Bump go.yaml.in/yaml/v4 from 4.0.0-rc.5 to 4.0.0-rc.6 (#2759)

Bumps [go.yaml.in/yaml/v4](https://github.com/yaml/go-yaml) from 4.0.0-rc.5 to 4.0.0-rc.6.
- [Commits](https://github.com/yaml/go-yaml/compare/v4.0.0-rc.5...v4.0.0-rc.6)

---
updated-dependencies:
- dependency-name: go.yaml.in/yaml/v4
  dependency-version: 4.0.0-rc.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/codeql.yml

@@ -44,7 +44,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -55,7 +55,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+      uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -69,4 +69,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
+      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2

.github/workflows/docker-githubaction.yml

@@ -0,0 +1,107 @@
+name: Release Docker GitHub Action
+
+on:
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  publishGithubActionDocker:
+    environment: dockerhub
+    env:
+      IMAGE_NAME: mikefarah/yq
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        with:
+          platforms: all
+
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        with:
+          version: latest
+
+      - name: Verify Dockerfile base image digest matches yq:4
+        run: |
+          PINNED_DIGEST=$(grep -oE 'sha256:[a-f0-9]{64}' github-action/Dockerfile | head -1)
+          if [ -z "${PINNED_DIGEST}" ]; then
+            echo "::error::Could not find a sha256 digest in github-action/Dockerfile"
+            exit 1
+          fi
+
+          LATEST_DIGEST=$(docker buildx imagetools inspect "${IMAGE_NAME}:4" --format '{{printf "%s" .Manifest.Digest}}')
+
+          echo "Dockerfile pins: ${PINNED_DIGEST}"
+          echo "mikefarah/yq:4 is:  ${LATEST_DIGEST}"
+
+          if [ "${PINNED_DIGEST}" != "${LATEST_DIGEST}" ]; then
+            echo "::error::github-action/Dockerfile digest does not match the current mikefarah/yq:4 image"
+            echo "Update the FROM line in github-action/Dockerfile to:"
+            echo "  FROM mikefarah/yq:4@${LATEST_DIGEST}"
+            exit 1
+          fi
+
+      - name: Resolve version from yq:4
+        run: |
+          IMAGE_VERSION=$(docker run --rm "${IMAGE_NAME}:4" --version | awk '{print $NF}' | sed 's/^v//')
+          if [ -z "${IMAGE_VERSION}" ]; then
+            echo "::error::Could not determine yq version from ${IMAGE_NAME}:4"
+            exit 1
+          fi
+          echo "Resolved yq version: ${IMAGE_VERSION}"
+          echo "IMAGE_VERSION=${IMAGE_VERSION}" >> "${GITHUB_ENV}"
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push github-action image
+        working-directory: github-action
+        run: |
+          PLATFORMS="linux/amd64,linux/ppc64le,linux/arm64,linux/arm/v7,linux/s390x"
+
+          echo "Building and pushing github-action image for version ${IMAGE_VERSION}"
+          docker buildx build \
+            --label "org.opencontainers.image.authors=https://github.com/mikefarah/yq/graphs/contributors" \
+            --label "org.opencontainers.image.created=$(date --rfc-3339=seconds)" \
+            --label "org.opencontainers.image.description=yq is a portable command-line data file processor" \
+            --label "org.opencontainers.image.documentation=https://mikefarah.gitbook.io/yq/" \
+            --label "org.opencontainers.image.licenses=MIT" \
+            --label "org.opencontainers.image.revision=$(git rev-parse HEAD)" \
+            --label "org.opencontainers.image.source=https://github.com/mikefarah/yq" \
+            --label "org.opencontainers.image.title=yq" \
+            --label "org.opencontainers.image.url=https://mikefarah.gitbook.io/yq/" \
+            --label "org.opencontainers.image.version=${IMAGE_VERSION}" \
+            --platform "${PLATFORMS}" \
+            --pull \
+            --push \
+            -t "${IMAGE_NAME}:${IMAGE_VERSION}-githubaction" \
+            -t "${IMAGE_NAME}:4-githubaction" \
+            -t "${IMAGE_NAME}:latest-githubaction" \
+            -t "ghcr.io/${IMAGE_NAME}:${IMAGE_VERSION}-githubaction" \
+            -t "ghcr.io/${IMAGE_NAME}:4-githubaction" \
+            -t "ghcr.io/${IMAGE_NAME}:latest-githubaction" \
+            .
+
+      - name: Report action.yml digest to pin
+        run: |
+          GITHUBACTION_DIGEST=$(docker buildx imagetools inspect "${IMAGE_NAME}:4-githubaction" --format '{{printf "%s" .Manifest.Digest}}')
+          echo "Published ${IMAGE_NAME}:4-githubaction at ${GITHUBACTION_DIGEST}"
+          echo "Update action.yml image to:"
+          echo "  docker://${IMAGE_NAME}:4-githubaction@${GITHUBACTION_DIGEST}"

.github/workflows/docker-release.yml

@@ -80,26 +80,3 @@ jobs:
             -t "ghcr.io/${IMAGE_NAME}:4" \
             -t "ghcr.io/${IMAGE_NAME}:latest" \
             .
-
-          cd github-action
-          docker buildx build \
-            --label "org.opencontainers.image.authors=https://github.com/mikefarah/yq/graphs/contributors" \
-            --label "org.opencontainers.image.created=$(date --rfc-3339=seconds)" \
-            --label "org.opencontainers.image.description=yq is a portable command-line data file processor" \
-            --label "org.opencontainers.image.documentation=https://mikefarah.gitbook.io/yq/" \
-            --label "org.opencontainers.image.licenses=MIT" \
-            --label "org.opencontainers.image.revision=$(git rev-parse HEAD)" \
-            --label "org.opencontainers.image.source=https://github.com/mikefarah/yq" \
-            --label "org.opencontainers.image.title=yq" \
-            --label "org.opencontainers.image.url=https://mikefarah.gitbook.io/yq/" \
-            --label "org.opencontainers.image.version=${IMAGE_VERSION}" \
-            --platform "${PLATFORMS}" \
-            --pull \
-            --push \
-            -t "${IMAGE_NAME}:${IMAGE_VERSION}-githubaction" \
-            -t "${IMAGE_NAME}:4-githubaction" \
-            -t "${IMAGE_NAME}:latest-githubaction" \
-            -t "ghcr.io/${IMAGE_NAME}:${IMAGE_VERSION}-githubaction" \
-            -t "ghcr.io/${IMAGE_NAME}:4-githubaction" \
-            -t "ghcr.io/${IMAGE_NAME}:latest-githubaction" \
-            .

