Repository navigation
chore(deps): bump sigs.k8s.io/yaml from 1.4.0 to 1.6.0 - #6240
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [sigs.k8s.io/yaml](https://github.com/kubernetes-sigs/yaml) from 1.4.0 to 1.6.0. - [Release notes](https://github.com/kubernetes-sigs/yaml/releases) - [Changelog](https://github.com/kubernetes-sigs/yaml/blob/master/RELEASE.md) - [Commits](kubernetes-sigs/yaml@v1.4.0...v1.6.0) --- updated-dependencies: - dependency-name: sigs.k8s.io/yaml dependency-version: 1.6.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues remain for the YAML dependency update and vendor refresh.
No open issues 🎉
What changed in this PR
Updates Fluid’s YAML dependency from sigs.k8s.io/yaml 1.4.0 to 1.6.0 and refreshes the vendored implementation.
Changes:
- Updates module versions, checksums, and vendor metadata.
- Switches the YAML backend to
go.yaml.in/yaml/v2v2.4.4. - Incorporates upstream error wrapping and consolidates
DisallowUnknownFieldsintoyaml.go.
| File | Description |
|---|---|
vendor/sigs.k8s.io/yaml/yaml.go |
Switches backend, wraps decoding errors, and consolidates decoder options. |
vendor/sigs.k8s.io/yaml/yaml_go110.go |
Removes the separate Go-version-specific implementation. |
vendor/sigs.k8s.io/yaml/goyaml.v2/OWNERS |
Removes obsolete fork ownership metadata. |
vendor/sigs.k8s.io/yaml/.travis.yml |
Removes upstream legacy CI configuration. |
vendor/modules.txt |
Records updated YAML modules and package paths. |
vendor/go.yaml.in/yaml/v2/yamlprivateh.go |
Vendors internal character and buffer helpers. |
vendor/go.yaml.in/yaml/v2/yamlh.go |
Vendors parser and emitter types and constants. |
vendor/go.yaml.in/yaml/v2/yaml.go |
Updates the upstream repository URL in a comment. |
vendor/go.yaml.in/yaml/v2/writerc.go |
Vendors output-buffer handling. |
vendor/go.yaml.in/yaml/v2/sorter.go |
Vendors mapping-key sorting. |
vendor/go.yaml.in/yaml/v2/resolve.go |
Vendors scalar type resolution. |
vendor/go.yaml.in/yaml/v2/README.md |
Updates package documentation and import examples. |
vendor/go.yaml.in/yaml/v2/readerc.go |
Vendors input decoding and buffering. |
vendor/go.yaml.in/yaml/v2/parserc.go |
Vendors YAML event parsing. |
vendor/go.yaml.in/yaml/v2/NOTICE |
Includes upstream attribution. |
vendor/go.yaml.in/yaml/v2/LICENSE.libyaml |
Includes licensing for libyaml-derived files. |
vendor/go.yaml.in/yaml/v2/LICENSE |
Includes the dependency’s Apache license. |
vendor/go.yaml.in/yaml/v2/encode.go |
Vendors Go-value encoding. |
vendor/go.yaml.in/yaml/v2/emitterc.go |
Vendors YAML output generation. |
vendor/go.yaml.in/yaml/v2/decode.go |
Vendors decoding into Go values. |
vendor/go.yaml.in/yaml/v2/apic.go |
Vendors parser and emitter lifecycle helpers. |
vendor/go.yaml.in/yaml/v2/.travis.yml |
Includes upstream legacy CI configuration. |
go.sum |
Updates checksums for sigs.k8s.io/yaml. |
go.mod |
Bumps the YAML dependency and adds its indirect v2 backend. |
Review effort: Balanced
cheyang
left a comment
cheyang
left a comment
There was a problem hiding this comment.
Both reviewers independently verified this bump is behavior-preserving rather than assuming it, and converged with no disputes. The vendored YAML v2 engine is byte-identical between 1.4.0's embedded goyaml.v2 and the new go.yaml.in/yaml/v2 v2.4.4 (one doc-comment URL excepted); a differential contract harness (marshal goldens, scalar typing, merge keys, error text) and a 16-case behavior matrix across fluid's actual usage shapes pass identically on base ff99142 and head 300d8cc; an envtest round-trip of Dataset/AlluxioRuntime YAML through a real API server is unchanged; and go build / go mod verify / go mod tidy are clean. The single runtime delta is jsonUnmarshal now wrapping errors with %w instead of %v: error strings are unchanged, and errors.Is/As now reach the stdlib json error — an additive improvement (sigs.k8s.io/yaml#106).
