feat: upgrade yaml library from gopkg.in/yaml.v3 to go.yaml.in/yaml/v4

arazzo/arazzo_order_test.go

@@ -10,7 +10,7 @@ import (
 	"github.com/speakeasy-api/openapi/expression"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 func TestArazzo_ArrayOrdering_ReorderWorkflows_Success(t *testing.T) {

arazzo/arazzo_test.go

@@ -25,7 +25,7 @@ import (
 	"github.com/speakeasy-api/openapi/yml"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 // TODO make it possible to choose json or yaml output

arazzo/core/criterion.go

@@ -11,7 +11,7 @@ import (
 	"github.com/speakeasy-api/openapi/marshaller"
 	"github.com/speakeasy-api/openapi/validation"
 	"github.com/speakeasy-api/openapi/yml"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 type CriterionExpressionType struct {

arazzo/core/criterion_syncchanges_test.go

@@ -6,7 +6,7 @@ import (
 	"github.com/speakeasy-api/openapi/pointer"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 func TestCriterionTypeUnion_SyncChanges_WithStringType_Success(t *testing.T) {

arazzo/core/criterion_test.go

@@ -7,7 +7,7 @@ import (
 	"github.com/speakeasy-api/openapi/marshaller"
 	"github.com/speakeasy-api/openapi/pointer"
 	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 func createCriterionWithRootNode(c Criterion, rootNode *yaml.Node) Criterion {

arazzo/core/reusable.go

@@ -11,7 +11,7 @@ import (
 	"github.com/speakeasy-api/openapi/validation"
 	values "github.com/speakeasy-api/openapi/values/core"
 	"github.com/speakeasy-api/openapi/yml"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 type Reusable[T marshaller.CoreModeler] struct {

arazzo/core/reusable_test.go

@@ -5,7 +5,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 func TestReusable_Unmarshal_WithReference_Success(t *testing.T) {

arazzo/criterion/condition.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/speakeasy-api/openapi/expression"
 	"github.com/speakeasy-api/openapi/validation"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 // Operator represents the operator used to compare the value of a criterion.

arazzo/requestbody_test.go

@@ -8,7 +8,7 @@ import (
 	"github.com/speakeasy-api/openapi/marshaller"
 	"github.com/speakeasy-api/openapi/pointer"
 	"github.com/stretchr/testify/assert"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 func TestRequestBody_Validate_JSONPathInPayload_Success(t *testing.T) {

arazzo/reusable.go

@@ -15,7 +15,7 @@ import (
 	"github.com/speakeasy-api/openapi/sequencedmap"
 	"github.com/speakeasy-api/openapi/validation"
 	"github.com/speakeasy-api/openapi/values"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 type (

arazzo/successaction.go

@@ -15,7 +15,7 @@ import (
 	"github.com/speakeasy-api/openapi/pointer"
 	"github.com/speakeasy-api/openapi/validation"
 	walkpkg "github.com/speakeasy-api/openapi/walk"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 // SuccessActionType represents the type of action to take on success.

cmd/openapi/commands/openapi/bootstrap.go

@@ -8,7 +8,7 @@ import (
 	"github.com/speakeasy-api/openapi/openapi"
 	"github.com/speakeasy-api/openapi/yml"
 	"github.com/spf13/cobra"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 var bootstrapCmd = &cobra.Command{

cmd/openapi/commands/overlay/apply.go

@@ -8,7 +8,7 @@ import (
 	overlayPkg "github.com/speakeasy-api/openapi/overlay"
 	"github.com/speakeasy-api/openapi/overlay/loader"
 	"github.com/spf13/cobra"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 var (

cmd/openapi/commands/overlay/compare.go

@@ -8,7 +8,7 @@ import (
 	overlayPkg "github.com/speakeasy-api/openapi/overlay"
 	"github.com/speakeasy-api/openapi/overlay/loader"
 	"github.com/spf13/cobra"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 var (

cmd/openapi/go.mod

@@ -10,7 +10,7 @@ require (
 	github.com/speakeasy-api/openapi/openapi/linter/customrules v0.0.0-20260217225223-7d484a30828f
 	github.com/spf13/cobra v1.10.1
 	github.com/stretchr/testify v1.11.1
-	gopkg.in/yaml.v3 v3.0.1
+	go.yaml.in/yaml/v4 v4.0.0-rc.4
 )
 