.github/workflows/go.yml

@@ -5,13 +5,39 @@ permissions:
 
 jobs:
 
+  verify-action-digest:
+    name: Verify action.yml image digest
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Verify action.yml digest matches published image
+        run: |
+          PINNED_DIGEST=$(grep -oE 'sha256:[a-f0-9]{64}' action.yml | head -1)
+          if [ -z "${PINNED_DIGEST}" ]; then
+            echo "::error::action.yml does not pin the runtime image by digest"
+            exit 1
+          fi
+
+          LATEST_DIGEST=$(docker buildx imagetools inspect docker.io/mikefarah/yq:4-githubaction --format '{{printf "%s" .Manifest.Digest}}')
+
+          echo "action.yml pins:              ${PINNED_DIGEST}"
+          echo "mikefarah/yq:4-githubaction: ${LATEST_DIGEST}"
+
+          if [ "${PINNED_DIGEST}" != "${LATEST_DIGEST}" ]; then
+            echo "::error::action.yml digest does not match the current mikefarah/yq:4-githubaction image"
+            echo "Update the image line in action.yml to:"
+            echo "  docker://mikefarah/yq:4-githubaction@${LATEST_DIGEST}"
+            exit 1
+          fi
+
   build:
     name: Build
     runs-on: ubuntu-latest
     steps:
 
     - name: Set up Go
-      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
       with:
         go-version: '^1.20'
       id: go
@@ -23,7 +49,7 @@ jobs:
       run: |
         go get -v -t -d ./...
         if [ -f Gopkg.toml ]; then
-            curl https://raw.githubusercontent.com/golang/dep/master/install.sh | sh
+            curl -sSfL https://raw.githubusercontent.com/golang/dep/1f7c19e5f52f49ffb9f956f64c010be14683468b/install.sh | env DEP_RELEASE_TAG=v0.5.4 sh
             dep ensure
         fi
 

.github/workflows/release.yml

@@ -15,7 +15,7 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version: '^1.20'
           check-latest: true
@@ -29,7 +29,7 @@ jobs:
         run: echo "VERSION=${GITHUB_REF##*/}" >> "${GITHUB_OUTPUT}"
 
       - name: Generate man page
-        uses: docker://pandoc/core:2.14.2
+        uses: docker://pandoc/core:2.14.2@sha256:04e127c6642a2b9d447c26fe0ac6a5932efa8f508eda9f07da51b6e621dd7c19
         id: gen-man-page
         with:
           args: >-
@@ -43,12 +43,12 @@ jobs:
             man.md
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@v3
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       - name: Cross compile
         run: |
           sudo apt-get install rhash -y
-          go install github.com/goreleaser/goreleaser/v2@latest
+          go install github.com/goreleaser/goreleaser/v2@v2.16.0
           ./scripts/xcompile.sh
 
       - name: Sign checksums

.github/workflows/scorecard.yml

@@ -73,6 +73,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           sarif_file: results.sarif

AGENTS.md

@@ -39,7 +39,6 @@ This is also included in the full CI pipeline via `make local test`.
 ### Prerequisites
 
 - **Go ≥ 1.25** (see `go.mod`)
-- **Node.js** (for `npx cspell` spelling checks in the full `make test` pipeline)
 - **Bash** (acceptance tests)
 - **Docker/Podman** is optional; use `make local <target>` to run natively when containers are unavailable
 
