Yamlpath

Latest version: v3.8.2

Safety actively analyzes 630217 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 5 of 9

2.4.0

Enhancements:
* Added new reference command-line tool: yaml-merge. This is a very complex
tool, so a comprehensive treatise will be added to the project Wiki to
explore its capabilities. Along with those of its component classes, its
unit tests also provide many examples of the same.
* YAMLPath instances now support arbitrary changes to separator.
* YAMLPath instances now support equality testing (against the stored path),
immune to differences in separator.
* The get_yaml_data function now supports "-" as a source file. This is
interpreted as a read from STDIN.
* Due to the change to the get_yaml_data function, the yaml-get reference
command-line tool now supports retrieving nodes from YAML/Compatible data
passed to it via STDIN when its YAML_FILE argument is set to -. The new
yaml-merge reference command-line tool also reads from STDIN when one of its
YAML_FILE input arguments is -. No other reference command-line tools
support this change at this time.

Known Issues:
1. Neither yaml-set nor yaml-merge will add override keys to a Hash which uses
the YAML merge operator (<<:) and which does not already have a matching
override key. This issue has existed for a very long time but was only
discovered during preparation for this release. This will be logged and
tracked as a Known Issue for this release -- to be fixed at another time --
because no one (not even myself) has yet encountered/reported this issue, it
is non-trivial to fix, and it is an edge-case. Here is an example of this
issue:

For ex.yaml:
---
anchored_hash: &its_anchor
ah_key: Base value
merging_hash:
<<: *its_anchor
mh_key: Implementation value

... both of these commands:
`yaml-set --change=/merging_hash/ah_key --value='Override value' ex.yaml`
`echo 'Override value' | yaml-merge -m /merging_hash/ah_key ex.yaml -`

... will fail to affect the expected change. The expectation would be:
---
anchored_hash: &its_anchor
ah_key: Base value
merging_hash:
<<: *its_anchor
mh_key: Implementation value
ah_key: Override value

... but the actual result is (without any indication of an error):
---
anchored_hash: &its_anchor
ah_key: Base value
merging_hash:
<<: *its_anchor
mh_key: Implementation value

2.3.7

Bug Fixes:
* Setting negative floats could cause the leading "-" symbol to be replaced
with an unexpcted "0" when specifying a float format, or crash when using
the default format.

2.3.6

Bug Fixes:
* When using yaml-set with --format=folded and --eyamlcrypt, the encrypted
value was being mistakenly appended with a spurious newline character at its
end. Note that this affected only Puppet's Hiera lookup and not EYAML
itself; on the command-line, the eyaml command would not show the extra
newline character. The yaml-get command was also not affected, making it
very difficult to set up a unit-test for this case.

2.3.5

Bug Fixes:
* Certain YAML constructs trigger AssertionErrors in ruamel.yaml during YAML
data writes. This was causing yaml-set to generate empty files. Until
https://sourceforge.net/p/ruamel-yaml/tickets/351/ is fixed, this patch
will revert the file contents to mitigate data loss under these conditions.
A specific test has been created to detect when the upstream issue is fixed.

2.3.4

Bug Fixes:
* Minor security patch: Python already makes non-shell subprocess calls safe
(mitigating shell command injection). This patch makes that already-present
protection explicit rather than implicit.

2.3.3

Bug Fixes:
* Subtraction Collector math had no effect when the RHS was a list of scalar
values (because LHS was a list of NodeCoords, so comparison was always
false). Also reduced O(3N) to O(2N) during Collector subtraction.

Enhancements:
* The console logger's debug method now includes the type of each element in a
list while it is being dumped.

Page 5 of 9

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.