IMAGE_NAME}:4"
+            exit 1
+          fi
+          echo "Resolved yq version: ${IMAGE_VERSION}"
+          echo "IMAGE_VERSION=${IMAGE_VERSION}" >> "${GITHUB_ENV}"
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push github-action image
+        working-directory: github-action
+        run: |
+          PLATFORMS="linux/amd64,linux/ppc64le,linux/arm64,linux/arm/v7,linux/s390x"
+
+          echo "Building and pushing github-action image for version ${IMAGE_VERSION}"
+          docker buildx build \
+            --label "org.opencontainers.image.authors=https://github.com/mikefarah/yq/graphs/contributors" \
+            --label "org.opencontainers.image.created=$(date --rfc-3339=seconds)" \
+            --label "org.opencontainers.image.description=yq is a portable command-line data file processor" \
+            --label "org.opencontainers.image.documentation=https://mikefarah.gitbook.io/yq/" \
+            --label "org.opencontainers.image.licenses=MIT" \
+            --label "org.opencontainers.image.revision=$(git rev-parse HEAD)" \
+            --label "org.opencontainers.image.source=https://github.com/mikefarah/yq" \
+            --label "org.opencontainers.image.title=yq" \
+            --label "org.opencontainers.image.url=https://mikefarah.gitbook.io/yq/" \
+            --label "org.opencontainers.image.version=${IMAGE_VERSION}" \
+            --platform "${PLATFORMS}" \
+            --pull \
+            --push \
+            -t "${IMAGE_NAME}:${IMAGE_VERSION}-githubaction" \
+            -t "${IMAGE_NAME}:4-githubaction" \
+            -t "${IMAGE_NAME}:latest-githubaction" \
+            -t "ghcr.io/${IMAGE_NAME}:${IMAGE_VERSION}-githubaction" \
+            -t "ghcr.io/${IMAGE_NAME}:4-githubaction" \
+            -t "ghcr.io/${IMAGE_NAME}:latest-githubaction" \
+            .
+
+      - name: Report action.yml digest to pin
+        run: |
+          GITHUBACTION_DIGEST=$(docker buildx imagetools inspect "${IMAGE_NAME}:4-githubaction" --format '{{printf "%s" .Manifest.Digest}}')
+          echo "Published ${IMAGE_NAME}:4-githubaction at ${GITHUBACTION_DIGEST}"
+          echo "Update action.yml image to:"
+          echo "  docker://${IMAGE_NAME}:4-githubaction@${GITHUBACTION_DIGEST}"

.github/workflows/docker-release.yml

@@ -7,23 +7,28 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   publishDocker:
     environment: dockerhub
     env:
       IMAGE_NAME: mikefarah/yq
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
         with:
           platforms: all
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
         with:
           version: latest
 
@@ -31,13 +36,13 @@ jobs:
         run: echo ${{ steps.buildx.outputs.platforms }} && docker version
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -75,26 +80,3 @@ jobs:
             -t "ghcr.io/${IMAGE_NAME}:4" \
             -t "ghcr.io/${IMAGE_NAME}:latest" \
             .
-
-          cd github-action
-          docker buildx build \
-            --label "org.opencontainers.image.authors=https://github.com/mikefarah/yq/graphs/contributors" \
-            --label "org.opencontainers.image.created=$(date --rfc-3339=seconds)" \
-            --label "org.opencontainers.image.description=yq is a portable command-line data file processor" \
-            --label "org.opencontainers.image.documentation=https://mikefarah.gitbook.io/yq/" \
-            --label "org.opencontainers.image.licenses=MIT" \
-            --label "org.opencontainers.image.revision=$(git rev-parse HEAD)" \
-            --label "org.opencontainers.image.source=https://github.com/mikefarah/yq" \
-            --label "org.opencontainers.image.title=yq" \
-            --label "org.opencontainers.image.url=https://mikefarah.gitbook.io/yq/" \
-            --label "org.opencontainers.image.version=${IMAGE_VERSION}" \
-            --platform "${PLATFORMS}" \
-            --pull \
-            --push \
-            -t "${IMAGE_NAME}:${IMAGE_VERSION}-githubaction" \
-            -t "${IMAGE_NAME}:4-githubaction" \
-            -t "${IMAGE_NAME}:latest-githubaction" \
-            -t "ghcr.io/${IMAGE_NAME}:${IMAGE_VERSION}-githubaction" \
-            -t "ghcr.io/${IMAGE_NAME}:4-githubaction" \
-            -t "ghcr.io/${IMAGE_NAME}:latest-githubaction" \
-            .

.github/workflows/go.yml

@@ -5,25 +5,51 @@ permissions:
 
 jobs:
 
+  verify-action-digest:
+    name: Verify action.yml image digest
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Verify action.yml digest matches published image
+        run: |
+          PINNED_DIGEST=$(grep -oE 'sha256:[a-f0-9]{64}' action.yml | head -1)
+          if [ -z "${PINNED_DIGEST}" ]; then
+            echo "::error::action.yml does not pin the runtime image by digest"
+            exit 1
+          fi
+
+          LATEST_DIGEST=$(docker buildx imagetools inspect docker.io/mikefarah/yq:4-githubaction --format '{{printf "%s" .Manifest.Digest}}')
+
+          echo "action.yml pins:              ${PINNED_DIGEST}"
+          echo "mikefarah/yq:4-githubaction: ${LATEST_DIGEST}"
+
+          if [ "${PINNED_DIGEST}" != "${LATEST_DIGEST}" ]; then
+            echo "::error::action.yml digest does not match the current mikefarah/yq:4-githubaction image"
+            echo "Update the image line in action.yml to:"
+            echo "  docker://mikefarah/yq:4-githubaction@${LATEST_DIGEST}"
+            exit 1
+          fi
+
   build:
     name: Build
     runs-on: ubuntu-latest
     steps:
 
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
       with:
         go-version: '^1.20'
       id: go
 
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v6
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
     - name: Get dependencies
       run: |
         go get -v -t -d ./...
         if [ -f Gopkg.toml ]; then
-            curl https://raw.githubusercontent.com/golang/dep/master/install.sh | sh
+            curl -sSfL https://raw.githubusercontent.com/golang/dep/1f7c19e5f52f49ffb9f956f64c010be14683468b/install.sh | env DEP_RELEASE_TAG=v0.5.4 sh
             dep ensure
         fi
 

.github/workflows/release.yml

@@ -5,12 +5,17 @@ on:
       - 'v4.*'
       - 'draft-*'
 
+permissions: {}
+
 jobs:
   publishGitRelease:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version: '^1.20'
           check-latest: true
@@ -24,7 +29,7 @@ jobs:
         run: echo "VERSION=${GITHUB_REF##*/}" >> "${GITHUB_OUTPUT}"
 
       - name: Generate man page
-        uses: docker://pandoc/core:2.14.2
+        uses: docker://pandoc/core:2.14.2@sha256:04e127c6642a2b9d447c26fe0ac6a5932efa8f508eda9f07da51b6e621dd7c19
         id: gen-man-page
         with:
           args: >-
@@ -37,14 +42,22 @@ jobs:
             --output=yq.1
             man.md
 
+      - name: Install cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+
       - name: Cross compile
         run: |
           sudo apt-get install rhash -y
-          go install github.com/goreleaser/goreleaser/v2@latest
+          go install github.com/goreleaser/goreleaser/v2@v2.17.1
           ./scripts/xcompile.sh
 
+      - name: Sign checksums
+        run: |
+          cosign sign-blob --yes --bundle build/checksums.bundle build/checksums
+          cosign sign-blob --yes --bundle build/checksums-bsd.bundle build/checksums-bsd
+
       - name: Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           files: build/*
           draft: true

.github/workflows/scorecard.yml

@@ -0,0 +1,78 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '39 7 * * 2'
+  push:
+    branches: [ "master" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
+    if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecard on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+          # (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore
+          # file_mode: git
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard (optional).
+      # Commenting out will disable upload of results to your repo's Code Scanning dashboard
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
+        with:
+          sarif_file: results.sarif

.github/workflows/snap-release.yml

@@ -7,19 +7,23 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
     buildSnap:
       environment: snap
       runs-on: ubuntu-latest
+      permissions:
+        contents: read
       steps:
-        - uses: actions/checkout@v6
-        - uses: snapcore/action-build@v1
+        - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        - uses: snapcore/action-build@3bdaa03e1ba6bf59a65f84a751d943d549a54e79 # v1.3.0
           id: build
           env:
             SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.STORE_LOGIN }}
           with:
             snapcraft-args: "remote-build --launchpad-accept-public-upload"
-        - uses: snapcore/action-publish@v1
+        - uses: snapcore/action-publish@214b86e5ca036ead1668c79afb81e550e6c54d40 # v1.2.0
           env:
             SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.STORE_LOGIN }}
           with:

.github/workflows/test-yq.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Get test
         id: get_value
         uses: mikefarah/yq@master

.gitignore

@@ -47,6 +47,7 @@ test*.tf
 test*.xml
 test*.toml
 test*.yaml
+*.kyaml
 test_dir1/
 test_dir2/
 0.yml
@@ -69,3 +70,7 @@ debian/files
 .vscode
 
 yq3
+
+# Golang
+.gomodcache/
+.gocache/

.golangci.yml

@@ -14,6 +14,11 @@ linters:
     - unconvert
     - unparam
   settings:
+    misspell:
+      locale: UK
+      ignore-rules:
+        - color
+        - colors
     depguard:
       rules:
         prevent_unmaintained_packages:

.goreleaser.yaml

@@ -39,7 +39,6 @@ builds:
       - openbsd_amd64
       - windows_386
       - windows_amd64
-      - windows_arm
       - windows_arm64
 
     no_unique_dist_dir: true

AGENTS.md

@@ -1,13 +1,92 @@
+# yq — agent instructions
+
+## ⚠️ MANDATORY: GitHub agent disclosure
+
+**Always required. No exceptions.**
+
+Whenever you perform **any** GitHub action on behalf of the user, you **must** disclose that an AI agent (Cursor) wrote the content and is acting on the user's behalf — **not the user personally**. Do this **before** submitting; never post first and add the disclosure later.
+
+Applies to **all** GitHub interactions, including:
+
+- Pull requests (titles, descriptions, and reviews)
+- PR comments and inline review comments
+- Issues (new issues, comments, and updates)
+- Any other post or reply on GitHub
+
+**How to disclose:** Put it prominently at the **top** of every PR description, review body, comment, or issue. Use wording like:
+
+
+Inline review comments must include a short disclosure too (e.g. `> Generated by Cursor acting on the user's behalf, not the user personally.`).
+
+**Never** submit a GitHub action without this disclosure.
+
+---
+
+Always run the spellcheck before raising a PR:
+
+```bash
+bash scripts/spelling.sh
+```
+
+This is also included in the full CI pipeline via `make local test`.
+
+## Cursor Cloud specific instructions
+
+### Overview
+
+**yq** is a Go CLI for querying and transforming YAML, JSON, XML, INI, and other structured formats. There are no long-running services — development is build-and-test against a local `./yq` binary.
+
+### Prerequisites
+
+- **Go ≥ 1.25** (see `go.mod`)
+- **Bash** (acceptance tests)
+- **Docker/Podman** is optional; use `make local <target>` to run natively when containers are unavailable
+
+### PATH
+
+After `scripts/devtools.sh`, add Go tool binaries to PATH:
+
+```bash
+export PATH="$HOME/go/bin:$PATH"
+```
+
+`golangci-lint` and `typos` install to `$HOME/go/bin`; `gosec` installs to `./bin/gosec` in the repo root.
+
+### Common commands (local, no Docker)
+
+| Task | Command |
+|------|---------|
+| Install dev tools | `bash scripts/devtools.sh` |
+| Vendor dependencies | `make local vendor` |
+| Build binary | `go build -o yq .` or `make local build` |
+| Format | `make local format` |
+| Lint | `make local check` |
+| Unit tests | `make local test` or `bash scripts/test.sh` |
+| Acceptance (E2E) | `bash scripts/acceptance.sh` (requires `./yq` built first) |
+
+`make local build` runs the full CI chain (format → spelling → gosec → lint → unit tests → build → acceptance). For a faster loop, build with `go build -o yq .` and run `bash scripts/acceptance.sh`.
+
+### Caveats
+
+- **`make` without `local`** tries Docker/Podman (`Dockerfile.dev`). In Cloud Agent VMs without Docker, always prefix with `make local`.
+- **Spelling step** uses `typos` (installed by `scripts/devtools.sh`).
+- **`make local test` / `scripts/check.sh`** require `golangci-lint` on PATH (`devtools.sh`).
+
+---
+
 # General rules
 ✅ **DO:**
 - You can use ./yq with the `--debug-node-info` flag to get a deeper understanding of the ast.
-- run ./scripts/format.sh then ./scripts/check.sh to format, then validate linting and spelling
+- run ./scripts/format.sh to format the code; then ./scripts/check.sh lint and finally ./scripts/spelling.sh to check spelling.
 - Add comprehensive tests to cover the changes
 - Run test suite to ensure there is no regression
-- Use UK english spelling (e.g. Colorisation not Colorization)
+- Use UK english spelling
+- **Follow the mandatory GitHub agent disclosure rule above** on every GitHub action — no exceptions
 
 ❌ **DON'T:**
 - Git add or commit
+- Add comments to functions that are self-explanatory
+- **Post to GitHub without the mandatory agent disclosure** (PRs, reviews, comments, issues, or any other GitHub interaction)
 
 
 
@@ -82,6 +161,7 @@ Create a test file `pkg/yqlib/<format>_test.go` using the `formatScenario` patte
 - `scenarioType` can be `"decode"` (test decoding to YAML) or `"roundtrip"` (encode/decode preservation)
 - Create a helper function `test<Format>Scenario()` that switches on `scenarioType`
 - Create main test function `Test<Format>FormatScenarios()` that iterates over scenarios
+- The main test function should use `documentScenarios` to ensure testcase documentation is generated.
 
 Test coverage must include:
 - Basic data types (scalars, arrays, objects/maps)
@@ -196,14 +276,6 @@ Tests must be implemented in `<format>_test.go` following the `formatScenario` p
 
 ## Common Patterns
 
-### Scalar-Only Formats
-Some formats only work with scalars (like base64, uri):
-```go
-if node.guessTagFromCustomType() != "!!str" {
-    return fmt.Errorf("cannot encode %v as <format>, can only operate on strings", node.Tag)
-}
-```
-
 ### Format with Indentation
 Use preferences to control output formatting:
 ```go
@@ -345,6 +417,7 @@ Create `pkg/yqlib/operator_<type>_test.go` using the `expressionScenario` patter
 - Include `subdescription` for longer test names
 - Set `expectedError` if testing error cases
 - Create main test function that iterates over scenarios
+- The main test function should use `documentScenarios` to ensure testcase documentation is generated.
 
 Test coverage must include:
 - Basic data types and nested structures

CODE_OF_CONDUCT.md

@@ -11,7 +11,7 @@ appearance, race, religion, or sexual identity and orientation.
 
 ## Our Standards
 
-Examples of behavior that contributes to creating a positive environment
+Examples of behaviour that contributes to creating a positive environment
 include:
 
 * Using welcoming and inclusive language
@@ -20,7 +20,7 @@ include:
 * Focusing on what is best for the community
 * Showing empathy towards other community members
 
-Examples of unacceptable behavior by participants include:
+Examples of unacceptable behaviour by participants include:
 
 * The use of sexualized language or imagery and unwelcome sexual attention or
  advances
@@ -34,13 +34,13 @@ Examples of unacceptable behavior by participants include:
 ## Our Responsibilities
 
 Project maintainers are responsible for clarifying the standards of acceptable
-behavior and are expected to take appropriate and fair corrective action in
-response to any instances of unacceptable behavior.
+behaviour and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behaviour.
 
 Project maintainers have the right and responsibility to remove, edit, or
 reject comments, commits, code, wiki edits, issues, and other contributions
 that are not aligned to this Code of Conduct, or to ban temporarily or
-permanently any contributor for other behaviors that they deem inappropriate,
+permanently any contributor for other behaviours that they deem inappropriate,
 threatening, offensive, or harmful.
 
 ## Scope
@@ -54,7 +54,7 @@ further defined and clarified by project maintainers.
 
 ## Enforcement
 
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
+Instances of abusive, harassing, or otherwise unacceptable behaviour may be
 reported by contacting the project team at mikefarah@gmail.com. All
 complaints will be reviewed and investigated and will result in a response that
 is deemed necessary and appropriate to the circumstances. The project team is

CONTRIBUTING.md

@@ -197,6 +197,21 @@ Note: PRs with small changes (e.g. minor typos) may not be merged (see https://j
   make [local] test    # Run in Docker container
   ```
 
+- **Problem**: Tests fail with a VCS error:
+  ```bash
+  error obtaining VCS status: exit status 128
+  Use -buildvcs=false to disable VCS stamping.
+  ```
+- **Solution**:
+  Git security mechanisms prevent Golang from detecting the Git details inside
+  the container; either build with the `local` option, or pass GOFLAGS to
+  disable Golang buildvcs behaviour.
+  ```bash
+  make local test
+  # OR
+  make test GOFLAGS='-buildvcs=true'
+  ```
+
 ### Documentation Generation Issues
 - **Problem**: Generated docs don't update after test changes
 - **Solution**: 

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.25.5 AS builder
+FROM golang:1.26.6@sha256:0d1d3a794be25f809dd2cb3160d8c73276c4056a9f8242a138e908ddeee7b6b6 AS builder
 
 WORKDIR /go/src/mikefarah/yq
 
@@ -10,7 +10,7 @@ RUN ./scripts/acceptance.sh
 
 # Choose alpine as a base image to make this useful for CI, as many
 # CI tools expect an interactive shell inside the container
-FROM alpine:3 AS production
+FROM alpine:3@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS production
 LABEL maintainer="Mike Farah <mikefarah@users.noreply.github.com>"
 
 COPY --from=builder /go/src/mikefarah/yq/yq /usr/bin/yq

Dockerfile.dev

@@ -1,8 +1,4 @@
-FROM golang:1.25.5
-
-RUN apt-get update && \
-    apt-get install -y npm && \
-    npm install -g npx cspell@latest
+FROM golang:1.26.6@sha256:0d1d3a794be25f809dd2cb3160d8c73276c4056a9f8242a138e908ddeee7b6b6
 
 COPY scripts/devtools.sh /opt/devtools.sh
 

Makefile

@@ -35,13 +35,14 @@ clean:
 ## prefix before other make targets to run in your local dev environment
 local: | quiet
 	@$(eval ENGINERUN= )
+	@$(eval GOFLAGS="$(GOFLAGS)" )
 	@mkdir -p tmp
 	@touch tmp/dev_image_id
 quiet: # this is silly but shuts up 'Nothing to be done for `local`'
 	@:
 
 prepare: tmp/dev_image_id
-tmp/dev_image_id: Dockerfile.dev scripts/devtools.sh
+tmp/dev_image_id: Dockerfile.dev scripts/devtools.sh _typos.toml
 	@mkdir -p tmp
 	@${ENGINE} rmi -f ${DEV_IMAGE} > /dev/null 2>&1 || true
 	@${ENGINE} build -t ${DEV_IMAGE} -f Dockerfile.dev .

Makefile.variables

@@ -4,6 +4,7 @@ IMPORT_PATH := github.com/mikefarah/${PROJECT}
 export GIT_COMMIT = $(shell git rev-parse --short HEAD)
 export GIT_DIRTY = $(shell test -n "$$(git status --porcelain)" && echo "+CHANGES" || true)
 export GIT_DESCRIBE = $(shell git describe --tags --always)
+GOFLAGS :=
 LDFLAGS :=
 LDFLAGS += -X main.GitCommit=${GIT_COMMIT}${GIT_DIRTY}
 LDFLAGS += -X main.GitDescribe=${GIT_DESCRIBE}
@@ -26,13 +27,15 @@ ifeq ($(CYG_CHECK),1)
 else
 	# all non-windows environments
 	ROOT := $(shell pwd)
-	SELINUX := $(shell which getenforce 2>&1 >/dev/null && echo :z)
+	# Deliberately use `command -v` instead of `which` to be POSIX compliant
+	SELINUX := $(shell command -v getenforce >/dev/null 2>&1 && echo :z)
 endif
 
 DEV_IMAGE := ${PROJECT}_dev
 
 ENGINERUN := ${ENGINE} run --rm \
 	-e LDFLAGS="${LDFLAGS}" \
+	-e GOFLAGS="${GOFLAGS}" \
 	-e GITHUB_TOKEN="${GITHUB_TOKEN}" \
 	-v ${ROOT}/vendor:/go/src${SELINUX} \
 	-v ${ROOT}:/${PROJECT}/src/${IMPORT_PATH}${SELINUX} \

README.md

@@ -3,7 +3,7 @@
 ![Build](https://github.com/mikefarah/yq/workflows/Build/badge.svg)  ![Docker Pulls](https://img.shields.io/docker/pulls/mikefarah/yq.svg) ![Github Releases (by Release)](https://img.shields.io/github/downloads/mikefarah/yq/total.svg) ![Go Report](https://goreportcard.com/badge/github.com/mikefarah/yq) ![CodeQL](https://github.com/mikefarah/yq/workflows/CodeQL/badge.svg)
 
 
-A lightweight and portable command-line YAML, JSON, INI and XML processor. `yq` uses [jq](https://github.com/stedolan/jq) (a popular JSON processor) like syntax but works with yaml files as well as json, xml, ini, properties, csv and tsv. It doesn't yet support everything `jq` does - but it does support the most common operations and functions, and more is being added continuously.
+A lightweight and portable command-line YAML, JSON, INI and XML processor. `yq` uses [jq](https://github.com/stedolan/jq) (a popular JSON processor) like syntax but works with yaml files as well as json, kyaml, xml, ini, properties, csv and tsv. It doesn't yet support everything `jq` does - but it does support the most common operations and functions, and more is being added continuously.
 
 yq is written in Go - so you can download a dependency free binary for your platform and you are good to go! If you prefer there are a variety of package managers that can be used as well as Docker and Podman, all listed below.
 
@@ -415,7 +415,7 @@ Flags:
   -h, --help                            help for yq
   -I, --indent int                      sets indent level for output (default 2)
   -i, --inplace                         update the file in place of first file given.
-  -p, --input-format string             [auto|a|yaml|y|json|j|props|p|csv|c|tsv|t|xml|x|base64|uri|toml|hcl|h|lua|l|ini|i] parse format for input. (default "auto")
+  -p, --input-format string             [auto|a|yaml|y|json|j|kyaml|ky|props|p|csv|c|tsv|t|xml|x|base64|uri|toml|hcl|h|lua|l|ini|i] parse format for input. (default "auto")
       --lua-globals                     output keys as top-level global variables
       --lua-prefix string               prefix (default "return ")
       --lua-suffix string               suffix (default ";\n")
@@ -424,7 +424,7 @@ Flags:
   -N, --no-doc                          Don't print document separators (---)
   -0, --nul-output                      Use NUL char to separate values. If unwrap scalar is also set, fail if unwrapped scalar contains NUL char.
   -n, --null-input                      Don't read input, simply evaluate the expression given. Useful for creating docs from scratch.
-  -o, --output-format string            [auto|a|yaml|y|json|j|props|p|csv|c|tsv|t|xml|x|base64|uri|toml|hcl|h|shell|s|lua|l|ini|i] output format type. (default "auto")
+  -o, --output-format string            [auto|a|yaml|y|json|j|kyaml|ky|props|p|csv|c|tsv|t|xml|x|base64|uri|toml|hcl|h|shell|s|lua|l|ini|i] output format type. (default "auto")
   -P, --prettyPrint                     pretty print, shorthand for '... style = ""'
       --properties-array-brackets       use [x] in array paths (e.g. for SpringBoot)
       --properties-separator string     separator to use between keys and values (default " = ")

SECURITY.md

@@ -0,0 +1,26 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please **do not** report security vulnerabilities through public GitHub issues.
+
+Instead, use GitHub's private vulnerability reporting feature:
+👉 https://github.com/mikefarah/yq/security
+
+This allows vulnerabilities to be triaged and addressed confidentially before any public disclosure.
+
+## Scope
+
+### HTTP / TLS / Network vulnerabilities
+
+yq is a command-line YAML/JSON/TOML processor that reads from files or standard input and writes to standard output. **yq does not include any HTTP or network libraries** and makes no network connections at runtime. CVEs related to HTTP, TLS, or networking are therefore **not applicable** to yq.
+
+### Dependency version bumps
+
+yq uses [Dependabot](https://docs.github.com/en/code-security/dependabot) to automatically raise pull requests for:
+
+- Go module dependencies
+- Go toolchain version
+- Docker base images
+
+Please **do not** raise pull requests or issues solely to bump dependency or Go versions — Dependabot handles this automatically and the maintainers merge those PRs regularly.