@@ -51,7 +50,7 @@ After `scripts/devtools.sh`, add Go tool binaries to PATH:
 export PATH="$HOME/go/bin:$PATH"
 ```
 
-`golangci-lint` installs to `$HOME/go/bin`; `gosec` installs to `./bin/gosec` in the repo root.
+`golangci-lint` and `typos` install to `$HOME/go/bin`; `gosec` installs to `./bin/gosec` in the repo root.
 
 ### Common commands (local, no Docker)
 
@@ -70,7 +69,7 @@ export PATH="$HOME/go/bin:$PATH"
 ### Caveats
 
 - **`make` without `local`** tries Docker/Podman (`Dockerfile.dev`). In Cloud Agent VMs without Docker, always prefix with `make local`.
-- **Spelling step** uses `npx cspell` and may download cspell on first run (network required).
+- **Spelling step** uses `typos` (installed by `scripts/devtools.sh`).
 - **`make local test` / `scripts/check.sh`** require `golangci-lint` on PATH (`devtools.sh`).
 
 ---

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.26.4@sha256:68cb6d68bed024785b69195b89af7ac7a444f27791435f98647edff595aa0479 AS builder
+FROM golang:1.26.4@sha256:792443b89f65105abba56b9bd5e97f680a80074ac62fc844a584212f8c8102c3 AS builder
 
 WORKDIR /go/src/mikefarah/yq
 
@@ -10,7 +10,7 @@ RUN ./scripts/acceptance.sh
 
 # Choose alpine as a base image to make this useful for CI, as many
 # CI tools expect an interactive shell inside the container
-FROM alpine:3@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11 AS production
+FROM alpine:3@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS production
 LABEL maintainer="Mike Farah <mikefarah@users.noreply.github.com>"
 
 COPY --from=builder /go/src/mikefarah/yq/yq /usr/bin/yq

Dockerfile.dev

@@ -1,8 +1,4 @@
-FROM golang:1.26.4@sha256:68cb6d68bed024785b69195b89af7ac7a444f27791435f98647edff595aa0479
+FROM golang:1.26.4@sha256:792443b89f65105abba56b9bd5e97f680a80074ac62fc844a584212f8c8102c3
-
-RUN apt-get update && \
-    apt-get install -y npm && \
-    npm install -g npx cspell@latest
 
 COPY scripts/devtools.sh /opt/devtools.sh
 

Makefile

@@ -42,7 +42,7 @@ quiet: # this is silly but shuts up 'Nothing to be done for `local`'
 	@:
 
 prepare: tmp/dev_image_id
-tmp/dev_image_id: Dockerfile.dev scripts/devtools.sh
+tmp/dev_image_id: Dockerfile.dev scripts/devtools.sh _typos.toml
 	@mkdir -p tmp
 	@${ENGINE} rmi -f ${DEV_IMAGE} > /dev/null 2>&1 || true
 	@${ENGINE} build -t ${DEV_IMAGE} -f Dockerfile.dev .

_typos.toml

@@ -0,0 +1,20 @@
+[files]
+extend-exclude = ["vendor", "bin"]
+
+[default]
+locale = "en"
+extend-ignore-identifiers-re = [
+  "NdJson",
+]
+
+[default.extend-identifiers]
+AttributeIDSupressMenu = "AttributeIDSupressMenu"
+
+[default.extend-words]
+Teh = "Teh"
+teh = "teh"
+Supress = "Supress"
+HashiCorp = "HashiCorp"
+Hashi = "Hashi"
+fot = "fot"
+nd = "nd"

action.yml

@@ -12,6 +12,6 @@ outputs:
     description: "The complete result from the yq command being run"
 runs:
   using: 'docker'
-  image: 'docker://mikefarah/yq:4-githubaction'
+  image: 'docker://mikefarah/yq:4-githubaction@sha256:e1b8c865f299ea6b02910a7ddf147d5d431244d4cc116f89c2148c9f53822906'
   args:
     - ${{ inputs.cmd }}

cspell.config.yaml

@@ -1,14 +0,0 @@
----
-$schema: https://raw.githubusercontent.com/streetsidesoftware/cspell/main/cspell.schema.json
-version: '0.2'
-language: en-GB
-dictionaryDefinitions:
-  - name: project-words
-    path: './project-words.txt'
-    addWords: true
-dictionaries:
-  - project-words
-ignorePaths:
-  - 'vendor'
-  - 'bin'
-  - '/project-words.txt'

github-action/Dockerfile

@@ -1,4 +1,4 @@
-FROM mikefarah/yq:4@sha256:603ebff15eb308a05f1c5b8b7613179cad859aed3ec9fdd04f2ef5d32345950e
+FROM mikefarah/yq:4@sha256:11a1f0b604b13dbbdc662260d8db6f644b22d8553122a25c1b5b2e8713ca6977
 
 COPY entrypoint.sh /entrypoint.sh
 

go.mod

@@ -13,16 +13,16 @@ require (
 	github.com/hashicorp/hcl/v2 v2.24.0
 	github.com/jinzhu/copier v0.4.0
 	github.com/magiconair/properties v1.8.10
-	github.com/pelletier/go-toml/v2 v2.3.1
+	github.com/pelletier/go-toml/v2 v2.4.2
 	github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/yuin/gopher-lua v1.1.2
 	github.com/zclconf/go-cty v1.18.1
-	go.yaml.in/yaml/v4 v4.0.0-rc.4
+	go.yaml.in/yaml/v4 v4.0.0-rc.6
-	golang.org/x/mod v0.36.0
+	golang.org/x/mod v0.37.0
-	golang.org/x/net v0.55.0
+	golang.org/x/net v0.56.0
-	golang.org/x/text v0.37.0
+	golang.org/x/text v0.38.0
 )
 
 require (
@@ -33,9 +33,9 @@ require (
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
-	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/tools v0.44.0 // indirect
+	golang.org/x/tools v0.45.0 // indirect
 )
 
 go 1.25.0

go.sum

@@ -46,8 +46,8 @@ github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWE
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
 github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
-github.com/pelletier/go-toml/v2 v2.3.1 h1:MYEvvGnQjeNkRF1qUuGolNtNExTDwct51yp7olPtrEc=
+github.com/pelletier/go-toml/v2 v2.4.2 h1:M2fKKbmyvI+hGId/D0W64qDBMVhJnNR10O5gIbMc//Q=
-github.com/pelletier/go-toml/v2 v2.3.1/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pelletier/go-toml/v2 v2.4.2/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e h1:aoZm08cpOy4WuID//EZDgcC4zIxODThtZNPirFr42+A=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -68,21 +68,21 @@ github.com/zclconf/go-cty v1.18.1/go.mod h1:qpnV6EDNgC1sns/AleL1fvatHw72j+S+nS+M
 github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940 h1:4r45xpDWB6ZMSMNJFMOjqrGHynW3DIBuR2H9j0ug+Mo=
 github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmBdvvj3nqzfzJ6nTCIwDTPZ56aVGvDrmztiO5g3qrM=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-go.yaml.in/yaml/v4 v4.0.0-rc.4 h1:UP4+v6fFrBIb1l934bDl//mmnoIZEDK0idg1+AIvX5U=
+go.yaml.in/yaml/v4 v4.0.0-rc.6 h1:1h7H1ohdUh93/FyE4YaDa1Zh64K6VVbjF4K6WUxMtH4=
-go.yaml.in/yaml/v4 v4.0.0-rc.4/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
+go.yaml.in/yaml/v4 v4.0.0-rc.6/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
-golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
-golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
-golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
-golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
+golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
-golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
+golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

go_install_test.go

@@ -1,3 +1,5 @@
+//go:build goinstall
+
 package main
 
 import (
@@ -11,6 +13,10 @@ import (
 // TestGoInstallCompatibility ensures the module can be zipped for go install.
 // This is an integration test that uses the same zip.CreateFromDir function
 // that go install uses internally. If this test fails, go install will fail.
+//
+// Built with the goinstall tag and run after the main test suite (see scripts/test.sh)
+// so it does not race with pkg/yqlib tests that rewrite doc/*.md during execution.
+//
 // See: https://github.com/mikefarah/yq/issues/2587
 func TestGoInstallCompatibility(t *testing.T) {
 	mod := module.Version{

pkg/yqlib/candidate_node.go

@@ -46,7 +46,11 @@ const (
 func createStringScalarNode(stringValue string) *CandidateNode {
 	var node = &CandidateNode{Kind: ScalarNode}
 	node.Value = stringValue
+	if stringValue == "<<" {
+		node.Tag = "!!merge"
+	} else {
 		node.Tag = "!!str"
+	}
 	return node
 }
 

pkg/yqlib/candidate_node_test.go

@@ -106,6 +106,31 @@ func TestCreateScalarNodeScenarios(t *testing.T) {
 	}
 }
 
+type createStringScalarNodeScenario struct {
+	stringValue string
+	expectedTag string
+}
+
+var createStringScalarNodeScenarios = []createStringScalarNodeScenario{
+	{
+		stringValue: "yourKey",
+		expectedTag: "!!str",
+	},
+	{
+		stringValue: "<<",
+		expectedTag: "!!merge",
+	},
+}
+
+func TestCreateStringScalarNodeScenarios(t *testing.T) {
+	for _, tt := range createStringScalarNodeScenarios {
+		actual := createStringScalarNode(tt.stringValue)
+		test.AssertResultWithContext(t, tt.stringValue, actual.Value, fmt.Sprintf("Value for: %v", tt.stringValue))
+		test.AssertResultWithContext(t, tt.expectedTag, actual.Tag, fmt.Sprintf("Tag for: %v", tt.stringValue))
+		test.AssertResultWithContext(t, ScalarNode, actual.Kind, fmt.Sprintf("Kind for: %v", tt.stringValue))
+	}
+}
+
 func TestGetKeyForMapValue(t *testing.T) {
 	key := createStringScalarNode("yourKey")
 	n := CandidateNode{Key: key, Value: "meow", document: 3}

pkg/yqlib/doc/operators/anchor-and-alias-operators.md

@@ -2,7 +2,7 @@
 
 Use the `alias` and `anchor` operators to read and write yaml aliases and anchors. The `explode` operator normalises a yaml file (dereference (or expands) aliases and remove anchor names).
 
-`yq` supports merge aliases (like `<<: *blah`) however this is no longer in the standard yaml spec (1.2) and so `yq` will automatically add the `!!merge` tag to these nodes as it is effectively a custom tag.
+`yq` supports merge keys (like `<<: *blah`) from YAML 1.1. These are no longer part of the YAML 1.2 standard, but remain common in practice. Plain `<<:` keys are recognised as merge keys and round-trip as `<<:` without an explicit `!!merge` tag. When the source uses an explicit `!!merge` tag, that is preserved on output. Internally, when `yq` synthesises a `<<` map key (for example during merge operations), it tags the key as `!!merge` rather than `!!str`.
 
 
 ## NOTE --yaml-fix-merge-anchor-to-spec flag
@@ -32,7 +32,7 @@ Given a sample.yml file of:
   r: 10
 - &SMALL
   r: 1
-- !!merge <<: *CENTRE
+- <<: *CENTRE
   r: 10
 ```
 then
@@ -213,10 +213,10 @@ item_value: &item_value
   value: true
 thingOne:
   name: item_1
-  !!merge <<: *item_value
+  <<: *item_value
 thingTwo:
   name: item_2
-  !!merge <<: *item_value
+  <<: *item_value
 ```
 then
 ```bash
@@ -231,7 +231,7 @@ thingOne:
   value: false
 thingTwo:
   name: item_2
-  !!merge <<: *item_value
+  <<: *item_value
 ```
 
 ## LEGACY: Explode with merge anchors
@@ -249,13 +249,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -298,7 +298,7 @@ Given a sample.yml file of:
   r: 10
 - &SMALL
   r: 1
-- !!merge <<:
+- <<:
     - *CENTRE
     - *BIG
 ```
@@ -328,7 +328,7 @@ Given a sample.yml file of:
   r: 10
 - &SMALL
   r: 1
-- !!merge <<:
+- <<:
     - *BIG
     - *LEFT
     - *SMALL
@@ -361,13 +361,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -411,7 +411,7 @@ Given a sample.yml file of:
   r: 10
 - &SMALL
   r: 1
-- !!merge <<:
+- <<:
     - *CENTRE
     - *BIG
 ```
@@ -442,7 +442,7 @@ Given a sample.yml file of:
   r: 10
 - &SMALL
   r: 1
-- !!merge <<:
+- <<:
     - *BIG
     - *LEFT
     - *SMALL
@@ -467,7 +467,7 @@ Given a sample.yml file of:
 ```yaml
 a:
   b: &b 42
-!!merge <<:
+<<:
   c: *b
 ```
 then

pkg/yqlib/doc/operators/divide.md

@@ -55,7 +55,7 @@ yq '.a = .a / 0 | .b = .b / 0' sample.yml
 ```
 will output
 ```yaml
-a: !!float +Inf
+a: +Inf
-b: !!float -Inf
+b: -Inf
 ```
 

