go-yaml

A dependency-free, spec-compliant YAML encoder and decoder for Go, built from scratch with AST access, YAML Path queries, and reversible transformations.

Library
Go
vv1.19.2
2,232 stars
MIT License

Repository Health

Pre-computed score based on development activity, maintenance, community, maturity, and trend momentum. How we score it →
55 /100 Fair
Development Activity 4
Maintenance 48
Community 68
Maturity 60
Momentum 40

Technical Analysis

AI-assessed by reading the actual repository — architecture, code quality, innovation, and documentation. How we score it →
81 /100 Excellent
Architecture 85
Code Quality 88
Innovation 82
Learning Curve 70

goccy/go-yaml is a from-scratch YAML library for Go designed to replace the aging go-yaml/yaml (gopkg.in/yaml). It ships with zero external dependencies, passes more of the official YAML Test Suite than gopkg.in/yaml.v3, and exposes public Tokenizer, Parser, and AST layers so tools can manipulate YAML documents directly instead of only working through struct tags.

Beyond basic Marshal/Unmarshal, it supports YAML Path queries for filtering and replacing content, anchor/alias resolution across files via ReferenceDirs, struct-tag-driven anchors and merge keys, JSON-tag compatibility, custom marshaler/unmarshaler hooks, and pretty-printed, optionally colorized parse errors that point at the offending source location.

What You Get

  • Zero-dependency Encoder/Decoder with a gopkg.in/yaml.v2/v3-compatible Marshal/Unmarshal API
  • Public lexer, parser, and AST packages for building custom YAML tooling
  • YAML Path support for querying, filtering, and replacing values without hand-written traversal
  • Anchor/alias handling, including cross-file references via ReferenceDirs and merge-key support on embedded structs
  • Pretty-formatted, optionally colorized parse errors annotated with the source YAML

Common Use Cases

  • Parsing and validating application or service configuration files with precise error locations
  • Building CLIs or editors that need to programmatically rewrite YAML while preserving comments, anchors, and formatting
  • Extracting values from large YAML documents with YAML Path instead of manual struct walking
  • Replacing gopkg.in/yaml.v2 or v3 in existing codebases that need better spec coverage or clearer errors

Under The Hood

Architecture The library is structured as a classic compiler-style pipeline wrapped by a reflection-based binding layer: the token package defines lexical tokens, lexer (lexer.Tokenize) turns source text into a token stream, scanner does the character-level scanning underneath it, and parser (parser.Parse) consumes tokens to build a typed ast.File tree. The root yaml package layers Decoder/Encoder (in decode.go/encode.go) and reflection-based struct binding (struct.go) on top of that AST, while path.go implements the YAMLPath query engine by combining the parser with the printer package for source-annotated output. This separation means the reflection-based Marshal/Unmarshal API and direct AST manipulation are independent consumers of the same lexer/parser core, and the bundled cmd/ycat CLI sits entirely outside the core packages.

Tech Stack Built for Go 1.21+ with genuinely zero third-party runtime dependencies (go.sum is empty) — a deliberate contrast to libraries that wrap C-derived libyaml bindings. The optional go-playground/validator integration is kept out of the top-level go.mod and scoped to the testdata directory to avoid pulling test-only dependencies into consumers. Tooling is standard Go: a Makefile driving golangci-lint (errcheck, govet, ineffassign, misspell, perfsprint, staticcheck, unused) and a GitHub Actions matrix testing ubuntu/macOS/Windows across four Go versions, plus dedicated i386 and -race jobs.

Code Quality Test coverage is extensive: dedicated _test.go files sit alongside every package (decode, encode, path, ast, parser, lexer, token, printer), plus a suite that runs the official external YAML Test Suite and a native Go fuzz test. Errors are explicit and typed rather than stringly-typed or swallowed — a shared Error interface (GetToken, GetMessage, FormatError) is implemented by distinct SyntaxError, TypeError, OverflowError, DuplicateKeyError, UnknownFieldError, and UnexpectedNodeTypeError types, alongside sentinel errors checked via errors.Is/errors.As. CI enforces linting and race-tested builds across multiple OSes and Go versions before merge.

API Design The public API deliberately mirrors gopkg.in/yaml.v2’s Marshal/Unmarshal signatures and accepts both yaml and json struct tags, so migrating from the incumbent library is close to a drop-in swap, while layering on ergonomics the older library lacks: exported Tokenizer/Parser/AST packages for YAML-aware tooling, a query-string YAMLPath language (yaml.PathString("$.store.book[*].author")) for extracting or replacing nested values without traversal code, struct-tag-driven anchor/alias declarations (yaml:"c,anchor=x") that let idiomatic Go control YAML’s non-scalar features, and FormatError/AnnotateSource helpers that render parse failures against the original source text with optional coloring.

Used by 8 apps in this directory

Go
32%
Apache 2.0

CubeSandbox

AI Agents · Developer Tools · Security

12,728

Instant, concurrent, hardware-isolated MicroVM sandboxes for AI agents — E2B-API compatible, sub-60ms cold starts, and a built-in zero-trust egress proxy, all self-hostable at scale.

View details
82
Repo Health
88
Technical
63
Dependency
Built with
Go 32%
Rust 26%
C 22%
Updated 2 weeks ago
TypeScript
51%
Other

Mattermost

Collaboration · Devops · Team Chat

39,203

Open core, self-hosted team collaboration with chat, AI agents, voice calling, and deep DevOps integrations — all under your control.

View details
96
Repo Health
87
Technical
65
Dependency
Built with
TypeScript 51%
Go 40%
Updated 1 weeks ago
Go
95%
Other

NetBird

Security

29,568

Replace your VPN with a zero-trust WireGuard overlay network that auto-connects devices, enforces SSO and posture checks, and deploys in under 5 minutes.

View details
91
Repo Health
82
Technical
66
Dependency
Built with
Go 95%
Updated 2 weeks ago
Go
91%
Apache 2.0

Ory Kratos

Authentication

13,895

API-first identity and user management that handles login, registration, MFA, and recovery so your application never has to.

View details
81
Repo Health
78
Technical
65
Dependency
Built with
Go 91%
Updated 2 months ago
Go
67%
Apache 2.0

OSV.dev

Security

2,948

Google's open-source vulnerability database that maps CVEs to exact package versions across 50+ ecosystems with a public API and data dumps.

View details
87
Repo Health
82
Technical
66
Dependency
Built with
Go 67%
Python 22%
Updated 1 weeks ago
Go
65%
GPL 3.0

Stormkit

Devops · Hosting Control Panel

262

Self-hostable platform for deploying and hosting modern web apps with automated CI/CD, custom domains, and a built-in serverless runtime — a true open-source alternative to Vercel and Netlify.

View details
79
Repo Health
79
Technical
67
Dependency
Built with
Go 65%
TypeScript 32%
Updated 1 weeks ago
Go
98%
Other

Tyk API Gateway

Developer Tools · Devops

10,838

Cloud-native, high-performance open-source API gateway for REST, GraphQL, gRPC, and TCP — built in Go since 2014 with no feature lockout.

View details
96
Repo Health
78
Technical
66
Dependency
Built with
Go 98%
Updated 2 weeks ago
Go
86%
Apache 2.0

Uncloud

Devops

5,503

Deploy and scale containerised apps across any servers without Kubernetes or Swarm overhead

View details
84
Repo Health
78
Technical
67
Dependency
Built with
Go 86%
Updated 1 weeks ago

Join founders buildingwith open source

Opinionated takes, migration guides, cost-saving tips, and insights from the open source ecosystem.

Subscribe on Substack
Join 750+ subscribers