_typos.toml

@@ -0,0 +1,20 @@
+[files]
+extend-exclude = ["vendor", "bin"]
+
+[default]
+locale = "en"
+extend-ignore-identifiers-re = [
+  "NdJson",
+]
+
+[default.extend-identifiers]
+AttributeIDSupressMenu = "AttributeIDSupressMenu"
+
+[default.extend-words]
+Teh = "Teh"
+teh = "teh"
+Supress = "Supress"
+HashiCorp = "HashiCorp"
+Hashi = "Hashi"
+fot = "fot"
+nd = "nd"

acceptance_tests/inputs-format.sh

@@ -154,6 +154,37 @@ EOM
   assertEquals "$expected" "$X"
 }
 
+testInputKYaml() {
+  cat >test.kyaml <<'EOL'
+# leading
+{
+  a: 1, # a line
+  # head b
+  b: 2,
+  c: [
+    # head d
+    "d", # d line
+  ],
+}
+EOL
+
+  read -r -d '' expected <<'EOM'
+# leading
+a: 1 # a line
+# head b
+b: 2
+c:
+  # head d
+  - d # d line
+EOM
+
+  X=$(./yq e -p=kyaml -P test.kyaml)
+  assertEquals "$expected" "$X"
+
+  X=$(./yq ea -p=kyaml -P test.kyaml)
+  assertEquals "$expected" "$X"
+}
+
 
 
 
@@ -313,4 +344,4 @@ EOM
   assertEquals "$expected" "$X"
 }
 
-source ./scripts/shunit2
+source ./scripts/shunit2

acceptance_tests/output-format.sh

@@ -280,6 +280,55 @@ EOM
   assertEquals "$expected" "$X"
 }
 
+testOutputKYaml() {
+  cat >test.yml <<'EOL'
+# leading
+a: 1 # a line
+# head b
+b: 2
+c:
+  # head d
+  - d # d line
+EOL
+
+  read -r -d '' expected <<'EOM'
+# leading
+{
+  a: 1, # a line
+  # head b
+  b: 2,
+  c: [
+    # head d
+    "d", # d line
+  ],
+}
+EOM
+
+  X=$(./yq e --output-format=kyaml test.yml)
+  assertEquals "$expected" "$X"
+
+  X=$(./yq ea --output-format=kyaml test.yml)
+  assertEquals "$expected" "$X"
+}
+
+testOutputKYamlShort() {
+  cat >test.yml <<EOL
+a: b
+EOL
+
+  read -r -d '' expected <<'EOM'
+{
+  a: "b",
+}
+EOM
+
+  X=$(./yq e -o=ky test.yml)
+  assertEquals "$expected" "$X"
+
+  X=$(./yq ea -o=ky test.yml)
+  assertEquals "$expected" "$X"
+}
+
 testOutputXmComplex() {
   cat >test.yml <<EOL
 a: {b: {c: ["cat", "dog"], +@f: meow}}

action.yml

@@ -12,6 +12,6 @@ outputs:
     description: "The complete result from the yq command being run"
 runs:
   using: 'docker'
-  image: 'docker://mikefarah/yq:4-githubaction'
+  image: 'docker://mikefarah/yq:4-githubaction@sha256:e1b8c865f299ea6b02910a7ddf147d5d431244d4cc116f89c2148c9f53822906'
   args:
     - ${{ inputs.cmd }}

cmd/evaluate_all_command.go

@@ -60,7 +60,7 @@ func evaluateAll(cmd *cobra.Command, args []string) (cmdError error) {
 	out := cmd.OutOrStdout()
 
 	if writeInplace {
-		// only use colors if its forced
+		// only use colours if its forced
 		colorsEnabled = forceColor
 		writeInPlaceHandler := yqlib.NewWriteInPlaceHandler(args[0])
 		out, err = writeInPlaceHandler.CreateTempFile()
@@ -101,12 +101,15 @@ func evaluateAll(cmd *cobra.Command, args []string) (cmdError error) {
 	}
 
 	if frontMatter != "" {
+		originalFilename := args[0]
 		frontMatterHandler := yqlib.NewFrontMatterHandler(args[0])
 		err = frontMatterHandler.Split()
 		if err != nil {
 			return err
 		}
 		args[0] = frontMatterHandler.GetYamlFrontMatterFilename()
+		yqlib.SetFilenameAlias(args[0], originalFilename)
+		defer yqlib.ClearFilenameAliases()
 
 		if frontMatter == "process" {
 			reader := frontMatterHandler.GetContentReader()

cmd/evaluate_all_command_test.go

@@ -13,6 +13,7 @@ func TestCreateEvaluateAllCommand(t *testing.T) {
 
 	if cmd == nil {
 		t.Fatal("createEvaluateAllCommand returned nil")
+		return
 	}
 
 	// Test basic command properties

cmd/evaluate_sequence_command.go

@@ -74,7 +74,7 @@ func evaluateSequence(cmd *cobra.Command, args []string) (cmdError error) {
 	}
 
 	if writeInplace {
-		// only use colors if its forced
+		// only use colours if its forced
 		colorsEnabled = forceColor
 		writeInPlaceHandler := yqlib.NewWriteInPlaceHandler(args[0])
 		out, err = writeInPlaceHandler.CreateTempFile()
@@ -122,12 +122,15 @@ func evaluateSequence(cmd *cobra.Command, args []string) (cmdError error) {
 
 	if frontMatter != "" {
 		yqlib.GetLogger().Debug("using front matter handler")
+		originalFilename := args[0]
 		frontMatterHandler := yqlib.NewFrontMatterHandler(args[0])
 		err = frontMatterHandler.Split()
 		if err != nil {
 			return err
 		}
 		args[0] = frontMatterHandler.GetYamlFrontMatterFilename()
+		yqlib.SetFilenameAlias(args[0], originalFilename)
+		defer yqlib.ClearFilenameAliases()
 
 		if frontMatter == "process" {
 			reader := frontMatterHandler.GetContentReader()

cmd/evaluate_sequence_command_test.go

@@ -13,6 +13,7 @@ func TestCreateEvaluateSequenceCommand(t *testing.T) {
 
 	if cmd == nil {
 		t.Fatal("createEvaluateSequenceCommand returned nil")
+		return
 	}
 
 	// Test basic command properties

cmd/root.go

@@ -2,12 +2,12 @@ package cmd
 
 import (
 	"fmt"
+	"log/slog"
 	"os"
 	"strings"
 
 	"github.com/mikefarah/yq/v4/pkg/yqlib"
 	"github.com/spf13/cobra"
-	logging "gopkg.in/op/go-logging.v1"
 )
 
 type runeValue rune
@@ -68,30 +68,21 @@ yq -P -oy sample.json
 		},
 		PersistentPreRunE: func(cmd *cobra.Command, _ []string) error {
 			cmd.SetOut(cmd.OutOrStdout())
-			level := logging.WARNING
-			stringFormat := `[%{level}] %{color}%{time:15:04:05}%{color:reset} %{message}`
 
 			// when NO_COLOR environment variable presents and not an empty string the coloured output should be disabled;
 			// refer to no-color.org
 			forceNoColor = forceNoColor || os.Getenv("NO_COLOR") != ""
 
-			if verbose && forceNoColor {
-				level = logging.DEBUG
-				stringFormat = `[%{level:5.5s}] %{time:15:04:05} %{shortfile:-33s} %{shortfunc:-25s} %{message}`
-			} else if verbose {
-				level = logging.DEBUG
-				stringFormat = `[%{level:5.5s}] %{color}%{time:15:04:05}%{color:bold} %{shortfile:-33s} %{shortfunc:-25s}%{color:reset} %{message}`
-			} else if forceNoColor {
-				stringFormat = `[%{level}] %{time:15:04:05} %{message}`
+			level := slog.LevelWarn
+			if verbose {
+				level = slog.LevelDebug
 			}
 
-			var format = logging.MustStringFormatter(stringFormat)
-			var backend = logging.AddModuleLevel(
-				logging.NewBackendFormatter(logging.NewLogBackend(os.Stderr, "", 0), format))
+			yqlib.GetLogger().SetLevel(level)
+			opts := &slog.HandlerOptions{Level: level, AddSource: verbose}
+			handler := slog.NewTextHandler(os.Stderr, opts)
+			yqlib.GetLogger().SetSlogger(slog.New(handler))
 
-			backend.SetLevel(level, "")
-
-			logging.SetBackend(backend)
 			yqlib.InitExpressionParser()
 
 			return nil
@@ -165,6 +156,8 @@ yq -P -oy sample.json
 	rootCmd.PersistentFlags().BoolVar(&yqlib.ConfiguredLuaPreferences.UnquotedKeys, "lua-unquoted", yqlib.ConfiguredLuaPreferences.UnquotedKeys, "output unquoted string keys (e.g. {foo=\"bar\"})")
 	rootCmd.PersistentFlags().BoolVar(&yqlib.ConfiguredLuaPreferences.Globals, "lua-globals", yqlib.ConfiguredLuaPreferences.Globals, "output keys as top-level global variables")
 
+	rootCmd.PersistentFlags().BoolVar(&yqlib.ConfiguredINIPreferences.PreserveSurroundedQuote, "ini-preserve-quotes", yqlib.ConfiguredINIPreferences.PreserveSurroundedQuote, "preserve surrounding quotes on INI values during round-trip")
+
 	rootCmd.PersistentFlags().StringVar(&yqlib.ConfiguredPropertiesPreferences.KeyValueSeparator, "properties-separator", yqlib.ConfiguredPropertiesPreferences.KeyValueSeparator, "separator to use between keys and values")
 	rootCmd.PersistentFlags().BoolVar(&yqlib.ConfiguredPropertiesPreferences.UseArrayBrackets, "properties-array-brackets", yqlib.ConfiguredPropertiesPreferences.UseArrayBrackets, "use [x] in array paths (e.g. for SpringBoot)")
 
@@ -184,7 +177,7 @@ yq -P -oy sample.json
 	}
 	rootCmd.Flags().BoolVarP(&version, "version", "V", false, "Print version information and quit")
 	rootCmd.PersistentFlags().BoolVarP(&writeInplace, "inplace", "i", false, "update the file in place of first file given.")
-	rootCmd.PersistentFlags().VarP(unwrapScalarFlag, "unwrapScalar", "r", "unwrap scalar, print the value with no quotes, colors or comments. Defaults to true for yaml")
+	rootCmd.PersistentFlags().VarP(unwrapScalarFlag, "unwrapScalar", "r", "unwrap scalar, print the value with no quotes, colours or comments. Defaults to true for yaml")
 	rootCmd.PersistentFlags().Lookup("unwrapScalar").NoOptDefVal = "true"
 	rootCmd.PersistentFlags().BoolVarP(&nulSepOutput, "nul-output", "0", false, "Use NUL char to separate values. If unwrap scalar is also set, fail if unwrapped scalar contains NUL char.")
 
@@ -203,6 +196,7 @@ yq -P -oy sample.json
 	}
 	rootCmd.PersistentFlags().BoolVarP(&yqlib.ConfiguredYamlPreferences.LeadingContentPreProcessing, "header-preprocess", "", true, "Slurp any header comments and separators before processing expression.")
 	rootCmd.PersistentFlags().BoolVarP(&yqlib.ConfiguredYamlPreferences.FixMergeAnchorToSpec, "yaml-fix-merge-anchor-to-spec", "", false, "Fix merge anchor to match YAML spec. Will default to true in late 2025")
+	rootCmd.PersistentFlags().BoolVarP(&yqlib.ConfiguredYamlPreferences.CompactSequenceIndent, "yaml-compact-seq-indent", "c", false, "Use compact sequence indentation where '- ' is considered part of the indentation.")
 
 	rootCmd.PersistentFlags().StringVarP(&splitFileExp, "split-exp", "s", "", "print each result (or doc) into a file named (exp). [exp] argument must return a string. You can use $index in the expression as the result counter. The necessary directories will be created.")
 	if err = rootCmd.RegisterFlagCompletionFunc("split-exp", cobra.NoFileCompletions); err != nil {
@@ -220,6 +214,7 @@ yq -P -oy sample.json
 
 	rootCmd.PersistentFlags().BoolVarP(&yqlib.ConfiguredSecurityPreferences.DisableEnvOps, "security-disable-env-ops", "", false, "Disable env related operations.")
 	rootCmd.PersistentFlags().BoolVarP(&yqlib.ConfiguredSecurityPreferences.DisableFileOps, "security-disable-file-ops", "", false, "Disable file related operations (e.g. load)")
+	rootCmd.PersistentFlags().BoolVarP(&yqlib.ConfiguredSecurityPreferences.EnableSystemOps, "security-enable-system-operator", "", false, "Enable system operator to allow execution of external commands.")
 
 	rootCmd.AddCommand(
 		createEvaluateSequenceCommand(),

cmd/root_test.go

@@ -195,6 +195,7 @@ func TestNew(t *testing.T) {
 
 	if rootCmd == nil {
 		t.Fatal("New() returned nil")
+		return
 	}
 
 	// Test basic command properties

cmd/utils.go

@@ -3,12 +3,12 @@ package cmd
 import (
 	"fmt"
 	"io"
+	"log/slog"
 	"os"
 	"strings"
 
 	"github.com/mikefarah/yq/v4/pkg/yqlib"
 	"github.com/spf13/cobra"
-	"gopkg.in/op/go-logging.v1"
 )
 
 func isAutomaticOutputFormat() bool {
@@ -87,6 +87,10 @@ func validateCommandFlags(args []string) error {
 		return fmt.Errorf("cannot pass files in when using null-input flag")
 	}
 
+	if indent < 0 {
+		return fmt.Errorf("indent must not be negative")
+	}
+
 	return nil
 }
 
@@ -104,8 +108,8 @@ func configureFormats(args []string) error {
 		return err
 	}
 
-	yqlib.GetLogger().Debug("Using input format %v", inputFormat)
-	yqlib.GetLogger().Debug("Using output format %v", outputFormat)
+	yqlib.GetLogger().Debugf("Using input format %v", inputFormat)
+	yqlib.GetLogger().Debugf("Using output format %v", outputFormat)
 
 	return nil
 }
@@ -117,7 +121,7 @@ func configureInputFormat(inputFilename string) error {
 		_, err := yqlib.FormatFromString(inputFormat)
 		if err != nil {
 			// unknown file type, default to yaml
-			yqlib.GetLogger().Debug("Unknown file format extension '%v', defaulting to yaml", inputFormat)
+			yqlib.GetLogger().Debugf("Unknown file format extension '%v', defaulting to yaml", inputFormat)
 			inputFormat = "yaml"
 			if isAutomaticOutputFormat() {
 				outputFormat = "yaml"
@@ -132,7 +136,7 @@ func configureInputFormat(inputFilename string) error {
 		//
 		outputFormat = yqlib.FormatStringFromFilename(inputFilename)
 		if inputFilename != "-" {
-			yqlib.GetLogger().Warning("yq default output is now 'auto' (based on the filename extension). Normally yq would output '%v', but for backwards compatibility 'yaml' has been set. Please use -oy to specify yaml, or drop the -p flag.", outputFormat)
+			yqlib.GetLogger().Warningf("yq default output is now 'auto' (based on the filename extension). Normally yq would output '%v', but for backwards compatibility 'yaml' has been set. Please use -oy to specify yaml, or drop the -p flag.", outputFormat)
 		}
 		outputFormat = "yaml"
 	}
@@ -166,6 +170,9 @@ func configureDecoder(evaluateTogether bool) (yqlib.Decoder, error) {
 	}
 	yqlib.ConfiguredYamlPreferences.EvaluateTogether = evaluateTogether
 
+	if format.DecoderFactory == nil {
+		return nil, fmt.Errorf("no support for %s input format", inputFormat)
+	}
 	yqlibDecoder := format.DecoderFactory()
 	if yqlibDecoder == nil {
 		return nil, fmt.Errorf("no support for %s input format", inputFormat)
@@ -197,18 +204,23 @@ func configureEncoder() (yqlib.Encoder, error) {
 	}
 	yqlib.ConfiguredXMLPreferences.Indent = indent
 	yqlib.ConfiguredYamlPreferences.Indent = indent
+	yqlib.ConfiguredKYamlPreferences.Indent = indent
 	yqlib.ConfiguredJSONPreferences.Indent = indent
 
 	yqlib.ConfiguredYamlPreferences.UnwrapScalar = unwrapScalar
+	yqlib.ConfiguredKYamlPreferences.UnwrapScalar = unwrapScalar
 	yqlib.ConfiguredPropertiesPreferences.UnwrapScalar = unwrapScalar
 	yqlib.ConfiguredJSONPreferences.UnwrapScalar = unwrapScalar
+	yqlib.ConfiguredShellVariablesPreferences.UnwrapScalar = unwrapScalar
 
 	yqlib.ConfiguredYamlPreferences.ColorsEnabled = colorsEnabled
+	yqlib.ConfiguredKYamlPreferences.ColorsEnabled = colorsEnabled
 	yqlib.ConfiguredJSONPreferences.ColorsEnabled = colorsEnabled
 	yqlib.ConfiguredHclPreferences.ColorsEnabled = colorsEnabled
 	yqlib.ConfiguredTomlPreferences.ColorsEnabled = colorsEnabled
 
 	yqlib.ConfiguredYamlPreferences.PrintDocSeparators = !noDocSeparators
+	yqlib.ConfiguredKYamlPreferences.PrintDocSeparators = !noDocSeparators
 
 	encoder := yqlibOutputFormat.EncoderFactory()
 
@@ -227,7 +239,7 @@ func maybeFile(str string) bool {
 	yqlib.GetLogger().Debugf("checking '%v' is a file", str)
 	stat, err := os.Stat(str) // #nosec
 	result := err == nil && !stat.IsDir()
-	if yqlib.GetLogger().IsEnabledFor(logging.DEBUG) {
+	if yqlib.GetLogger().IsEnabledFor(slog.LevelDebug) {
 		if err != nil {
 			yqlib.GetLogger().Debugf("error: %v", err)
 		} else {
@@ -272,7 +284,7 @@ func processArgs(originalArgs []string) (string, []string, error) {
 
 	if expressionFile == "" && maybeFirstArgIsAFile && strings.HasSuffix(args[0], ".yq") {
 		// lets check if an expression file was given
-		yqlib.GetLogger().Debug("Assuming arg %v is an expression file", args[0])
+		yqlib.GetLogger().Debugf("Assuming arg %v is an expression file", args[0])
 		expressionFile = args[0]
 		args = args[1:]
 	}
@@ -288,7 +300,7 @@ func processArgs(originalArgs []string) (string, []string, error) {
 
 	yqlib.GetLogger().Debugf("processed args: %v", args)
 	if expression == "" && len(args) > 0 && args[0] != "-" && !maybeFile(args[0]) {
-		yqlib.GetLogger().Debug("assuming expression is '%v'", args[0])
+		yqlib.GetLogger().Debugf("assuming expression is '%v'", args[0])
 		expression = args[0]
 		args = args[1:]
 	}

cmd/utils_test.go

@@ -911,7 +911,7 @@ func stringsEqual(a, b []string) bool {
 		return false
 	}
 	for i := range a {
-		if a[i] != b[i] {
+		if a[i] != b[i] { //nolint:gosec // G602 false positive: b length equality is checked above
 			return false
 		}
 	}
@@ -926,13 +926,13 @@ func TestSetupColors(t *testing.T) {
 		expectColors bool
 	}{
 		{
-			name:         "force color enabled",
+			name:         "force colour enabled",
 			forceColor:   true,
 			forceNoColor: false,
 			expectColors: true,
 		},
 		{
-			name:         "force no color enabled",
+			name:         "force no colour enabled",
 			forceColor:   false,
 			forceNoColor: true,
 			expectColors: false,
@@ -1086,6 +1086,7 @@ func TestValidateCommandFlags(t *testing.T) {
 		frontMatter   string
 		splitFileExp  string
 		nullInput     bool
+		indent        int
 		expectError   bool
 		errorContains string
 	}{
@@ -1148,6 +1149,27 @@ func TestValidateCommandFlags(t *testing.T) {
 			expectError:   true,
 			errorContains: "cannot pass files in when using null-input flag",
 		},
+		{
+			name:          "negative indent",
+			args:          []string{"file.yaml"},
+			writeInplace:  false,
+			frontMatter:   "",
+			splitFileExp:  "",
+			nullInput:     false,
+			indent:        -1,
+			expectError:   true,
+			errorContains: "indent must not be negative",
+		},
+		{
+			name:         "zero indent is valid",
+			args:         []string{"file.yaml"},
+			writeInplace: false,
+			frontMatter:  "",
+			splitFileExp: "",
+			nullInput:    false,
+			indent:       0,
+			expectError:  false,
+		},
 	}
 
 	for _, tt := range tests {
@@ -1157,17 +1179,20 @@ func TestValidateCommandFlags(t *testing.T) {
 			originalFrontMatter := frontMatter
 			originalSplitFileExp := splitFileExp
 			originalNullInput := nullInput
+			originalIndent := indent
 			defer func() {
 				writeInplace = originalWriteInplace
 				frontMatter = originalFrontMatter
 				splitFileExp = originalSplitFileExp
 				nullInput = originalNullInput
+				indent = originalIndent
 			}()
 
 			writeInplace = tt.writeInplace
 			frontMatter = tt.frontMatter
 			splitFileExp = tt.splitFileExp
 			nullInput = tt.nullInput
+			indent = tt.indent
 
 			err := validateCommandFlags(tt.args)
 			if tt.expectError {

cmd/version.go

@@ -11,7 +11,7 @@ var (
 	GitDescribe string
 
 	// Version is main version number that is being run at the moment.
-	Version = "v4.50.1"
+	Version = "v4.53.6"
 
 	// VersionPrerelease is a pre-release marker for the version. If this is "" (empty string)
 	// then it means that it is a final release. Otherwise, this is a pre-release

cmd/version_test.go

@@ -1,6 +1,9 @@
 package cmd
 
-import "testing"
+import (
+	"strings"
+	"testing"
+)
 
 func TestGetVersionDisplay(t *testing.T) {
 	var expectedVersion = ProductName + " (https://github.com/mikefarah/yq/) version " + Version
@@ -25,6 +28,18 @@ func TestGetVersionDisplay(t *testing.T) {
 }
 
 func Test_getHumanVersion(t *testing.T) {
+	// Save original values
+	origGitDescribe := GitDescribe
+	origGitCommit := GitCommit
+	origVersionPrerelease := VersionPrerelease
+
+	// Restore after test
+	defer func() {
+		GitDescribe = origGitDescribe
+		GitCommit = origGitCommit
+		VersionPrerelease = origVersionPrerelease
+	}()
+
 	GitDescribe = "e42813d"
 	GitCommit = "e42813d+CHANGES"
 	var wanted string
@@ -49,3 +64,118 @@ func Test_getHumanVersion(t *testing.T) {
 		}
 	}
 }
+
+func Test_getHumanVersion_NoGitDescribe(t *testing.T) {
+	// Save original values
+	origGitDescribe := GitDescribe
+	origGitCommit := GitCommit
+	origVersionPrerelease := VersionPrerelease
+
+	// Restore after test
+	defer func() {
+		GitDescribe = origGitDescribe
+		GitCommit = origGitCommit
+		VersionPrerelease = origVersionPrerelease
+	}()
+
+	GitDescribe = ""
+	GitCommit = ""
+	VersionPrerelease = ""
+
+	got := getHumanVersion()
+	if got != Version {
+		t.Errorf("getHumanVersion() = %v, want %v", got, Version)
+	}
+}
+
+func Test_getHumanVersion_WithPrerelease(t *testing.T) {
+	// Save original values
+	origGitDescribe := GitDescribe
+	origGitCommit := GitCommit
+	origVersionPrerelease := VersionPrerelease
+
+	// Restore after test
+	defer func() {
+		GitDescribe = origGitDescribe
+		GitCommit = origGitCommit
+		VersionPrerelease = origVersionPrerelease
+	}()
+
+	GitDescribe = ""
+	GitCommit = "abc123"
+	VersionPrerelease = "beta"
+
+	got := getHumanVersion()
+	expected := Version + "-beta (abc123)"
+	if got != expected {
+		t.Errorf("getHumanVersion() = %v, want %v", got, expected)
+	}
+}
+
+func Test_getHumanVersion_PrereleaseInVersion(t *testing.T) {
+	// Save original values
+	origGitDescribe := GitDescribe
+	origGitCommit := GitCommit
+	origVersionPrerelease := VersionPrerelease
+
+	// Restore after test
+	defer func() {
+		GitDescribe = origGitDescribe
+		GitCommit = origGitCommit
+		VersionPrerelease = origVersionPrerelease
+	}()
+
+	GitDescribe = "v1.2.3-rc1"
+	GitCommit = "xyz789"
+	VersionPrerelease = "rc1"
+
+	got := getHumanVersion()
+	// Should not duplicate "rc1" since it's already in GitDescribe
+	expected := "v1.2.3-rc1 (xyz789)"
+	if got != expected {
+		t.Errorf("getHumanVersion() = %v, want %v", got, expected)
+	}
+}
+
+func Test_getHumanVersion_StripSingleQuotes(t *testing.T) {
+	// Save original values
+	origGitDescribe := GitDescribe
+	origGitCommit := GitCommit
+	origVersionPrerelease := VersionPrerelease
+
+	// Restore after test
+	defer func() {
+		GitDescribe = origGitDescribe
+		GitCommit = origGitCommit
+		VersionPrerelease = origVersionPrerelease
+	}()
+
+	GitDescribe = "'v1.2.3'"
+	GitCommit = "'commit123'"
+	VersionPrerelease = ""
+
+	got := getHumanVersion()
+	// Should strip single quotes
+	if strings.Contains(got, "'") {
+		t.Errorf("getHumanVersion() = %v, should not contain single quotes", got)
+	}
+	expected := "v1.2.3"
+	if got != expected {
+		t.Errorf("getHumanVersion() = %v, want %v", got, expected)
+	}
+}
+
+func TestProductName(t *testing.T) {
+	if ProductName != "yq" {
+		t.Errorf("ProductName = %v, want yq", ProductName)
+	}
+}
+
+func TestVersionIsSet(t *testing.T) {
+	if Version == "" {
+		t.Error("Version should not be empty")
+	}
+	if !strings.HasPrefix(Version, "v") {
+		t.Errorf("Version %v should start with 'v'", Version)
+	}
+}

cspell.config.yaml

@@ -1,14 +0,0 @@
----
-$schema: https://raw.githubusercontent.com/streetsidesoftware/cspell/main/cspell.schema.json
-version: '0.2'
-language: en-GB
-dictionaryDefinitions:
-  - name: project-words
-    path: './project-words.txt'
-    addWords: true
-dictionaries:
-  - project-words
-ignorePaths:
-  - 'vendor'
-  - 'bin'
-  - '/project-words.txt'

examples/kyaml.kyaml

@@ -0,0 +1,10 @@
+# leading
+{
+  a: 1, # a line
+  # head b
+  b: 2,
+  c: [
+    # head d
+    "d", # d line
+  ],
+}

examples/kyaml.yml

@@ -0,0 +1,7 @@
+# leading
+a: 1 # a line
+# head b
+b: 2
+c:
+  # head d
+  - d # d line

github-action/Dockerfile

@@ -1,4 +1,4 @@
-FROM mikefarah/yq:4
+FROM mikefarah/yq:4@sha256:11a1f0b604b13dbbdc662260d8db6f644b22d8553122a25c1b5b2e8713ca6977
 
