Skip to content

Conversation

@scop
Copy link
Contributor

@scop scop commented Dec 28, 2025

What kind of change does this PR introduce?

Dependency health improvement.

What is the current behavior?

Use of unmaintained gopkg.in/yaml.vX dependencies.

What is the new behavior (if this is a feature change)?**

Use of maintained go.yaml.in/yaml/vX dependencies.

  • Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

NONE

Special notes for your reviewer

https://github.com/yaml/go-yaml#project-status

While at it, upgrade from 2.4.0 to 2.4.2 and 3.0.1 to 3.0.4, these were already indirectly used.

2.4.0 are identical, 2.4.0...2.4.1 diff: https://gist.github.com/scop/57f94f2bf97fb6a2d01349fa59d88530

3.0.1 are identical, 3.0.1..3.0.2 diff: https://gist.github.com/scop/57f94f2bf97fb6a2d01349fa59d88530

Remaining diffs as usual at https://github.com/yaml/go-yaml/tags

Does this PR introduce a user-facing change?

For user-facing changes, please add a concise, human-readable release note to
the release-note

(In particular, describe what changes users might need to make in their
application as a result of this pull request.)

NONE

@scop scop requested a review from a team as a code owner December 28, 2025 23:03
@scop scop requested review from raghavkaul and spencerschrock and removed request for a team December 28, 2025 23:03
@dosubot dosubot bot added the size:S This PR changes 10-29 lines, ignoring generated files. label Dec 28, 2025
@scop scop temporarily deployed to integration-test December 28, 2025 23:03 — with GitHub Actions Inactive
@codecov
Copy link

codecov bot commented Dec 28, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.70%. Comparing base (353ed60) to head (e9e5951).
⚠️ Report is 299 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4895      +/-   ##
==========================================
+ Coverage   66.80%   69.70%   +2.89%     
==========================================
  Files         230      251      +21     
  Lines       16602    15649     -953     
==========================================
- Hits        11091    10908     -183     
+ Misses       4808     3867     -941     
- Partials      703      874     +171     
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@AdamKorcz
Copy link
Contributor

Could you sign the DCO?

The latter is a maintained fork of the former.
https://github.com/yaml/go-yaml#project-status

While at it, upgrade from 2.4.0 to 2.4.2 and 3.0.1 to 3.0.4, these were
already indirectly used.

2.4.0 are identical, 2.4.0...2.4.1 diff:
https://gist.github.com/scop/57f94f2bf97fb6a2d01349fa59d88530

3.0.1 are identical, 3.0.1..3.0.2 diff:
https://gist.github.com/scop/57f94f2bf97fb6a2d01349fa59d88530

Signed-off-by: Ville Skyttä <ville.skytta@iki.fi>
@scop
Copy link
Contributor Author

scop commented Jan 7, 2026

Oops, sorry, done.

Copy link
Member

@spencerschrock spencerschrock left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks. We should probably merge all of our yaml usage to the same version at some point. Whether that's v3 or v4.

@spencerschrock spencerschrock merged commit 626ef36 into ossf:main Jan 8, 2026
37 checks passed
@scop scop deleted the chore/go.yaml.in branch January 8, 2026 18:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size:S This PR changes 10-29 lines, ignoring generated files.

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

3 participants