Migrate to SnakeYAML Engine

CHANGELOG.md

@@ -9,6 +9,7 @@
 * Fix #4818: [java-generator] Escape `*/` in generated JavaDocs
 
 #### Improvements
+* Fix #4747: migrate to SnakeYAML Engine
 * Fix #4800: (java-generator) Reflect the `scope` field when implementing the `Namespaced` interface
 * Fix #4739: honor optimistic concurrency control semantics in the mock server for `PUT` and `PATCH` requests.
 * Fix #4644: generate CRDs in parallel and optimize code

extensions/istio/tests/src/test/java/io/fabric8/istio/test/v1beta1/GatewayTest.java

@@ -28,7 +28,8 @@
 import okhttp3.mockwebserver.RecordedRequest;
 import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
-import org.yaml.snakeyaml.Yaml;
+import org.snakeyaml.engine.v2.api.Load;
+import org.snakeyaml.engine.v2.api.LoadSettings;
 
 import java.net.HttpURLConnection;
 import java.util.Collections;
@@ -142,8 +143,7 @@ void checkBasicGateway() throws Exception {
         .build();
 
     final String output = Serialization.yamlMapper().writeValueAsString(gateway);
-    Yaml parser = new Yaml();
-    final Map<String, Object> reloaded = parser.loadAs(output, Map.class);
+    final Map<String, Object> reloaded = loadYaml(output);
 
     assertEquals("Gateway", reloaded.get("kind"));
 
@@ -186,4 +186,9 @@ void checkBasicGateway() throws Exception {
     final Map<String, String> tls = server.get("tls");
     assertEquals("TLSV1_2", tls.get("minProtocolVersion"));
   }
+
+  private Map<String, Object> loadYaml(String output) {
+    Load parser = new Load(LoadSettings.builder().build());
+    return (Map<String, Object>) parser.loadFromString(output);
+  }
 }

extensions/istio/tests/src/test/java/io/fabric8/istio/test/v1beta1/VirtualServiceTest.java

@@ -37,7 +37,8 @@
 import okhttp3.mockwebserver.RecordedRequest;
 import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
-import org.yaml.snakeyaml.Yaml;
+import org.snakeyaml.engine.v2.api.Load;
+import org.snakeyaml.engine.v2.api.LoadSettings;
 
 import java.io.IOException;
 import java.io.InputStream;
@@ -185,8 +186,7 @@ void checkBasicVirtualService() throws Exception {
 
     final String output = Serialization.yamlMapper().writeValueAsString(virtualService);
 
-    Yaml parser = new Yaml();
-    final Map<String, Object> reloaded = parser.loadAs(output, Map.class);
+    final Map<String, Object> reloaded = loadYaml(output);
 
     assertEquals("VirtualService", reloaded.get("kind"));
 
@@ -267,8 +267,7 @@ void checkVirtualServiceWithMatch() throws IOException {
         .build();
 
     final String output = Serialization.yamlMapper().writeValueAsString(resource);
-    Yaml parser = new Yaml();
-    final Map<String, Object> reloaded = parser.loadAs(output, Map.class);
+    final Map<String, Object> reloaded = loadYaml(output);
 
     assertEquals("VirtualService", reloaded.get("kind"));
 
@@ -352,8 +351,7 @@ void checkVirtualServiceWithPortSelector() throws IOException {
         .build();
 
     final String output = Serialization.yamlMapper().writeValueAsString(resource);
-    Yaml parser = new Yaml();
-    final Map<String, Object> reloaded = parser.loadAs(output, Map.class);
+    final Map<String, Object> reloaded = loadYaml(output);
 
     assertEquals("VirtualService", reloaded.get("kind"));
 
@@ -466,4 +464,9 @@ void allowCredentialsShouldWork() throws IOException {
 
     assertFalse(virtualService.getSpec().getHttp().get(0).getCorsPolicy().getAllowCredentials());
   }
+
+  private Map<String, Object> loadYaml(String output) {
+    Load parser = new Load(LoadSettings.builder().build());
+    return (Map<String, Object>) parser.loadFromString(output);
+  }
 }

kubernetes-client-api/pom.xml

@@ -137,18 +137,12 @@
       <artifactId>slf4j-api</artifactId>
     </dependency>
     <dependency>
-      <groupId>org.yaml</groupId>
-      <artifactId>snakeyaml</artifactId>
+      <groupId>org.snakeyaml</groupId>
+      <artifactId>snakeyaml-engine</artifactId>
     </dependency>
     <dependency>
       <groupId>com.fasterxml.jackson.dataformat</groupId>
       <artifactId>jackson-dataformat-yaml</artifactId>
-      <exclusions>
-        <exclusion>
-          <groupId>org.yaml</groupId>
-          <artifactId>snakeyaml</artifactId>
-        </exclusion>
-      </exclusions>
     </dependency>
     <dependency>
       <groupId>com.fasterxml.jackson.datatype</groupId>

kubernetes-client-api/src/main/java/io/fabric8/kubernetes/client/utils/Serialization.java