 COPY entrypoint.sh /entrypoint.sh
 

go.mod

@@ -3,42 +3,40 @@ module github.com/mikefarah/yq/v4
 require (
 	github.com/a8m/envsubst v1.4.3
 	github.com/alecthomas/participle/v2 v2.1.4
-	github.com/alecthomas/repr v0.5.2
+	github.com/alecthomas/repr v0.5.4
 	github.com/dimchansky/utfbom v1.1.1
 	github.com/elliotchance/orderedmap v1.8.0
-	github.com/fatih/color v1.18.0
+	github.com/fatih/color v1.19.0
 	github.com/go-ini/ini v1.67.0
-	github.com/goccy/go-json v0.10.5
-	github.com/goccy/go-yaml v1.19.1
+	github.com/goccy/go-json v0.10.6
+	github.com/goccy/go-yaml v1.19.2
 	github.com/hashicorp/hcl/v2 v2.24.0
 	github.com/jinzhu/copier v0.4.0
-	github.com/magiconair/properties v1.8.10
-	github.com/pelletier/go-toml/v2 v2.2.4
+	github.com/magiconair/properties v1.18.11
+	github.com/pelletier/go-toml/v2 v2.4.3
 	github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
-	github.com/yuin/gopher-lua v1.1.1
-	github.com/zclconf/go-cty v1.17.0
-	go.yaml.in/yaml/v4 v4.0.0-rc.3
-	golang.org/x/net v0.48.0
-	golang.org/x/text v0.32.0
-	gopkg.in/op/go-logging.v1 v1.0.0-20160211212156-b2cb9fa56473
+	github.com/yuin/gopher-lua v1.1.2
+	github.com/zclconf/go-cty v1.19.0
+	go.yaml.in/yaml/v4 v4.0.0-rc.6
+	golang.org/x/mod v0.40.0
+	golang.org/x/net v0.58.0
+	golang.org/x/text v0.41.0
 )
 
 require (
 	github.com/agext/levenshtein v1.2.1 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
+	github.com/apparentlymart/go-textseg/v17 v17.0.1 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
-	golang.org/x/mod v0.30.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
-	golang.org/x/sys v0.39.0 // indirect
-	golang.org/x/tools v0.39.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/tools v0.49.0 // indirect
 )
 
-go 1.24.0
-
-toolchain go1.24.1
+go 1.25.0

go.sum

@@ -6,10 +6,12 @@ github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8v
 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
 github.com/alecthomas/participle/v2 v2.1.4 h1:W/H79S8Sat/krZ3el6sQMvMaahJ+XcM9WSI2naI7w2U=
 github.com/alecthomas/participle/v2 v2.1.4/go.mod h1:8tqVbpTX20Ru4NfYQgZf4mP18eXPTBViyMWiArNEgGI=
-github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs=
-github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
+github.com/alecthomas/repr v0.5.4 h1:OVP7JEcuzU9CCDsT6STCr3rg17oQfWILtPWd2EG0uN4=
+github.com/alecthomas/repr v0.5.4/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4=
 github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
 github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
+github.com/apparentlymart/go-textseg/v17 v17.0.1 h1:bpMXRgQ5cEoRNuQke1a80/Nl6w3G5eoIbWo9f3gXkAs=
+github.com/apparentlymart/go-textseg/v17 v17.0.1/go.mod h1:fa8X4jgGeevslICIY6LcdjkSecWnXmYd9Lk34z/VxZs=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
@@ -18,16 +20,16 @@ github.com/dimchansky/utfbom v1.1.1 h1:vV6w1AhK4VMnhBno/TPVCoK9U/LP0PkLCS9tbxHdi
 github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=
 github.com/elliotchance/orderedmap v1.8.0 h1:TrOREecvh3JbS+NCgwposXG5ZTFHtEsQiCGOhPElnMw=
 github.com/elliotchance/orderedmap v1.8.0/go.mod h1:wsDwEaX5jEoyhbs7x93zk2H/qv0zwuhg4inXhDkYqys=
-github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
-github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
+github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
 github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
 github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
 github.com/go-test/deep v1.0.3 h1:ZrJSEWsXzPOxaZnFteGEfooLba+ju3FYIbOrS+rQd68=
 github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
-github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
-github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
-github.com/goccy/go-yaml v1.19.1 h1:3rG3+v8pkhRqoQ/88NYNMHYVGYztCOCIZ7UQhu7H+NE=
-github.com/goccy/go-yaml v1.19.1/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
+github.com/goccy/go-json v0.10.6 h1:p8HrPJzOakx/mn/bQtjgNjdTcN+/S6FcG2CTtQOrHVU=
+github.com/goccy/go-json v0.10.6/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
+github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/hashicorp/hcl/v2 v2.24.0 h1:2QJdZ454DSsYGoaE6QheQZjtKZSUs9Nh2izTWiwQxvE=
@@ -38,16 +40,16 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
 github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
-github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
-github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
+github.com/magiconair/properties v1.18.11 h1:j5ozYZl0zCjG7ahMDH0GWIobOvvUzT0BdAguG0ViKy0=
+github.com/magiconair/properties v1.18.11/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
 github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
-github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
-github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdDPYVpY=
+github.com/pelletier/go-toml/v2 v2.4.3/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e h1:aoZm08cpOy4WuID//EZDgcC4zIxODThtZNPirFr42+A=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -61,30 +63,28 @@ github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3A
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=
-github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
-github.com/zclconf/go-cty v1.17.0 h1:seZvECve6XX4tmnvRzWtJNHdscMtYEx5R7bnnVyd/d0=
-github.com/zclconf/go-cty v1.17.0/go.mod h1:wqFzcImaLTI6A5HfsRwB0nj5n0MRZFwmey8YoFPPs3U=
+github.com/yuin/gopher-lua v1.1.2 h1:yF/FjE3hD65tBbt0VXLE13HWS9h34fdzJmrWRXwobGA=
+github.com/yuin/gopher-lua v1.1.2/go.mod h1:7aRmXIWl37SqRf0koeyylBEzJ+aPt8A+mmkQ4f1ntR8=
+github.com/zclconf/go-cty v1.19.0 h1:IV8WdqYZc2c5rLX9bEoLNXKojBAp0MZPBHMIrCoa/s4=
+github.com/zclconf/go-cty v1.19.0/go.mod h1:12W89jGn3JCOIQi7infWr9m80rOkb5RNYJqXMZcN4c8=
 github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940 h1:4r45xpDWB6ZMSMNJFMOjqrGHynW3DIBuR2H9j0ug+Mo=
 github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmBdvvj3nqzfzJ6nTCIwDTPZ56aVGvDrmztiO5g3qrM=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-go.yaml.in/yaml/v4 v4.0.0-rc.3 h1:3h1fjsh1CTAPjW7q/EMe+C8shx5d8ctzZTrLcs/j8Go=
-go.yaml.in/yaml/v4 v4.0.0-rc.3/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
-golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk=
-golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
-golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU=
-golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4=
+go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
+golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs=
+golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
-golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
-golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
-golang.org/x/tools v0.39.0 h1:ik4ho21kwuQln40uelmciQPp9SipgNDdrafrYA4TmQQ=
-golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/op/go-logging.v1 v1.0.0-20160211212156-b2cb9fa56473 h1:6D+BvnJ/j6e222UW8s2qTSe3wGBtvo0MbVQG/c5k8RE=
-gopkg.in/op/go-logging.v1 v1.0.0-20160211212156-b2cb9fa56473/go.mod h1:N1eN2tsCx0Ydtgjl4cqmbRCsY4/+z4cYDeqwZTk6zog=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

go_install_test.go

@@ -0,0 +1,30 @@
+//go:build goinstall
+
+package main
+
+import (
+	"io"
+	"testing"
+
+	"golang.org/x/mod/module"
+	"golang.org/x/mod/zip"
+)
+
+// TestGoInstallCompatibility ensures the module can be zipped for go install.
+// This is an integration test that uses the same zip.CreateFromDir function
+// that go install uses internally. If this test fails, go install will fail.
+//
+// Built with the goinstall tag and run after the main test suite (see scripts/test.sh)
+// so it does not race with pkg/yqlib tests that rewrite doc/*.md during execution.
+//
+// See: https://github.com/mikefarah/yq/issues/2587
+func TestGoInstallCompatibility(t *testing.T) {
+	mod := module.Version{
+		Path:    "github.com/mikefarah/yq/v4",
+		Version: "v4.0.0", // the actual version doesn't matter for validation
+	}
+
+	if err := zip.CreateFromDir(io.Discard, mod, "."); err != nil {
+		t.Fatalf("Module cannot be zipped for go install: %v", err)
+	}
+}

pkg/yqlib/all_at_once_evaluator.go

@@ -49,12 +49,13 @@ func (e *allAtOnceEvaluator) EvaluateFiles(expression string, filenames []string
 
 	var allDocuments = list.New()
 	for _, filename := range filenames {
-		reader, err := readStream(filename)
+		reader, cleanup, err := readStream(filename)
 		if err != nil {
 			return err
 		}
 
 		fileDocuments, err := readDocuments(reader, filename, fileIndex, decoder)
+		cleanup()
 		if err != nil {
 			return err
 		}

pkg/yqlib/all_at_once_evaluator_test.go

@@ -54,3 +54,25 @@ func TestAllAtOnceEvaluateNodes(t *testing.T) {
 		test.AssertResultComplex(t, tt.expected, resultsToString(t, list))
 	}
 }
+
+func TestTomlDecoderCanBeReinitializedAcrossDocuments(t *testing.T) {
+	decoder := NewTomlDecoder()
+
+	firstDocuments, err := ReadDocuments(strings.NewReader("id = \"Foobar\"\n"), decoder)
+	if err != nil {
+		t.Fatalf("failed to read first TOML document: %v", err)
+	}
+	if firstDocuments.Len() != 1 {
+		t.Fatalf("expected first document count to be 1, got %d", firstDocuments.Len())
+	}
+	test.AssertResult(t, "Foobar", firstDocuments.Front().Value.(*CandidateNode).Content[1].Value)
+
+	secondDocuments, err := ReadDocuments(strings.NewReader("id = \"Banana\"\n"), decoder)
+	if err != nil {
+		t.Fatalf("failed to read second TOML document: %v", err)
+	}
+	if secondDocuments.Len() != 1 {
+		t.Fatalf("expected second document count to be 1, got %d", secondDocuments.Len())
+	}
+	test.AssertResult(t, "Banana", secondDocuments.Front().Value.(*CandidateNode).Content[1].Value)
+}

pkg/yqlib/candidate_node.go

@@ -27,10 +27,30 @@ const (
 	FlowStyle
 )
 
+// EncodeHint controls how a mapping node is serialised by format-specific encoders
+// that distinguish between inline and block/section representations (e.g. TOML, HCL).
+type EncodeHint int
+
+const (
+	// EncodeHintDefault lets the encoder choose the representation (e.g. TOML block
+	// mappings default to [section] headers).
+	EncodeHintDefault EncodeHint = iota
+	// EncodeHintSeparateBlock forces the node to be emitted as a separate block or
+	// table-section header (used by TOML [section] and HCL block decoders).
+	EncodeHintSeparateBlock
+	// EncodeHintInline forces the node to be emitted as an inline / flow table
+	// (used by TOML inline-table decoder and TOML encoder).
+	EncodeHintInline
+)
+
 func createStringScalarNode(stringValue string) *CandidateNode {
 	var node = &CandidateNode{Kind: ScalarNode}
 	node.Value = stringValue
-	node.Tag = "!!str"
+	if stringValue == "<<" {
+		node.Tag = "!!merge"
+	} else {
+		node.Tag = "!!str"
+	}
 	return node
 }
 
@@ -97,9 +117,9 @@ type CandidateNode struct {
 	// (e.g. top level cross document merge). This property does not propagate to child nodes.
 	EvaluateTogether bool
 	IsMapKey         bool
-	// For formats like HCL and TOML: indicates that child entries should be emitted as separate blocks/tables
-	// rather than consolidated into nested mappings (default behaviour)
-	EncodeSeparate bool
+	// EncodeHint controls how a mapping node is serialised by format-specific encoders
+	// (e.g. TOML, HCL) that support both inline and block/section representations.
+	EncodeHint EncodeHint
 }
 
 func (n *CandidateNode) CreateChild() *CandidateNode {
@@ -280,7 +300,7 @@ func (n *CandidateNode) AddChild(rawChild *CandidateNode) {
 
 func (n *CandidateNode) AddChildren(children []*CandidateNode) {
 	if n.Kind == MappingNode {
-		for i := 0; i < len(children); i += 2 {
+		for i := 0; i < len(children)-1; i += 2 {
 			key := children[i]
 			value := children[i+1]
 			n.AddKeyValueChild(key, value)
@@ -323,11 +343,11 @@ func (n *CandidateNode) guessTagFromCustomType() string {
 	dataBucket, errorReading := parseSnippet(n.Value)
 
 	if errorReading != nil {
-		log.Debug("guessTagFromCustomType: could not guess underlying tag type %v", errorReading)
+		log.Debugf("guessTagFromCustomType: could not guess underlying tag type %v", errorReading)
 		return n.Tag
 	}
 	guessedTag := dataBucket.Tag
-	log.Info("im guessing the tag %v is a %v", n.Tag, guessedTag)
+	log.Infof("im guessing the tag %v is a %v", n.Tag, guessedTag)
 	return guessedTag
 }
 
@@ -411,7 +431,7 @@ func (n *CandidateNode) doCopy(cloneContent bool) *CandidateNode {
 		EvaluateTogether: n.EvaluateTogether,
 		IsMapKey:         n.IsMapKey,
 
-		EncodeSeparate: n.EncodeSeparate,
+		EncodeHint: n.EncodeHint,
 	}
 
 	if cloneContent {
@@ -445,7 +465,7 @@ func (n *CandidateNode) UpdateFrom(other *CandidateNode, prefs assignPreferences
 }
 
 func (n *CandidateNode) UpdateAttributesFrom(other *CandidateNode, prefs assignPreferences) {
-	log.Debug("UpdateAttributesFrom: n: %v other: %v", NodeToString(n), NodeToString(other))
+	log.Debugf("UpdateAttributesFrom: n: %v other: %v", NodeToString(n), NodeToString(other))
 	if n.Kind != other.Kind {
 		// clear out the contents when switching to a different type
 		// e.g. map to array
@@ -465,8 +485,8 @@ func (n *CandidateNode) UpdateAttributesFrom(other *CandidateNode, prefs assignP
 		n.Anchor = other.Anchor
 	}
 
-	// Preserve EncodeSeparate flag for format-specific encoding hints
-	n.EncodeSeparate = other.EncodeSeparate
+	// Preserve EncodeHint for format-specific encoding hints
+	n.EncodeHint = other.EncodeHint
 
 	// merge will pickup the style of the new thing
 	// when autocreating nodes

pkg/yqlib/candidate_node_goccy_yaml.go

@@ -36,13 +36,13 @@ func (o *CandidateNode) UnmarshalGoccyYAML(node ast.Node, cm yaml.CommentMap, an
 					switch commentMapComment.Position {
 					case yaml.CommentHeadPosition:
 						o.HeadComment = comment.String()
-						log.Debug("its a head comment %v", comment.String())
+						log.Debugf("its a head comment %v", comment.String())
 					case yaml.CommentLinePosition:
 						o.LineComment = comment.String()
-						log.Debug("its a line comment %v", comment.String())
+						log.Debugf("its a line comment %v", comment.String())
 					case yaml.CommentFootPosition:
 						o.FootComment = comment.String()
-						log.Debug("its a foot comment %v", comment.String())
+						log.Debugf("its a foot comment %v", comment.String())
 					}
 				}
 			}
@@ -93,8 +93,8 @@ func (o *CandidateNode) UnmarshalGoccyYAML(node ast.Node, cm yaml.CommentMap, an
 			log.Debugf("folded Type %v", astLiteral.Start.Type)
 			o.Style = FoldedStyle
 		}
-		log.Debug("start value: %v ", node.(*ast.LiteralNode).Start.Value)
-		log.Debug("start value: %v ", node.(*ast.LiteralNode).Start.Type)
+		log.Debugf("start value: %v ", node.(*ast.LiteralNode).Start.Value)
+		log.Debugf("start value: %v ", node.(*ast.LiteralNode).Start.Type)
 		// TODO: here I could put the original value with line breaks
 		// to solve the multiline > problem
 		o.Value = astLiteral.Value.Value
@@ -187,7 +187,7 @@ func (o *CandidateNode) UnmarshalGoccyYAML(node ast.Node, cm yaml.CommentMap, an
 }
 
 func (o *CandidateNode) goccyProcessMappingValueNode(mappingEntry *ast.MappingValueNode, cm yaml.CommentMap, anchorMap map[string]*CandidateNode) error {
-	log.Debug("UnmarshalYAML MAP KEY entry %v", mappingEntry.Key)
+	log.Debugf("UnmarshalYAML MAP KEY entry %v", mappingEntry.Key)
 
 	// AddKeyValueFirst because it clones the nodes, and we want to have the real refs when Unmarshalling
 	// particularly for the anchorMap
@@ -197,7 +197,7 @@ func (o *CandidateNode) goccyProcessMappingValueNode(mappingEntry *ast.MappingVa
 		return err
 	}
 
-	log.Debug("UnmarshalYAML MAP VALUE entry %v", mappingEntry.Value)
+	log.Debugf("UnmarshalYAML MAP VALUE entry %v", mappingEntry.Value)
 	if err := valueNode.UnmarshalGoccyYAML(mappingEntry.Value, cm, anchorMap); err != nil {
 		return err
 	}

pkg/yqlib/candidate_node_json.go

@@ -7,6 +7,9 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"math"
+	"strconv"
+	"strings"
 
 	"github.com/goccy/go-json"
 )
@@ -120,7 +123,7 @@ func (o *CandidateNode) UnmarshalJSON(data []byte) error {
 	if err != nil {
 		return err
 	}
-	log.Debug("UnmarshalJSON -  scalar is %v", scalar)
+	log.Debugf("UnmarshalJSON -  scalar is %v", scalar)
 
 	return o.setScalarFromJson(scalar)
 
@@ -140,6 +143,12 @@ func (o *CandidateNode) MarshalJSON() ([]byte, error) {
 		return buf.Bytes(), err
 	case ScalarNode:
 		log.Debugf("MarshalJSON ScalarNode")
+		if o.guessTagFromCustomType() == "!!float" {
+			if raw, ok := jsonFloatLiteral(o.Value); ok {
+				buf.WriteString(raw)
+				return buf.Bytes(), nil
+			}
+		}
 		value, err := o.GetValueRep()
 		if err != nil {
 			return buf.Bytes(), err
@@ -177,3 +186,85 @@ func (o *CandidateNode) MarshalJSON() ([]byte, error) {
 		return buf.Bytes(), err
 	}
 }
+
+// jsonFloatLiteral returns a JSON-shaped representation of a YAML !!float scalar
+// value, preserving the original textual form (e.g. "50.0" stays "50.0") whenever
+// possible. The second return value is false when the value cannot be safely
+// rendered as a JSON number (e.g. ".inf", ".nan", or anything that parses to a
+// non-finite float); callers should fall back to the normal encoding path in
+// that case, which preserves the existing behaviour for those inputs.
+func jsonFloatLiteral(raw string) (string, bool) {
+	if raw == "" {
+		return "", false
+	}
+	f, err := strconv.ParseFloat(raw, 64)
+	if err != nil {
+		return "", false
+	}
+	if math.IsInf(f, 0) || math.IsNaN(f) {
+		return "", false
+	}
+	if isJSONNumberLiteral(raw) {
+		return raw, true
+	}
+	formatted := strconv.FormatFloat(f, 'f', -1, 64)
+	if !strings.ContainsAny(formatted, ".eE") {
+		formatted += ".0"
+	}
+	return formatted, true
+}
+
+// isJSONNumberLiteral reports whether s is already a valid JSON number literal
+// representing a fractional value (i.e. contains a "." or an exponent), so it
+// can be emitted verbatim without round-tripping through a float64.
+func isJSONNumberLiteral(s string) bool {
+	if s == "" {
+		return false
+	}
+	i := 0
+	if s[i] == '-' {
+		i++
+		if i == len(s) {
+			return false
+		}
+	}
+	// integer part: 0 or [1-9][0-9]*
+	if s[i] == '0' {
+		i++
+	} else if s[i] >= '1' && s[i] <= '9' {
+		for i < len(s) && s[i] >= '0' && s[i] <= '9' {
+			i++
+		}
+	} else {
+		return false
+	}
+	hasFraction := false
+	if i < len(s) && s[i] == '.' {
+		hasFraction = true
+		i++
+		if i == len(s) || s[i] < '0' || s[i] > '9' {
+			return false
+		}
+		for i < len(s) && s[i] >= '0' && s[i] <= '9' {
+			i++
+		}
+	}
+	hasExponent := false
+	if i < len(s) && (s[i] == 'e' || s[i] == 'E') {
+		hasExponent = true
+		i++
+		if i < len(s) && (s[i] == '+' || s[i] == '-') {
+			i++
+		}
+		if i == len(s) || s[i] < '0' || s[i] > '9' {
+			return false
+		}
+		for i < len(s) && s[i] >= '0' && s[i] <= '9' {
+			i++
+		}
+	}
+	if i != len(s) {
+		return false
+	}
+	return hasFraction || hasExponent
+}

pkg/yqlib/candidate_node_test.go

@@ -106,6 +106,31 @@ func TestCreateScalarNodeScenarios(t *testing.T) {
 	}
 }
 
+type createStringScalarNodeScenario struct {
+	stringValue string
+	expectedTag string
+}
+
+var createStringScalarNodeScenarios = []createStringScalarNodeScenario{
+	{
+		stringValue: "yourKey",
+		expectedTag: "!!str",
+	},
+	{
+		stringValue: "<<",
+		expectedTag: "!!merge",
+	},
+}
+
+func TestCreateStringScalarNodeScenarios(t *testing.T) {
+	for _, tt := range createStringScalarNodeScenarios {
+		actual := createStringScalarNode(tt.stringValue)
+		test.AssertResultWithContext(t, tt.stringValue, actual.Value, fmt.Sprintf("Value for: %v", tt.stringValue))
+		test.AssertResultWithContext(t, tt.expectedTag, actual.Tag, fmt.Sprintf("Tag for: %v", tt.stringValue))
+		test.AssertResultWithContext(t, ScalarNode, actual.Kind, fmt.Sprintf("Kind for: %v", tt.stringValue))
+	}
+}
+
 func TestGetKeyForMapValue(t *testing.T) {
 	key := createStringScalarNode("yourKey")
 	n := CandidateNode{Key: key, Value: "meow", document: 3}

pkg/yqlib/candidate_node_yaml.go

@@ -55,13 +55,13 @@ func (o *CandidateNode) copyFromYamlNode(node *yaml.Node, anchorMap map[string]*
 
 	if o.Anchor != "" {
 		anchorMap[o.Anchor] = o
-		log.Debug("set anchor %v to %v", o.Anchor, NodeToString(o))
+		log.Debugf("set anchor %v to %v", o.Anchor, NodeToString(o))
 	}
 
