chore: migrate from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 by AdamMagued · Pull Request #269 · speakeasy-api/openapi

AdamMagued · 2026-10-11T15:14:41Z

Migrates imports and go.mod module dependencies from legacy gopkg.in/yaml.v3 to maintained go.yaml.in/yaml/v3 (v3.0.5).

Resolves #201.

Summary of changes:

Promoted direct module dependency on go.yaml.in/yaml/v3 v3.0.5 across go.mod manifests.
Migrated package imports across the codebase from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3.
Bridged external query evaluators (jsonpath, yamlpath) in overlay with zero-copy node casting to maintain compatibility without performance degradation.
All unit tests and go vet checks pass cleanly.

Summary by cubic

Migrates the YAML library from the unmaintained gopkg.in/yaml.v3 to the maintained go.yaml.in/yaml/v3 fork, resolving #201.

Updates all YAML imports and go.mod dependencies across the codebase, including cmd/openapi, openapi/linter/customrules, and jsonschema/oas3/tests, and aligns their root-module pseudo-versions.
Bumps github.com/speakeasy-api/jsonpath to v0.7.0 and switches the jsonpath and yamlpath evaluators to go.yaml.in/yaml/v3, dropping the bridge code that converted nodes between the two modules.
Encodes typed-nil legacy yaml nodes as null in sequencedmap.

^{Written for commit f308ebf. Summary will update on new commits.}

cubic-dev-ai

All reported issues were addressed across 176 files

_{Shadow auto-approve: would not auto-approve because issues were found.

View guided diff | Re-trigger cubic}

TristanSpeakEasy

Thanks for the contribution Adam, good to get this moving. Could you address cubic's feedback and the comments I've left? The standalone CLI build needs fixing before this goes in. I also reproduced the compatibility issues cubic flagged, so let's make the migration plan explicit rather than treating this as an import-only change, especially where existing callers can silently lose data.

…ormatting

cubic-dev-ai

All reported issues were addressed across 16 files (changes from recent commits).

_{Shadow auto-approve: would not auto-approve because issues were found.

View guided diff | Re-trigger cubic}

…acy unmarshalers in sequencedmap

AdamMagued · 2026-10-14T04:24:30Z

All requested review items and automated reviewer findings have been resolved:

Standalone CLI Build & Pseudo-version Workflow:
- Updated github.com/speakeasy-api/openapi and github.com/speakeasy-api/openapi/openapi/linter/customrules in cmd/openapi/go.mod to the updated pseudo-version following the documented multi-module workflow (v1.25.6-0.20261014041923-1f876e09ff4f).
- Verified that standalone CLI compilation (GOWORK=off go build -C cmd/openapi .) succeeds without type mismatch errors between legacy and modern YAML nodes/styles.
Formatting & Module Tidiness:
- Sorted go.yaml.in/yaml/v3 v3.0.5 before golang.org/x/sync in go.mod.
- Corrected import grouping and formatting in jsonschema/oas3/validation.go, marshaller/sequencedmap.go, marshaller/unmarshaller.go, sequencedmap/map.go, and jsonpointer/jsonpointer.go.
- Verified both .mise-tasks/mod-check and .mise-tasks/fmt-check pass cleanly across all modules in the repository.
SequencedMap Legacy Compatibility:
- Documented the go.yaml.in/yaml/v3 contract on Map.UnmarshalYAML and Map.MarshalYAML.
- Added LegacyYAMLAdapter[K, V] and Map.AsLegacyYAML() to satisfy gopkg.in/yaml.v3.Unmarshaler and Marshaler without data loss or leaking node internal fields (kind, style, content).
- Extended Map.UnmarshalYAML and Map.MarshalYAML to bridge nested legacy value unmarshalers (UnmarshalYAML(*gopkg.in/yaml.v3.Node) error) and marshalers (MarshalYAML()), preventing data loss when map value types implement legacy YAML interfaces.
- Added unit test coverage for round-trips, direct legacy unmarshaling behavior, and nested legacy value unmarshalers in sequencedmap/yaml_migration_test.go.
JSONPointer, Values, and Linter Fix Bridge:
- Preserved legacy result types in jsonpointer.GetTarget when navigating from legacy input nodes, returning *gopkg.in/yaml.v3.Node and asserting both node kind and resolved values in jsonpointer/legacy_yaml_test.go.
- Added values.FromLegacyNode and values.ToLegacyNode zero-copy conversion helpers.
- Added validation.LegacyNodeFix and updated the fix engine to invoke legacy node fixes, with test assertions on node kind and contents in linter/fix/legacy_fix_test.go.
- Added compile-time layout guards and //nolint:gosec annotations on zero-copy pointer casts between identical yaml.Node memory layouts.

cubic-dev-ai

All reported issues were addressed across 7 files (changes from recent commits).

