YAML library used

[felixfontein]

(Created from #1437 so we can add it to the discussion milestone.)

We're using go-yaml.v3 in SOPS. Unfortunately this library doesn't seem to be actively maintained anymore; the last commit is from May 2022, and there are quite a few bug reports and bugfix PRs that haven't been looked at / haven't progressed, some of them for years. (I got one myself, go-yaml/yaml#690, open since January 2021, last maintainer reaction in May 2021. This is blocking a bugfix on sops's side: #936 (comment))

Two issues have been created in the past in the repository asking whether it's still maintained, and the (single) maintainer always responded that it still is:

• Is this (v3) repo still maintained? go-yaml/yaml#788
• Is this library still maintained? go-yaml/yaml#776

Other projects have actually went on to fork go-yaml locally, like kubernetes-sigs:

• Request to create an official fork of go-yaml kubernetes-sigs/yaml#72
• Create a fork of go-yaml kubernetes-sigs/yaml#76

Maybe we should also consider switching to that fork? Or is anyone aware of other forks of go-yaml.v3, or even other actively maintained YAML libraries for Go?

[felixfontein]

There's another YAML library for Golang: https://github.com/goccy/go-yaml It seems to be actively maintained. Maybe we should consider migrating to that one? There seems to be no other actively maintained YAML library; the kubernetes-sigs fork only receives bugfixes the Kubernetes projects needs and only gets new features if the original go-yaml/yaml gets new features (which looks quite unlikely right now), and is not meant to be used by any non-Kubernetes projects.