 	// its a single alias
 	if node.Alias != nil && node.Alias.Anchor != "" {
 		o.Alias = anchorMap[node.Alias.Anchor]
-		log.Debug("set alias to %v", NodeToString(anchorMap[node.Alias.Anchor]))
+		log.Debugf("set alias to %v", NodeToString(anchorMap[node.Alias.Anchor]))
 	}
 	o.HeadComment = node.HeadComment
 	o.LineComment = node.LineComment
@@ -106,7 +106,7 @@ func (o *CandidateNode) UnmarshalYAML(node *yaml.Node, anchorMap map[string]*Can
 	log.Debugf("UnmarshalYAML %v", node.Tag)
 	switch node.Kind {
 	case yaml.AliasNode:
-		log.Debug("UnmarshalYAML - alias from yaml: %v", o.Tag)
+		log.Debugf("UnmarshalYAML - alias from yaml: %v", o.Tag)
 		o.Kind = AliasNode
 		o.copyFromYamlNode(node, anchorMap)
 		return nil
@@ -176,15 +176,15 @@ func (o *CandidateNode) UnmarshalYAML(node *yaml.Node, anchorMap map[string]*Can
 }
 
 func (o *CandidateNode) MarshalYAML() (*yaml.Node, error) {
-	log.Debug("MarshalYAML to yaml: %v", o.Tag)
+	log.Debugf("MarshalYAML to yaml: %v", o.Tag)
 	switch o.Kind {
 	case AliasNode:
-		log.Debug("MarshalYAML - alias to yaml: %v", o.Tag)
+		log.Debugf("MarshalYAML - alias to yaml: %v", o.Tag)
 		target := &yaml.Node{Kind: yaml.AliasNode}
 		o.copyToYamlNode(target)
 		return target, nil
 	case ScalarNode:
-		log.Debug("MarshalYAML - scalar: %v", o.Value)
+		log.Debugf("MarshalYAML - scalar: %v", o.Value)
 		target := &yaml.Node{Kind: yaml.ScalarNode}
 		o.copyToYamlNode(target)
 		return target, nil

pkg/yqlib/chown_linux.go

@@ -18,7 +18,7 @@ func changeOwner(info fs.FileInfo, file *os.File) error {
 			// this happens with snap confinement
 			// not really a big issue as users can chown
 			// the file themselves if required.
-			log.Info("Skipping chown: %v", err)
+			log.Infof("Skipping chown: %v", err)
 		}
 	}
 	return nil

pkg/yqlib/context.go

@@ -3,9 +3,8 @@ package yqlib
 import (
 	"container/list"
 	"fmt"
+	"log/slog"
 	"time"
-
-	logging "gopkg.in/op/go-logging.v1"
 )
 
 type Context struct {
@@ -75,7 +74,7 @@ func (n *Context) ChildContext(results *list.List) Context {
 }
 
 func (n *Context) ToString() string {
-	if !log.IsEnabledFor(logging.DEBUG) {
+	if !log.IsEnabledFor(slog.LevelDebug) {
 		return ""
 	}
 	result := fmt.Sprintf("Context\nDontAutoCreate: %v\n", n.DontAutoCreate)

pkg/yqlib/context_test.go

@@ -2,11 +2,11 @@ package yqlib
 
 import (
 	"container/list"
+	"log/slog"
 	"strings"
 	"testing"
 
 	"github.com/mikefarah/yq/v4/test"
-	logging "gopkg.in/op/go-logging.v1"
 )
 
 func TestChildContext(t *testing.T) {
@@ -155,8 +155,8 @@ func TestToString(t *testing.T) {
 	test.AssertResultComplex(t, "", result)
 
 	// Test with debug logging enabled
-	logging.SetLevel(logging.DEBUG, "")
-	defer logging.SetLevel(logging.INFO, "") // Reset to default
+	GetLogger().SetLevel(slog.LevelDebug)
+	defer GetLogger().SetLevel(slog.LevelWarn) // Reset to default
 
 	result2 := context.ToString()
 	test.AssertResultComplex(t, true, len(result2) > 0)

pkg/yqlib/data_tree_navigator.go

@@ -2,8 +2,7 @@ package yqlib
 
 import (
 	"fmt"
-
-	logging "gopkg.in/op/go-logging.v1"
+	"log/slog"
 )
 
 type DataTreeNavigator interface {
@@ -55,7 +54,7 @@ func (d *dataTreeNavigator) GetMatchingNodes(context Context, expressionNode *Ex
 		return context, nil
 	}
 	log.Debugf("Processing Op: %v", expressionNode.Operation.toString())
-	if log.IsEnabledFor(logging.DEBUG) {
+	if log.IsEnabledFor(slog.LevelDebug) {
 		for el := context.MatchingNodes.Front(); el != nil; el = el.Next() {
 			log.Debug(NodeToString(el.Value.(*CandidateNode)))
 		}

pkg/yqlib/decoder_hcl.go

@@ -226,7 +226,7 @@ func addBlockToMapping(parent *CandidateNode, block *hclsyntax.Block, src []byte
 		// Mark the type node if there are multiple blocks of this type at this level
 		// This tells the encoder to emit them as separate blocks rather than consolidating them
 		if isMultipleBlocksOfType {
-			typeNode.EncodeSeparate = true
+			typeNode.EncodeHint = EncodeHintSeparateBlock
 		}
 	}
 	current = typeNode
@@ -300,8 +300,7 @@ func convertHclExprToNode(expr hclsyntax.Expression, src []byte) *CandidateNode
 			it := v.ElementIterator()
 			for it.Next() {
 				key, val := it.Element()
-				keyStr := key.AsString()
-				keyNode := createStringScalarNode(keyStr)
+				keyNode := convertCtyValueToNode(key)
 				valNode := convertCtyValueToNode(val)
 				m.AddKeyValueChild(keyNode, valNode)
 			}
@@ -338,8 +337,7 @@ func convertHclExprToNode(expr hclsyntax.Expression, src []byte) *CandidateNode
 				}
 				continue
 			}
-			keyStr := keyVal.AsString()
-			keyNode := createStringScalarNode(keyStr)
+			keyNode := convertCtyValueToNode(keyVal)
 			valNode := convertHclExprToNode(item.ValueExpr, src)
 			m.AddKeyValueChild(keyNode, valNode)
 		}
@@ -460,7 +458,7 @@ func convertCtyValueToNode(v cty.Value) *CandidateNode {
 		it := v.ElementIterator()
 		for it.Next() {
 			key, val := it.Element()
-			keyNode := createStringScalarNode(key.AsString())
+			keyNode := convertCtyValueToNode(key)
 			valNode := convertCtyValueToNode(val)
 			m.AddKeyValueChild(keyNode, valNode)
 		}

pkg/yqlib/decoder_ini.go

@@ -12,17 +12,20 @@ import (
 type iniDecoder struct {
 	reader   io.Reader
 	finished bool // Flag to signal completion of processing
+	prefs    INIPreferences
 }
 
-func NewINIDecoder() Decoder {
+func NewINIDecoder(prefs INIPreferences) Decoder {
 	return &iniDecoder{
-		finished: false, // Initialize the flag as false
+		finished: false, // Initialise the flag as false
+		prefs:    prefs,
 	}
 }
 
 func (dec *iniDecoder) Init(reader io.Reader) error {
 	// Store the reader for use in Decode
 	dec.reader = reader
+	dec.finished = false
 	return nil
 }
 
@@ -39,7 +42,10 @@ func (dec *iniDecoder) Decode() (*CandidateNode, error) {
 	}
 
 	// Parse the INI content
-	cfg, err := ini.Load(content)
+	loadOpts := ini.LoadOptions{
+		PreserveSurroundedQuote: dec.prefs.PreserveSurroundedQuote,
+	}
+	cfg, err := ini.LoadSources(loadOpts, content)
 	if err != nil {
 		return nil, fmt.Errorf("failed to parse INI content: %w", err)
 	}

pkg/yqlib/decoder_properties.go

@@ -16,10 +16,11 @@ type propertiesDecoder struct {
 	reader   io.Reader
 	finished bool
 	d        DataTreeNavigator
+	prefs    PropertiesPreferences
 }
 
 func NewPropertiesDecoder() Decoder {
-	return &propertiesDecoder{d: NewDataTreeNavigator(), finished: false}
+	return &propertiesDecoder{d: NewDataTreeNavigator(), finished: false, prefs: ConfiguredPropertiesPreferences.Copy()}
 }
 
 func (dec *propertiesDecoder) Init(reader io.Reader) error {
@@ -28,20 +29,56 @@ func (dec *propertiesDecoder) Init(reader io.Reader) error {
 	return nil
 }
 
-func parsePropKey(key string) []interface{} {
+func parsePropKey(key string, prefs PropertiesPreferences) []interface{} {
 	pathStrArray := strings.Split(key, ".")
-	path := make([]interface{}, len(pathStrArray))
-	for i, pathStr := range pathStrArray {
-		num, err := strconv.ParseInt(pathStr, 10, 32)
-		if err == nil {
-			path[i] = num
-		} else {
-			path[i] = pathStr
-		}
+	path := make([]interface{}, 0, len(pathStrArray))
+	for _, pathStr := range pathStrArray {
+		path = appendPropKeySegment(path, pathStr, prefs.UseArrayBrackets)
 	}
 	return path
 }
 
+func appendPropKeySegment(path []interface{}, segment string, useArrayBrackets bool) []interface{} {
+	if useArrayBrackets && strings.Contains(segment, "[") {
+		bracketPath, ok := parsePropKeyArrayBracketSegment(segment)
+		if ok {
+			return append(path, bracketPath...)
+		}
+	}
+
+	num, err := strconv.ParseInt(segment, 10, 32)
+	if err == nil {
+		return append(path, num)
+	}
+	return append(path, segment)
+}
+
+func parsePropKeyArrayBracketSegment(segment string) ([]interface{}, bool) {
+	path := []interface{}{}
+	bracketIndex := strings.Index(segment, "[")
+	if bracketIndex > 0 {
+		path = append(path, segment[:bracketIndex])
+	}
+
+	remaining := segment[bracketIndex:]
+	for remaining != "" {
+		if !strings.HasPrefix(remaining, "[") {
+			return nil, false
+		}
+		closingBracket := strings.Index(remaining, "]")
+		if closingBracket < 0 {
+			return nil, false
+		}
+		arrayIndex, err := strconv.ParseInt(remaining[1:closingBracket], 10, 32)
+		if err != nil {
+			return nil, false
+		}
+		path = append(path, arrayIndex)
+		remaining = remaining[closingBracket+1:]
+	}
+	return path, true
+}
+
 func (dec *propertiesDecoder) processComment(c string) string {
 	if c == "" {
 		return ""
@@ -75,7 +112,7 @@ func (dec *propertiesDecoder) applyPropertyComments(context Context, path []inte
 
 func (dec *propertiesDecoder) applyProperty(context Context, properties *properties.Properties, key string) error {
 	value, _ := properties.Get(key)
-	path := parsePropKey(key)
+	path := parsePropKey(key, dec.prefs)
 
 	propertyComments := properties.GetComments(key)
 	if len(propertyComments) > 0 {

pkg/yqlib/decoder_test.go

@@ -68,7 +68,7 @@ func mustProcessFormatScenario(s formatScenario, decoder Decoder, encoder Encode
 
 	result, err := processFormatScenario(s, decoder, encoder)
 	if err != nil {
-		log.Error("Bad scenario %v: %w", s.description, err)
+		log.Errorf("Bad scenario %v: %v", s.description, err)
 		return fmt.Sprintf("Bad scenario %v: %v", s.description, err.Error())
 	}
 	return result

pkg/yqlib/decoder_toml.go

@@ -44,9 +44,22 @@ func (dec *tomlDecoder) Init(reader io.Reader) error {
 	}
 	dec.pendingComments = make([]string, 0)
 	dec.firstContentSeen = false
+	dec.finished = false
 	return nil
 }
 
+func (dec *tomlDecoder) attachOrphanedCommentsToNode(tableNodeValue *CandidateNode) {
+	if len(dec.pendingComments) > 0 {
+		comments := strings.Join(dec.pendingComments, "\n")
+		if tableNodeValue.HeadComment == "" {
+			tableNodeValue.HeadComment = comments
+		} else {
+			tableNodeValue.HeadComment = tableNodeValue.HeadComment + "\n" + comments
+		}
+		dec.pendingComments = make([]string, 0)
+	}
+}
+
 func (dec *tomlDecoder) getFullPath(tomlNode *toml.Node) []interface{} {
 	path := make([]interface{}, 0)
 	for {
@@ -93,7 +106,7 @@ func (dec *tomlDecoder) decodeKeyValuesIntoMap(rootMap *CandidateNode, tomlNode
 
 	for dec.parser.NextExpression() {
 		nextItem := dec.parser.Expression()
-		log.Debug("decodeKeyValuesIntoMap -- next exp, its a %v", nextItem.Kind)
+		log.Debugf("decodeKeyValuesIntoMap -- next exp, its a %v", nextItem.Kind)
 
 		switch nextItem.Kind {
 		case toml.KeyValue:
@@ -105,7 +118,7 @@ func (dec *tomlDecoder) decodeKeyValuesIntoMap(rootMap *CandidateNode, tomlNode
 			dec.pendingComments = append(dec.pendingComments, string(nextItem.Data))
 		default:
 			// run out of key values
-			log.Debug("done in decodeKeyValuesIntoMap, gota a %v", nextItem.Kind)
+			log.Debugf("done in decodeKeyValuesIntoMap, gota a %v", nextItem.Kind)
 			return true, nil
 		}
 	}
@@ -137,21 +150,39 @@ func (dec *tomlDecoder) createInlineTableMap(tomlNode *toml.Node) (*CandidateNod
 	}
 
 	return &CandidateNode{
-		Kind:    MappingNode,
-		Tag:     "!!map",
-		Content: content,
+		Kind:       MappingNode,
+		Tag:        "!!map",
+		EncodeHint: EncodeHintInline,
+		Content:    content,
 	}, nil
 }
 
 func (dec *tomlDecoder) createArray(tomlNode *toml.Node) (*CandidateNode, error) {
 	content := make([]*CandidateNode, 0)
+	var pendingArrayComments []string
+
 	iterator := tomlNode.Children()
 	for iterator.Next() {
 		child := iterator.Node()
+
+		// Handle comments within arrays
+		if child.Kind == toml.Comment {
+			// Collect comments to attach to the next array element
+			pendingArrayComments = append(pendingArrayComments, string(child.Data))
+			continue
+		}
+
 		yamlNode, err := dec.decodeNode(child)
 		if err != nil {
 			return nil, err
 		}
+
+		// Attach any pending comments to this array element
+		if len(pendingArrayComments) > 0 {
+			yamlNode.HeadComment = strings.Join(pendingArrayComments, "\n")
+			pendingArrayComments = make([]string, 0)
+		}
+
 		content = append(content, yamlNode)
 	}
 
@@ -241,7 +272,7 @@ func (dec *tomlDecoder) Decode() (*CandidateNode, error) {
 
 		currentNode := dec.parser.Expression()
 
-		log.Debug("currentNode: %v ", currentNode.Kind)
+		log.Debugf("currentNode: %v ", currentNode.Kind)
 		runAgainstCurrentExp, err = dec.processTopLevelNode(currentNode)
 		if err != nil {
 			return dec.rootMap, err
@@ -268,7 +299,7 @@ func (dec *tomlDecoder) Decode() (*CandidateNode, error) {
 func (dec *tomlDecoder) processTopLevelNode(currentNode *toml.Node) (bool, error) {
 	var runAgainstCurrentExp bool
 	var err error
-	log.Debug("processTopLevelNode: Going to process %v state is current %v", currentNode.Kind, NodeToString(dec.rootMap))
+	log.Debugf("processTopLevelNode: Going to process %v state is current %v", currentNode.Kind, NodeToString(dec.rootMap))
 	switch currentNode.Kind {
 	case toml.Comment:
 		// Collect comment to attach to next element
@@ -296,7 +327,7 @@ func (dec *tomlDecoder) processTopLevelNode(currentNode *toml.Node) (bool, error
 		runAgainstCurrentExp, err = dec.decodeKeyValuesIntoMap(dec.rootMap, currentNode)
 	}
 
-	log.Debug("processTopLevelNode: DONE Processing state is now %v", NodeToString(dec.rootMap))
+	log.Debugf("processTopLevelNode: DONE Processing state is now %v", NodeToString(dec.rootMap))
 	return runAgainstCurrentExp, err
 }
 
@@ -304,7 +335,7 @@ func (dec *tomlDecoder) processTable(currentNode *toml.Node) (bool, error) {
 	log.Debug("Enter processTable")
 	child := currentNode.Child()
 	fullPath := dec.getFullPath(child)
-	log.Debug("fullpath: %v", fullPath)
+	log.Debugf("fullpath: %v", fullPath)
 
 	c := Context{}
 	c = c.SingleChildContext(dec.rootMap)
@@ -315,10 +346,10 @@ func (dec *tomlDecoder) processTable(currentNode *toml.Node) (bool, error) {
 	}
 
 	tableNodeValue := &CandidateNode{
-		Kind:           MappingNode,
-		Tag:            "!!map",
-		Content:        make([]*CandidateNode, 0),
-		EncodeSeparate: true,
+		Kind:       MappingNode,
+		Tag:        "!!map",
+		Content:    make([]*CandidateNode, 0),
+		EncodeHint: EncodeHintSeparateBlock,
 	}
 
 	// Attach pending head comments to the table
@@ -329,20 +360,39 @@ func (dec *tomlDecoder) processTable(currentNode *toml.Node) (bool, error) {
 
 	var tableValue *toml.Node
 	runAgainstCurrentExp := false
-	hasValue := dec.parser.NextExpression()
-	// check to see if there is any table data
-	if hasValue {
+	sawKeyValue := false
+	for dec.parser.NextExpression() {
 		tableValue = dec.parser.Expression()
-		// next expression is not table data, so we are done
-		if tableValue.Kind != toml.KeyValue {
-			log.Debug("got an empty table")
-			runAgainstCurrentExp = true
-		} else {
-			runAgainstCurrentExp, err = dec.decodeKeyValuesIntoMap(tableNodeValue, tableValue)
-			if err != nil && !errors.Is(err, io.EOF) {
-				return false, err
-			}
+		// Allow standalone comments inside the table before the first key-value.
+		// These should be associated with the next element in the table (usually the first key-value),
+		// not treated as "end of table" (which would cause subsequent key-values to be parsed at root).
+		if tableValue.Kind == toml.Comment {
+			dec.pendingComments = append(dec.pendingComments, string(tableValue.Data))
+			continue
 		}
+
+		// next expression is not table data, so we are done (but we need to re-process it at top-level)
+		if tableValue.Kind != toml.KeyValue {
+			log.Debug("got an empty table (or reached next section)")
+			// If the table had only comments, attach them to the table itself so they don't leak to the next node.
+			if !sawKeyValue {
+				dec.attachOrphanedCommentsToNode(tableNodeValue)
+			}
+			runAgainstCurrentExp = true
+			break
+		}
+
+		sawKeyValue = true
+		runAgainstCurrentExp, err = dec.decodeKeyValuesIntoMap(tableNodeValue, tableValue)
+		if err != nil && !errors.Is(err, io.EOF) {
+			return false, err
+		}
+		break
+	}
+	// If we hit EOF after only seeing comments inside this table, attach them to the table itself
+	// so they don't leak to whatever comes next.
+	if !sawKeyValue {
+		dec.attachOrphanedCommentsToNode(tableNodeValue)
 	}
 
 	err = dec.d.DeeplyAssign(c, fullPath, tableNodeValue)
@@ -353,7 +403,7 @@ func (dec *tomlDecoder) processTable(currentNode *toml.Node) (bool, error) {
 }
 
 func (dec *tomlDecoder) arrayAppend(context Context, path []interface{}, rhsNode *CandidateNode) error {
-	log.Debug("arrayAppend to path: %v,%v", path, NodeToString(rhsNode))
+	log.Debugf("arrayAppend to path: %v,%v", path, NodeToString(rhsNode))
 	rhsCandidateNode := &CandidateNode{
 		Kind:    SequenceNode,
 		Tag:     "!!seq",
@@ -378,7 +428,7 @@ func (dec *tomlDecoder) processArrayTable(currentNode *toml.Node) (bool, error)
 	log.Debug("Enter processArrayTable")
 	child := currentNode.Child()
 	fullPath := dec.getFullPath(child)
-	log.Debug("Fullpath: %v", fullPath)
+	log.Debugf("Fullpath: %v", fullPath)
 
 	c := Context{}
 	c = c.SingleChildContext(dec.rootMap)
@@ -393,9 +443,9 @@ func (dec *tomlDecoder) processArrayTable(currentNode *toml.Node) (bool, error)
 	hasValue := dec.parser.NextExpression()
 
 	tableNodeValue := &CandidateNode{
-		Kind:           MappingNode,
-		Tag:            "!!map",
-		EncodeSeparate: true,
+		Kind:       MappingNode,
+		Tag:        "!!map",
+		EncodeHint: EncodeHintSeparateBlock,
 	}
 
 	// Attach pending head comments to the array table
@@ -405,19 +455,52 @@ func (dec *tomlDecoder) processArrayTable(currentNode *toml.Node) (bool, error)
 	}
 
 	runAgainstCurrentExp := false
-	// if the next value is a ArrayTable or Table, then its not part of this declaration (not a key value pair)
-	// so lets leave that expression for the next round of parsing
-	if hasValue && (dec.parser.Expression().Kind == toml.ArrayTable || dec.parser.Expression().Kind == toml.Table) {
-		runAgainstCurrentExp = true
-	} else if hasValue {
-		// otherwise, if there is a value, it must be some key value pairs of the
-		// first object in the array!
-		tableValue := dec.parser.Expression()
-		runAgainstCurrentExp, err = dec.decodeKeyValuesIntoMap(tableNodeValue, tableValue)
-		if err != nil && !errors.Is(err, io.EOF) {
-			return false, err
+	sawKeyValue := false
+	if hasValue {
+		for {
+			exp := dec.parser.Expression()
+			// Allow standalone comments inside array tables before the first key-value.
+			if exp.Kind == toml.Comment {
+				dec.pendingComments = append(dec.pendingComments, string(exp.Data))
+				hasValue = dec.parser.NextExpression()
+				if !hasValue {
+					break
+				}
+				continue
+			}
+
+			// if the next value is a ArrayTable or Table, then its not part of this declaration (not a key value pair)
+			// so lets leave that expression for the next round of parsing
+			if exp.Kind == toml.ArrayTable || exp.Kind == toml.Table {
+				// If this array-table entry had only comments, attach them to the entry so they don't leak.
+				if !sawKeyValue {
+					dec.attachOrphanedCommentsToNode(tableNodeValue)
+				}
+				runAgainstCurrentExp = true
+				break
+			}
+
+			sawKeyValue = true
+			// otherwise, if there is a value, it must be some key value pairs of the
+			// first object in the array!
+			runAgainstCurrentExp, err = dec.decodeKeyValuesIntoMap(tableNodeValue, exp)
+			if err != nil && !errors.Is(err, io.EOF) {
+				return false, err
+			}
+			break
 		}
 	}
+	// If we hit EOF after only seeing comments inside this array-table entry, attach them to the entry
+	// so they don't leak to whatever comes next.
+	if !sawKeyValue && len(dec.pendingComments) > 0 {
+		comments := strings.Join(dec.pendingComments, "\n")
+		if tableNodeValue.HeadComment == "" {
+			tableNodeValue.HeadComment = comments
+		} else {
+			tableNodeValue.HeadComment = tableNodeValue.HeadComment + "\n" + comments
+		}
+		dec.pendingComments = make([]string, 0)
+	}
 
 	// += function
 	err = dec.arrayAppend(c, fullPath, tableNodeValue)
@@ -430,23 +513,42 @@ func (dec *tomlDecoder) processArrayTable(currentNode *toml.Node) (bool, error)
 // Because TOML. So we'll inject the last index into the path.
 
 func getPathToUse(fullPath []interface{}, dec *tomlDecoder, c Context) ([]interface{}, error) {
-	pathToCheck := fullPath
-	if len(fullPath) >= 1 {
-		pathToCheck = fullPath[:len(fullPath)-1]
-	}
-	readOp := createTraversalTree(pathToCheck, traversePreferences{DontAutoCreate: true}, false)
+	// We need to check the entire path (except the last element), not just the immediate parent,
+	// because we may have nested array tables like [[array.subarray.subsubarray]]
+	// where both 'array' and 'subarray' are arrays that already exist.
 