pkg/yqlib/doc/operators/headers/anchor-and-alias-operators.md

@@ -2,7 +2,7 @@
 
 Use the `alias` and `anchor` operators to read and write yaml aliases and anchors. The `explode` operator normalises a yaml file (dereference (or expands) aliases and remove anchor names).
 
-`yq` supports merge aliases (like `<<: *blah`) however this is no longer in the standard yaml spec (1.2) and so `yq` will automatically add the `!!merge` tag to these nodes as it is effectively a custom tag.
+`yq` supports merge keys (like `<<: *blah`) from YAML 1.1. These are no longer part of the YAML 1.2 standard, but remain common in practice. Plain `<<:` keys are recognised as merge keys and round-trip as `<<:` without an explicit `!!merge` tag. When the source uses an explicit `!!merge` tag, that is preserved on output. Internally, when `yq` synthesises a `<<` map key (for example during merge operations), it tags the key as `!!merge` rather than `!!str`.
 
 
 ## NOTE --yaml-fix-merge-anchor-to-spec flag

pkg/yqlib/doc/operators/modulo.md

@@ -34,7 +34,7 @@ yq '.a = .a % .b' sample.yml
 ```
 will output
 ```yaml
-a: !!float 2
+a: 2
 b: 2.5
 ```
 
@@ -69,7 +69,7 @@ yq '.a = .a % .b' sample.yml
 ```
 will output
 ```yaml
-a: !!float NaN
+a: NaN
 b: 0
 ```
 

pkg/yqlib/doc/operators/multiply-merge.md

@@ -471,13 +471,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -487,7 +487,7 @@ yq '.foobar * .foobarList' sample.yml
 will output
 ```yaml
 c: foobarList_c
-!!merge <<:
+<<:
   - *foo
   - *bar
 thing: foobar_thing

pkg/yqlib/doc/operators/recursive-descent-glob.md

@@ -131,13 +131,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -147,7 +147,7 @@ yq '.foobar | [..]' sample.yml
 will output
 ```yaml
 - c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 - foobar_c
 - *foo