 require (
@@ -46,4 +46,5 @@ require (
 	golang.org/x/sync v0.19.0 // indirect
 	golang.org/x/sys v0.36.0 // indirect
 	golang.org/x/text v0.34.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

cmd/openapi/go.sum

@@ -101,6 +101,8 @@ github.com/vmware-labs/yaml-jsonpath v0.3.2 h1:/5QKeCBGdsInyDCyVNLbXyilb61MXGi9N
 github.com/vmware-labs/yaml-jsonpath v0.3.2/go.mod h1:U6whw1z03QyqgWdgXxvVnQ90zN1BWz5V+51Ewf8k+rQ=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
+go.yaml.in/yaml/v4 v4.0.0-rc.4 h1:UP4+v6fFrBIb1l934bDl//mmnoIZEDK0idg1+AIvX5U=
+go.yaml.in/yaml/v4 v4.0.0-rc.4/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
 golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561 h1:MDc5xs78ZrZr3HMQugiXOAkSZtfTpbJLDr/lwfgO53E=
 golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=

expression/core/value.go

@@ -1,5 +1,5 @@
 package core
 
-import "gopkg.in/yaml.v3"
+import "go.yaml.in/yaml/v4"
 
 type ValueOrExpression = *yaml.Node

expression/value.go

@@ -1,7 +1,7 @@
 package expression
 
 import (
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 // ValueOrExpression represents a raw value or expression in the Arazzo document.

expression/value_test.go

@@ -6,7 +6,7 @@ import (
 	"github.com/speakeasy-api/openapi/expression"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 func TestGetValueOrExpressionValue_Success(t *testing.T) {

extensions/core/extensions.go

@@ -5,7 +5,7 @@ import (
 
 	"github.com/speakeasy-api/openapi/marshaller"
 	"github.com/speakeasy-api/openapi/sequencedmap"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 type (

extensions/core/extensions_test.go

@@ -11,7 +11,7 @@ import (
 	"github.com/speakeasy-api/openapi/sequencedmap"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 type TestCoreModel struct {

extensions/extensions.go

@@ -10,7 +10,7 @@ import (
 	"github.com/speakeasy-api/openapi/marshaller"
 	"github.com/speakeasy-api/openapi/sequencedmap"
 	"github.com/speakeasy-api/openapi/yml"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 const (

extensions/extensions_isequal_test.go

@@ -4,7 +4,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 func TestExtensions_IsEqual_Success(t *testing.T) {

extensions/extensions_test.go

@@ -13,7 +13,7 @@ import (
 	"github.com/speakeasy-api/openapi/sequencedmap"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 type ModelWithExtensions struct {

go.mod

@@ -7,6 +7,7 @@ require (
 	github.com/speakeasy-api/jsonpath v0.6.3
 	github.com/stretchr/testify v1.11.1
 	github.com/vmware-labs/yaml-jsonpath v0.3.2
+	go.yaml.in/yaml/v4 v4.0.0-rc.4
 	golang.org/x/sync v0.19.0
 	golang.org/x/text v0.34.0
 	gopkg.in/yaml.v3 v3.0.1

go.sum

@@ -44,6 +44,8 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/vmware-labs/yaml-jsonpath v0.3.2 h1:/5QKeCBGdsInyDCyVNLbXyilb61MXGi9NP674f9Hobk=
 github.com/vmware-labs/yaml-jsonpath v0.3.2/go.mod h1:U6whw1z03QyqgWdgXxvVnQ90zN1BWz5V+51Ewf8k+rQ=
+go.yaml.in/yaml/v4 v4.0.0-rc.4 h1:UP4+v6fFrBIb1l934bDl//mmnoIZEDK0idg1+AIvX5U=
+go.yaml.in/yaml/v4 v4.0.0-rc.4/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
 golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=

hashing/hashing.go

@@ -9,7 +9,7 @@ import (
 	"strings"
 
 	"github.com/speakeasy-api/openapi/internal/interfaces"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 func Hash(v any) string {

hashing/hashing_test.go

@@ -14,7 +14,7 @@ import (
 	"github.com/speakeasy-api/openapi/yml"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 type testEnum string

internal/interfaces/interfaces.go

@@ -6,7 +6,7 @@ import (
 	"reflect"
 