No blocking findings. Worth knowing (folded below, none of it gates merge): the binary links the yaml.v2 parser lineage twice, with the second copy now a maintained fork that can drift — inherent to upstream's fork migration and not removable by this PR; a maintainer question on eventually migrating the 6 remaining gopkg.in/yaml.v2 call sites (go.yaml.in/yaml/v2 is the drop-in, not sigs); and a suggestion to keep the yaml contract tests in-repo so future bumps don't need a manual deep-dive. Reviewer agreement: no disputes — every finding was independently confirmed in cross-critique; Copilot (advisory Reviewer C) reviewed the same head and raised no findings.
Next round
[MUST] (none — nothing gates merge; all acceptance criteria passed and required CI is green on 300d8cc, re-check if rebased)
[SHOULD] Post-merge, maintainer discretion: migrate the 6 gopkg.in/yaml.v2 call sites to go.yaml.in/yaml/v2 (Q1); uplift the yaml contract pin tests into the repo (F2)
[Filed] (none — no tracking issues opened during this round)
Non-blocking observations (3) — not part of this round's ask; fix now, follow up, or file an issue as you see fit
- vendor/modules.txt:286 [minor] — Two yaml.v2 parser implementations ship in the binary; the second copy is now a maintained fork that can drift
The bump routes sigs.k8s.io/yaml through go.yaml.in/yaml/v2 v2.4.4 while gopkg.in/yaml.v2 v2.4.0 remains vendored for other dependencies, so the controller links two YAML v2 parsers (verified via go list -deps on cmd/{alluxio,dataset,webhook,fluidapp}). They are byte-identical today (all 13 engine .go files identical except one doc-comment URL in yaml.go), so there is zero behavioral risk now; the PR-introduced delta is the future drift vector — go.yaml.in/yaml/v2 is maintained and will move, while gopkg.in/yaml.v2 is archived and won't. One precision note settled in cross-critique: pre-bump the binary already linked two copies of the same v2.4.0 lineage (gopkg.in/yaml.v2 plus sigs' embedded goyaml.v2 snapshot); this PR keeps the count at two and changes the provenance of the second copy. Codex additionally showed the duplication is non-removable by this PR or any near-term fluid-only change (vendored k8s code — structured-merge-diff, component-base, kube-openapi — also imports gopkg.in/yaml.v2). Consensus of both reviewers: inherent to upstream's fork migration, recorded as a known tradeoff, not actionable here. - go.mod:80 [minor] — pre-existing, not introduced by this PR
Out of scope for this PR, but worth a maintainer decision: after this bump, fluid still directly requires the archived gopkg.in/yaml.v2 v2.4.0 (6 first-party importers), so two copies of the same parser lineage coexist in the build — behavior verified identical today. Should a follow-up migrate those call sites to retire the archived module? Sharpened in cross-critique: go.yaml.in/yaml/v2 is the drop-in target, NOT sigs.k8s.io/yaml — several of those call sites use yaml.v2-specific semantics (MapSlice, no JSON round-trip), and sigs' Unmarshal routes through JSON and types ints as float64, so a naive swap to sigs would be a behavior change, not a mechanical migration. Also note vendored third-party k8s code imports gopkg.in/yaml.v2, so full retirement needs upstream movement too. - pkg/ddc/alluxio/master_internal_test.go:1 [nit] — pre-existing, not introduced by this PR — Uplift a sigs.k8s.io/yaml contract pin into the repo
Fluid has 22 direct sigs.k8s.io/yaml call sites but no test pinning the library's observable contract (golden marshal output, JSON-path scalar typing — ints decode as float64 in map[string]interface{} — merge keys, error-text prefixes). Each future bump of this library re-risks exactly the class of silent change this review had to rule out by hand. Stdlib-only contract tests exist on both reviewer verify branches (golden-pinned TestYamlBehaviorMatrix on the Codex branch, four contract tests on the Claude branch) and would be a cheap permanent regression net if contributed back after merge.
Verified review delta
- F1-dual-yamlv2-engine: open (initial-pr)
- Q1-gopkg-yaml-v2-still-direct: open (preexisting)
- F2-uplift-yaml-contract-tests: open (preexisting)
Code: clear. CI: success; attribution: unknown. Required CI checks still apply.
Bumps sigs.k8s.io/yaml from 1.4.0 to 1.6.0.
Release notes
Sourced from sigs.k8s.io/yaml's releases.
Commits
048d724Merge pull request #132 from thockin/master23c836cBolster tests, mostly in error-handling2e3340bAdd compact output tests4a4f539Add test case for tabs in multi-line strings13509adChange which methods get a newline and fix tests59c2c43Add compact mode so KYAML can be used in more placesabc1addkyaml: Implement escaping closer to YAML spec7749171Add a yamlfmt cmda932007Add KYAML support0f318dcMerge pull request #134 from kubernetes-sigs/forgot-to-add-redirects-for-cons...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)