-	resultContext, err := dec.d.GetMatchingNodes(c, readOp)
-	if err != nil {
-		return nil, err
+	if len(fullPath) == 0 {
+		return fullPath, nil
 	}
-	if resultContext.MatchingNodes.Len() >= 1 {
-		match := resultContext.MatchingNodes.Front().Value.(*CandidateNode)
-		// path refers to an array, we need to add this to the last element in the array
-		if match.Kind == SequenceNode {
-			fullPath = append(pathToCheck, len(match.Content)-1, fullPath[len(fullPath)-1])
-			log.Debugf("Adding to end of %v array, using path: %v", pathToCheck, fullPath)
+
+	resultPath := make([]interface{}, 0, len(fullPath)*2) // preallocate with extra space for indices
+
+	// Process all segments except the last one
+	for i := 0; i < len(fullPath)-1; i++ {
+		resultPath = append(resultPath, fullPath[i])
+
+		// Check if the current path segment points to an array
+		readOp := createTraversalTree(resultPath, traversePreferences{DontAutoCreate: true}, false)
+		resultContext, err := dec.d.GetMatchingNodes(c, readOp)
+		if err != nil {
+			return nil, err
+		}
+
+		if resultContext.MatchingNodes.Len() >= 1 {
+			match := resultContext.MatchingNodes.Front().Value.(*CandidateNode)
+			// If this segment points to an array, we need to add the last index
+			// before continuing with the rest of the path
+			if match.Kind == SequenceNode && len(match.Content) > 0 {
+				lastIndex := len(match.Content) - 1
+				resultPath = append(resultPath, lastIndex)
+				log.Debugf("Path segment %v is an array, injecting index %d", resultPath[:len(resultPath)-1], lastIndex)
+			}
 		}
 	}
-	return fullPath, err
+
+	// Add the last segment
+	resultPath = append(resultPath, fullPath[len(fullPath)-1])
+
+	log.Debugf("getPathToUse: original path %v -> result path %v", fullPath, resultPath)
+	return resultPath, nil
 }

pkg/yqlib/decoder_uri_test.go

@@ -0,0 +1,160 @@
+//go:build !yq_nouri
+
+package yqlib
+
+import (
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/mikefarah/yq/v4/test"
+)
+
+func TestUriDecoder_Init(t *testing.T) {
+	decoder := NewUriDecoder()
+	reader := strings.NewReader("test")
+	err := decoder.Init(reader)
+	test.AssertResult(t, nil, err)
+}
+
+func TestUriDecoder_DecodeSimpleString(t *testing.T) {
+	decoder := NewUriDecoder()
+	reader := strings.NewReader("hello%20world")
+	err := decoder.Init(reader)
+	test.AssertResult(t, nil, err)
+
+	node, err := decoder.Decode()
+	test.AssertResult(t, nil, err)
+	test.AssertResult(t, "!!str", node.Tag)
+	test.AssertResult(t, "hello world", node.Value)
+}
+
+func TestUriDecoder_DecodeSpecialCharacters(t *testing.T) {
+	decoder := NewUriDecoder()
+	reader := strings.NewReader("hello%21%40%23%24%25")
+	err := decoder.Init(reader)
+	test.AssertResult(t, nil, err)
+
+	node, err := decoder.Decode()
+	test.AssertResult(t, nil, err)
+	test.AssertResult(t, "hello!@#$%", node.Value)
+}
+
+func TestUriDecoder_DecodeUTF8(t *testing.T) {
+	decoder := NewUriDecoder()
+	reader := strings.NewReader("%E2%9C%93%20check")
+	err := decoder.Init(reader)
+	test.AssertResult(t, nil, err)
+
+	node, err := decoder.Decode()
+	test.AssertResult(t, nil, err)
+	test.AssertResult(t, "✓ check", node.Value)
+}
+
+func TestUriDecoder_DecodePlusSign(t *testing.T) {
+	decoder := NewUriDecoder()
+	reader := strings.NewReader("a+b")
+	err := decoder.Init(reader)
+	test.AssertResult(t, nil, err)
+
+	node, err := decoder.Decode()
+	test.AssertResult(t, nil, err)
+	// Note: url.QueryUnescape does NOT convert + to space
+	// That's only for form encoding (url.ParseQuery)
+	test.AssertResult(t, "a b", node.Value)
+}
+
+func TestUriDecoder_DecodeEmptyString(t *testing.T) {
+	decoder := NewUriDecoder()
+	reader := strings.NewReader("")
+	err := decoder.Init(reader)
+	test.AssertResult(t, nil, err)
+
+	node, err := decoder.Decode()
+	test.AssertResult(t, nil, err)
+	test.AssertResult(t, "", node.Value)
+
+	// Second decode should return EOF
+	node, err = decoder.Decode()
+	test.AssertResult(t, io.EOF, err)
+	test.AssertResult(t, (*CandidateNode)(nil), node)
+}
+
+func TestUriDecoder_DecodeMultipleCalls(t *testing.T) {
+	decoder := NewUriDecoder()
+	reader := strings.NewReader("test")
+	err := decoder.Init(reader)
+	test.AssertResult(t, nil, err)
+
+	// First decode
+	node, err := decoder.Decode()
+	test.AssertResult(t, nil, err)
+	test.AssertResult(t, "test", node.Value)
+
+	// Second decode should return EOF since we've consumed all input
+	node, err = decoder.Decode()
+	test.AssertResult(t, io.EOF, err)
+	test.AssertResult(t, (*CandidateNode)(nil), node)
+}
+
+func TestUriDecoder_DecodeInvalidEscape(t *testing.T) {
+	decoder := NewUriDecoder()
+	reader := strings.NewReader("test%ZZ")
+	err := decoder.Init(reader)
+	test.AssertResult(t, nil, err)
+
+	_, err = decoder.Decode()
+	// Should return an error for invalid escape sequence
+	if err == nil {
+		t.Error("Expected error for invalid escape sequence, got nil")
+	}
+}
+
+func TestUriDecoder_DecodeSlashAndQuery(t *testing.T) {
+	decoder := NewUriDecoder()
+	reader := strings.NewReader("path%2Fto%2Ffile%3Fquery%3Dvalue")
+	err := decoder.Init(reader)
+	test.AssertResult(t, nil, err)
+
+	node, err := decoder.Decode()
+	test.AssertResult(t, nil, err)
+	test.AssertResult(t, "path/to/file?query=value", node.Value)
+}
+
+func TestUriDecoder_DecodePercent(t *testing.T) {
+	decoder := NewUriDecoder()
+	reader := strings.NewReader("100%25")
+	err := decoder.Init(reader)
+	test.AssertResult(t, nil, err)
+
+	node, err := decoder.Decode()
+	test.AssertResult(t, nil, err)
+	test.AssertResult(t, "100%", node.Value)
+}
+
+func TestUriDecoder_DecodeNoEscaping(t *testing.T) {
+	decoder := NewUriDecoder()
+	reader := strings.NewReader("simple_text-123")
+	err := decoder.Init(reader)
+	test.AssertResult(t, nil, err)
+
+	node, err := decoder.Decode()
+	test.AssertResult(t, nil, err)
+	test.AssertResult(t, "simple_text-123", node.Value)
+}
+
+// Mock reader that returns an error
+type errorReader struct{}
+
+func (e *errorReader) Read(_ []byte) (n int, err error) {
+	return 0, io.ErrUnexpectedEOF
+}
+
+func TestUriDecoder_DecodeReadError(t *testing.T) {
+	decoder := NewUriDecoder()
+	err := decoder.Init(&errorReader{})
+	test.AssertResult(t, nil, err)
+
+	_, err = decoder.Decode()
+	test.AssertResult(t, io.ErrUnexpectedEOF, err)
+}

pkg/yqlib/decoder_xml.go

@@ -64,7 +64,7 @@ func (dec *xmlDecoder) processComment(c string) string {
 }
 
 func (dec *xmlDecoder) createMap(n *xmlNode) (*CandidateNode, error) {
-	log.Debug("createMap: headC: %v, lineC: %v, footC: %v", n.HeadComment, n.LineComment, n.FootComment)
+	log.Debugf("createMap: headC: %v, lineC: %v, footC: %v", n.HeadComment, n.LineComment, n.FootComment)
 	yamlNode := &CandidateNode{Kind: MappingNode, Tag: "!!map"}
 
 	if len(n.Data) > 0 {
@@ -92,7 +92,7 @@ func (dec *xmlDecoder) createMap(n *xmlNode) (*CandidateNode, error) {
 		log.Debugf("label=%v, i=%v, keyValuePair.FootComment: %v", label, i, keyValuePair.FootComment)
 		labelNode.FootComment = dec.processComment(keyValuePair.FootComment)
 
-		log.Debug("len of children in %v is %v", label, len(children))
+		log.Debugf("len of children in %v is %v", label, len(children))
 		if len(children) > 1 {
 			valueNode, err = dec.createSequence(children)
 			if err != nil {
@@ -105,7 +105,7 @@ func (dec *xmlDecoder) createMap(n *xmlNode) (*CandidateNode, error) {
 			if len(children[0].Children) == 0 && children[0].HeadComment != "" {
 				if len(children[0].Data) > 0 {
 
-					log.Debug("scalar comment hack, currentlabel [%v]", labelNode.HeadComment)
+					log.Debugf("scalar comment hack, currentlabel [%v]", labelNode.HeadComment)
 					labelNode.HeadComment = joinComments([]string{labelNode.HeadComment, strings.TrimSpace(children[0].HeadComment)}, "\n")
 					children[0].HeadComment = ""
 				} else {
@@ -151,7 +151,7 @@ func (dec *xmlDecoder) convertToYamlNode(n *xmlNode) (*CandidateNode, error) {
 
 	scalar := dec.createValueNodeFromData(n.Data)
 
-	log.Debug("scalar (%v), headC: %v, lineC: %v, footC: %v", scalar.Tag, n.HeadComment, n.LineComment, n.FootComment)
+	log.Debugf("scalar (%v), headC: %v, lineC: %v, footC: %v", scalar.Tag, n.HeadComment, n.LineComment, n.FootComment)
 	scalar.HeadComment = dec.processComment(n.HeadComment)
 	scalar.LineComment = dec.processComment(n.LineComment)
 	if scalar.Tag == "!!seq" {
@@ -211,17 +211,17 @@ func (n *xmlNode) AddChild(s string, c *xmlNode) {
 	if n.Children == nil {
 		n.Children = make([]*xmlChildrenKv, 0)
 	}
-	log.Debug("looking for %s", s)
+	log.Debugf("looking for %s", s)
 	// see if we can find an existing entry to add to
 	for _, childEntry := range n.Children {
 		if childEntry.K == s {
-			log.Debug("found it, appending an entry%s", s)
+			log.Debugf("found it, appending an entry%s", s)
 			childEntry.V = append(childEntry.V, c)
-			log.Debug("yay len of children in %v is %v", s, len(childEntry.V))
+			log.Debugf("yay len of children in %v is %v", s, len(childEntry.V))
 			return
 		}
 	}
-	log.Debug("not there, making a new one %s", s)
+	log.Debugf("not there, making a new one %s", s)
 	n.Children = append(n.Children, &xmlChildrenKv{K: s, V: []*xmlNode{c}})
 }
 
@@ -267,7 +267,7 @@ func (dec *xmlDecoder) decodeXML(root *xmlNode) error {
 
 		switch se := t.(type) {
 		case xml.StartElement:
-			log.Debug("start element %v", se.Name.Local)
+			log.Debugf("start element %v", se.Name.Local)
 			elem.state = "started"
 			// Build new a new current element and link it to its parent
 			var label = se.Name.Local
@@ -302,14 +302,14 @@ func (dec *xmlDecoder) decodeXML(root *xmlNode) error {
 			if len(newBit) > 0 {
 				elem.n.Data = append(elem.n.Data, newBit)
 				elem.state = "chardata"
-				log.Debug("chardata [%v] for %v", elem.n.Data, elem.label)
+				log.Debugf("chardata [%v] for %v", elem.n.Data, elem.label)
 			}
 		case xml.EndElement:
 			if elem == nil {
 				log.Debug("no element, probably bad xml")
 				continue
 			}
-			log.Debug("end element %v", elem.label)
+			log.Debugf("end element %v", elem.label)
 			elem.state = "finished"
 			// And add it to its parent list
 			if elem.parent != nil {
@@ -326,10 +326,10 @@ func (dec *xmlDecoder) decodeXML(root *xmlNode) error {
 				applyFootComment(elem, commentStr)
 
 			case "chardata":
-				log.Debug("got a line comment for (%v) %v: [%v]", elem.state, elem.label, commentStr)
+				log.Debugf("got a line comment for (%v) %v: [%v]", elem.state, elem.label, commentStr)
 				elem.n.LineComment = joinComments([]string{elem.n.LineComment, commentStr}, " ")
 			default:
-				log.Debug("got a head comment for (%v) %v: [%v]", elem.state, elem.label, commentStr)
+				log.Debugf("got a head comment for (%v) %v: [%v]", elem.state, elem.label, commentStr)
 				elem.n.HeadComment = joinComments([]string{elem.n.HeadComment, commentStr}, " ")
 			}
 
@@ -354,7 +354,7 @@ func applyFootComment(elem *element, commentStr string) {
 	if len(elem.n.Children) > 0 {
 		lastChildIndex := len(elem.n.Children) - 1
 		childKv := elem.n.Children[lastChildIndex]
-		log.Debug("got a foot comment, putting on last child for %v: [%v]", childKv.K, commentStr)
+		log.Debugf("got a foot comment, putting on last child for %v: [%v]", childKv.K, commentStr)
 		// if it's an array of scalars, put the foot comment on the scalar itself
 		if len(childKv.V) > 0 && len(childKv.V[0].Children) == 0 {
 			nodeToUpdate := childKv.V[len(childKv.V)-1]
@@ -363,7 +363,7 @@ func applyFootComment(elem *element, commentStr string) {
 			childKv.FootComment = joinComments([]string{elem.n.FootComment, commentStr}, " ")
 		}
 	} else {
-		log.Debug("got a foot comment for %v: [%v]", elem.label, commentStr)
+		log.Debugf("got a foot comment for %v: [%v]", elem.label, commentStr)
 		elem.n.FootComment = joinComments([]string{elem.n.FootComment, commentStr}, " ")
 	}
 }

pkg/yqlib/decoder_yaml.go

@@ -78,7 +78,7 @@ func (dec *yamlDecoder) processReadStream(reader *bufio.Reader) (io.Reader, stri
 		if separatorPrefixRe.MatchString(line) {
 			match := separatorPrefixRe.FindString(line)
 			remainder := line[len(match):]
-			// normalize separator newline: if original had none, default to LF
+			// normalise separator newline: if original had none, default to LF
 			sepNewline := newline
 			if sepNewline == "" {
 				sepNewline = "\n"

pkg/yqlib/doc/operators/anchor-and-alias-operators.md

@@ -2,7 +2,7 @@
 
 Use the `alias` and `anchor` operators to read and write yaml aliases and anchors. The `explode` operator normalises a yaml file (dereference (or expands) aliases and remove anchor names).
 
-`yq` supports merge aliases (like `<<: *blah`) however this is no longer in the standard yaml spec (1.2) and so `yq` will automatically add the `!!merge` tag to these nodes as it is effectively a custom tag.
+`yq` supports merge keys (like `<<: *blah`) from YAML 1.1. These are no longer part of the YAML 1.2 standard, but remain common in practice. Plain `<<:` keys are recognised as merge keys and round-trip as `<<:` without an explicit `!!merge` tag. When the source uses an explicit `!!merge` tag, that is preserved on output. Internally, when `yq` synthesises a `<<` map key (for example during merge operations), it tags the key as `!!merge` rather than `!!str`.
 
 
 ## NOTE --yaml-fix-merge-anchor-to-spec flag
@@ -22,7 +22,7 @@ see https://yaml.org/type/merge.html
 
 Given a sample.yml file of:
 ```yaml
-- &CENTER
+- &CENTRE
   x: 1
   y: 2
 - &LEFT
@@ -32,7 +32,7 @@ Given a sample.yml file of:
   r: 10
 - &SMALL
   r: 1
-- !!merge <<: *CENTER
+- <<: *CENTRE
   r: 10
 ```
 then
@@ -213,10 +213,10 @@ item_value: &item_value
   value: true
 thingOne:
   name: item_1
-  !!merge <<: *item_value
+  <<: *item_value
 thingTwo:
   name: item_2
-  !!merge <<: *item_value
+  <<: *item_value
 ```
 then
 ```bash
@@ -231,7 +231,7 @@ thingOne:
   value: false
 thingTwo:
   name: item_2
-  !!merge <<: *item_value
+  <<: *item_value
 ```
 
 ## LEGACY: Explode with merge anchors
@@ -249,13 +249,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -288,7 +288,7 @@ see https://yaml.org/type/merge.html. This has the correct data, but the wrong k
 
 Given a sample.yml file of:
 ```yaml
-- &CENTER
+- &CENTRE
   x: 1
   y: 2
 - &LEFT
@@ -298,8 +298,8 @@ Given a sample.yml file of:
   r: 10
 - &SMALL
   r: 1
-- !!merge <<:
-    - *CENTER
+- <<:
+    - *CENTRE
     - *BIG
 ```
 then
@@ -318,7 +318,7 @@ see https://yaml.org/type/merge.html. This has the correct data, but the wrong k
 
 Given a sample.yml file of:
 ```yaml
-- &CENTER
+- &CENTRE
   x: 1
   y: 2
 - &LEFT
@@ -328,7 +328,7 @@ Given a sample.yml file of:
   r: 10
 - &SMALL
   r: 1
-- !!merge <<:
+- <<:
     - *BIG
     - *LEFT
     - *SMALL
@@ -361,13 +361,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -401,7 +401,7 @@ Taken from https://yaml.org/type/merge.html. Same values as legacy, but with the
 
 Given a sample.yml file of:
 ```yaml
-- &CENTER
+- &CENTRE
   x: 1
   y: 2
 - &LEFT
@@ -411,8 +411,8 @@ Given a sample.yml file of:
   r: 10
 - &SMALL
   r: 1
-- !!merge <<:
-    - *CENTER
+- <<:
+    - *CENTRE
     - *BIG
 ```
 then
@@ -432,7 +432,7 @@ Taken from https://yaml.org/type/merge.html. Same values as legacy, but with the
 
 Given a sample.yml file of:
 ```yaml
-- &CENTER
+- &CENTRE
   x: 1
   y: 2
 - &LEFT
@@ -442,7 +442,7 @@ Given a sample.yml file of:
   r: 10
 - &SMALL
   r: 1
-- !!merge <<:
+- <<:
     - *BIG
     - *LEFT
     - *SMALL
@@ -467,7 +467,7 @@ Given a sample.yml file of:
 ```yaml
 a:
   b: &b 42
-!!merge <<:
+<<:
   c: *b
 ```
 then

pkg/yqlib/doc/operators/datetime.md

@@ -2,7 +2,7 @@
 
 Various operators for parsing and manipulating dates. 
 
-## Date time formattings
+## Date time formatting
 This uses Golang's built in time library for parsing and formatting date times.
 
 When not specified, the RFC3339 standard is assumed `2006-01-02T15:04:05Z07:00` for parsing.

pkg/yqlib/doc/operators/divide.md

@@ -55,7 +55,7 @@ yq '.a = .a / 0 | .b = .b / 0' sample.yml
 ```
 will output
 ```yaml
-a: !!float +Inf
-b: !!float -Inf
+a: +Inf
+b: -Inf
 ```
 

pkg/yqlib/doc/operators/headers/anchor-and-alias-operators.md

@@ -2,7 +2,7 @@
 
 Use the `alias` and `anchor` operators to read and write yaml aliases and anchors. The `explode` operator normalises a yaml file (dereference (or expands) aliases and remove anchor names).
 
-`yq` supports merge aliases (like `<<: *blah`) however this is no longer in the standard yaml spec (1.2) and so `yq` will automatically add the `!!merge` tag to these nodes as it is effectively a custom tag.
+`yq` supports merge keys (like `<<: *blah`) from YAML 1.1. These are no longer part of the YAML 1.2 standard, but remain common in practice. Plain `<<:` keys are recognised as merge keys and round-trip as `<<:` without an explicit `!!merge` tag. When the source uses an explicit `!!merge` tag, that is preserved on output. Internally, when `yq` synthesises a `<<` map key (for example during merge operations), it tags the key as `!!merge` rather than `!!str`.
 
 
 ## NOTE --yaml-fix-merge-anchor-to-spec flag

pkg/yqlib/doc/operators/headers/datetime.md

@@ -2,7 +2,7 @@
 
 Various operators for parsing and manipulating dates. 
 
-## Date time formattings
+## Date time formatting
 This uses Golang's built in time library for parsing and formatting date times.
 
 When not specified, the RFC3339 standard is assumed `2006-01-02T15:04:05Z07:00` for parsing.

pkg/yqlib/doc/operators/headers/slice-array.md

@@ -1,5 +1,5 @@
-# Slice/Splice Array
+# Slice Array or String
 
-The slice array operator takes an array as input and returns a subarray. Like the `jq` equivalent, `.[10:15]` will return an array of length 5, starting from index 10 inclusive, up to index 15 exclusive. Negative numbers count backwards from the end of the array.
+The slice operator works on both arrays and strings. Like the `jq` equivalent, `.[10:15]` will return a subarray (or substring) of length 5, starting from index 10 inclusive, up to index 15 exclusive. Negative numbers count backwards from the end of the array or string.
 
-You may leave out the first or second number, which will refer to the start or end of the array respectively.
+You may leave out the first or second number, which will refer to the start or end of the array or string respectively.

pkg/yqlib/doc/operators/headers/system-operators.md

@@ -0,0 +1,27 @@
+# System Operators
+
+The `system` operator allows you to run an external command and use its output as a value in your expression.
+
+**Security warning**: The system operator is disabled by default. You must explicitly pass `--security-enable-system-operator` to use it.
+
+**Note:** When enabled, the system operator can replicate the functionality of `env` and `load`
+operators via external commands. Enabling it effectively overrides `--security-disable-env-ops`
+and `--security-disable-file-ops`.
+
+## Usage
+
+```bash
+yq --security-enable-system-operator --null-input '.field = system("command"; "arg1")'
+```
+
+The operator takes:
+- A command string (required)
+- An argument (or an array of arguments), separated from the command by `;` (optional)
+
+The current matched node's value is serialised and piped to the command via stdin. The command's stdout (with trailing newline stripped) is returned as a string.
+
+## Disabling the system operator
+
+The system operator is disabled by default. When disabled, an error is returned instead of running the command, consistent with `--security-disable-env-ops` and `--security-disable-file-ops`.
+
+Use `--security-enable-system-operator` flag to enable it.

pkg/yqlib/doc/operators/modulo.md

@@ -34,7 +34,7 @@ yq '.a = .a % .b' sample.yml
 ```
 will output
 ```yaml
-a: !!float 2
+a: 2
 b: 2.5
 ```
 
@@ -69,7 +69,7 @@ yq '.a = .a % .b' sample.yml
 ```
 will output
 ```yaml
-a: !!float NaN
+a: NaN
 b: 0
 ```
 

pkg/yqlib/doc/operators/multiply-merge.md

@@ -471,13 +471,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -487,7 +487,7 @@ yq '.foobar * .foobarList' sample.yml
 will output
 ```yaml
 c: foobarList_c
-!!merge <<:
+<<:
   - *foo
   - *bar
 thing: foobar_thing

pkg/yqlib/doc/operators/parent.md

@@ -80,7 +80,7 @@ will output
 ```
 
 ## Get the top (root) parent
-Use negative numbers to get the top parents
+Use negative numbers to get the top parents. You can think of this as indexing into the 'parents' array above
 
 Given a sample.yml file of:
 ```yaml
@@ -156,6 +156,25 @@ a:
     c: cat
 ```
 
+## N-th negative
+Similarly, use negative numbers to index backwards from the parents array
+
+Given a sample.yml file of:
+```yaml
+a:
+  b:
+    c: cat
+```
+then
+```bash
+yq '.a.b.c | parent(-2)' sample.yml
+```
+will output
+```yaml
+b:
+  c: cat
+```
+
 ## No parent
 Given a sample.yml file of:
 ```yaml

pkg/yqlib/doc/operators/recursive-descent-glob.md

@@ -131,13 +131,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -147,7 +147,7 @@ yq '.foobar | [..]' sample.yml
 will output
 ```yaml
 - c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 - foobar_c
 - *foo

pkg/yqlib/doc/operators/slice-array.md

@@ -1,8 +1,8 @@
-# Slice/Splice Array
+# Slice Array or String
 
-The slice array operator takes an array as input and returns a subarray. Like the `jq` equivalent, `.[10:15]` will return an array of length 5, starting from index 10 inclusive, up to index 15 exclusive. Negative numbers count backwards from the end of the array.
+The slice operator works on both arrays and strings. Like the `jq` equivalent, `.[10:15]` will return a subarray (or substring) of length 5, starting from index 10 inclusive, up to index 15 exclusive. Negative numbers count backwards from the end of the array or string.
 
