Merge branch 'main' into update/snakeyaml-engine-2.6

Author: zmccoy

.github/workflows/ci.yml

@@ -40,21 +40,21 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout current branch (full)
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           fetch-depth: 0
 
       - name: Download Java (temurin@11)
         id: download-java-temurin-11
         if: matrix.java == 'temurin@11'
-        uses: typelevel/download-java@v1
+        uses: typelevel/download-java@v2
         with:
           distribution: temurin
           java-version: 11
 
       - name: Setup Java (temurin@11)
         if: matrix.java == 'temurin@11'
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@v3
         with:
           distribution: jdkfile
           java-version: 11
@@ -63,21 +63,21 @@ jobs:
       - name: Download Java (temurin@17)
         id: download-java-temurin-17
         if: matrix.java == 'temurin@17'
-        uses: typelevel/download-java@v1
+        uses: typelevel/download-java@v2
         with:
           distribution: temurin
           java-version: 17
 
       - name: Setup Java (temurin@17)
         if: matrix.java == 'temurin@17'
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@v3
         with:
           distribution: jdkfile
           java-version: 17
           jdkFile: ${{ steps.download-java-temurin-17.outputs.jdkFile }}
 
       - name: Cache sbt
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         with:
           path: |
             ~/.sbt
@@ -92,23 +92,23 @@ jobs:
         run: sbt githubWorkflowCheck
 
       - name: Check headers and formatting
-        if: matrix.java == 'temurin@11'
-        run: sbt 'project ${{ matrix.project }}' '++${{ matrix.scala }}' headerCheckAll scalafmtCheckAll 'project /' scalafmtSbtCheck
+        if: matrix.java == 'temurin@11' && matrix.os == 'ubuntu-latest'
+        run: sbt 'project ${{ matrix.project }}' '++ ${{ matrix.scala }}' headerCheckAll scalafmtCheckAll 'project /' scalafmtSbtCheck
 
       - name: Test
-        run: sbt 'project ${{ matrix.project }}' '++${{ matrix.scala }}' test
+        run: sbt 'project ${{ matrix.project }}' '++ ${{ matrix.scala }}' test
 
       - name: Check scalafix lints
-        if: matrix.java == 'temurin@11'
-        run: sbt 'project ${{ matrix.project }}' '++${{ matrix.scala }}' 'scalafixAll --check'
+        if: matrix.java == 'temurin@11' && matrix.os == 'ubuntu-latest'
+        run: sbt 'project ${{ matrix.project }}' '++ ${{ matrix.scala }}' 'scalafixAll --check'
 
       - name: Check binary compatibility
-        if: matrix.java == 'temurin@11'
-        run: sbt 'project ${{ matrix.project }}' '++${{ matrix.scala }}' mimaReportBinaryIssues
+        if: matrix.java == 'temurin@11' && matrix.os == 'ubuntu-latest'
+        run: sbt 'project ${{ matrix.project }}' '++ ${{ matrix.scala }}' mimaReportBinaryIssues
 
       - name: Generate API documentation
-        if: matrix.java == 'temurin@11'
-        run: sbt 'project ${{ matrix.project }}' '++${{ matrix.scala }}' doc
+        if: matrix.java == 'temurin@11' && matrix.os == 'ubuntu-latest'
+        run: sbt 'project ${{ matrix.project }}' '++ ${{ matrix.scala }}' doc
 
       - name: Make target directories
         if: github.event_name != 'pull_request' && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main')
@@ -120,7 +120,7 @@ jobs:
 
       - name: Upload target directories
         if: github.event_name != 'pull_request' && (startsWith(github.ref, 'refs/tags/v') || github.ref == 'refs/heads/main')
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: target-${{ matrix.os }}-${{ matrix.java }}-${{ matrix.scala }}-${{ matrix.project }}
           path: targets.tar
@@ -137,21 +137,21 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout current branch (full)
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           fetch-depth: 0
 
       - name: Download Java (temurin@11)
         id: download-java-temurin-11
         if: matrix.java == 'temurin@11'
-        uses: typelevel/download-java@v1
+        uses: typelevel/download-java@v2
         with:
           distribution: temurin
           java-version: 11
 
       - name: Setup Java (temurin@11)
         if: matrix.java == 'temurin@11'
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@v3
         with:
           distribution: jdkfile
           java-version: 11
@@ -160,21 +160,21 @@ jobs:
       - name: Download Java (temurin@17)
         id: download-java-temurin-17
         if: matrix.java == 'temurin@17'
-        uses: typelevel/download-java@v1
+        uses: typelevel/download-java@v2
         with:
           distribution: temurin
           java-version: 17
 
       - name: Setup Java (temurin@17)
         if: matrix.java == 'temurin@17'
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@v3
         with:
           distribution: jdkfile
           java-version: 17
           jdkFile: ${{ steps.download-java-temurin-17.outputs.jdkFile }}
 
       - name: Cache sbt
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         with:
           path: |
             ~/.sbt
@@ -186,7 +186,7 @@ jobs:
           key: ${{ runner.os }}-sbt-cache-v2-${{ hashFiles('**/*.sbt') }}-${{ hashFiles('project/build.properties') }}
 
