Replace github.com/ghodss/yaml w/ sigs.k8s.io/yaml (#366)

michael-burt · web-flow · commit 44cff9b3c304 · 2025-11-04T20:17:42.000-07:00
Replace unmaintained yaml libs:

github.com/ghodss/yaml → sigs.k8s.io/yaml
gopkg.in/yaml.v3 → go.yaml.in/yaml/v3
diff --git a/cmd/gen-qbec-swagger/main.go b/cmd/gen-qbec-swagger/main.go
@@ -22,7 +22,7 @@ import (
 	"os"
 	"time"
 
-	"github.com/ghodss/yaml"
+	"sigs.k8s.io/yaml"
 )
 
 func main() {
diff --git a/go.mod b/go.mod
@@ -5,7 +5,6 @@ go 1.24.6
 require (
 	github.com/bmatcuk/doublestar/v4 v4.9.1
 	github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e
-	github.com/ghodss/yaml v1.0.0
 	github.com/go-openapi/spec v0.22.0
 	github.com/go-openapi/strfmt v0.24.0
 	github.com/go-openapi/validate v0.25.0
@@ -20,15 +19,16 @@ require (
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
 	github.com/tidwall/pretty v1.2.1
+	go.yaml.in/yaml/v3 v3.0.4
 	google.golang.org/protobuf v1.36.10
-	gopkg.in/yaml.v3 v3.0.1
 	k8s.io/api v0.34.1
 	k8s.io/apimachinery v0.34.1
 	k8s.io/cli-runtime v0.34.1
 	k8s.io/client-go v0.34.1
 	k8s.io/gengo v0.0.0-20250922181213-ec3ebc5fd46b
 	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912
 	k8s.io/kubectl v0.34.1
+	sigs.k8s.io/yaml v1.6.0
 )
 
 require (
@@ -86,7 +86,6 @@ require (
 	github.com/xlab/treeprint v1.2.0 // indirect
 	go.mongodb.org/mongo-driver v1.17.4 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/crypto v0.42.0 // indirect
 	golang.org/x/net v0.44.0 // indirect
 	golang.org/x/oauth2 v0.27.0 // indirect
@@ -97,7 +96,7 @@ require (
 	golang.org/x/time v0.9.0 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/component-base v0.34.1 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
@@ -106,5 +105,4 @@ require (
 	sigs.k8s.io/kustomize/kyaml v0.20.1 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
-	sigs.k8s.io/yaml v1.6.0 // indirect
 )
diff --git a/go.sum b/go.sum
@@ -31,8 +31,6 @@ github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f h1:Wl78ApPPB2
 github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f/go.mod h1:OSYXu++VVOHnXeitef/D8n/6y4QV8uLHSFXX4NeXMGc=
 github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
 github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
-github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
 github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
 github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
@@ -250,8 +248,6 @@ gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWM
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/internal/commands/common.go b/internal/commands/common.go
@@ -23,7 +23,6 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/ghodss/yaml"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 	"github.com/splunk/qbec/internal/cmd"
@@ -32,6 +31,7 @@ import (
 	"github.com/splunk/qbec/internal/remote"
 	"github.com/splunk/qbec/internal/sio"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/yaml"
 )
 
 // ctxProvider provides standard configuration available to all commands
diff --git a/internal/commands/common_test.go b/internal/commands/common_test.go
@@ -21,11 +21,11 @@ import (
 	"sync"
 	"testing"
 
-	"github.com/ghodss/yaml"
 	"github.com/pkg/errors"
 	"github.com/splunk/qbec/internal/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"sigs.k8s.io/yaml"
 )
 
 func TestRunInParallelNoObjects(t *testing.T) {
diff --git a/internal/commands/component.go b/internal/commands/component.go
@@ -22,11 +22,11 @@ import (
 	"io"
 	"strings"
 
-	"github.com/ghodss/yaml"
 	"github.com/spf13/cobra"
 	"github.com/splunk/qbec/internal/cmd"
 	"github.com/splunk/qbec/internal/diff"
 	"github.com/splunk/qbec/internal/model"
+	"sigs.k8s.io/yaml"
 )
 
 func newComponentCommand(cp ctxProvider) *cobra.Command {
diff --git a/internal/commands/diff.go b/internal/commands/diff.go
@@ -21,7 +21,6 @@ import (
 	"sort"
 	"sync"
 