-You may leave out the first or second number, which will refer to the start or end of the array respectively.
+You may leave out the first or second number, which will refer to the start or end of the array or string respectively.
 
 ## Slicing arrays
 Given a sample.yml file of:
@@ -103,3 +103,81 @@ will output
 - cow
 ```
 
+## Slicing strings
+Given a sample.yml file of:
+```yaml
+country: Australia
+```
+then
+```bash
+yq '.country[0:5]' sample.yml
+```
+will output
+```yaml
+Austr
+```
+
+## Slicing strings - without the second number
+Finishes at the end of the string
+
+Given a sample.yml file of:
+```yaml
+country: Australia
+```
+then
+```bash
+yq '.country[5:]' sample.yml
+```
+will output
+```yaml
+alia
+```
+
+## Slicing strings - without the first number
+Starts from the start of the string
+
+Given a sample.yml file of:
+```yaml
+country: Australia
+```
+then
+```bash
+yq '.country[:5]' sample.yml
+```
+will output
+```yaml
+Austr
+```
+
+## Slicing strings - use negative numbers to count backwards from the end
+Negative indices count from the end of the string
+
+Given a sample.yml file of:
+```yaml
+country: Australia
+```
+then
+```bash
+yq '.country[-5:]' sample.yml
+```
+will output
+```yaml
+ralia
+```
+
+## Slicing strings - Unicode
+Indices are rune-based, so multi-byte characters are handled correctly
+
+Given a sample.yml file of:
+```yaml
+greeting: héllo
+```
+then
+```bash
+yq '.greeting[1:3]' sample.yml
+```
+will output
+```yaml
+él
+```
+

pkg/yqlib/doc/operators/system-operators.md

@@ -0,0 +1,76 @@
+# System Operators
+
+The `system` operator allows you to run an external command and use its output as a value in your expression.
+
+**Security warning**: The system operator is disabled by default. You must explicitly pass `--security-enable-system-operator` to use it.
+
+**Note:** When enabled, the system operator can replicate the functionality of `env` and `load`
+operators via external commands. Enabling it effectively overrides `--security-disable-env-ops`
+and `--security-disable-file-ops`.
+
+## Usage
+
+```bash
+yq --security-enable-system-operator --null-input '.field = system("command"; "arg1")'
+```
+
+The operator takes:
+- A command string (required)
+- An argument (or an array of arguments), separated from the command by `;` (optional)
+
+The current matched node's value is serialised and piped to the command via stdin. The command's stdout (with trailing newline stripped) is returned as a string.
+
+## Disabling the system operator
+
+The system operator is disabled by default. When disabled, an error is returned instead of running the command, consistent with `--security-disable-env-ops` and `--security-disable-file-ops`.
+
+Use `--security-enable-system-operator` flag to enable it.
+
+## system operator returns error when disabled
+Use `--security-enable-system-operator` to enable the system operator.
+
+Given a sample.yml file of:
+```yaml
+country: Australia
+```
+then
+```bash
+yq '.country = system("/usr/bin/echo"; "test")' sample.yml
+```
+will output
+```bash
+Error: system operations are disabled, use --security-enable-system-operator to enable
+```
+
+## Run a command with an argument
+Use `--security-enable-system-operator` to enable the system operator.
+
+Given a sample.yml file of:
+```yaml
+country: Australia
+```
+then
+```bash
+yq --security-enable-system-operator '.country = system("/usr/bin/echo"; "test")' sample.yml
+```
+will output
+```yaml
+country: test
+```
+
+## Run a command without arguments
+Omit the semicolon and args to run the command with no extra arguments.
+
+Given a sample.yml file of:
+```yaml
+a: hello
+```
+then
+```bash
+yq --security-enable-system-operator '.a = system("/usr/bin/echo")' sample.yml
+```
+will output
+```yaml
+a: ""
+```
+

pkg/yqlib/doc/operators/traverse-read.md

@@ -294,13 +294,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -325,13 +325,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -376,13 +376,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -409,13 +409,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -442,13 +442,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -477,13 +477,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -513,13 +513,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -546,13 +546,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -579,13 +579,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -614,13 +614,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then

pkg/yqlib/doc/usage/convert.md

@@ -125,6 +125,22 @@ will output
 {"whatever":"cat"}
 ```
 
+## Encode json: preserve floats with trailing zero
+Whole-number floats keep their decimal point so downstream consumers see a JSON number with a fractional part (matches Go's encoding/json, Python's json, and jq).
+
+Given a sample.yml file of:
+```yaml
+percentiles: [50.0, 95.0, 99.0, 99.9]
+```
+then
+```bash
+yq -o=json -I=0 '.' sample.yml
+```
+will output
+```json
+{"percentiles":[50.0,95.0,99.0,99.9]}
+```
+
 ## Roundtrip JSON Lines / NDJSON
 Given a sample.json file of:
 ```json

pkg/yqlib/doc/usage/headers/kyaml.md

@@ -0,0 +1,9 @@
+# KYaml
+
+Encode and decode to and from KYaml (a restricted subset of YAML that uses flow-style collections).
+
+KYaml is useful when you want YAML data rendered in a compact, JSON-like form while still supporting YAML features like comments.
+
+Notes:
+- Strings are always double-quoted in KYaml output.
+- Anchors and aliases are expanded (KYaml output does not emit them).

pkg/yqlib/doc/usage/headers/toml.md

@@ -1,4 +1,4 @@
 # TOML
 
-Decode from TOML. Note that `yq` does not yet support outputting in TOML format (and therefore it cannot roundtrip)
+Encode and decode to and from TOML.
 

pkg/yqlib/doc/usage/kyaml.md

@@ -0,0 +1,253 @@
+# KYaml
+
+Encode and decode to and from KYaml (a restricted subset of YAML that uses flow-style collections).
+
+KYaml is useful when you want YAML data rendered in a compact, JSON-like form while still supporting YAML features like comments.
+
+Notes:
+- Strings are always double-quoted in KYaml output.
+- Anchors and aliases are expanded (KYaml output does not emit them).
+
+## Encode kyaml: plain string scalar
+Strings are always double-quoted in KYaml output.
+
+Given a sample.yml file of:
+```yaml
+cat
+
+```
+then
+```bash
+yq -o=kyaml '.' sample.yml
+```
+will output
+```yaml
+"cat"
+```
+
+## encode flow mapping and sequence
+Given a sample.yml file of:
+```yaml
+a: b
+c:
+  - d
+
+```
+then
+```bash
+yq -o=kyaml '.' sample.yml
+```
+will output
+```yaml
+{
+  a: "b",
+  c: [
+    "d",
+  ],
+}
+```
+
+## encode non-string scalars
+Given a sample.yml file of:
+```yaml
+a: 12
+b: true
+c: null
+d: "true"
+
+```
+then
+```bash
+yq -o=kyaml '.' sample.yml
+```
+will output
+```yaml
+{
+  a: 12,
+  b: true,
+  c: null,
+  d: "true",
+}
+```
+
+## quote non-identifier keys
+Given a sample.yml file of:
+```yaml
+"1a": b
+"has space": c
+
+```
+then
+```bash
+yq -o=kyaml '.' sample.yml
+```
+will output
+```yaml
+{
+  "1a": "b",
+  "has space": "c",
+}
+```
+
+## escape quoted strings
+Given a sample.yml file of:
+```yaml
+a: "line1\nline2\t\"q\""
+
+```
+then
+```bash
+yq -o=kyaml '.' sample.yml
+```
+will output
+```yaml
+{
+  a: "line1\nline2\t\"q\"",
+}
+```
+
+## preserve comments when encoding
+Given a sample.yml file of:
+```yaml
+# leading
+a: 1 # a line
+# head b
+b: 2
+c:
+  # head d
+  - d # d line
+  - e
+# trailing
+
+```
+then
+```bash
+yq -o=kyaml '.' sample.yml
+```
+will output
+```yaml
+# leading
+{
+  a: 1, # a line
+  # head b
+  b: 2,
+  c: [
+    # head d
+    "d", # d line
+    "e",
+  ],
+  # trailing
+}
+```
+
+## Encode kyaml: anchors and aliases
+KYaml output does not support anchors/aliases; they are expanded to concrete values.
+
+Given a sample.yml file of:
+```yaml
+base: &base
+  a: b
+copy: *base
+
+```
+then
+```bash
+yq -o=kyaml '.' sample.yml
+```
+will output
+```yaml
+{
+  base: {
+    a: "b",
+  },
+  copy: {
+    a: "b",
+  },
+}
+```
+
+## Encode kyaml: yaml to kyaml shows formatting differences
+KYaml uses flow-style collections (braces/brackets) and explicit commas.
+
+Given a sample.yml file of:
+```yaml
+person:
+  name: John
+  pets:
+    - cat
+    - dog
+
+```
+then
+```bash
+yq -o=kyaml '.' sample.yml
+```
+will output
+```yaml
+{
+  person: {
+    name: "John",
+    pets: [
+      "cat",
+      "dog",
+    ],
+  },
+}
+```
+
+## Encode kyaml: nested lists of objects
+Lists and objects can be nested arbitrarily; KYaml always uses flow-style collections.
+
+Given a sample.yml file of:
+```yaml
+- name: a
+  items:
+    - id: 1
+      tags:
+        - k: x
+          v: y
+        - k: x2
+          v: y2
+    - id: 2
+      tags:
+        - k: z
+          v: w
+
+```
+then
+```bash
+yq -o=kyaml '.' sample.yml
+```
+will output
+```yaml
+[
+  {
+    name: "a",
+    items: [
+      {
+        id: 1,
+        tags: [
+          {
+            k: "x",
+            v: "y",
+          },
+          {
+            k: "x2",
+            v: "y2",
+          },
+        ],
+      },
+      {
+        id: 2,
+        tags: [
+          {
+            k: "z",
+            v: "w",
+          },
+        ],
+      },
+    ],
+  },
+]
+```
+

pkg/yqlib/doc/usage/toml.md

@@ -1,6 +1,6 @@
 # TOML
 
-Decode from TOML. Note that `yq` does not yet support outputting in TOML format (and therefore it cannot roundtrip)
+Encode and decode to and from TOML.
 
 
 ## Parse: Simple
@@ -329,3 +329,75 @@ B = 12
 name = "Tom"  # name comment
 ```
 
+## Roundtrip: sample from web
+Given a sample.toml file of:
+```toml
+# This is a TOML document
+title = "TOML Example"
+
+[owner]
+name = "Tom Preston-Werner"
+dob = 1979-05-27T07:32:00-08:00
+
+[database]
+enabled = true
+ports = [8000, 8001, 8002]
+data = [["delta", "phi"], [3.14]]
+temp_targets = { cpu = 79.5, case = 72.0 }
+
+# [servers] yq can't do this one yet
+[servers.alpha]
+ip = "10.0.0.1"
+role = "frontend"
+
+[servers.beta]
+ip = "10.0.0.2"
+role = "backend"
+
+```
+then
+```bash
+yq '.' sample.toml
+```
+will output
+```yaml
+# This is a TOML document
+title = "TOML Example"
+
+[owner]
+name = "Tom Preston-Werner"
+dob = 1979-05-27T07:32:00-08:00
+
+[database]
+enabled = true
+ports = [8000, 8001, 8002]
+data = [["delta", "phi"], [3.14]]
+temp_targets = { cpu = 79.5, case = 72.0 }
+
+# [servers] yq can't do this one yet
+[servers.alpha]
+ip = "10.0.0.1"
+role = "frontend"
+
+[servers.beta]
+ip = "10.0.0.2"
+role = "backend"
+```
+
+## Encode: Simple mapping produces table section
+Given a sample.yml file of:
+```yaml
+arg:
+  hello: foo
+
+```
+then
+```bash
+yq -o toml '.' sample.yml
+```
+will output
+```toml
+[arg]
+hello = "foo"
+```
+

pkg/yqlib/encoder.go

@@ -1,7 +1,12 @@
 package yqlib
 
 import (
+	"bufio"
+	"errors"
 	"io"
+	"strings"
+
+	"github.com/fatih/color"
 )
 
 type Encoder interface {
@@ -25,3 +30,63 @@ func mapKeysToStrings(node *CandidateNode) {
 		mapKeysToStrings(child)
 	}
 }
+
+// Some funcs are shared between encoder_yaml and encoder_kyaml
+func PrintYAMLDocumentSeparator(writer io.Writer, PrintDocSeparators bool) error {
+	if PrintDocSeparators {
+		log.Debug("writing doc sep")
+		if err := writeString(writer, "---\n"); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+func PrintYAMLLeadingContent(writer io.Writer, content string, PrintDocSeparators bool, ColorsEnabled bool) error {
+	reader := bufio.NewReader(strings.NewReader(content))
+
+	// reuse precompiled package-level regex
+	// (declared in decoder_yaml.go)
+
+	for {
+
+		readline, errReading := reader.ReadString('\n')
+		if errReading != nil && !errors.Is(errReading, io.EOF) {
+			return errReading
+		}
+		if strings.Contains(readline, "$yqDocSeparator$") {
+			// Preserve the original line ending (CRLF or LF)
+			lineEnding := "\n"
+			if strings.HasSuffix(readline, "\r\n") {
+				lineEnding = "\r\n"
+			}
+			if PrintDocSeparators {
+				if err := writeString(writer, "---"+lineEnding); err != nil {
+					return err
+				}
+			}
+
+		} else {
+			if len(readline) > 0 && readline != "\n" && readline[0] != '%' && !commentLineRe.MatchString(readline) {
+				readline = "# " + readline
+			}
+			if ColorsEnabled && strings.TrimSpace(readline) != "" {
+				readline = format(color.FgHiBlack) + readline + format(color.Reset)
+			}
+			if err := writeString(writer, readline); err != nil {
+				return err
+			}
+		}
+
+		if errors.Is(errReading, io.EOF) {
+			if readline != "" {
+				// the last comment we read didn't have a newline, put one in
+				if err := writeString(writer, "\n"); err != nil {
+					return err
+				}
+			}
+			break
+		}
+	}
+
+	return nil
+}

pkg/yqlib/encoder_hcl.go

@@ -66,8 +66,8 @@ func (he *hclEncoder) Encode(writer io.Writer, node *CandidateNode) error {
 	finalOutput := he.injectComments(compactOutput, commentMap)
 
 	if he.prefs.ColorsEnabled {
-		colorized := he.colorizeHcl(finalOutput)
-		_, err := writer.Write(colorized)
+		colourized := he.colorizeHcl(finalOutput)
+		_, err := writer.Write(colourized)
 		return err
 	}
 
@@ -173,19 +173,18 @@ func (he *hclEncoder) injectComments(output []byte, commentMap map[string]string
 	return []byte(result)
 }
 
-// colorizeHcl applies syntax highlighting to HCL output using fatih/color
 func (he *hclEncoder) colorizeHcl(input []byte) []byte {
 	hcl := string(input)
 	result := strings.Builder{}
 
-	// Create color functions for different token types
+	// Create colour functions for different token types
 	commentColor := color.New(color.FgHiBlack).SprintFunc()
 	stringColor := color.New(color.FgGreen).SprintFunc()
 	numberColor := color.New(color.FgHiMagenta).SprintFunc()
 	keyColor := color.New(color.FgCyan).SprintFunc()
 	boolColor := color.New(color.FgHiMagenta).SprintFunc()
 
-	// Simple tokenization for HCL coloring
+	// Simple tokenization for HCL colouring
 	i := 0
 	for i < len(hcl) {
 		ch := hcl[i]
@@ -450,8 +449,8 @@ func (he *hclEncoder) encodeBlockIfMapping(body *hclwrite.Body, key string, valu
 		return false
 	}
 
-	// If EncodeSeparate is set, emit children as separate blocks regardless of label extraction
-	if valueNode.EncodeSeparate {
+	// If EncodeHintSeparateBlock is set, emit children as separate blocks regardless of label extraction
+	if valueNode.EncodeHint == EncodeHintSeparateBlock {
 		if handled, _ := he.encodeMappingChildrenAsBlocks(body, key, valueNode); handled {
 			return true
 		}
@@ -476,12 +475,12 @@ func (he *hclEncoder) encodeBlockIfMapping(body *hclwrite.Body, key string, valu
 		}
 	}
 
-	// If all child values are mappings, treat each child key as a labeled instance of this block type
+	// If all child values are mappings, treat each child key as a labelled instance of this block type
 	if handled, _ := he.encodeMappingChildrenAsBlocks(body, key, valueNode); handled {
 		return true
 	}
 
-	// No labels detected, render as unlabeled block
+	// No labels detected, render as unlabelled block
 	block := body.AppendNewBlock(key, nil)
 	if err := he.encodeNodeAttributes(block.Body(), valueNode); err == nil {
 		return true
@@ -538,9 +537,9 @@ func (he *hclEncoder) encodeMappingChildrenAsBlocks(body *hclwrite.Body, blockTy
 		return false, nil
 	}
 
-	// Only emit as separate blocks if EncodeSeparate is true
+	// Only emit as separate blocks if EncodeHintSeparateBlock is set
 	// This allows the encoder to respect the original block structure preserved by the decoder
-	if !valueNode.EncodeSeparate {
+	if valueNode.EncodeHint != EncodeHintSeparateBlock {
 		return false, nil
 	}
 

pkg/yqlib/encoder_kyaml.go

@@ -0,0 +1,318 @@
+//go:build !yq_nokyaml
+
+package yqlib
+
+import (
+	"bytes"
+	"io"
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+type kyamlEncoder struct {
+	prefs KYamlPreferences
+}
+
+func NewKYamlEncoder(prefs KYamlPreferences) Encoder {
+	return &kyamlEncoder{prefs: prefs}
+}
+
+func (ke *kyamlEncoder) CanHandleAliases() bool {
+	// KYAML is a restricted subset; avoid emitting anchors/aliases.
+	return false
+}
+
+func (ke *kyamlEncoder) PrintDocumentSeparator(writer io.Writer) error {
+	return PrintYAMLDocumentSeparator(writer, ke.prefs.PrintDocSeparators)
+}
+
+func (ke *kyamlEncoder) PrintLeadingContent(writer io.Writer, content string) error {
+	return PrintYAMLLeadingContent(writer, content, ke.prefs.PrintDocSeparators, ke.prefs.ColorsEnabled)
+}
+
+func (ke *kyamlEncoder) Encode(writer io.Writer, node *CandidateNode) error {
+	log.Debugf("encoderKYaml - going to print %v", NodeToString(node))
+	if node.Kind == ScalarNode && ke.prefs.UnwrapScalar {
+		return writeString(writer, node.Value+"\n")
+	}
+
+	destination := writer
+	tempBuffer := bytes.NewBuffer(nil)
+	if ke.prefs.ColorsEnabled {
+		destination = tempBuffer
+	}
+
+	// Mirror the YAML encoder behaviour: trailing comments on the document root
+	// are stored in FootComment and need to be printed after the document.
+	trailingContent := node.FootComment
+
+	if err := ke.writeCommentBlock(destination, node.HeadComment, 0); err != nil {
+		return err
+	}
+	if err := ke.writeNode(destination, node, 0); err != nil {
+		return err
+	}
+	if err := ke.writeInlineComment(destination, node.LineComment); err != nil {
+		return err
+	}
+	if err := writeString(destination, "\n"); err != nil {
+		return err
+	}
+	if err := ke.PrintLeadingContent(destination, trailingContent); err != nil {
+		return err
+	}
+
+	if ke.prefs.ColorsEnabled {
+		return colorizeAndPrint(tempBuffer.Bytes(), writer)
+	}
+	return nil
+}
+
+func (ke *kyamlEncoder) writeNode(writer io.Writer, node *CandidateNode, indent int) error {
+	switch node.Kind {
+	case MappingNode:
+		return ke.writeMapping(writer, node, indent)
+	case SequenceNode:
+		return ke.writeSequence(writer, node, indent)
+	case ScalarNode:
+		return writeString(writer, ke.formatScalar(node))
+	case AliasNode:
+		// Should have been exploded by the printer, but handle defensively.
+		if node.Alias == nil {
+			return writeString(writer, "null")
+		}
+		return ke.writeNode(writer, node.Alias, indent)
+	default:
+		return writeString(writer, "null")
+	}
+}
+
+func (ke *kyamlEncoder) writeMapping(writer io.Writer, node *CandidateNode, indent int) error {
+	if len(node.Content) == 0 {
+		return writeString(writer, "{}")
+	}
+	if err := writeString(writer, "{\n"); err != nil {
+		return err
+	}
+
+	for i := 0; i+1 < len(node.Content); i += 2 {
+		keyNode := node.Content[i]
+		valueNode := node.Content[i+1]
+
+		entryIndent := indent + ke.prefs.Indent
+		if err := ke.writeCommentBlock(writer, keyNode.HeadComment, entryIndent); err != nil {
+			return err
+		}
+		if valueNode.HeadComment != "" && valueNode.HeadComment != keyNode.HeadComment {
+			if err := ke.writeCommentBlock(writer, valueNode.HeadComment, entryIndent); err != nil {
+				return err
+			}
+		}
+
+		if err := ke.writeIndent(writer, entryIndent); err != nil {
+			return err
+		}
+		if err := writeString(writer, ke.formatKey(keyNode)); err != nil {
+			return err
+		}
+		if err := writeString(writer, ": "); err != nil {
+			return err
+		}
+		if err := ke.writeNode(writer, valueNode, entryIndent); err != nil {
+			return err
+		}
+
+		// Always emit a trailing comma; KYAML encourages explicit separators,
+		// and this ensures all quoted strings have a trailing `",` as requested.
+		if err := writeString(writer, ","); err != nil {
+			return err
+		}
+		inline := valueNode.LineComment
+		if inline == "" {
+			inline = keyNode.LineComment
+		}
+		if err := ke.writeInlineComment(writer, inline); err != nil {
+			return err
+		}
+		if err := writeString(writer, "\n"); err != nil {
+			return err
+		}
+
+		foot := valueNode.FootComment
+		if foot == "" {
+			foot = keyNode.FootComment
+		}
+		if err := ke.writeCommentBlock(writer, foot, entryIndent); err != nil {
+			return err
+		}
+	}
+
+	if err := ke.writeIndent(writer, indent); err != nil {
+		return err
+	}
+	return writeString(writer, "}")
+}
+
+func (ke *kyamlEncoder) writeSequence(writer io.Writer, node *CandidateNode, indent int) error {
+	if len(node.Content) == 0 {
+		return writeString(writer, "[]")
+	}
+	if err := writeString(writer, "[\n"); err != nil {
+		return err
+	}
+
+	for _, child := range node.Content {
+		itemIndent := indent + ke.prefs.Indent
+		if err := ke.writeCommentBlock(writer, child.HeadComment, itemIndent); err != nil {
+			return err
+		}
+		if err := ke.writeIndent(writer, itemIndent); err != nil {
+			return err
+		}
+		if err := ke.writeNode(writer, child, itemIndent); err != nil {
+			return err
+		}
+		if err := writeString(writer, ","); err != nil {
+			return err
+		}
+		if err := ke.writeInlineComment(writer, child.LineComment); err != nil {
+			return err
+		}
+		if err := writeString(writer, "\n"); err != nil {
+			return err
+		}
+		if err := ke.writeCommentBlock(writer, child.FootComment, itemIndent); err != nil {
+			return err
+		}
+	}
+
+	if err := ke.writeIndent(writer, indent); err != nil {
+		return err
+	}
+	return writeString(writer, "]")
+}
+
+func (ke *kyamlEncoder) writeIndent(writer io.Writer, indent int) error {
+	if indent <= 0 {
+		return nil
+	}
+	return writeString(writer, strings.Repeat(" ", indent))
+}
+
+func (ke *kyamlEncoder) formatKey(keyNode *CandidateNode) string {
+	// KYAML examples use bare keys. Quote keys only when needed.
+	key := keyNode.Value
+	if isValidKYamlBareKey(key) {
+		return key
+	}
+	return `"` + escapeDoubleQuotedString(key) + `"`
+}
+
+func (ke *kyamlEncoder) formatScalar(node *CandidateNode) string {
+	switch node.Tag {
+	case "!!null":
+		return "null"
+	case "!!bool":
+		return strings.ToLower(node.Value)
+	case "!!int", "!!float":
+		return node.Value
+	case "!!str":
+		return `"` + escapeDoubleQuotedString(node.Value) + `"`
+	default:
+		// Fall back to a string representation to avoid implicit typing surprises.
+		return `"` + escapeDoubleQuotedString(node.Value) + `"`
+	}
+}
+
+var kyamlBareKeyRe = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_-]*$`)
+
+func isValidKYamlBareKey(s string) bool {
+	// Conservative: require an identifier-like key; otherwise quote.
+	if s == "" {
+		return false
+	}
+	return kyamlBareKeyRe.MatchString(s)
+}
+
+func escapeDoubleQuotedString(s string) string {
+	var b strings.Builder
+	b.Grow(len(s) + 2)
+
+	for _, r := range s {
+		switch r {
+		case '\\':
+			b.WriteString(`\\`)
+		case '"':
+			b.WriteString(`\"`)
+		case '\n':
+			b.WriteString(`\n`)
+		case '\r':
+			b.WriteString(`\r`)
+		case '\t':
+			b.WriteString(`\t`)
+		default:
+			if r < 0x20 {
+				// YAML double-quoted strings support \uXXXX escapes.
+				b.WriteString(`\u`)
+				hex := "0000" + strings.ToUpper(strconv.FormatInt(int64(r), 16))
+				b.WriteString(hex[len(hex)-4:])
+			} else {
+				b.WriteRune(r)
+			}
+		}
+	}
+	return b.String()
+}
+
+func (ke *kyamlEncoder) writeCommentBlock(writer io.Writer, comment string, indent int) error {
+	if strings.TrimSpace(comment) == "" {
+		return nil
+	}
+
+	lines := strings.Split(strings.ReplaceAll(comment, "\r\n", "\n"), "\n")
+	for _, line := range lines {
+		trimmed := strings.TrimSpace(line)
+		if trimmed == "" {
+			continue
+		}
+
+		if err := ke.writeIndent(writer, indent); err != nil {
+			return err
+		}
+
+		toWrite := line
+		if !commentLineRe.MatchString(toWrite) {
+			toWrite = "# " + toWrite
+		}
+		if err := writeString(writer, toWrite); err != nil {
+			return err
+		}
+		if err := writeString(writer, "\n"); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (ke *kyamlEncoder) writeInlineComment(writer io.Writer, comment string) error {
+	comment = strings.TrimSpace(strings.ReplaceAll(comment, "\r\n", "\n"))
+	if comment == "" {
+		return nil
+	}
+
+	lines := strings.Split(comment, "\n")
+	first := strings.TrimSpace(lines[0])
+	if first == "" {
+		return nil
+	}
+
+	if !strings.HasPrefix(first, "#") {
+		first = "# " + first
+	}
+
+	if err := writeString(writer, " "); err != nil {
+		return err
+	}
+	return writeString(writer, first)
+}