       - name: Download target directories (2.12.17, rootJVM)
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@v3
         with:
           name: target-${{ matrix.os }}-${{ matrix.java }}-2.12.17-rootJVM
 
@@ -196,7 +196,7 @@ jobs:
           rm targets.tar
 
       - name: Download target directories (2.13.10, rootJVM)
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@v3
         with:
           name: target-${{ matrix.os }}-${{ matrix.java }}-2.13.10-rootJVM
 
@@ -206,7 +206,7 @@ jobs:
           rm targets.tar
 
       - name: Download target directories (3.2.1, rootJVM)
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@v3
         with:
           name: target-${{ matrix.os }}-${{ matrix.java }}-3.2.1-rootJVM
 
@@ -227,4 +227,4 @@ jobs:
           (echo "$PGP_PASSPHRASE"; echo; echo) | gpg --command-fd 0 --pinentry-mode loopback --change-passphrase $(gpg --list-secret-keys --with-colons 2> /dev/null | grep '^sec:' | cut --delimiter ':' --fields 5 | tail -n 1)
 
       - name: Publish
-        run: sbt '++${{ matrix.scala }}' tlRelease
+        run: sbt '++ ${{ matrix.scala }}' tlRelease

.scalafmt.conf

@@ -1,4 +1,4 @@
-version = 3.6.1
+version = 3.7.2
 runner.dialect = scala213
 continuationIndent.defnSite = 2
 docstrings.style = Asterisk

build.sbt

@@ -6,12 +6,12 @@ ThisBuild / tlFatalWarningsInCi := false //TODO: ... fix this someday
 ThisBuild / githubWorkflowBuildMatrixFailFast := Some(false)
 
 val Versions = new {
-  val circe = "0.14.3"
+  val circe = "0.14.4"
   val discipline = "1.5.1"
   val scalaCheck = "1.17.0"
-  val scalaTest = "3.2.14"
+  val scalaTest = "3.2.15"
   val scalaTestPlus = "3.2.11.0"
-  val snakeYaml = "1.33"
+  val snakeYaml = "2.0"
   val snakeYamlEngine = "2.6"
   val previousCirceYamls = Set("0.14.0", "0.14.1", "0.14.2")
 

circe-yaml/src/main/scala/io/circe/yaml/Parser.scala

@@ -66,11 +66,13 @@ final case class Parser(
   def parseDocuments(yaml: String): Stream[Either[ParsingFailure, Json]] = parseDocuments(new StringReader(yaml))
 
   private[this] def parseSingle(reader: Reader): Either[ParsingFailure, Node] =
-    Either.catchNonFatal(new Yaml(loaderOptions).compose(reader)).leftMap(err => ParsingFailure(err.getMessage, err))
+    Either
+      .catchNonFatal(new Yaml(new SafeConstructor(loaderOptions)).compose(reader))
+      .leftMap(err => ParsingFailure(err.getMessage, err))
 
   private[this] def parseStream(reader: Reader): Either[ParsingFailure, Stream[Node]] =
     Either
-      .catchNonFatal(new Yaml(loaderOptions).composeAll(reader).asScala.toStream)
+      .catchNonFatal(new Yaml(new SafeConstructor(loaderOptions)).composeAll(reader).asScala.toStream)
       .leftMap(err => ParsingFailure(err.getMessage, err))
 
   def copy(

circe-yaml/src/main/scala/io/circe/yaml/parser/package.scala

@@ -21,6 +21,7 @@ import cats.syntax.either._
 import io.circe._
 import org.yaml.snakeyaml.LoaderOptions
 import org.yaml.snakeyaml.Yaml
+import org.yaml.snakeyaml.constructor.SafeConstructor
 import org.yaml.snakeyaml.nodes._
 
 import java.io._
@@ -56,11 +57,13 @@ package object parser extends io.circe.yaml.common.Parser {
 
   @deprecated("moved to Parser.CustomTag", since = "0.14.2")
   private[this] def parseSingle(reader: Reader): Either[ParsingFailure, Node] =
-    Either.catchNonFatal(new Yaml(loaderOptions).compose(reader)).leftMap(err => ParsingFailure(err.getMessage, err))
+    Either
+      .catchNonFatal(new Yaml(new SafeConstructor(loaderOptions)).compose(reader))
+      .leftMap(err => ParsingFailure(err.getMessage, err))
 
   @deprecated("moved to Parser.CustomTag", since = "0.14.2")
   private[this] def parseStream(reader: Reader): Stream[Node] =
-    new Yaml(loaderOptions).composeAll(reader).asScala.toStream
+    new Yaml(new SafeConstructor(loaderOptions)).composeAll(reader).asScala.toStream
 
   @deprecated("moved to Parser.CustomTag", since = "0.14.2")
   private[this] object CustomTag {

project/build.properties

@@ -1 +1 @@
-sbt.version = 1.8.0
+sbt.version = 1.8.2

project/plugins.sbt

@@ -1 +1 @@
-addSbtPlugin("io.circe" % "sbt-circe-org" % "0.1.1")
+addSbtPlugin("io.circe" % "sbt-circe-org" % "0.1.2")