@@ -26,12 +26,8 @@
 import io.fabric8.kubernetes.api.model.runtime.RawExtension;
 import io.fabric8.kubernetes.client.KubernetesClientException;
 import io.fabric8.kubernetes.model.jackson.UnmatchedFieldTypeModule;
-import org.yaml.snakeyaml.DumperOptions;
-import org.yaml.snakeyaml.Yaml;
-import org.yaml.snakeyaml.constructor.SafeConstructor;
-import org.yaml.snakeyaml.nodes.Tag;
-import org.yaml.snakeyaml.representer.Representer;
-import org.yaml.snakeyaml.resolver.Resolver;
+import org.snakeyaml.engine.v2.api.Load;
+import org.snakeyaml.engine.v2.api.LoadSettings;
 
 import java.io.BufferedInputStream;
 import java.io.ByteArrayInputStream;
@@ -253,9 +249,8 @@ private static <T> T unmarshal(InputStream is, ObjectMapper mapper, TypeReferenc
 
       final T result;
       if (intch != '{' && intch != '[') {
-        final Yaml yaml = new Yaml(new SafeConstructor(), new Representer(), new DumperOptions(),
-            new CustomYamlTagResolverWithLimit());
-        final Object obj = yaml.load(bis);
+        final Load yaml = new Load(LoadSettings.builder().build());
+        final Object obj = yaml.loadFromInputStream(bis);
         if (obj instanceof Map) {
           result = mapper.convertValue(obj, type);
         } else {
@@ -439,17 +434,4 @@ public static <T> T clone(T resource) {
       throw new IllegalStateException(e);
     }
   }
-
-  private static class CustomYamlTagResolverWithLimit extends Resolver {
-    @Override
-    public void addImplicitResolver(Tag tag, Pattern regexp, String first, int limit) {
-      if (tag == Tag.TIMESTAMP)
-        return;
-      if (tag.equals(Tag.BOOL)) {
-        regexp = Pattern.compile("^(?:true|True|TRUE|false|False|FALSE)$");
-        first = "tTfF";
-      }
-      super.addImplicitResolver(tag, regexp, first, limit);
-    }
-  }
 }

kubernetes-client-api/src/test/java/io/fabric8/kubernetes/client/utils/SerializationYamlTest.java

@@ -19,7 +19,7 @@
 import org.junit.jupiter.api.Disabled;
 import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
-import org.yaml.snakeyaml.constructor.ConstructorException;
+import org.snakeyaml.engine.v2.exceptions.ConstructorException;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.junit.jupiter.api.Assertions.assertThrows;

platforms/karaf/features/src/main/resources/feature.xml

@@ -24,7 +24,8 @@
     <bundle dependency='true'>mvn:com.fasterxml.jackson.core/jackson-databind/${jackson.bundle.version}</bundle>
     <bundle dependency='true'>mvn:com.fasterxml.jackson.dataformat/jackson-dataformat-yaml/${jackson.bundle.version}</bundle>
     <bundle dependency='true'>mvn:com.fasterxml.jackson.datatype/jackson-datatype-jsr310/${jackson.bundle.version}</bundle>
-    <bundle dependency='true'>mvn:org.yaml/snakeyaml/${snakeyaml.version}</bundle>
+    <bundle dependency='true'>mvn:org.yaml/snakeyaml/${snakeyaml.bundle.version}</bundle>
+    <bundle dependency='true'>mvn:org.snakeyaml/snakeyaml-engine/${snakeyaml.version}</bundle>
     <bundle dependency='true'>mvn:org.apache.servicemix.bundles/org.apache.servicemix.bundles.generex/${generex.bundle.version}</bundle>
     <bundle dependency='true'>mvn:org.apache.servicemix.bundles/org.apache.servicemix.bundles.automaton/${automaton.bundle.version}</bundle>
     <bundle dependency='true'>mvn:org.apache.servicemix.bundles/org.apache.servicemix.bundles.conscrypt-openjdk/${conscrypt-openjdk-uber.bundle.version}</bundle>

pom.xml

@@ -112,7 +112,8 @@
     <zjsonpatch.version>0.3.0</zjsonpatch.version>
     <slf4j.version>1.7.36</slf4j.version>
     <lombok.version>1.18.26</lombok.version>
-    <snakeyaml.version>1.33</snakeyaml.version>
+    <snakeyaml.version>2.5</snakeyaml.version>
+    <snakeyaml.bundle.version>1.33</snakeyaml.bundle.version>
     <bouncycastle.version>1.70</bouncycastle.version>
     <commons-compress.version>1.22</commons-compress.version>
     <scr.annotations.version>1.12.0</scr.annotations.version>
@@ -683,8 +684,8 @@
       </dependency>
 
       <dependency>
-        <groupId>org.yaml</groupId>
-        <artifactId>snakeyaml</artifactId>
+        <groupId>org.snakeyaml</groupId>
+        <artifactId>snakeyaml-engine</artifactId>
         <version>${snakeyaml.version}</version>
       </dependency>