-	"github.com/ghodss/yaml"
 	"github.com/spf13/cobra"
 	"github.com/splunk/qbec/internal/cmd"
 	"github.com/splunk/qbec/internal/diff"
@@ -31,6 +30,7 @@ import (
 	"github.com/splunk/qbec/internal/sio"
 	"github.com/splunk/qbec/internal/types"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"sigs.k8s.io/yaml"
 )
 
 type diffIgnores struct {
diff --git a/internal/commands/env.go b/internal/commands/env.go
@@ -20,9 +20,9 @@ import (
 	"sort"
 	"strings"
 
-	"github.com/ghodss/yaml"
 	"github.com/spf13/cobra"
 	"github.com/splunk/qbec/internal/cmd"
+	"sigs.k8s.io/yaml"
 )
 
 func newEnvCommand(cp ctxProvider) *cobra.Command {
diff --git a/internal/commands/fmtutil.go b/internal/commands/fmtutil.go
@@ -28,7 +28,7 @@ import (
 
 	"github.com/google/go-jsonnet/formatter"
 	"github.com/tidwall/pretty"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 func format(in []byte, filename string) ([]byte, error) {
diff --git a/internal/commands/init.go b/internal/commands/init.go
@@ -22,12 +22,12 @@ import (
 	"os"
 	"path/filepath"
 
-	"github.com/ghodss/yaml"
 	"github.com/spf13/cobra"
 	"github.com/splunk/qbec/internal/cmd"
 	"github.com/splunk/qbec/internal/model"
 	"github.com/splunk/qbec/internal/remote"
 	"github.com/splunk/qbec/internal/sio"
+	"sigs.k8s.io/yaml"
 )
 
 type initCommandConfig struct {
diff --git a/internal/commands/param.go b/internal/commands/param.go
@@ -21,13 +21,13 @@ import (
 	"io"
 	"sort"
 
-	"github.com/ghodss/yaml"
 	"github.com/spf13/cobra"
 	"github.com/splunk/qbec/internal/cmd"
 	"github.com/splunk/qbec/internal/diff"
 	"github.com/splunk/qbec/internal/eval"
 	"github.com/splunk/qbec/internal/model"
 	"github.com/splunk/qbec/internal/sio"
+	"sigs.k8s.io/yaml"
 )
 
 var maxDisplayValueLength = 1024
diff --git a/internal/commands/show.go b/internal/commands/show.go
@@ -21,14 +21,14 @@ import (
 	"io"
 	"strings"
 
-	"github.com/ghodss/yaml"
 	"github.com/spf13/cobra"
 	"github.com/splunk/qbec/internal/cmd"
 	"github.com/splunk/qbec/internal/model"
 	"github.com/splunk/qbec/internal/objsort"
 	"github.com/splunk/qbec/internal/sio"
 	"github.com/splunk/qbec/internal/types"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"sigs.k8s.io/yaml"
 )
 
 type metaOnly struct {
diff --git a/internal/commands/utils_test.go b/internal/commands/utils_test.go
@@ -28,7 +28,6 @@ import (
 	"strings"
 	"testing"
 
-	yamllib "github.com/ghodss/yaml"
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 	"github.com/splunk/qbec/internal/cmd"
@@ -41,6 +40,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/util/yaml"
 	"k8s.io/client-go/dynamic"
+	yamllib "sigs.k8s.io/yaml"
 )
 
 type objectKey struct {
diff --git a/internal/diff/diff.go b/internal/diff/diff.go
@@ -18,9 +18,9 @@ package diff
 import (
 	"strings"
 
-	"github.com/ghodss/yaml"
 	"github.com/pkg/errors"
 	godiff "github.com/pmezard/go-difflib/difflib"
+	"sigs.k8s.io/yaml"
 )
 
 const (
diff --git a/internal/model/app.go b/internal/model/app.go
@@ -26,10 +26,10 @@ import (
 	"strings"
 	"time"
 
-	"github.com/ghodss/yaml"
 	"github.com/pkg/errors"
 	"github.com/splunk/qbec/internal/filematcher"
 	"github.com/splunk/qbec/internal/sio"
+	"sigs.k8s.io/yaml"
 )
 
