[manishsvk]

What

Migrates go-apiops' YAML node type from go.yaml.in/yaml/v4 to github.com/pb33f/go-yaml, and moves to the first releases built on that type: pb33f/jsonpath v0.8.4 and pb33f/libopenapi v0.41.6.

Why

vacuum v0.32.0+ requires pb33f/jsonpath v0.8.4, which switched its YAML node type from go.yaml.in/yaml/v4 to github.com/pb33f/go-yaml. Go module resolution selects a single jsonpath for the build, so go-apiops gets compiled against the new one and fails to type-check wherever a node crosses the jsonpath or libopenapi boundary:

cannot use *go.yaml.in/yaml/v4.Node as *github.com/pb33f/go-yaml.Node

Every failing line is inside go-apiops, so this cannot be worked around downstream — Go type identity is per-package-path, and replace directives in a library's go.mod are ignored by consumers.

This currently blocks the vacuum upgrade in two repos:

• fix(deps): update module github.com/daveshanley/vacuum to v0.33.0 deck#2299
• fix(deps): update module github.com/daveshanley/vacuum to v0.33.0 kongctl#2549

Both produce the same 7 errors, all of this one class, in deckformat/entitypointers.go, openapitools/utils.go and yamlbasics/selectors.go.

How

The package selector stays yaml., and every symbol in use (Node, Kind, DocumentNode, SequenceNode, MappingNode, ScalarNode, AliasNode, DoubleQuotedStyle, FlowStyle, Marshal, Unmarshal) exists in the new module, so this is an import-path change across the 20 affected files plus go.mod/go.sum — no logic changes. Same shape as b19ff9c ("Upgrade to yaml.v4").

The libopenapi API surface used here is additive-only across v0.33.0 → v0.41.6: the eight datamodel/high/v3 structs have identical field sets, base.SchemaProxy only gained methods, and datamodel.DocumentConfiguration only gained fields (both flags set here are unchanged).

Breaking changes

• *yaml.Node in the exported API is now github.com/pb33f/go-yaml. Affects ~40 exported functions and methods, plus yamlbasics.NodeSet, YamlArrayMatcher and YamlArrayIterator. Consumers that name the type must swap their own import. decK does not (it never spells the type, so it needs only a go.mod bump); kongctl does, in roughly 12 files starting with internal/cmd/root/verbs/patch/file.go.
• Minimum Go is now 1.26, required by libopenapi v0.41.x. CI picks this up automatically via go-version-file: go.mod.

Suggest releasing as v0.5.0 rather than a patch, so go get -u does not adopt it silently.

Validation

go build, go vet, gofmt and golangci-lint (0 issues) are clean, and all package tests pass.

The Go 1.26 floor also required bumping the pinned golangci-lint in CI: the v2.8.0 release binary is built with Go 1.25 and refuses to load a config targeting a newer Go version. v2.9.0 is the earliest release built with Go 1.26 and reports no new issues here; later releases do (v2.11.4 surfaces four pre-existing gosec findings), so the bump is kept minimal.

The underlying YAML engine does change — internal/libyaml differs by ~9,100 lines between the rc.4 in use here and upstream rc.6, and by a further ~670 lines in the fork — so output was compared byte-for-byte against a build of main:

• 62 generated fixtures across openapi2kong and openapi2mcp: identical
• 147 decK-format YAML outputs (add-tags, remove-tags, list-tags, patch, merge) over 60 real decK config files: identical
• a case covering comments, anchors, merge keys, flow style, block scalars and non-ASCII scalars: identical

Downstream, decK builds and passes its unit tests and lint integration tests against this branch with no source changes — including the cases that exercise vacuum's built-in recommended ruleset, which needed no golden-file updates. decK's Kong-backed integration suite was not run locally (no Docker available); it does not touch this code path, but CI on the decK PR will cover it.

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 58.82%. Comparing base (5c4b2db) to head (7de41aa).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #305   +/-   ##
=======================================
  Coverage   58.82%   58.82%           
=======================================
  Files          36       36           
  Lines        3869     3869           
=======================================
  Hits         2276     2276           
  Misses       1380     1380           
  Partials      213      213           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.