 	"github.com/speakeasy-api/openapi/validation"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 type Validator[T any] interface {

internal/interfaces/interfaces_test.go

@@ -8,7 +8,7 @@ import (
 
 	"github.com/speakeasy-api/openapi/validation"
 	"github.com/stretchr/testify/assert"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 // Test implementations for Model interface

internal/testutils/utils.go

@@ -12,10 +12,13 @@ import (
 	"reflect"
 	"strconv"
 	"testing"
+	"unsafe"
 
+	"github.com/speakeasy-api/jsonpath/pkg/jsonpath"
 	"github.com/speakeasy-api/openapi/yml"
 	"github.com/stretchr/testify/assert"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
+	yamlv3 "gopkg.in/yaml.v3"
 )
 
 // TODO use these more in tests
@@ -183,3 +186,11 @@ func DownloadFile(url, cacheEnvVar, cacheDirName string) (io.ReadCloser, error)
 	// Return the data as a ReadCloser
 	return io.NopCloser(bytes.NewReader(data)), nil
 }
+
+// QueryV4 runs a jsonpath query using a v4 node by casting to v3 and back.
+// This bridges the gap between jsonpath libraries that use yaml.v3 types and
+// the v4 types used throughout this codebase.
+func QueryV4(path *jsonpath.JSONPath, node *yaml.Node) []*yaml.Node {
+	v3result := path.Query((*yamlv3.Node)(unsafe.Pointer(node))) //nolint:gosec // v4.Node is a strict superset of v3.Node (verified at init)
+	return *(*[]*yaml.Node)(unsafe.Pointer(&v3result))           //nolint:gosec // pointer types have identical memory layouts
+}

internal/testutils/utils_test.go

@@ -4,8 +4,10 @@ import (
 	"iter"
 	"testing"
 
+	"github.com/speakeasy-api/jsonpath/pkg/jsonpath"
 	"github.com/stretchr/testify/assert"
-	"gopkg.in/yaml.v3"
+	"github.com/stretchr/testify/require"
+	"go.yaml.in/yaml/v4"
 )
 
 func TestCreateStringYamlNode_Success(t *testing.T) {
@@ -508,3 +510,64 @@ func TestAssertEqualSequencedMap_NilChecks(t *testing.T) {
 		AssertEqualSequencedMap(mockT, nil, nilPtr)
 	})
 }
+
+func TestQueryV4_Success(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		yml      string
+		query    string
+		expected string
+	}{
+		{
+			name:     "scalar value lookup",
+			yml:      "name: alice\nage: 30\n",
+			query:    "$.name",
+			expected: "alice",
+		},
+		{
+			name:     "nested value lookup",
+			yml:      "user:\n  name: bob\n",
+			query:    "$.user.name",
+			expected: "bob",
+		},
+		{
+			name:     "array element lookup",
+			yml:      "items:\n  - first\n  - second\n",
+			query:    "$.items[1]",
+			expected: "second",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			var root yaml.Node
+			err := yaml.Unmarshal([]byte(tt.yml), &root)
+			require.NoError(t, err, "unmarshal should succeed")
+
+			path, err := jsonpath.NewPath(tt.query)
+			require.NoError(t, err, "jsonpath should be valid")
+
+			result := QueryV4(path, &root)
+			require.Len(t, result, 1, "should return exactly one match")
+			assert.Equal(t, tt.expected, result[0].Value, "should return correct value")
+		})
+	}
+}
+
+func TestQueryV4_NoMatch(t *testing.T) {
+	t.Parallel()
+
+	var root yaml.Node
+	err := yaml.Unmarshal([]byte("name: alice\n"), &root)
+	require.NoError(t, err, "unmarshal should succeed")
+
+	path, err := jsonpath.NewPath("$.missing")
+	require.NoError(t, err, "jsonpath should be valid")
+
+	result := QueryV4(path, &root)
+	assert.Empty(t, result, "should return no matches for missing path")
+}

json/json.go

@@ -9,7 +9,7 @@ import (
 	"strings"
 
 	"github.com/speakeasy-api/openapi/yml"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 // YAMLToJSON converts a YAML node to JSON using a custom JSON writer that preserves formatting.

json/json_test.go

@@ -7,7 +7,7 @@ import (
 	"github.com/speakeasy-api/openapi/json"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v4"
 )
 
 func TestYAMLToJSON_Success(t *testing.T) {