pkg/yqlib/encoder_shellvariables.go

@@ -57,7 +57,13 @@ func (pe *shellVariablesEncoder) doEncode(w *io.Writer, node *CandidateNode, pat
 			// let's just pick a fallback key to use if we are encoding a single scalar
 			nonemptyPath = "value"
 		}
-		_, err := io.WriteString(*w, nonemptyPath+"="+quoteValue(node.Value)+"\n")
+		var valueString string
+		if pe.prefs.UnwrapScalar {
+			valueString = node.Value
+		} else {
+			valueString = quoteValue(node.Value)
+		}
+		_, err := io.WriteString(*w, nonemptyPath+"="+valueString+"\n")
 		return err
 	case SequenceNode:
 		for index, child := range node.Content {

pkg/yqlib/encoder_shellvariables_test.go

@@ -135,3 +135,36 @@ func TestShellVariablesEncoderCustomSeparatorArray(t *testing.T) {
 func TestShellVariablesEncoderCustomSeparatorSingleChar(t *testing.T) {
 	assertEncodesToWithSeparator(t, "a:\n b: value", "aXb=value", "X")
 }
+
+func assertEncodesToUnwrapped(t *testing.T, yaml string, shellvars string) {
+	var output bytes.Buffer
+	writer := bufio.NewWriter(&output)
+
+	originalUnwrapScalar := ConfiguredShellVariablesPreferences.UnwrapScalar
+	defer func() {
+		ConfiguredShellVariablesPreferences.UnwrapScalar = originalUnwrapScalar
+	}()
+
+	ConfiguredShellVariablesPreferences.UnwrapScalar = true
+
+	var encoder = NewShellVariablesEncoder()
+	inputs, err := readDocuments(strings.NewReader(yaml), "test.yml", 0, NewYamlDecoder(ConfiguredYamlPreferences))
+	if err != nil {
+		panic(err)
+	}
+	node := inputs.Front().Value.(*CandidateNode)
+	err = encoder.Encode(writer, node)
+	if err != nil {
+		panic(err)
+	}
+	writer.Flush()
+
+	test.AssertResult(t, shellvars, strings.TrimSuffix(output.String(), "\n"))
+}
+
+func TestShellVariablesEncoderUnwrapScalar(t *testing.T) {
+	assertEncodesToUnwrapped(t, "a: Lewis Carroll", "a=Lewis Carroll")
+	assertEncodesToUnwrapped(t, "b: 123", "b=123")
+	assertEncodesToUnwrapped(t, "c: true", "c=true")
+	assertEncodesToUnwrapped(t, "d: value with spaces", "d=value with spaces")
+}

pkg/yqlib/encoder_toml.go

@@ -1,3 +1,5 @@
+//go:build !yq_notoml
+
 package yqlib
 
 import (
@@ -45,8 +47,8 @@ func (te *tomlEncoder) Encode(writer io.Writer, node *CandidateNode) error {
 	}
 
 	if te.prefs.ColorsEnabled {
-		colorized := te.colorizeToml(buf.Bytes())
-		_, err := writer.Write(colorized)
+		colourised := te.colorizeToml(buf.Bytes())
+		_, err := writer.Write(colourised)
 		return err
 	}
 
@@ -67,6 +69,27 @@ func (te *tomlEncoder) CanHandleAliases() bool {
 
 // ---- helpers ----
 
+// tomlKey returns the key quoted if it contains characters that are not valid
+// in a TOML bare key. TOML bare keys may only contain ASCII letters, ASCII
+// digits, underscores, and dashes.
+func tomlKey(key string) string {
+	for _, r := range key {
+		if (r < 'A' || r > 'Z') && (r < 'a' || r > 'z') && (r < '0' || r > '9') && r != '_' && r != '-' {
+			return fmt.Sprintf("%q", key)
+		}
+	}
+	return key
+}
+
+// tomlDottedKey joins path components, quoting any that require it.
+func tomlDottedKey(path []string) string {
+	parts := make([]string, len(path))
+	for i, p := range path {
+		parts[i] = tomlKey(p)
+	}
+	return strings.Join(parts, ".")
+}
+
 func (te *tomlEncoder) writeComment(w io.Writer, comment string) error {
 	if comment == "" {
 		return nil
@@ -109,12 +132,23 @@ func (te *tomlEncoder) encodeRootMapping(w io.Writer, node *CandidateNode) error
 		}
 	}
 
-	// Preserve existing order by iterating Content
 	for i := 0; i < len(node.Content); i += 2 {
 		keyNode := node.Content[i]
 		valNode := node.Content[i+1]
-		if err := te.encodeTopLevelEntry(w, []string{keyNode.Value}, valNode); err != nil {
-			return err
+		if isTomlAttribute(valNode) {
+			if err := te.encodeTopLevelEntry(w, []string{keyNode.Value}, valNode); err != nil {
+				return err
+			}
+		}
+	}
+
+	for i := 0; i < len(node.Content); i += 2 {
+		keyNode := node.Content[i]
+		valNode := node.Content[i+1]
+		if !isTomlAttribute(valNode) {
+			if err := te.encodeTopLevelEntry(w, []string{keyNode.Value}, valNode); err != nil {
+				return err
+			}
 		}
 	}
 	return nil
@@ -122,6 +156,10 @@ func (te *tomlEncoder) encodeRootMapping(w io.Writer, node *CandidateNode) error
 
 // encodeTopLevelEntry encodes a key/value at the root, dispatching to attribute, table, or array-of-tables
 func (te *tomlEncoder) encodeTopLevelEntry(w io.Writer, path []string, node *CandidateNode) error {
+	if len(path) == 0 {
+		return fmt.Errorf("cannot encode TOML entry with empty path")
+	}
+
 	switch node.Kind {
 	case ScalarNode:
 		// key = value
@@ -142,9 +180,15 @@ func (te *tomlEncoder) encodeTopLevelEntry(w io.Writer, path []string, node *Can
 		}
 		if allMaps {
 			key := path[len(path)-1]
+			quotedKey := tomlKey(key)
+			if te.wroteRootAttr {
+				if _, err := w.Write([]byte("\n")); err != nil {
+					return err
+				}
+				te.wroteRootAttr = false
+			}
 			for _, it := range node.Content {
-				// [[key]] then body
-				if _, err := w.Write([]byte("[[" + key + "]]\n")); err != nil {
+				if _, err := w.Write([]byte("[[" + quotedKey + "]]\n")); err != nil {
 					return err
 				}
 				if err := te.encodeMappingBodyWithPath(w, []string{key}, it); err != nil {
@@ -156,12 +200,12 @@ func (te *tomlEncoder) encodeTopLevelEntry(w io.Writer, path []string, node *Can
 		// Regular array attribute
 		return te.writeArrayAttribute(w, path[len(path)-1], node)
 	case MappingNode:
-		// Inline table if not EncodeSeparate, else emit separate tables/arrays of tables for children under this path
-		if !node.EncodeSeparate {
-			// If children contain mappings or arrays of mappings, prefer separate sections
-			if te.hasEncodeSeparateChild(node) || te.hasStructuralChildren(node) {
-				return te.encodeSeparateMapping(w, path, node)
-			}
+		// Use inline table syntax only for nodes explicitly marked as TOML inline tables.
+		// YAML flow-style mappings are not treated as inline tables; the FlowStyle attribute
+		// is a YAML-specific rendering hint and should not affect TOML output. This ensures
+		// that auto-detected JSON input (parsed as YAML flow style) produces readable table
+		// sections, consistent with explicitly parsed JSON input.
+		if node.EncodeHint == EncodeHintInline {
 			return te.writeInlineTableAttribute(w, path[len(path)-1], node)
 		}
 		return te.encodeSeparateMapping(w, path, node)
@@ -170,7 +214,30 @@ func (te *tomlEncoder) encodeTopLevelEntry(w io.Writer, path []string, node *Can
 	}
 }
 
+func isTomlArrayOfTables(seq *CandidateNode) bool {
+	if len(seq.Content) == 0 {
+		return false
+	}
+	for _, it := range seq.Content {
+		if it.Kind != MappingNode || it.EncodeHint == EncodeHintInline {
+			return false
+		}
+	}
+	return true
+}
+
+func isTomlAttribute(node *CandidateNode) bool {
+	if node.Kind == ScalarNode {
+		return true
+	}
+	return node.Kind == SequenceNode && !isTomlArrayOfTables(node)
+}
+
 func (te *tomlEncoder) writeAttribute(w io.Writer, key string, value *CandidateNode) error {
+	if value.Tag == "!!null" {
+		return nil
+	}
+
 	te.wroteRootAttr = true // Mark that we wrote a root attribute
 
 	// Write head comment before the attribute
@@ -179,7 +246,7 @@ func (te *tomlEncoder) writeAttribute(w io.Writer, key string, value *CandidateN
 	}
 
 	// Write the attribute
-	line := key + " = " + te.formatScalar(value)
+	line := tomlKey(key) + " = " + te.formatScalar(value)
 
 	// Add line comment if present
 	if value.LineComment != "" {
@@ -204,7 +271,7 @@ func (te *tomlEncoder) writeArrayAttribute(w io.Writer, key string, seq *Candida
 
 	// Handle empty arrays
 	if len(seq.Content) == 0 {
-		line := key + " = []"
+		line := tomlKey(key) + " = []"
 		if seq.LineComment != "" {
 			lineComment := strings.TrimSpace(seq.LineComment)
 			if !strings.HasPrefix(lineComment, "#") {
@@ -216,6 +283,81 @@ func (te *tomlEncoder) writeArrayAttribute(w io.Writer, key string, seq *Candida
 		return err
 	}
 
+	// Check if any array elements have head comments - if so, use multiline format
+	hasElementComments := false
+	for _, it := range seq.Content {
+		if it.HeadComment != "" {
+			hasElementComments = true
+			break
+		}
+	}
+
+	if hasElementComments {
+		// Write multiline array format with comments
+		if _, err := w.Write([]byte(tomlKey(key) + " = [\n")); err != nil {
+			return err
+		}
+
+		for i, it := range seq.Content {
+			// Write head comment for this element
+			if it.HeadComment != "" {
+				commentLines := strings.Split(it.HeadComment, "\n")
+				for _, commentLine := range commentLines {
+					if strings.TrimSpace(commentLine) != "" {
+						if !strings.HasPrefix(strings.TrimSpace(commentLine), "#") {
+							commentLine = "# " + commentLine
+						}
+						if _, err := w.Write([]byte("  " + commentLine + "\n")); err != nil {
+							return err
+						}
+					}
+				}
+			}
+
+			// Write the element value
+			var itemStr string
+			switch it.Kind {
+			case ScalarNode:
+				itemStr = te.formatScalar(it)
+			case SequenceNode:
+				nested, err := te.sequenceToInlineArray(it)
+				if err != nil {
+					return err
+				}
+				itemStr = nested
+			case MappingNode:
+				inline, err := te.mappingToInlineTable(it)
+				if err != nil {
+					return err
+				}
+				itemStr = inline
+			case AliasNode:
+				return fmt.Errorf("aliases are not supported in TOML")
+			default:
+				return fmt.Errorf("unsupported array item kind: %v", it.Kind)
+			}
+
+			// Always add trailing comma in multiline arrays
+			itemStr += ","
+
+			if _, err := w.Write([]byte("  " + itemStr + "\n")); err != nil {
+				return err
+			}
+
+			// Add blank line between elements (except after the last one)
+			if i < len(seq.Content)-1 {
+				if _, err := w.Write([]byte("\n")); err != nil {
+					return err
+				}
+			}
+		}
+
+		if _, err := w.Write([]byte("]\n")); err != nil {
+			return err
+		}
+		return nil
+	}
+
 	// Join scalars or nested arrays recursively into TOML array syntax
 	items := make([]string, 0, len(seq.Content))
 	for _, it := range seq.Content {
@@ -243,7 +385,7 @@ func (te *tomlEncoder) writeArrayAttribute(w io.Writer, key string, seq *Candida
 		}
 	}
 
-	line := key + " = [" + strings.Join(items, ", ") + "]"
+	line := tomlKey(key) + " = [" + strings.Join(items, ", ") + "]"
 
 	// Add line comment if present
 	if seq.LineComment != "" {
@@ -291,21 +433,24 @@ func (te *tomlEncoder) mappingToInlineTable(m *CandidateNode) (string, error) {
 		v := m.Content[i+1]
 		switch v.Kind {
 		case ScalarNode:
-			parts = append(parts, fmt.Sprintf("%s = %s", k, te.formatScalar(v)))
+			if v.Tag == "!!null" {
+				continue
+			}
+			parts = append(parts, fmt.Sprintf("%s = %s", tomlKey(k), te.formatScalar(v)))
 		case SequenceNode:
 			// inline array in inline table
 			arr, err := te.sequenceToInlineArray(v)
 			if err != nil {
 				return "", err
 			}
-			parts = append(parts, fmt.Sprintf("%s = %s", k, arr))
+			parts = append(parts, fmt.Sprintf("%s = %s", tomlKey(k), arr))
 		case MappingNode:
 			// nested inline table
 			inline, err := te.mappingToInlineTable(v)
 			if err != nil {
 				return "", err
 			}
-			parts = append(parts, fmt.Sprintf("%s = %s", k, inline))
+			parts = append(parts, fmt.Sprintf("%s = %s", tomlKey(k), inline))
 		default:
 			return "", fmt.Errorf("unsupported inline table value kind: %v", v.Kind)
 		}
@@ -318,7 +463,7 @@ func (te *tomlEncoder) writeInlineTableAttribute(w io.Writer, key string, m *Can
 	if err != nil {
 		return err
 	}
-	_, err = w.Write([]byte(key + " = " + inline + "\n"))
+	_, err = w.Write([]byte(tomlKey(key) + " = " + inline + "\n"))
 	return err
 }
 
@@ -340,7 +485,7 @@ func (te *tomlEncoder) writeTableHeader(w io.Writer, path []string, m *Candidate
 	}
 
 	// Write table header [a.b.c]
-	header := "[" + strings.Join(path, ".") + "]\n"
+	header := "[" + tomlDottedKey(path) + "]\n"
 	_, err := w.Write([]byte(header))
 	return err
 }
@@ -348,24 +493,21 @@ func (te *tomlEncoder) writeTableHeader(w io.Writer, path []string, m *Candidate
 // encodeSeparateMapping handles a mapping that should be encoded as table sections.
 // It emits the table header for this mapping if it has any content, then processes children.
 func (te *tomlEncoder) encodeSeparateMapping(w io.Writer, path []string, m *CandidateNode) error {
-	// Check if this mapping has any non-mapping, non-array-of-tables children (i.e., attributes)
+	// Check if this mapping has any non-mapping, non-array-of-tables children (i.e., attributes).
+	// Inline mapping children also count as attributes since they render as key = { ... }.
 	hasAttrs := false
 	for i := 0; i < len(m.Content); i += 2 {
 		v := m.Content[i+1]
-		if v.Kind == ScalarNode {
+		if v.Kind == ScalarNode && v.Tag != "!!null" {
+			hasAttrs = true
+			break
+		}
+		if v.Kind == MappingNode && v.EncodeHint == EncodeHintInline {
 			hasAttrs = true
 			break
 		}
 		if v.Kind == SequenceNode {
-			// Check if it's NOT an array of tables
-			allMaps := true
-			for _, it := range v.Content {
-				if it.Kind != MappingNode {
-					allMaps = false
-					break
-				}
-			}
-			if !allMaps {
+			if !isTomlArrayOfTables(v) {
 				hasAttrs = true
 				break
 			}
@@ -383,31 +525,26 @@ func (te *tomlEncoder) encodeSeparateMapping(w io.Writer, path []string, m *Cand
 		return nil
 	}
 
-	// No attributes, just nested structures - process children
+	// No attributes, just nested table structures - process children recursively
 	for i := 0; i < len(m.Content); i += 2 {
 		k := m.Content[i].Value
 		v := m.Content[i+1]
 		switch v.Kind {
 		case MappingNode:
-			// Emit [path.k]
 			newPath := append(append([]string{}, path...), k)
-			if err := te.writeTableHeader(w, newPath, v); err != nil {
-				return err
-			}
-			if err := te.encodeMappingBodyWithPath(w, newPath, v); err != nil {
+			if err := te.encodeSeparateMapping(w, newPath, v); err != nil {
 				return err
 			}
 		case SequenceNode:
 			// If sequence of maps, emit [[path.k]] per element
-			allMaps := true
-			for _, it := range v.Content {
-				if it.Kind != MappingNode {
-					allMaps = false
-					break
+			if isTomlArrayOfTables(v) {
+				key := tomlDottedKey(append(append([]string{}, path...), k))
+				if te.wroteRootAttr {
+					if _, err := w.Write([]byte("\n")); err != nil {
+						return err
+					}
+					te.wroteRootAttr = false
 				}
-			}
-			if allMaps {
-				key := strings.Join(append(append([]string{}, path...), k), ".")
 				for _, it := range v.Content {
 					if _, err := w.Write([]byte("[[" + key + "]]\n")); err != nil {
 						return err
@@ -432,42 +569,9 @@ func (te *tomlEncoder) encodeSeparateMapping(w io.Writer, path []string, m *Cand
 	return nil
 }
 
-func (te *tomlEncoder) hasEncodeSeparateChild(m *CandidateNode) bool {
-	for i := 0; i < len(m.Content); i += 2 {
-		v := m.Content[i+1]
-		if v.Kind == MappingNode && v.EncodeSeparate {
-			return true
-		}
-	}
-	return false
-}
-
-func (te *tomlEncoder) hasStructuralChildren(m *CandidateNode) bool {
-	for i := 0; i < len(m.Content); i += 2 {
-		v := m.Content[i+1]
-		// Only consider it structural if mapping has EncodeSeparate or is non-empty
-		if v.Kind == MappingNode && v.EncodeSeparate {
-			return true
-		}
-		if v.Kind == SequenceNode {
-			allMaps := true
-			for _, it := range v.Content {
-				if it.Kind != MappingNode {
-					allMaps = false
-					break
-				}
-			}
-			if allMaps {
-				return true
-			}
-		}
-	}
-	return false
-}
-
 // encodeMappingBodyWithPath encodes attributes and nested arrays of tables using full dotted path context
 func (te *tomlEncoder) encodeMappingBodyWithPath(w io.Writer, path []string, m *CandidateNode) error {
-	// First, attributes (scalars and non-map arrays)
+	// First, attributes (scalars, inline mappings, and non-map arrays)
 	for i := 0; i < len(m.Content); i += 2 {
 		k := m.Content[i].Value
 		v := m.Content[i+1]
@@ -476,15 +580,14 @@ func (te *tomlEncoder) encodeMappingBodyWithPath(w io.Writer, path []string, m *
 			if err := te.writeAttribute(w, k, v); err != nil {
 				return err
 			}
-		case SequenceNode:
-			allMaps := true
-			for _, it := range v.Content {
-				if it.Kind != MappingNode {
-					allMaps = false
-					break
+		case MappingNode:
+			if v.EncodeHint == EncodeHintInline {
+				if err := te.writeInlineTableAttribute(w, k, v); err != nil {
+					return err
 				}
 			}
-			if !allMaps {
+		case SequenceNode:
+			if !isTomlArrayOfTables(v) {
 				if err := te.writeArrayAttribute(w, k, v); err != nil {
 					return err
 				}
@@ -497,15 +600,8 @@ func (te *tomlEncoder) encodeMappingBodyWithPath(w io.Writer, path []string, m *
 		k := m.Content[i].Value
 		v := m.Content[i+1]
 		if v.Kind == SequenceNode {
-			allMaps := true
-			for _, it := range v.Content {
-				if it.Kind != MappingNode {
-					allMaps = false
-					break
-				}
-			}
-			if allMaps {
-				dotted := strings.Join(append(append([]string{}, path...), k), ".")
+			if isTomlArrayOfTables(v) {
+				dotted := tomlDottedKey(append(append([]string{}, path...), k))
 				for _, it := range v.Content {
 					if _, err := w.Write([]byte("[[" + dotted + "]]\n")); err != nil {
 						return err
@@ -518,12 +614,14 @@ func (te *tomlEncoder) encodeMappingBodyWithPath(w io.Writer, path []string, m *
 		}
 	}
 
-	// Finally, child mappings that are not marked EncodeSeparate get inlined as attributes
+	// Finally, child mappings: inline-hint ones were emitted above as attributes,
+	// while all others are emitted as separate sub-table sections.
 	for i := 0; i < len(m.Content); i += 2 {
 		k := m.Content[i].Value
 		v := m.Content[i+1]
-		if v.Kind == MappingNode && !v.EncodeSeparate {
-			if err := te.writeInlineTableAttribute(w, k, v); err != nil {
+		if v.Kind == MappingNode && v.EncodeHint != EncodeHintInline {
+			subPath := append(append([]string{}, path...), k)
+			if err := te.encodeSeparateMapping(w, subPath, v); err != nil {
 				return err
 			}
 		}
@@ -540,14 +638,28 @@ func (te *tomlEncoder) colorizeToml(input []byte) []byte {
 	color.NoColor = false
 
