chore: Move to maintained yaml library #4227

mrueg · 2025-11-08T00:07:18Z

What this PR does / why we need it:
gopkg.in/yaml is unmaintained, this moves the dependency to a maintained yaml library https://github.com/yaml/go-yaml which is also used by https://github.com/kubernetes-sigs/yaml?tab=readme-ov-file#compatibility (which is used in gatekeeper as well)

Which issue(s) this PR fixes (optional, using fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when the PR gets merged):
Fixes #

Special notes for your reviewer:

Copilot

Pull Request Overview

This PR removes the gopkg.in/yaml.v2 dependency from the vendored dependencies. The change completely removes all yaml.v2 source files and updates the vendor modules list accordingly.

Key Changes

Removed yaml.v2 entry from vendor/modules.txt
Deleted all yaml.v2 source files from vendor/gopkg.in/yaml.v2/ directory
Removed yaml.v2 README documentation

Reviewed Changes

Copilot reviewed 7 out of 26 changed files in this pull request and generated no comments.

File	Description
vendor/modules.txt	Removed yaml.v2 v2.4.0 dependency declaration
vendor/gopkg.in/yaml.v2/*.go	Deleted all yaml.v2 Go source files including core functionality
vendor/gopkg.in/yaml.v2/README.md	Removed yaml.v2 package documentation

codecov-commenter · 2025-11-08T00:20:44Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 41.05%. Comparing base (3350319) to head (db7e875).
⚠️ Report is 551 commits behind head on master.

❗ There is a different number of reports uploaded between BASE (3350319) and HEAD (db7e875). Click for more details.

HEAD has 1 upload less than BASE

Flag BASE (3350319) HEAD (db7e875)

unittests 2 1

Additional details and impacted files

@@             Coverage Diff             @@
##           master    #4227       +/-   ##
===========================================
- Coverage   54.49%   41.05%   -13.45%     
===========================================
  Files         134      252      +118     
  Lines       12329    17796     +5467     
===========================================
+ Hits         6719     7306      +587     
- Misses       5116     9847     +4731     
- Partials      494      643      +149

Flag	Coverage Δ
unittests	`41.05% <ø> (-13.45%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

JaydipGabani

@mrueg Thanks for the PR!

JaydipGabani · 2025-11-10T15:14:51Z

cmd/build/helmify/main.go

 	"strings"

-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"


@mrueg should we just move to v4? are there breaking changes from v3 - v4?

I wanted to keep the change set minimal. v4 hasn't had an official release. latest is https://github.com/yaml/go-yaml/releases/tag/v4.0.0-rc.3

Makes sense.

JaydipGabani

lgtm. @sozercan ptal

JaydipGabani · 2025-11-12T20:16:39Z

cmd/build/helmify/main.go

 	"strings"

-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"


Makes sense.

JaydipGabani · 2025-11-22T00:55:07Z

@mrueg can you resolve conflict?

mrueg · 2025-11-28T21:59:36Z

@mrueg can you resolve conflict?

Rebased.

sozercan · 2025-12-02T00:28:15Z

do we need to vendor this? lgtm otherwise, thanks!

sozercan · 2025-12-02T00:28:58Z

cmd/gator/expand/expand.go

 	"github.com/open-policy-agent/gatekeeper/v3/pkg/gator/reader"
 	"github.com/spf13/cobra"
-	"gopkg.in/yaml.v2" // yaml.v3 inserts a space before '-', which is inconsistent with standard, kubernetes and kubebuilder format. yaml.v2 does not insert these spaces.
+	"go.yaml.in/yaml/v2" // yaml.v3 inserts a space before '-', which is inconsistent with standard, kubernetes and kubebuilder format. yaml.v2 does not insert these spaces.


can we get rid of this comment now?

@mrueg can you address this.

@mrueg ping on this.

Removed the comment.

JaydipGabani · 2025-12-09T23:34:12Z

@mrueg plesae fix the conflicts.

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 7 comments.

go.mod

pkg/gator/yaml.go

pkg/gator/verify/read_suites.go

pkg/expansion/fixtures/load.go

cmd/gator/test/test.go

cmd/gator/expand/expand.go

cmd/build/helmify/main.go

JaydipGabani · 2025-12-11T21:57:19Z

@mrueg can you address the feedback above?

mrueg · 2025-12-11T22:09:52Z

@JaydipGabani which one? The one from CoPilot seems to be wrong, as it effectively reverts this change.