 // Baseline is a special environment name that represents the baseline environment with no customizations.
diff --git a/internal/model/app_test.go b/internal/model/app_test.go
@@ -29,11 +29,11 @@ import (
 	"text/template"
 	"time"
 
-	"github.com/ghodss/yaml"
 	"github.com/splunk/qbec/internal/sio"
 	"github.com/splunk/qbec/internal/testutil"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"sigs.k8s.io/yaml"
 )
 
 func setPwd(t *testing.T, dir string) func() {
diff --git a/internal/model/k8s_test.go b/internal/model/k8s_test.go
@@ -19,9 +19,9 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/ghodss/yaml"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"sigs.k8s.io/yaml"
 )
 
 var cm = `
diff --git a/internal/model/validator.go b/internal/model/validator.go
@@ -19,11 +19,11 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/ghodss/yaml"
 	"github.com/go-openapi/spec"
 	"github.com/go-openapi/strfmt"
 	"github.com/go-openapi/validate"
 	"github.com/pkg/errors"
+	"sigs.k8s.io/yaml"
 )
 
 // LatestAPIVersion is the latest version of the API we support.
diff --git a/internal/remote/client.go b/internal/remote/client.go
@@ -21,7 +21,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/ghodss/yaml"
 	"github.com/jonboulle/clockwork"
 	"github.com/pkg/errors"
 	"github.com/splunk/qbec/internal/model"
@@ -35,6 +34,7 @@ import (
 	apiTypes "k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/discovery"
 	"k8s.io/client-go/dynamic"
+	"sigs.k8s.io/yaml"
 )
 
 const (
diff --git a/internal/remote/pristine_test.go b/internal/remote/pristine_test.go
@@ -20,11 +20,11 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/ghodss/yaml"
 	"github.com/splunk/qbec/internal/model"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"sigs.k8s.io/yaml"
 )
 
 func TestZipRoundTrip(t *testing.T) {
diff --git a/internal/types/secrets_test.go b/internal/types/secrets_test.go
@@ -19,9 +19,9 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/ghodss/yaml"
 	"github.com/splunk/qbec/internal/model"
 	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/yaml"
 )
 
 var cm = `
diff --git a/vm/internal/natives/helm.go b/vm/internal/natives/helm.go
@@ -22,8 +22,8 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/ghodss/yaml"
 	"github.com/pkg/errors"
+	"sigs.k8s.io/yaml"
 )
 
 // helmOptions are options that can be passed to the helm template command as well
diff --git a/vm/internal/natives/yaml.go b/vm/internal/natives/yaml.go
@@ -17,7 +17,7 @@ package natives
 import (
 	"io"
 
-	v3yaml "gopkg.in/yaml.v3"
+	v3yaml "go.yaml.in/yaml/v3"
 	"k8s.io/apimachinery/pkg/util/yaml"
 )
 

Original file line number	Diff line number	Diff line change
`@@ -22,7 +22,7 @@ import (`
`22`	`22`	`"os"`
`23`	`23`	`"time"`
`24`	`24`
`25`		`- "github.com/ghodss/yaml"`
	`25`	`+ "sigs.k8s.io/yaml"`
`26`	`26`	`)`
`27`	`27`
`28`	`28`	`func main() {`
Original file line number	Diff line number	Diff line change
`@@ -20,9 +20,9 @@ import (`
`20`	`20`	`"sort"`
`21`	`21`	`"strings"`
`22`	`22`
`23`		`- "github.com/ghodss/yaml"`
`24`	`23`	`"github.com/spf13/cobra"`
`25`	`24`	`"github.com/splunk/qbec/internal/cmd"`
	`25`	`+ "sigs.k8s.io/yaml"`
`26`	`26`	`)`
`27`	`27`
`28`	`28`	`func newEnvCommand(cp ctxProvider) *cobra.Command {`
Original file line number	Diff line number	Diff line change
`@@ -28,7 +28,7 @@ import (`
`28`	`28`
`29`	`29`	`"github.com/google/go-jsonnet/formatter"`
`30`	`30`	`"github.com/tidwall/pretty"`
`31`		`- "gopkg.in/yaml.v3"`
	`31`	`+ "go.yaml.in/yaml/v3"`
`32`	`32`	`)`
`33`	`33`
`34`	`34`	`func format(in []byte, filename string) ([]byte, error) {`