go-yaml

A dependency-free, spec-compliant YAML encoder and decoder for Go, built from scratch with AST access, YAML Path queries, and reversible transformations.

Library
Go
vv1.19.2
2,225stars
MIT License

Repository Health

Pre-computed score based on development activity, maintenance, community, maturity, and trend momentum.How we score it →
56/100Fair
Development Activity8
Maintenance48
Community68
Maturity60
Momentum40

Technical Analysis

AI-assessed by reading the actual repository — architecture, code quality, innovation, and documentation.How we score it →
81/100Excellent
Architecture85
Code Quality88
Innovation82
Learning Curve70

goccy/go-yaml is a from-scratch YAML library for Go designed to replace the aging go-yaml/yaml (gopkg.in/yaml). It ships with zero external dependencies, passes more of the official YAML Test Suite than gopkg.in/yaml.v3, and exposes public Tokenizer, Parser, and AST layers so tools can manipulate YAML documents directly instead of only working through struct tags.

Beyond basic Marshal/Unmarshal, it supports YAML Path queries for filtering and replacing content, anchor/alias resolution across files via ReferenceDirs, struct-tag-driven anchors and merge keys, JSON-tag compatibility, custom marshaler/unmarshaler hooks, and pretty-printed, optionally colorized parse errors that point at the offending source location.

What You Get

  • Zero-dependency Encoder/Decoder with a gopkg.in/yaml.v2/v3-compatible Marshal/Unmarshal API
  • Public lexer, parser, and AST packages for building custom YAML tooling
  • YAML Path support for querying, filtering, and replacing values without hand-written traversal
  • Anchor/alias handling, including cross-file references via ReferenceDirs and merge-key support on embedded structs
  • Pretty-formatted, optionally colorized parse errors annotated with the source YAML

Common Use Cases

  • Parsing and validating application or service configuration files with precise error locations
  • Building CLIs or editors that need to programmatically rewrite YAML while preserving comments, anchors, and formatting
  • Extracting values from large YAML documents with YAML Path instead of manual struct walking
  • Replacing gopkg.in/yaml.v2 or v3 in existing codebases that need better spec coverage or clearer errors

Under The Hood

Architecture The library is structured as a classic compiler-style pipeline wrapped by a reflection-based binding layer: the token package defines lexical tokens, lexer (lexer.Tokenize) turns source text into a token stream, scanner does the character-level scanning underneath it, and parser (parser.Parse) consumes tokens to build a typed ast.File tree. The root yaml package layers Decoder/Encoder (in decode.go/encode.go) and reflection-based struct binding (struct.go) on top of that AST, while path.go implements the YAMLPath query engine by combining the parser with the printer package for source-annotated output. This separation means the reflection-based Marshal/Unmarshal API and direct AST manipulation are independent consumers of the same lexer/parser core, and the bundled cmd/ycat CLI sits entirely outside the core packages.

Tech Stack Built for Go 1.21+ with genuinely zero third-party runtime dependencies (go.sum is empty) — a deliberate contrast to libraries that wrap C-derived libyaml bindings. The optional go-playground/validator integration is kept out of the top-level go.mod and scoped to the testdata directory to avoid pulling test-only dependencies into consumers. Tooling is standard Go: a Makefile driving golangci-lint (errcheck, govet, ineffassign, misspell, perfsprint, staticcheck, unused) and a GitHub Actions matrix testing ubuntu/macOS/Windows across four Go versions, plus dedicated i386 and -race jobs.

Code Quality Test coverage is extensive: dedicated _test.go files sit alongside every package (decode, encode, path, ast, parser, lexer, token, printer), plus a suite that runs the official external YAML Test Suite and a native Go fuzz test. Errors are explicit and typed rather than stringly-typed or swallowed — a shared Error interface (GetToken, GetMessage, FormatError) is implemented by distinct SyntaxError, TypeError, OverflowError, DuplicateKeyError, UnknownFieldError, and UnexpectedNodeTypeError types, alongside sentinel errors checked via errors.Is/errors.As. CI enforces linting and race-tested builds across multiple OSes and Go versions before merge.

API Design The public API deliberately mirrors gopkg.in/yaml.v2’s Marshal/Unmarshal signatures and accepts both yaml and json struct tags, so migrating from the incumbent library is close to a drop-in swap, while layering on ergonomics the older library lacks: exported Tokenizer/Parser/AST packages for YAML-aware tooling, a query-string YAMLPath language (yaml.PathString("$.store.book[*].author")) for extracting or replacing nested values without traversal code, struct-tag-driven anchor/alias declarations (yaml:"c,anchor=x") that let idiomatic Go control YAML’s non-scalar features, and FormatError/AnnotateSource helpers that render parse failures against the original source text with optional coloring.

Used by 8 apps in this directory

Go
31%
Apache 2.0

CubeSandbox

Developer Tools · Security · AI Agents

11,386

Instant, concurrent, hardware-isolated MicroVM sandboxes for AI agents — E2B-API compatible, sub-60ms cold starts, and a built-in zero-trust egress proxy, all self-hostable at scale.

View details
82
Repo Health
88
Technical
63
Dependency
Built with
Go31%
Rust28%
C23%
Updated 2 days ago
TypeScript
51%
Other

Mattermost

Team Chat · Collaboration · Devops

38,940

Open core, self-hosted team collaboration with chat, AI agents, voice calling, and deep DevOps integrations — all under your control.

View details
96
Repo Health
87
Technical
65
Dependency
Built with
TypeScript51%
Go40%
Updated yesterday
Go
94%
Other

NetBird

Security

28,735

Replace your VPN with a zero-trust WireGuard overlay network that auto-connects devices, enforces SSO and posture checks, and deploys in under 5 minutes.

View details
92
Repo Health
82
Technical
66
Dependency
Built with
Go94%
Updated today
Go
91%
Apache 2.0

Ory Kratos

Authentication

13,853

API-first identity and user management that handles login, registration, MFA, and recovery so your application never has to.

View details
84
Repo Health
78
Technical
67
Dependency
Built with
Go91%
Updated 1 months ago
Go
61%
Apache 2.0

OSV.dev

Security

2,902

Google's open-source vulnerability database that maps CVEs to exact package versions across 50+ ecosystems with a public API and data dumps.

View details
89
Repo Health
82
Technical
70
Dependency
Built with
Go61%
Python26%
Updated 2 days ago
Go
63%
GPL 3.0

Stormkit

Devops · Hosting Control Panel

255

Self-hostable platform for deploying and hosting modern web apps with automated CI/CD, custom domains, and a built-in serverless runtime — a true open-source alternative to Vercel and Netlify.

View details
78
Repo Health
79
Technical
68
Dependency
Built with
Go63%
TypeScript34%
Updated 2 days ago
Go
98%
Other

Tyk API Gateway

Developer Tools · Devops

10,810

Cloud-native, high-performance open-source API gateway for REST, GraphQL, gRPC, and TCP — built in Go since 2014 with no feature lockout.

View details
96
Repo Health
78
Technical
66
Dependency
Built with
Go98%
Updated 2 days ago
Go
85%
Apache 2.0

Uncloud

Devops

5,470

Deploy and scale containerised apps across any servers without Kubernetes or Swarm overhead

View details
83
Repo Health
78
Technical
66
Dependency
Built with
Go85%
Updated 2 days ago

Join founders buildingwith open source

Opinionated takes, migration guides, cost-saving tips, and insights from the open source ecosystem.

Subscribe on Substack
Join 750+ subscribers

Search