_{Shadow auto-approve: would not auto-approve because issues were found.

View guided diff | Re-trigger cubic}

TristanSpeakEasy · 2026-10-14T23:19:23Z

@AdamMagued almost there just some conflicts and last bit of cubic feedback to address

# Conflicts: # cmd/openapi/go.mod # cmd/openapi/go.sum # go.mod # internal/interfaces/interfaces_test.go # openapi/linter/customrules/go.mod

cubic-dev-ai

0 issues found across 2 files (changes from recent commits).

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Shadow auto-approve: would not auto-approve. Auto-approval skipped because this PR is from an external contributor.

View guided diff | Re-trigger cubic}

cubic-dev-ai

0 issues found across 1 file (changes from recent commits).

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Shadow auto-approve: would not auto-approve. Auto-approval skipped because this PR is from an external contributor.

View guided diff | Re-trigger cubic}

cubic-dev-ai

0 issues found across 3 files (changes from recent commits).

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Shadow auto-approve: would not auto-approve. Auto-approval skipped because this PR is from an external contributor.

View guided diff | Re-trigger cubic}

… use go.yaml.in/yaml/v3

TristanSpeakEasy · 2026-10-16T00:29:32Z

@AdamMagued I've picked this up to get it over the line. Rather than keeping the unsafe bridge between the old and new node types, I've migrated the dependencies that still used gopkg.in/yaml.v3, which let me remove the bridge entirely.

Dependencies

speakeasy-api/jsonpath: migrated in chore!: migrate from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 jsonpath#26 (it'll be released as v0.7.0). This PR currently points at that branch's pseudo-version.
vmware-labs/yaml-jsonpath: opened chore: migrate from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 vmware-labs/yaml-jsonpath#65 upstream. Until it's merged and released, we're using the speakeasy-api/yaml-jsonpath fork, published under its own module path (github.com/speakeasy-api/yaml-jsonpath) so we don't need a replace. Once upstream releases, we can switch back.
dprotaso/go-yit: upstream had already moved to go.yaml.in/yaml/v3 at 7afe425 (before going on to the v4 release candidates), so this just pins that commit.

Removed from this PR

All the unsafe node casts, plus validation.LegacyNodeFix, values.FromLegacyNode/ToLegacyNode, sequencedmap.LegacyYAMLAdapter/AsLegacyYAML, and the legacy branches in jsonpointer, hashing and sequencedmap, along with their tests. Those files now match main apart from the import swap.
gopkg.in/yaml.v3 no longer appears in any of the repo's go.mod files, not even as an indirect dependency.

Before merging

Merge and tag chore!: migrate from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 jsonpath#26 as v0.7.0, then move this PR onto that tag.
This is still a breaking change for anyone using our YAML node types (values.Value, root nodes, NodeFix, etc.), since they now come from go.yaml.in/yaml/v3. It needs a release note.

fmt, mod-check, lint, examples, CLI integration tests and the build all pass locally, and the CLI builds standalone with GOWORK=off. The only test failures are 7 TestJSONSchemaTestSuite_RoundTrip cases, which fail the same way on main.

cubic-dev-ai

All reported issues were addressed across 24 files (changes from recent commits).

_{Shadow auto-approve: would not auto-approve because issues were found.

View guided diff | Re-trigger cubic}

cubic-dev-ai

0 issues found across 9 files (changes from recent commits).

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Shadow auto-approve: would not auto-approve. Auto-approval skipped because this PR is from an external contributor.