pkg/yqlib/doc/operators/traverse-read.md

@@ -294,13 +294,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -325,13 +325,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -376,13 +376,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -409,13 +409,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -442,13 +442,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -477,13 +477,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -513,13 +513,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -546,13 +546,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -579,13 +579,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then
@@ -614,13 +614,13 @@ bar: &bar
   c: bar_c
 foobarList:
   b: foobarList_b
-  !!merge <<:
+  <<:
     - *foo
     - *bar
   c: foobarList_c
 foobar:
   c: foobar_c
-  !!merge <<: *foo
+  <<: *foo
   thing: foobar_thing
 ```
 then

pkg/yqlib/doc/usage/headers/toml.md

@@ -1,4 +1,4 @@
 # TOML
 
-Decode from TOML. Note that `yq` does not yet support outputting in TOML format (and therefore it cannot roundtrip)
+Encode and decode to and from TOML.
 

pkg/yqlib/doc/usage/toml.md

@@ -1,6 +1,6 @@
 # TOML
 
-Decode from TOML. Note that `yq` does not yet support outputting in TOML format (and therefore it cannot roundtrip)
+Encode and decode to and from TOML.
 
 
 ## Parse: Simple

pkg/yqlib/encoder_toml.go

@@ -677,7 +677,7 @@ func (te *tomlEncoder) colorizeToml(input []byte) []byte {
 
 		// Table sections - [section] or [[array]]
 		// Only treat '[' as a table section if it appears at the start of the line
-		// (possibly after whitespace). This avoids mis-colouring inline arrays like
+        // (possibly after whitespace). This avoids incorrectly colouring inline arrays like
 		// "ports = [8000, 8001]" as table sections.
 		if ch == '[' {
 			isSectionHeader := true

pkg/yqlib/file_utils.go

@@ -40,7 +40,7 @@ func tryRemoveTempFile(filename string) {
 // thanks https://stackoverflow.com/questions/21060945/simple-way-to-copy-a-file-in-golang
 func copyFileContents(src, dst string) (err error) {
 	// ignore CWE-22 gosec issue - that's more targeted for http based apps that run in a public directory,
-	// and ensuring that it's not possible to give a path to a file outside thar directory.
+	// and ensuring that it's not possible to give a path to a file outside that directory.
 
 	in, err := os.Open(src) // #nosec
 	if err != nil {

pkg/yqlib/goccy_yaml_test.go

@@ -230,8 +230,7 @@ var goccyYamlFormatScenarios = []formatScenario{
 		description: "merge anchor",
 		skipDoc:     true,
 		input:       "a: &remember\n  c: mike\nb:\n  <<: *remember",
-		// fine to have !!merge as that's what the current impl does
+		expected:    "a: &remember\n  c: mike\nb:\n  <<: *remember\n",
-		expected: "a: &remember\n  c: mike\nb:\n  !!merge <<: *remember\n",
 	},
 	{
 		description: "custom tag",

pkg/yqlib/lib_test.go

@@ -24,7 +24,7 @@ type parseSnippetScenario struct {
 var parseSnippetScenarios = []parseSnippetScenario{
 	{
 		snippet:       ":",
-		expectedError: "yaml: while parsing a block mapping at <unknown position>: did not find expected key",
+		expectedError: "go-yaml load error in parser (while parsing a block mapping) at L1.C1: did not find expected key",
 	},
 	{
 		snippet: "",

pkg/yqlib/operator_anchors_aliases_test.go

@@ -31,7 +31,7 @@ thingOne:
     value: false
 thingTwo:
     name: item_2
-    !!merge <<: *item_value
+    <<: *item_value
 `
 
 var explodeMergeAnchorsFixedExpected = `D0, P[], (!!map)::foo:
@@ -288,7 +288,63 @@ var badAnchorOperatorScenarios = []expressionScenario{
 	},
 }
 
+var mixedMergeTagStyleDocument = `
+constants:
+    errorResponse: &errorResponse
+        status: 200
+endpoints:
+    - condition: true
+      !!merge <<: *errorResponse
+    - condition: false
+      <<: *errorResponse
+other:
+    !!merge <<: *errorResponse
+somethingElse:
+    <<: *errorResponse
+`
+
+var mixedMergeTagStyleExplodedDocument = `
+constants:
+    errorResponse:
+        status: 200
+endpoints:
+    - condition: true
+      status: 200
+    - condition: false
+      status: 200
+other:
+    status: 200
+somethingElse:
+    status: 200
+`
+
 var anchorOperatorScenarios = []expressionScenario{
+	{
+		// mergeObjects previously skipped all !!merge-tagged nodes. Since !!merge only appears on
+		// << map keys, this meant applyAssignment was never called for the << key. It was later
+		// autocreated by createStringScalarNode("<<") with tag !!str, silently dropping !!merge.
+		// DontFollowAlias:true already prevents aliases being followed, so the skip was redundant.
+		// Old (buggy) output: "D0, P[], (!!map)::base: &base\n    x: 1\ndest:\n    <<: *base\n"
+		skipDoc:     true,
+		description: "direct *+ preserves explicit !!merge tag on << key (regression for issue 2677)",
+		document:    "base: &base\n    x: 1\ndest:\n    !!merge <<: *base\n",
+		expression:  `. as $d | {} *+ $d`,
+		expected:    []string{"D0, P[], (!!map)::base: &base\n    x: 1\ndest:\n    !!merge <<: *base\n"},
+	},
+	{
+		skipDoc:     true,
+		description: "explicit !!merge tag on << key is preserved through ireduce merge",
+		document:    mixedMergeTagStyleDocument,
+		expression:  `. as $item ireduce ({}; . *+ $item)`,
+		expected:    []string{"D0, P[], (!!map)::" + mixedMergeTagStyleDocument},
+	},
+	{
+		skipDoc:     true,
+		description: "explode expands << merge keys regardless of explicit tag style (!!merge or plain)",
+		document:    mixedMergeTagStyleDocument,
+		expression:  `explode(.)`,
+		expected:    []string{"D0, P[], (!!map)::" + mixedMergeTagStyleExplodedDocument},
+	},
 	{
 		skipDoc:     true,
 		description: "merge anchor to alias alias",

pkg/yqlib/operator_divide_test.go

@@ -45,7 +45,7 @@ var divideOperatorScenarios = []expressionScenario{
 		document:       `{a: 1, b: -1}`,
 		expression:     `.a = .a / 0 | .b = .b / 0`,
 		expected: []string{
-			"D0, P[], (!!map)::{a: !!float +Inf, b: !!float -Inf}\n",
+			"D0, P[], (!!map)::{a: +Inf, b: -Inf}\n",
 		},
 	},
 	{

pkg/yqlib/operator_load_test.go

@@ -77,7 +77,7 @@ var loadScenarios = []expressionScenario{
 		document:       `{something: {file: "thing.yml"}, over: {here: [{file: "thing.yml"}]}}`,
 		expression:     `(.. | select(has("file"))) |= load("../../examples/" + .file)`,
 		expected: []string{
-			"D0, P[], (!!map)::{something: {a: apple is included, b: cool.}, over: {here: [{a: apple is included, b: cool.}]}}\n",
+			"D0, P[], (!!map)::{something: {a: apple is included, b: cool.}, over: {here: [{a: apple is included,\n                b: cool.}]}}\n",
 		},
 	},
 	{

pkg/yqlib/operator_modulo_test.go

@@ -37,7 +37,7 @@ var moduloOperatorScenarios = []expressionScenario{
 		document:       `{a: 12, b: 2.5}`,
 		expression:     `.a = .a % .b`,
 		expected: []string{
-			"D0, P[], (!!map)::{a: !!float 2, b: 2.5}\n",
+			"D0, P[], (!!map)::{a: 2, b: 2.5}\n",
 		},
 	},
 	{
@@ -53,7 +53,7 @@ var moduloOperatorScenarios = []expressionScenario{
 		document:       `{a: 1.1, b: 0}`,
 		expression:     `.a = .a % .b`,
 		expected: []string{
-			"D0, P[], (!!map)::{a: !!float NaN, b: 0}\n",
+			"D0, P[], (!!map)::{a: NaN, b: 0}\n",
 		},
 	},
 	{
@@ -70,7 +70,7 @@ var moduloOperatorScenarios = []expressionScenario{
 		document:   "a: 2\nb: !goat 2.3",
 		expression: `.a = .a % .b`,
 		expected: []string{
-			"D0, P[], (!!map)::a: !!float 2\nb: !goat 2.3\n",
+			"D0, P[], (!!map)::a: 2\nb: !goat 2.3\n",
 		},
 	},
 	{

pkg/yqlib/operator_multiply.go

@@ -189,10 +189,6 @@ func mergeObjects(d *dataTreeNavigator, context Context, lhs *CandidateNode, rhs
 
 		log.Debugf("going to applied assignment to LHS: %v with RHS: %v", NodeToString(lhs), NodeToString(candidate))
 
-		if candidate.Tag == "!!merge" {
-			continue
-		}
-
 		err := applyAssignment(d, context, pathIndexToStartFrom, lhs, candidate, preferences)
 		if err != nil {
 			return nil, err

pkg/yqlib/operator_multiply_test.go

@@ -121,7 +121,7 @@ var multiplyOperatorScenarios = []expressionScenario{
 		document:   mergeArrayWithAnchors,
 		expression: `. * .`,
 		expected: []string{
-			"D0, P[], (!!map)::sample:\n    - &a\n    - !!merge <<: *a\n",
+			"D0, P[], (!!map)::sample:\n    - &a\n    - <<: *a\n",
 		},
 	},
 	{
@@ -514,7 +514,7 @@ var multiplyOperatorScenarios = []expressionScenario{
 		environmentVariables: map[string]string{"originalPath": ".myArray", "otherPath": ".newArray", "idPath": ".a"},
 		expression:           mergeExpression,
 		expected: []string{
-			"D0, P[], (!!map)::{myArray: [{a: apple, b: appleB2}, {a: kiwi, b: kiwiB}, {a: banana, b: bananaB, c: bananaC}, {a: dingo, c: dingoC}], something: else}\n",
+			"D0, P[], (!!map)::{myArray: [{a: apple, b: appleB2}, {a: kiwi, b: kiwiB}, {a: banana, b: bananaB, c: bananaC},\n        {a: dingo, c: dingoC}], something: else}\n",
 		},
 	},
 	{
@@ -546,7 +546,7 @@ var multiplyOperatorScenarios = []expressionScenario{
 		document:    mergeDocSample,
 		expression:  `.foobar * .foobarList`,
 		expected: []string{
-			"D0, P[foobar], (!!map)::c: foobarList_c\n!!merge <<: [*foo, *bar]\nthing: foobar_thing\nb: foobarList_b\n",
+			"D0, P[foobar], (!!map)::c: foobarList_c\n<<: [*foo, *bar]\nthing: foobar_thing\nb: foobarList_b\n",
 		},
 	},
 	{
@@ -554,7 +554,7 @@ var multiplyOperatorScenarios = []expressionScenario{
 		document:   document,
 		expression: `.b * .c`,
 		expected: []string{
-			"D0, P[b], (!!map)::{name: dog, \"<<\": *cat}\n",
+			"D0, P[b], (!!map)::{name: dog, <<: *cat}\n",
 		},
 	},
 	{
@@ -581,7 +581,7 @@ var multiplyOperatorScenarios = []expressionScenario{
 		document:    "a: 2\nb: !goat 3.5",
 		expression:  ".a = .a * .b",
 		expected: []string{
-			"D0, P[], (!!map)::a: !!float 7\nb: !goat 3.5\n",
+			"D0, P[], (!!map)::a: 7\nb: !goat 3.5\n",
 		},
 	},
 	{

pkg/yqlib/operator_recursive_descent_test.go

@@ -187,7 +187,7 @@ var recursiveDescentOperatorScenarios = []expressionScenario{
 		document:    mergeDocSample,
 		expression:  `.foobar | [..]`,
 		expected: []string{
-			"D0, P[foobar], (!!seq)::- c: foobar_c\n  !!merge <<: *foo\n  thing: foobar_thing\n- foobar_c\n- *foo\n- foobar_thing\n",
+			"D0, P[foobar], (!!seq)::- c: foobar_c\n  <<: *foo\n  thing: foobar_thing\n- foobar_c\n- *foo\n- foobar_thing\n",
 		},
 	},
 	{
@@ -195,7 +195,7 @@ var recursiveDescentOperatorScenarios = []expressionScenario{
 		document:   mergeDocSample,
 		expression: `.foobar | [...]`,
 		expected: []string{
-			"D0, P[foobar], (!!seq)::- c: foobar_c\n  !!merge <<: *foo\n  thing: foobar_thing\n- c\n- foobar_c\n- !!merge <<\n- *foo\n- thing\n- foobar_thing\n",
+			"D0, P[foobar], (!!seq)::- c: foobar_c\n  <<: *foo\n  thing: foobar_thing\n- c\n- foobar_c\n- <<\n- *foo\n- thing\n- foobar_thing\n",
 		},
 	},
 	{
@@ -203,7 +203,7 @@ var recursiveDescentOperatorScenarios = []expressionScenario{
 		document:   mergeDocSample,
 		expression: `.foobarList | ..`,
 		expected: []string{
-			"D0, P[foobarList], (!!map)::b: foobarList_b\n!!merge <<: [*foo, *bar]\nc: foobarList_c\n",
+			"D0, P[foobarList], (!!map)::b: foobarList_b\n<<: [*foo, *bar]\nc: foobarList_c\n",
 			"D0, P[foobarList b], (!!str)::foobarList_b\n",
 			"D0, P[foobarList <<], (!!seq)::[*foo, *bar]\n",
 			"D0, P[foobarList << 0], (alias)::*foo\n",