JaydipGabani · 2025-12-11T22:54:51Z

Ohh nvm, I thought the earlier feedback was not addressed, we can dismiss copilot one. My appologies.

Signed-off-by: Manuel Rüger <[email protected]>

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Copilot · 2026-01-05T00:07:07Z

pkg/gator/yaml.go

 	"encoding/json"

-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"


The import path "go.yaml.in/yaml/v3" appears to be incorrect. The standard maintained YAML library for Go uses the import path "gopkg.in/yaml.v3" (note the period before v3, not a slash). The repository at https://github.com/go-yaml/yaml documents that the correct import paths are:

gopkg.in/yaml.v3 for v3

gopkg.in/yaml.v2 for v2

Please verify that "go.yaml.in/yaml/v3" is a valid and maintained module. If the intention is to use the standard go-yaml library, the import should be "gopkg.in/yaml.v3" instead.

Suggested change

"go.yaml.in/yaml/v3"

"gopkg.in/yaml.v3"

Signed-off-by: Manuel Rüger <[email protected]> Co-authored-by: Jaydip Gabani <[email protected]> Signed-off-by: Oliver Karstoft <[email protected]>

Copilot AI review requested due to automatic review settings November 8, 2025 00:07

mrueg requested a review from a team as a code owner November 8, 2025 00:07

mrueg force-pushed the go.yaml.in branch from 826b73c to afe5979 Compare November 8, 2025 00:07

Copilot AI reviewed Nov 8, 2025

View reviewed changes

JaydipGabani reviewed Nov 10, 2025

View reviewed changes

JaydipGabani approved these changes Nov 12, 2025

View reviewed changes

cmd/build/helmify/main.go

"strings"

"gopkg.in/yaml.v3"

"go.yaml.in/yaml/v3"

Copy link

Contributor

JaydipGabani Nov 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense.

mrueg force-pushed the go.yaml.in branch from afe5979 to a2901fc Compare November 28, 2025 21:59

sozercan reviewed Dec 2, 2025

View reviewed changes

mrueg force-pushed the go.yaml.in branch from a2901fc to 5a956fe Compare December 10, 2025 21:05

Copilot AI review requested due to automatic review settings December 10, 2025 21:05

Copilot started reviewing on behalf of mrueg December 10, 2025 21:06 View session

Copilot AI reviewed Dec 10, 2025

View reviewed changes

chore: Move to maintained yaml library

bbbedd6

Signed-off-by: Manuel Rüger <[email protected]>

Copilot AI review requested due to automatic review settings January 4, 2026 23:57

mrueg force-pushed the go.yaml.in branch from 33f702f to bbbedd6 Compare January 4, 2026 23:57

Copilot started reviewing on behalf of mrueg January 4, 2026 23:57 View session

Copilot AI reviewed Jan 5, 2026

View reviewed changes

Merge branch 'master' into go.yaml.in

db7e875

JaydipGabani merged commit c4715a2 into open-policy-agent:master Jan 6, 2026
19 checks passed

mrueg mentioned this pull request Jan 6, 2026

chore: Switch to maintained yaml library open-policy-agent/opa#8182

Merged

chore: Move to maintained yaml library #4227

chore: Move to maintained yaml library #4227

Uh oh!

Conversation

mrueg commented Nov 8, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Key Changes

Reviewed Changes

Uh oh!

codecov-commenter commented Nov 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

JaydipGabani left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

JaydipGabani left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

JaydipGabani commented Nov 22, 2025

Uh oh!

mrueg commented Nov 28, 2025

Uh oh!

sozercan commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

JaydipGabani commented Dec 9, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JaydipGabani commented Dec 11, 2025

Uh oh!

mrueg commented Dec 11, 2025

Uh oh!

JaydipGabani commented Dec 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

codecov-commenter commented Nov 8, 2025 •

edited

Loading

sozercan commented Dec 2, 2025 •

edited

Loading

JaydipGabani commented Dec 11, 2025 •

edited

Loading