View guided diff | Re-trigger cubic}

TristanSpeakEasy

Thanks Adam, this is good to go now that jsonpath and yamlpath are on go.yaml.in/yaml/v3 and the bridge code is gone.

codecov · 2026-10-16T00:56:12Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

chore: migrate from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3

1fa8b9d

AdamMagued requested a review from a team as a code owner October 11, 2026 15:14

cubic-dev-ai Bot reviewed Oct 11, 2026

View reviewed changes

Comment thread jsonpointer/jsonpointer.go

Comment thread hashing/hashing.go

Comment thread values/value.go

Comment thread validation/fix.go

Comment thread sequencedmap/map.go

Comment thread overlay/jsonpath.go Outdated

TristanSpeakEasy requested changes Oct 14, 2026

View reviewed changes

Comment thread cmd/openapi/go.mod

Comment thread go.mod

fix: address review feedback on yaml.v3 migration compatibility and f…

2990fd8

…ormatting

cubic-dev-ai Bot reviewed Oct 14, 2026

View reviewed changes

Comment thread jsonpointer/jsonpointer.go Outdated

Comment thread linter/fix/legacy_fix_test.go Outdated

Comment thread sequencedmap/map.go Outdated

Comment thread jsonpointer/legacy_yaml_test.go Outdated

AdamMagued added 2 commits October 14, 2026 07:19

fix: preserve legacy node types in jsonpointer and support nested leg…

1f876e0

…acy unmarshalers in sequencedmap

cmd/openapi: update root and customrules dependency pseudo-versions

7a1a246

cubic-dev-ai Bot reviewed Oct 14, 2026

View reviewed changes

Comment thread sequencedmap/map.go Outdated

TristanSpeakEasy added 2 commits October 16, 2026 09:21

Merge remote-tracking branch 'origin/main' into pr-269-yaml-migration

ac1624f

# Conflicts: # cmd/openapi/go.mod # cmd/openapi/go.sum # go.mod # internal/interfaces/interfaces_test.go # openapi/linter/customrules/go.mod

fix: encode typed-nil legacy yaml nodes as null in sequencedmap

90410c9

cubic-dev-ai Bot reviewed Oct 15, 2026

View reviewed changes

TristanSpeakEasy added 3 commits October 16, 2026 09:54

chore: point customrules at yaml migration root module pseudo-version

d4071aa

chore: point cmd/openapi at yaml migration pseudo-versions

abb9980

chore: tidy converter tests module

80abc8c

cubic-dev-ai Bot reviewed Oct 15, 2026

View reviewed changes

TristanSpeakEasy added 3 commits October 16, 2026 10:25

refactor: drop gopkg.in/yaml.v3 bridge code now jsonpath and yamlpath…

f0b9f7b

… use go.yaml.in/yaml/v3

chore: point customrules at migrated root module pseudo-version

32acaee

chore: point cmd/openapi and test modules at migrated pseudo-versions

683982d

TristanSpeakEasy mentioned this pull request Oct 16, 2026

chore!: migrate from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 speakeasy-api/jsonpath#26

Merged

cubic-dev-ai Bot reviewed Oct 16, 2026

View reviewed changes

Comment thread sequencedmap/map.go

TristanSpeakEasy added 3 commits October 16, 2026 10:36

chore: bump speakeasy-api/jsonpath to v0.7.0

daec030

chore: point customrules at root module with jsonpath v0.7.0

d735848

chore: point cmd/openapi and test modules at jsonpath v0.7.0 root module

f308ebf

cubic-dev-ai Bot reviewed Oct 16, 2026

View reviewed changes

TristanSpeakEasy approved these changes Oct 16, 2026

View reviewed changes

TristanSpeakEasy enabled auto-merge October 16, 2026 00:44

TristanSpeakEasy added this pull request to the merge queue Oct 16, 2026

Merged via the queue into speakeasy-api:main with commit 5c1b54d Oct 16, 2026
13 checks passed

Conversation

AdamMagued commented Oct 11, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TristanSpeakEasy left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

AdamMagued commented Oct 14, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

TristanSpeakEasy commented Oct 14, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

TristanSpeakEasy commented Oct 16, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

TristanSpeakEasy left a comment

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Oct 16, 2026

Codecov Report

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

AdamMagued commented Oct 11, 2026 •

edited by cubic-dev-ai Bot

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading