change yaml library to go.yaml.in/yaml/v3 - #1772
Conversation
|
There is work in progress about the license of that project: yaml/go-yaml#6 So we should block until that is stabilized. |
License of go-yaml has changed to Apache now. This PR can move forward |
|
The change are only on main branch for now. go-yaml has only released -rc for now for the v4. It might be a bit early |
dolmen
added
YAML
|
I'd like to see this PR merged, with the v3 tag it now has, while the YAML organization works on v4. That move would make it easier to get buy-in for using Testify at organizations that balk at running abandonware. The main branch's README received a July 30 update that makes it clear that v3 will receive security updates. |
|
I think this is good to be merged, so instantly all indirect dependencies to the archive repo would disappear. |
* fixes go-openapi#127 The direct dependencies to this archived repo have been replaced by the active fork imported from go.yaml.in/yaml/v3. NOTE: an indirect dependency remains from stretchr/testify. There is an open PR there to solve this stretchr/testify#1772. There is not much I can do here to remove this indirect test dependency. Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
* fixes #127 The direct dependencies to this archived repo have been replaced by the active fork imported from go.yaml.in/yaml/v3. NOTE: an indirect dependency remains from stretchr/testify. There is an open PR there to solve this stretchr/testify#1772. There is not much I can do here to remove this indirect test dependency. Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
|
The majority of testify users would need to wait until we make a release to benefit from this. Recently we've been on a (very) approximate 6-monthly release cadence, that's not to say we couldn't release earlier than expected to mitigate this and another EOL dependency. My point is that there isn't a pressing need to rush this. We really do want to merge this, but v4 is in release candidate so I don't think it will be all that long now. |
|
Happy New Year! Would be nice to see this merged- it's our only remaining dependency on the old library... |
This was not completly finished in the last one. It is a problem of testify, but they are working on it (see stretchr/testify#1772). This hopefully fixes that
This was not completely finished in the last one. It is a problem of testify, but they are working on it (see stretchr/testify#1772). This hopefully fixes that --------- Co-authored-by: Nico Haas <nico.haas@aisec.fraunhofer.de>
|
I have now merged #1823 (upgrade objx to v0.5.3). @boekkooi-impossiblecloud Please rebase. |
The [go-yaml](https://github.com/go-yaml/yaml/) project was archived on Apr 1, 2025 and is no longer maintained. Luckily the official YAML organization forked the project and is maintaining it under https://github.com/yaml/go-yaml/tree/v3.
739dbe6 to
0358d0e
Compare
|
@dolmen Thanks you, The PR is rebased. Have a great evening. |
|
Could we merge this ? |
|
In Our main dependency introducing it is |
|
@dolmen Are there any further changes blocking this from being merged? |
|
@dolmen Anything we can help with? I believe changes are now made but the review is still not dismissed. Thanks! |
| require ( | ||
| github.com/stretchr/objx v0.5.3 | ||
| gopkg.in/yaml.v3 v3.0.1 | ||
| go.yaml.in/yaml/v3 v3.0.4 |
There was a problem hiding this comment.
Might be worth updating to v3.0.5, which now has zero dependencies;
yaml/go-yaml@v3.0.4...v3.0.5
Also curious; the new location is the same code as the old module; I saw mention of licensing issues, but if I see correctly that was for automated scanners that couldn't parse the license text (but already the case for the old module). If that's the remaining blocker, I'm also happy to open a backport in upstream to get the license changes in the v2 and v3 branches. (I'm trying to reduce our dependency tree, and most repositories migrated, but testify still causes the old module name to be included). |
|
Let's get this moving, with reference to @dolmen's plan I've drafted the v1.12.0 release, it contains only one change that warrants a minor version bump. I'll give some appropriate amount of time for the other maintainers to give input before I release it, then merge this and release as 1.12.1 (or 1.13.0 if an actual change happens). I'd prefer not to do so; but I can dismiss @dolmen's review here if we need to. I'm confident that his concerns are resolved. |
|
Thanks @brackendawson. @dolmen's plan and your approach both sound good to me. |
|
The plan sounds valid. As I'm maintainer of yaml/go-yaml and testify I stayed silent here as I'm partial. I'm happy to see the integration of yaml/go-yaml in testify is progressing. Especially now we (go-yaml) provided a v3.0.5 that is now dependency free |
|
If we want to upgrade to 3.0.5 in this or another PR I’m quite willing.. |
I opened #1935 to upgrade to 3.0.5. It's one additional commit on top of this branch, to include original @boekkooi-impossiblecloud's attribution. |
Thanks! We need to be aware that doing this effectively bypasses reviews on this PR, though. |
I am confident that dolmen's concerns have been fully resolved.
|
Thank you @boekkooi-impossiblecloud and @harryzcy, this will be included in a v1.12.1 release soon. |
|
Thanks @brackendawson, @dolmen for the reviewing and maintaining testify! Have a great day y'all! |
16 participants
Summary
The go-yaml project was archived on Apr 1, 2025 and is no longer maintained. Luckily the official YAML organization forked the project and is maintaining it under https://github.com/yaml/go-yaml/tree/v3.
Changes
Replaced all occurrences of
gopkg.in/yaml.v3withgo.yaml.in/yaml/v3Motivation
go-yaml was archived on Apr 1.
Related issues