 	// Create color functions for different token types
-	commentColor := color.New(color.FgHiBlack).SprintFunc()
-	stringColor := color.New(color.FgGreen).SprintFunc()
-	numberColor := color.New(color.FgHiMagenta).SprintFunc()
-	keyColor := color.New(color.FgCyan).SprintFunc()
-	boolColor := color.New(color.FgHiMagenta).SprintFunc()
-	sectionColor := color.New(color.FgYellow, color.Bold).SprintFunc()
+	// Use EnableColor() to ensure colors work even when NO_COLOR env is set
+	commentColorObj := color.New(color.FgHiBlack)
+	commentColorObj.EnableColor()
+	stringColorObj := color.New(color.FgGreen)
+	stringColorObj.EnableColor()
+	numberColorObj := color.New(color.FgHiMagenta)
+	numberColorObj.EnableColor()
+	keyColorObj := color.New(color.FgCyan)
+	keyColorObj.EnableColor()
+	boolColorObj := color.New(color.FgHiMagenta)
+	boolColorObj.EnableColor()
+	sectionColorObj := color.New(color.FgYellow, color.Bold)
+	sectionColorObj.EnableColor()
 
-	// Simple tokenization for TOML coloring
+	commentColor := commentColorObj.SprintFunc()
+	stringColor := stringColorObj.SprintFunc()
+	numberColor := numberColorObj.SprintFunc()
+	keyColor := keyColorObj.SprintFunc()
+	boolColor := boolColorObj.SprintFunc()
+	sectionColor := sectionColorObj.SprintFunc()
+
+	// Simple tokenization for TOML colouring
 	i := 0
 	for i < len(toml) {
 		ch := toml[i]
@@ -565,7 +677,7 @@ func (te *tomlEncoder) colorizeToml(input []byte) []byte {
 
 		// Table sections - [section] or [[array]]
 		// Only treat '[' as a table section if it appears at the start of the line
-		// (possibly after whitespace). This avoids mis-colouring inline arrays like
+		// (possibly after whitespace). This avoids incorrectly colouring inline arrays like
 		// "ports = [8000, 8001]" as table sections.
 		if ch == '[' {
 			isSectionHeader := true

pkg/yqlib/encoder_xml.go

@@ -59,7 +59,7 @@ func (e *xmlEncoder) Encode(writer io.Writer, node *CandidateNode) error {
 					return err
 				}
 				if _, err := e.writer.Write([]byte("\n")); err != nil {
-					log.Warning("Unable to write newline, skipping: %w", err)
+					log.Warningf("Unable to write newline, skipping: %v", err)
 				}
 			}
 		}
@@ -131,7 +131,7 @@ func (e *xmlEncoder) encodeTopLevelMap(encoder *xml.Encoder, node *CandidateNode
 				return err
 			}
 			if _, err := e.writer.Write([]byte("\n")); err != nil {
-				log.Warning("Unable to write newline, skipping: %w", err)
+				log.Warningf("Unable to write newline, skipping: %v", err)
 			}
 		} else if key.Value == e.prefs.DirectiveName {
 			var directive xml.Directive = []byte(value.Value)
@@ -139,7 +139,7 @@ func (e *xmlEncoder) encodeTopLevelMap(encoder *xml.Encoder, node *CandidateNode
 				return err
 			}
 			if _, err := e.writer.Write([]byte("\n")); err != nil {
-				log.Warning("Unable to write newline, skipping: %w", err)
+				log.Warningf("Unable to write newline, skipping: %v", err)
 			}
 		} else {
 

pkg/yqlib/encoder_yaml.go

@@ -1,13 +1,11 @@
 package yqlib
 
 import (
-	"bufio"
 	"bytes"
-	"errors"
+	"fmt"
 	"io"
 	"strings"
 
-	"github.com/fatih/color"
 	"go.yaml.in/yaml/v4"
 )
 
@@ -24,67 +22,15 @@ func (ye *yamlEncoder) CanHandleAliases() bool {
 }
 
 func (ye *yamlEncoder) PrintDocumentSeparator(writer io.Writer) error {
-	if ye.prefs.PrintDocSeparators {
-		log.Debug("writing doc sep")
-		if err := writeString(writer, "---\n"); err != nil {
-			return err
-		}
-	}
-	return nil
+	return PrintYAMLDocumentSeparator(writer, ye.prefs.PrintDocSeparators)
 }
 
 func (ye *yamlEncoder) PrintLeadingContent(writer io.Writer, content string) error {
-	reader := bufio.NewReader(strings.NewReader(content))
-
-	// reuse precompiled package-level regex
-	// (declared in decoder_yaml.go)
-
-	for {
-
-		readline, errReading := reader.ReadString('\n')
-		if errReading != nil && !errors.Is(errReading, io.EOF) {
-			return errReading
-		}
-		if strings.Contains(readline, "$yqDocSeparator$") {
-			// Preserve the original line ending (CRLF or LF)
-			lineEnding := "\n"
-			if strings.HasSuffix(readline, "\r\n") {
-				lineEnding = "\r\n"
-			}
-			if ye.prefs.PrintDocSeparators {
-				if err := writeString(writer, "---"+lineEnding); err != nil {
-					return err
-				}
-			}
-
-		} else {
-			if len(readline) > 0 && readline != "\n" && readline[0] != '%' && !commentLineRe.MatchString(readline) {
-				readline = "# " + readline
-			}
-			if ye.prefs.ColorsEnabled && strings.TrimSpace(readline) != "" {
-				readline = format(color.FgHiBlack) + readline + format(color.Reset)
-			}
-			if err := writeString(writer, readline); err != nil {
-				return err
-			}
-		}
-
-		if errors.Is(errReading, io.EOF) {
-			if readline != "" {
-				// the last comment we read didn't have a newline, put one in
-				if err := writeString(writer, "\n"); err != nil {
-					return err
-				}
-			}
-			break
-		}
-	}
-
-	return nil
+	return PrintYAMLLeadingContent(writer, content, ye.prefs.PrintDocSeparators, ye.prefs.ColorsEnabled)
 }
 
 func (ye *yamlEncoder) Encode(writer io.Writer, node *CandidateNode) error {
-	log.Debug("encoderYaml - going to print %v", NodeToString(node))
+	log.Debugf("encoderYaml - going to print %v", NodeToString(node))
 	// Detect line ending style from LeadingContent
 	lineEnding := "\n"
 	if strings.Contains(node.LeadingContent, "\r\n") {
@@ -104,20 +50,37 @@ func (ye *yamlEncoder) Encode(writer io.Writer, node *CandidateNode) error {
 		destination = tempBuffer
 	}
 
-	var encoder = yaml.NewEncoder(destination)
+	indent := ye.prefs.Indent
+	if indent < 2 {
+		indent = 2
+	} else if indent > 9 {
+		indent = 9
+	}
 
-	encoder.SetIndent(ye.prefs.Indent)
+	dumper, err := yaml.NewDumper(destination,
+		yaml.WithV3Defaults(),
+		yaml.WithIndent(indent),
+		yaml.WithCompactSeqIndent(ye.prefs.CompactSequenceIndent),
+		yaml.WithLineWidth(-1),
+	)
+	if err != nil {
+		return fmt.Errorf("configure YAML encoding: %w", err)
+	}
 
 	target, err := node.MarshalYAML()
-
 	if err != nil {
+		_ = dumper.Close()
 		return err
 	}
 
 	trailingContent := target.FootComment
 	target.FootComment = ""
 
-	if err := encoder.Encode(target); err != nil {
+	err = dumper.Dump(target)
+	if closeErr := dumper.Close(); err == nil {
+		err = closeErr
+	}
+	if err != nil {
 		return err
 	}
 

pkg/yqlib/expression_parser.go

@@ -26,7 +26,7 @@ func newExpressionParser() ExpressionParserInterface {
 }
 
 func (p *expressionParserImpl) ParseExpression(expression string) (*ExpressionNode, error) {
-	log.Debug("Parsing expression: [%v]", expression)
+	log.Debugf("Parsing expression: [%v]", expression)
 	tokens, err := p.pathTokeniser.Tokenise(expression)
 	if err != nil {
 		return nil, err

pkg/yqlib/expression_parser_test.go

@@ -95,6 +95,7 @@ func TestParserSingleOperation(t *testing.T) {
 	test.AssertResultComplex(t, nil, err)
 	if result == nil {
 		t.Fatal("Expected non-nil result for single operation")
+		return
 	}
 	if result.Operation == nil {
 		t.Fatal("Expected operation to be set")

pkg/yqlib/expression_postfix.go

@@ -3,8 +3,7 @@ package yqlib
 import (
 	"errors"
 	"fmt"
-
-	logging "gopkg.in/op/go-logging.v1"
+	"log/slog"
 )
 
 type expressionPostFixer interface {
@@ -134,7 +133,7 @@ func (p *expressionPostFixerImpl) ConvertToPostfix(infixTokens []*token) ([]*Ope
 		return nil, fmt.Errorf("bad expression - probably missing close bracket on %v", opStack[len(opStack)-1].toString(false))
 	}
 
-	if log.IsEnabledFor(logging.DEBUG) {
+	if log.IsEnabledFor(slog.LevelDebug) {
 		log.Debugf("PostFix Result:")
 		for _, currentToken := range result {
 			log.Debugf("> %v", currentToken.toString())

pkg/yqlib/file_utils.go

@@ -7,7 +7,15 @@ import (
 )
 
 func tryRenameFile(from string, to string) error {
-	if renameError := os.Rename(from, to); renameError != nil {
+	if info, err := os.Lstat(to); err == nil && info.Mode()&os.ModeSymlink != 0 {
+		log.Debug("Target file is symlink, skipping rename and attempting to copy contents")
+
+		if copyError := copyFileContents(from, to); copyError != nil {
+			return fmt.Errorf("failed copying from %v to %v: %w", from, to, copyError)
+		}
+		tryRemoveTempFile(from)
+		return nil
+	} else if renameError := os.Rename(from, to); renameError != nil {
 		log.Debugf("Error renaming from %v to %v, attempting to copy contents", from, to)
 		log.Debug(renameError.Error())
 		log.Debug("going to try copying instead")
@@ -22,7 +30,7 @@ func tryRenameFile(from string, to string) error {
 }
 
 func tryRemoveTempFile(filename string) {
-	log.Debug("Removing temp file: %v", filename)
+	log.Debugf("Removing temp file: %v", filename)
 	removeErr := os.Remove(filename)
 	if removeErr != nil {
 		log.Errorf("Failed to remove temp file: %v", filename)
@@ -32,7 +40,7 @@ func tryRemoveTempFile(filename string) {
 // thanks https://stackoverflow.com/questions/21060945/simple-way-to-copy-a-file-in-golang
 func copyFileContents(src, dst string) (err error) {
 	// ignore CWE-22 gosec issue - that's more targeted for http based apps that run in a public directory,
-	// and ensuring that it's not possible to give a path to a file outside thar directory.
+	// and ensuring that it's not possible to give a path to a file outside that directory.
 
 	in, err := os.Open(src) // #nosec
 	if err != nil {
@@ -60,8 +68,7 @@ func SafelyCloseReader(reader io.Reader) {
 func safelyCloseFile(file *os.File) {
 	err := file.Close()
 	if err != nil {
-		log.Error("Error closing file!")
-		log.Error(err.Error())
+		log.Errorf("Error closing file %v: %v", file.Name(), err)
 	}
 }
 

pkg/yqlib/format.go

@@ -22,6 +22,12 @@ var YamlFormat = &Format{"yaml", []string{"y", "yml"},
 	func() Decoder { return NewYamlDecoder(ConfiguredYamlPreferences) },
 }
 
+var KYamlFormat = &Format{"kyaml", []string{"ky"},
+	func() Encoder { return NewKYamlEncoder(ConfiguredKYamlPreferences) },
+	// KYaml is stricter YAML
+	func() Decoder { return NewYamlDecoder(ConfiguredYamlPreferences) },
+}
+
 var JSONFormat = &Format{"json", []string{"j"},
 	func() Encoder { return NewJSONEncoder(ConfiguredJSONPreferences) },
 	func() Decoder { return NewJSONDecoder() },
@@ -84,11 +90,12 @@ var LuaFormat = &Format{"lua", []string{"l"},
 
 var INIFormat = &Format{"ini", []string{"i"},
 	func() Encoder { return NewINIEncoder() },
-	func() Decoder { return NewINIDecoder() },
+	func() Decoder { return NewINIDecoder(ConfiguredINIPreferences) },
 }
 
 var Formats = []*Format{
 	YamlFormat,
+	KYamlFormat,
 	JSONFormat,
 	PropertiesFormat,
 	CSVFormat,
@@ -121,8 +128,11 @@ func FormatStringFromFilename(filename string) string {
 		ext := filepath.Ext(filename)
 		if len(ext) >= 2 && ext[0] == '.' {
 			format := strings.ToLower(ext[1:])
-			GetLogger().Debugf("detected format '%s'", format)
-			return format
+			if _, err := FormatFromString(format); err == nil {
+				GetLogger().Debugf("detected format '%s'", format)
+				return format
+			}
+			GetLogger().Debugf("extension '%s' is not a recognised format, defaulting to yaml", format)
 		}
 	}
 

pkg/yqlib/format_test.go

@@ -59,4 +59,7 @@ func TestFormatStringFromFilename(t *testing.T) {
 	test.AssertResult(t, "json", FormatStringFromFilename("TEST.JSON"))
 	test.AssertResult(t, "yaml", FormatStringFromFilename("test.json/foo"))
 	test.AssertResult(t, "yaml", FormatStringFromFilename(""))
+	// unrecognised extensions should default to yaml instead of being passed through verbatim
+	// (see https://github.com/mikefarah/yq/issues/1608)
+	test.AssertResult(t, "yaml", FormatStringFromFilename("test.tfstate"))
 }

pkg/yqlib/front_matter.go

@@ -2,11 +2,26 @@ package yqlib
 
 import (
 	"bufio"
+	"bytes"
 	"errors"
 	"io"
 	"os"
 )
 
+var utf8BOM = []byte{0xEF, 0xBB, 0xBF}
+
+// stripUTF8BOM returns a reader that skips a leading UTF-8 BOM, if present.
+func stripUTF8BOM(r io.Reader) io.Reader {
+	br := bufio.NewReader(r)
+
+	peek, err := br.Peek(3)
+	if err == nil && bytes.Equal(peek, utf8BOM) {
+		_, _ = br.Discard(3)
+	}
+
+	return br
+}
+
 type frontMatterHandler interface {
 	Split() error
 	GetYamlFrontMatterFilename() string
@@ -43,13 +58,13 @@ func (f *frontMatterHandlerImpl) Split() error {
 	var reader *bufio.Reader
 	var err error
 	if f.originalFilename == "-" {
-		reader = bufio.NewReader(os.Stdin)
+		reader = bufio.NewReader(stripUTF8BOM(os.Stdin))
 	} else {
 		file, err := os.Open(f.originalFilename) // #nosec
 		if err != nil {
 			return err
 		}
-		reader = bufio.NewReader(file)
+		reader = bufio.NewReader(stripUTF8BOM(file))
 	}
 	f.contentReader = reader
 
@@ -58,7 +73,7 @@ func (f *frontMatterHandlerImpl) Split() error {
 		return err
 	}
 	f.yamlFrontMatterFilename = yamlTempFile.Name()
-	log.Debug("yamlTempFile: %v", yamlTempFile.Name())
+	log.Debugf("yamlTempFile: %v", yamlTempFile.Name())
 
 	lineCount := 0
 

pkg/yqlib/front_matter_test.go

@@ -108,6 +108,142 @@ yaml: doc
 	fmHandler.CleanUp()
 }
 
+func TestFrontMatterFilenamePreserved(t *testing.T) {
+	// Regression test for https://github.com/mikefarah/yq/issues/2538
+	// When using --front-matter, the filename operator should return
+	// the original filename, not the path to the temporary file.
+	file := createTestFile(`---
+name: john
+---
+Some content
+`)
+	originalFilename := "/path/to/original/file.md"
+
+	fmHandler := NewFrontMatterHandler(file)
+	err := fmHandler.Split()
+	if err != nil {
+		panic(err)
+	}
+
+	tempFilename := fmHandler.GetYamlFrontMatterFilename()
+
+	// Register the alias (as the command code does)
+	SetFilenameAlias(tempFilename, originalFilename)
+	defer ClearFilenameAliases()
+
+	// Verify resolveFilename returns the original name
+	resolved := resolveFilename(tempFilename)
+	test.AssertResult(t, originalFilename, resolved)
+
+	// Read documents using the temp file, verify they get the original filename
+	reader, cleanup, err := readStream(tempFilename)
+	if err != nil {
+		panic(err)
+	}
+	defer cleanup()
+	decoder := NewYamlDecoder(ConfiguredYamlPreferences)
+	docs, err := readDocuments(reader, tempFilename, 0, decoder)
+	if err != nil {
+		panic(err)
+	}
+
+	if docs.Len() == 0 {
+		t.Fatal("expected at least one document")
+	}
+
+	firstDoc := docs.Front().Value.(*CandidateNode)
+	test.AssertResult(t, originalFilename, firstDoc.filename)
+
+	tryRemoveTempFile(file)
+	fmHandler.CleanUp()
+}
+
+func TestFrontMatterSplitWithBOM(t *testing.T) {
+	// Regression test for https://github.com/mikefarah/yq/issues/2496
+	// A UTF-8 BOM before the opening --- must be skipped, otherwise the
+	// separator isn't recognised and the opening --- is lost.
+	file := createTestFile("\ufeff---\na: apple\nb: banana\n---\nnot a\nyaml: doc\n")
+
+	expectedYamlFm := `---
+a: apple
+b: banana
+`
+
+	expectedContent := `---
+not a
+yaml: doc
+`
+
+	fmHandler := NewFrontMatterHandler(file)
+	err := fmHandler.Split()
+	if err != nil {
+		panic(err)
+	}
+
+	yamlFm := readFile(fmHandler.GetYamlFrontMatterFilename())
+
+	test.AssertResult(t, expectedYamlFm, yamlFm)
+
+	contentBytes, err := io.ReadAll(fmHandler.GetContentReader())
+	if err != nil {
+		panic(err)
+	}
+	test.AssertResult(t, expectedContent, string(contentBytes))
+
+	tryRemoveTempFile(file)
+	fmHandler.CleanUp()
+}
+
+func TestFrontMatterSplitWithBOMFromStdin(t *testing.T) {
+	// Regression test for https://github.com/mikefarah/yq/issues/2496
+	// A UTF-8 BOM must also be skipped when reading front matter from stdin.
+	originalStdin := os.Stdin
+	defer func() { os.Stdin = originalStdin }()
+
+	r, w, err := os.Pipe()
+	if err != nil {
+		panic(err)
+	}
+	os.Stdin = r
+	defer safelyCloseFile(r)
+
+	go func() {
+		_, writeErr := w.WriteString("\ufeff---\na: apple\nb: banana\n---\nnot a\nyaml: doc\n")
+		if writeErr != nil {
+			t.Errorf("failed to write front matter to the stdin pipe: %v", writeErr)
+		}
+		safelyCloseFile(w)
+	}()
+
+	expectedYamlFm := `---
+a: apple
+b: banana
+`
+
+	expectedContent := `---
+not a
+yaml: doc
+`
+
+	fmHandler := NewFrontMatterHandler("-")
+	err = fmHandler.Split()
+	if err != nil {
+		panic(err)
+	}
+
+	yamlFm := readFile(fmHandler.GetYamlFrontMatterFilename())
+
+	test.AssertResult(t, expectedYamlFm, yamlFm)
+
+	contentBytes, err := io.ReadAll(fmHandler.GetContentReader())
+	if err != nil {
+		panic(err)
+	}
+	test.AssertResult(t, expectedContent, string(contentBytes))
+
+	fmHandler.CleanUp()
+}
+
 func TestFrontMatterSplitWithArray(t *testing.T) {
 	file := createTestFile(`[1,2,3]
 ---

pkg/yqlib/goccy_yaml_test.go

@@ -230,8 +230,7 @@ var goccyYamlFormatScenarios = []formatScenario{
 		description: "merge anchor",
 		skipDoc:     true,
 		input:       "a: &remember\n  c: mike\nb:\n  <<: *remember",
-		// fine to have !!merge as that's what the current impl does
-		expected: "a: &remember\n  c: mike\nb:\n  !!merge <<: *remember\n",
+		expected:    "a: &remember\n  c: mike\nb:\n  <<: *remember\n",
 	},
 	{
 		description: "custom tag",

pkg/yqlib/hcl_test.go

@@ -4,6 +4,7 @@ package yqlib
 
 import (
 	"bufio"
+	"bytes"
 	"fmt"
 	"testing"
 
@@ -175,6 +176,41 @@ var hclFormatScenarios = []formatScenario{
 		expected:     "obj: {a: 1, b: \"two\"}\n",
 		scenarioType: "decode",
 	},
+	{
+		description:  "object with integer keys",
+		skipDoc:      true,
+		input:        `obj = { 1 = "one", 2 = "two" }`,
+		expected:     "obj: {1: \"one\", 2: \"two\"}\n",
+		scenarioType: "decode",
+	},
+	{
+		description:  "object with boolean keys",
+		skipDoc:      true,
+		input:        `obj = { (true) = "yes", (false) = "no" }`,
+		expected:     "obj: {true: \"yes\", false: \"no\"}\n",
+		scenarioType: "decode",
+	},
+	{
+		description:  "object with float keys",
+		skipDoc:      true,
+		input:        `obj = { (3.14) = "pi" }`,
+		expected:     "obj: {3.14: \"pi\"}\n",
+		scenarioType: "decode",
+	},
+	{
+		description:  "object with mixed scalar keys",
+		skipDoc:      true,
+		input:        `obj = { a = 1, 1 = "one", (true) = "yes" }`,
+		expected:     "obj: {a: 1, 1: \"one\", true: \"yes\"}\n",
+		scenarioType: "decode",
+	},
+	{
+		description:  "nested object with integer keys",
+		skipDoc:      true,
+		input:        `config = { levels = { 1 = "debug", 2 = "info" } }`,
+		expected:     "config: {levels: {1: \"debug\", 2: \"info\"}}\n",
+		scenarioType: "decode",
+	},
 	{
 		description:  "nested block",
 		skipDoc:      true,
@@ -471,6 +507,13 @@ var hclFormatScenarios = []formatScenario{
 		expected:     "service {\n  optional_field = null\n}\n",
 		scenarioType: "roundtrip",
 	},
+	{
+		description:  "object with integer key and empty value",
+		skipDoc:      true,
+		input:        `intdict = { 1 = {} }`,
+		expected:     "intdict: {1: {}}\n",
+		scenarioType: "decode",
+	},
 }
 
 func testHclScenario(t *testing.T, s formatScenario) {
@@ -543,6 +586,35 @@ func documentHclRoundTripScenario(w *bufio.Writer, s formatScenario) {
 	writeOrPanic(w, fmt.Sprintf("```hcl\n%v```\n\n", mustProcessFormatScenario(s, NewHclDecoder(), NewHclEncoder(ConfiguredHclPreferences))))
 }
 
+func TestHclEncoderPrintDocumentSeparator(t *testing.T) {
+	encoder := NewHclEncoder(ConfiguredHclPreferences)
+	var buf bytes.Buffer
+	writer := bufio.NewWriter(&buf)
+
+	err := encoder.PrintDocumentSeparator(writer)
+	writer.Flush()
+
+	test.AssertResult(t, nil, err)
+	test.AssertResult(t, "", buf.String())
+}
+
+func TestHclEncoderPrintLeadingContent(t *testing.T) {
+	encoder := NewHclEncoder(ConfiguredHclPreferences)
+	var buf bytes.Buffer
+	writer := bufio.NewWriter(&buf)
+
+	err := encoder.PrintLeadingContent(writer, "some content")
+	writer.Flush()
+
+	test.AssertResult(t, nil, err)
+	test.AssertResult(t, "", buf.String())
+}
+
+func TestHclEncoderCanHandleAliases(t *testing.T) {
+	encoder := NewHclEncoder(ConfiguredHclPreferences)
+	test.AssertResult(t, false, encoder.CanHandleAliases())
+}
+
 func TestHclFormatScenarios(t *testing.T) {
 	for _, tt := range hclFormatScenarios {
 		testHclScenario(t, tt)

pkg/yqlib/ini.go

@@ -1,18 +1,21 @@
 package yqlib
 
 type INIPreferences struct {
-	ColorsEnabled bool
+	ColorsEnabled           bool
+	PreserveSurroundedQuote bool
 }
 
 func NewDefaultINIPreferences() INIPreferences {
 	return INIPreferences{
-		ColorsEnabled: false,
+		ColorsEnabled:           false,
+		PreserveSurroundedQuote: false,
 	}
 }
 
 func (p *INIPreferences) Copy() INIPreferences {
 	return INIPreferences{
-		ColorsEnabled: p.ColorsEnabled,
+		ColorsEnabled:           p.ColorsEnabled,
+		PreserveSurroundedQuote: p.PreserveSurroundedQuote,
 	}
 }