@@ -216,7 +216,7 @@ var recursiveDescentOperatorScenarios = []expressionScenario{
 		document:   mergeDocSample,
 		expression: `.foobarList | ...`,
 		expected: []string{
-			"D0, P[foobarList], (!!map)::b: foobarList_b\n!!merge <<: [*foo, *bar]\nc: foobarList_c\n",
+			"D0, P[foobarList], (!!map)::b: foobarList_b\n<<: [*foo, *bar]\nc: foobarList_c\n",
 			"D0, P[foobarList b], (!!str)::b\n",
 			"D0, P[foobarList b], (!!str)::foobarList_b\n",
 			"D0, P[foobarList <<], (!!merge)::<<\n",

pkg/yqlib/operator_select_test.go

@@ -98,7 +98,7 @@ var selectOperatorScenarios = []expressionScenario{
 		document:    `[{animal: cat, legs: {cool: true}}, {animal: fish}]`,
 		expression:  `(.[] | select(.legs.cool == true).canWalk) = true | (.[] | .alive.things) = "yes"`,
 		expected: []string{
-			"D0, P[], (!!seq)::[{animal: cat, legs: {cool: true}, canWalk: true, alive: {things: yes}}, {animal: fish, alive: {things: yes}}]\n",
+			"D0, P[], (!!seq)::[{animal: cat, legs: {cool: true}, canWalk: true, alive: {things: yes}}, {animal: fish,\n        alive: {things: yes}}]\n",
 		},
 	},
 	{

pkg/yqlib/operator_sort_keys_test.go

@@ -37,7 +37,7 @@ var sortKeysOperatorScenarios = []expressionScenario{
 		document:       `{bParent: {c: dog, array: [3,1,2]}, aParent: {z: donkey, x: [{c: yum, b: delish}, {b: ew, a: apple}]}}`,
 		expression:     `sort_keys(..)`,
 		expected: []string{
-			"D0, P[], (!!map)::{aParent: {x: [{b: delish, c: yum}, {a: apple, b: ew}], z: donkey}, bParent: {array: [3, 1, 2], c: dog}}\n",
+			"D0, P[], (!!map)::{aParent: {x: [{b: delish, c: yum}, {a: apple, b: ew}], z: donkey}, bParent: {array: [\n            3, 1, 2], c: dog}}\n",
 		},
 	},
 }

pkg/yqlib/operator_style_test.go

@@ -50,7 +50,7 @@ var styleOperatorScenarios = []expressionScenario{
 		document:   "bing: &foo {x: z}\na:\n  c: cat\n  <<: [*foo]",
 		expression: `(... | select(tag=="!!str")) style="single"`,
 		expected: []string{
-			"D0, P[], (!!map)::'bing': &foo {'x': 'z'}\n'a':\n    'c': 'cat'\n    !!merge <<: [*foo]\n",
+			"D0, P[], (!!map)::'bing': &foo {'x': 'z'}\n'a':\n    'c': 'cat'\n    <<: [*foo]\n",
 		},
 	},
 	{

pkg/yqlib/operator_traverse_path_test.go

@@ -494,7 +494,7 @@ var traversePathOperatorScenarios = []expressionScenario{
 		document:   mergeDocSample,
 		expression: `.foobar`,
 		expected: []string{
-			"D0, P[foobar], (!!map)::c: foobar_c\n!!merge <<: *foo\nthing: foobar_thing\n",
+			"D0, P[foobar], (!!map)::c: foobar_c\n<<: *foo\nthing: foobar_thing\n",
 		},
 	},
 	{
@@ -518,7 +518,7 @@ var traversePathOperatorScenarios = []expressionScenario{
 		document:   mergeDocSample,
 		expression: `.foobarList`,
 		expected: []string{
-			"D0, P[foobarList], (!!map)::b: foobarList_b\n!!merge <<: [*foo, *bar]\nc: foobarList_c\n",
+			"D0, P[foobarList], (!!map)::b: foobarList_b\n<<: [*foo, *bar]\nc: foobarList_c\n",
 		},
 	},
 	{

project-words.txt

@@ -1,306 +0,0 @@
-abxbbxdbxebxczzx
-abxbbxdbxebxczzy
-accum
-Accum
-adithyasunil
-AEDT
-água
-ÁGUA
-alecthomas
-appleapple
-Astuff
-autocreating
-autoparse
-AWST
-axbxcxdxe
-axbxcxdxexxx
-bananabanana
-barp
-nbaz
-bitnami
-blarp
-blddir
-Bobo
-BODMAS
-bonapite
-Brien
-Bstuff
-BUILDKIT
-buildpackage
-catmeow
-CATYPE
-CBVVE
-chardata
-chillum
-choco
-chomper
-cleanup
-cmlu
-colorise
-colors
-Colors
-colourize
-compinit
-coolioo
-coverprofile
-createmap
-csvd
-CSVUTF
-currentlabel
-cygpath
-czvf
-datestring
-datetime
-Datetime
-datetimes
-DEBEMAIL
-debhelper
-Debugf
-debuild
-delish
-delpaths
-DELPATHS
-devorbitus
-devscripts
-dimchansky
-Dont
-dput
-elliotchance
-endhint
-endofname
-Entriesfrom
-envsubst
-errorlevel
-Escandón
-Evalall
-fakefilename
-fakeroot
-Farah
-fatih
-Fifi
-filebytes
-Fileish
-foobar
-foobaz
-foof
-frood
-fullpath
-gitbook
-githubactions
-gnupg
-goccy
-gofmt
-gogo
-golangci
-goreleaser
-GORELEASER
-GOMODCACHE
-GOPATH
-gosec
-gota
-goversion
-GOVERSION
-haha
-hellno
-herbygillot
-hexdump
-Hoang
-hostpath
-hotdog
-howdy
-incase
-Infof
-inlinetables
-inplace
-ints
-ireduce
-iwatch
-jinzhu
-jq's
-jsond
-keygrip
-Keygrip
-KEYGRIP
-KEYID
-keyvalue
-kwak
-lalilu
-ldflags
-LDFLAGS
-lexer
-Lexer
-libdistro
-lindex
-linecomment
-LVAs
-magiconair
-mapvalues
-Mier
-mikefarah
-minideb
-minishift
-mipsle
-mitchellh
-mktemp
-Mult
-multidoc
-multimaint
-myenv
-myenvnonexisting
-myfile
-myformat
-ndjson
-NDJSON
-NFKD
-nixpkgs
-nojson
-nonascii
-nonempty
-noninteractive
-Nonquoting
-nosec
-notoml
-noxml
-nolua
-nullinput
-onea
-Oneshot
-opencollect
-opstack
-orderedmap
-osarch
-overridign
-pacman
-Padder
-pandoc
-parsechangelog
-pcsv
-pelletier
-pflag
-prechecking
-Prerelease
-proc
-propsd
-qylib
-readline
-realnames
-realpath
-repr
-rhash
-rindex
-risentveber
-rmescandon
-Rosey
-roundtrip
-roundtrips
-Roundtrip
-roundtripping
-Interp
-interp
-runningvms
-sadface
-selfupdate
-setpath
-sharedfolder
-Sharedfolder
-shellvariables
-shellvars
-shortfunc
-shortpipe
-shunit
-snapcraft
-somevalue
-splt
-srcdir
-stackoverflow
-stiched
-Strc
-strenv
-strload
-stylig
-subarray
-subchild
-subdescription
-submatch
-submatches
-SUBSTR
-tempfile
-tfstate
-Tfstate
-thar
-timezone
-Timezone
-timezones
-Timezones
-tojson
-Tokenvalue
-tsvd
-Tuan
-tzdata
-Uhoh
-updateassign
-urid
-utfbom
-Warningf
-Wazowski
-webi
-Webi
-wherever
-winget
-withdots
-wizz
-woop
-workdir
-Writable
-xmld
-xyzzy
-yamld
-yqlib
-yuin
-zabbix
-tonumber
-noyaml
-nolint
-shortfile
-Unmarshalling
-noini
-nocsv
-nobase64
-nouri
-noprops
-nosh
-noshell
-tinygo
-nonexistent
-hclsyntax
-hclwrite
-nohcl
-zclconf
-cty
-go-cty
-Colorisation
-goimports
-errorlint
-RDBMS
-expeñded
-bananabananabananabanana
-edwinjhlee
-flox
-unlabelled
-kyaml
-KYAML
-nokyaml
-buildvcs
-behaviour
-GOFLAGS
-gocache
-subsubarray
-Ffile
-Fquery
-coverpkg
-gsub
-ralia
-Austr
-ustrali
-héllo
-alia

release_instructions.txt

@@ -8,15 +8,22 @@
 - git push --tags
 - use github actions to publish docker and make github release
 - check github updated yq action in marketplace
-- update github-action/Dockerfile to pin the newly published docker image digest:
+- update github-action/Dockerfile to pin the newly published docker image digest (must match the mikefarah/yq:4 manifest digest):
-    skopeo inspect docker://docker.io/mikefarah/yq:4 | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['Digest'])"
+    docker buildx imagetools inspect docker.io/mikefarah/yq:4 --format '{{printf "%s" .Manifest.Digest}}'
   then update the FROM line in github-action/Dockerfile with the new digest:
-    FROM mikefarah/yq:4@sha256:<new-digest>
+    FROM mikefarah/yq:4@<digest-from-above>
+- commit the Dockerfile change, then manually run the "Release Docker GitHub Action" workflow
+  (Actions -> Release Docker GitHub Action -> Run workflow)
+- update action.yml to pin the newly published github-action image digest (must match the mikefarah/yq:4-githubaction manifest digest):
+    docker buildx imagetools inspect docker.io/mikefarah/yq:4-githubaction --format '{{printf "%s" .Manifest.Digest}}'
+  then update the image line in action.yml with the new digest:
+    image: 'docker://mikefarah/yq:4-githubaction@<digest-from-above>'
+- commit the action.yml change and push
 
 // release artifacts are signed with cosign keyless signing (Sigstore)
 // users can verify with:
 //   cosign verify-blob --bundle checksums.bundle checksums
-// install cosign: brew install cosign  OR  go install github.com/sigstore/cosign/v2/cmd/cosign@latest
+// install cosign: brew install cosign  OR  go install github.com/sigstore/cosign/v2/cmd/cosign@v2.6.1
 
 
 - snapcraft

scripts/devtools.sh

@@ -1,5 +1,50 @@
 #!/bin/sh
 set -ex
-go mod download golang.org/x/tools@latest
+go mod download golang.org/x/tools@v0.44.0
-curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.11.3
+curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/6008b81b81c690c046ffc3fd5bce896da715d5fd/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.11.3
-curl -sSfL https://raw.githubusercontent.com/securego/gosec/master/install.sh | sh -s v2.22.11
+curl -sSfL https://raw.githubusercontent.com/securego/gosec/424fc4cd9c82ea0fd6bee9cd49c2db2c3cc0c93f/install.sh | sh -s v2.22.11
+
+TYPOS_VERSION=v1.47.2
+TYPOS_OS=$(uname -s | tr '[:upper:]' '[:lower:]')
+TYPOS_ARCH=$(uname -m)
+case "${TYPOS_ARCH}" in
+  x86_64) TYPOS_ARCH=x86_64 ;;
+  aarch64|arm64) TYPOS_ARCH=aarch64 ;;
+  *)
+    echo "unsupported architecture for typos: ${TYPOS_ARCH}"
+    exit 1
+    ;;
+esac
+case "${TYPOS_OS}" in
+  linux) TYPOS_TARGET="${TYPOS_ARCH}-unknown-linux-musl" ;;
+  darwin) TYPOS_TARGET="${TYPOS_ARCH}-apple-darwin" ;;
+  *)
+    echo "unsupported OS for typos: ${TYPOS_OS}"
+    exit 1
+    ;;
+esac
+TYPOS_ARCHIVE="typos-${TYPOS_VERSION}-${TYPOS_TARGET}.tar.gz"
+TYPOS_URL="https://github.com/crate-ci/typos/releases/download/${TYPOS_VERSION}/${TYPOS_ARCHIVE}"
+case "${TYPOS_TARGET}" in
+  aarch64-apple-darwin) TYPOS_SHA256=23ca24a9186b5cb395b5f6c8eea8cdb02911c8980833e016454b56e90c3bd474 ;;
+  aarch64-unknown-linux-musl) TYPOS_SHA256=596d5c6b9ecf34307f68bea649178c5b45a4398fe3a1fcef9598e85aa2ccb742 ;;
+  x86_64-apple-darwin) TYPOS_SHA256=469a2d9fc894b0cdcec6e4fa3719b4c4638e195feee6517d4845450f8e8985c6 ;;
+  x86_64-unknown-linux-musl) TYPOS_SHA256=7aef58932fc123b4cf4b40d86468e89a3297d80169051d7cfd13a235e05fc426 ;;
+  *)
+    echo "unsupported typos target: ${TYPOS_TARGET}"
+    exit 1
+    ;;
+esac
+TYPOS_TMPDIR=$(mktemp -d)
+curl -sSfL "${TYPOS_URL}" -o "${TYPOS_TMPDIR}/${TYPOS_ARCHIVE}"
+TYPOS_ACTUAL_SHA256=$(sha256sum "${TYPOS_TMPDIR}/${TYPOS_ARCHIVE}" 2>/dev/null | cut -d' ' -f1)
+if [ -z "${TYPOS_ACTUAL_SHA256}" ]; then
+  TYPOS_ACTUAL_SHA256=$(shasum -a 256 "${TYPOS_TMPDIR}/${TYPOS_ARCHIVE}" | cut -d' ' -f1)
+fi
+if [ "${TYPOS_ACTUAL_SHA256}" != "${TYPOS_SHA256}" ]; then
+  echo "typos archive checksum mismatch: expected ${TYPOS_SHA256}, got ${TYPOS_ACTUAL_SHA256}"
+  exit 1
+fi
+tar xzf "${TYPOS_TMPDIR}/${TYPOS_ARCHIVE}" -C "${TYPOS_TMPDIR}"
+install -m 755 "${TYPOS_TMPDIR}/typos" "$(go env GOPATH)/bin/typos"
+rm -rf "${TYPOS_TMPDIR}"

scripts/spelling.sh

@@ -1,3 +1,18 @@
 #!/bin/bash
 
-npx cspell --no-progress "**/*.{sh,go,md}"
+set -euo pipefail
+
+GOPATH_TYPOS="$(go env GOPATH)/bin/typos"
+TYPOS_CMD=""
+
+if [ -f "${GOPATH_TYPOS}" ]; then
+  TYPOS_CMD="${GOPATH_TYPOS}"
+elif command -v typos >/dev/null 2>&1; then
+  TYPOS_CMD="typos"
+else
+  echo "Error: typos not found in $(go env GOPATH)/bin or PATH."
+  echo "Please run scripts/devtools.sh or ensure typos is installed correctly."
+  exit 1
+fi
+
+git ls-files '*.go' '*.sh' '*.md' | "${TYPOS_CMD}" --file-list -

scripts/test.sh

@@ -1,3 +1,7 @@
 #!/bin/bash
 
 go test $(go list ./... | grep -v -E 'examples' | grep -v -E 'test')
+
+# Run after the main test suite: TestGoInstallCompatibility zips the module tree and
+# must not run in parallel with pkg/yqlib tests that rewrite doc/*.md files.
+go test -tags goinstall -run TestGoInstallCompatibility .

scripts/xcompile.sh

@@ -2,7 +2,7 @@
 
 set -eo pipefail
 
-# You may need to go install github.com/goreleaser/goreleaser/v2@latest first
+# You may need to go install github.com/goreleaser/goreleaser/v2@v2.16.0 first
 GORELEASER="goreleaser build --clean"
 if [ -z "$CI" ] || [[ "${GITHUB_REF_NAME:-}" == draft-* ]]; then
   GORELEASER+=" --snapshot"