pkg.sopackage field notes

brew / Rang 118

yq mit Homebrew installieren

Prüfe Installationswege, Executables, Metadaten und Sicherheitshinweise für yq in AI-Agent-Workflows.

Installation

Weitere Installationsbefehle

macOS

Homebrewverifiziert · 100%
brew install yq

provider-native install command

Überblick

Paketzusammenfassung

Process YAML, JSON, XML, CSV and properties documents from the CLI

Befehle und Aliase

  • yq

Verlauf

Projektgeschichte und Nutzung

Mike Farah’s yq is a portable Go command-line processor for YAML and neighboring structured formats, best understood as the “jq-shaped” tool package users reach for when sed, awk, or ad hoc Python would be too brittle for configuration files.

Projektgeschichte

The mikefarah/yq repository was created in 2015 and grew out of a very practical niche: manipulating YAML from shell scripts. Older v3 documentation described the goal as being the jq or sed of YAML files; the modern README broadens that into a lightweight processor for YAML, JSON, INI, XML, TOML, properties, CSV, and TSV while retaining jq-like expression syntax.

The v4 line became the modern identity of the project: a dependency-free Go binary, installable through package managers or containers, with a richer expression language for reading, updating, merging, converting, and editing files in place. That v3-to-v4 split is historically important because many examples, packages, and user questions distinguish Mike Farah’s yq from both older yq syntax and the separate kislyuk/yq wrapper around jq.

Adoptionsgeschichte

Adoption followed the rise of YAML-heavy infrastructure work: Kubernetes manifests, CI configuration, GitHub Actions workflows, Helm and Kustomize adjunct scripts, and release automation. The project documents Homebrew, snap, Docker/Podman, GitHub Action, and direct binary installation, and its repository badges track Docker pulls and GitHub release downloads.

The tool also became popular enough to create name-collision folklore: multiple unrelated tools are called yq, and users often have to verify whether their package manager installed Mike Farah’s Go implementation, kislyuk’s Python/jq wrapper, or an older major version.

Wie es verwendet wird

Typical usage is one-liner data surgery: read nested fields, update YAML in place, inject environment variables, merge files, convert YAML to JSON or XML to YAML, and compose expressions in CI scripts. Package users value that yq ships as a static-style Go binary, so it works well in minimal containers and build agents.

In package-nerd workflows, yq often sits next to jq: jq remains the canonical JSON processor, while yq handles the messy real-world files that package manifests, deployment descriptors, and CI systems store in YAML or adjacent formats.

Warum Paket-Nerds sich dafür interessieren

yq is one of the canonical examples of a small CLI becoming infrastructure glue. It saves package maintainers from writing custom parsers for YAML edits, and its availability across Homebrew, Linux distributions, Windows package managers, containers, and GitHub Actions makes it a dependable assumption in cross-platform scripts.

Its significance is also social: when someone says “install yq,” package nerds immediately ask which yq and which major version. That ambiguity is part of the package’s history.

Zeitleiste

  • 2015-09-26: The mikefarah/yq GitHub repository is created.
  • 2019-2020: v3 documentation describes yq as a lightweight portable YAML processor aiming to be the jq or sed of YAML files.
  • 2021: The v4 release line is active, with GitHub releases such as v4.9.0 and v4.10.0 published in May and July 2021.
  • 2020s: The project expands its documented format support beyond YAML and JSON to XML, INI, properties, CSV, TSV, TOML, and related structured data.

Related projects

  • Related projects include jq, kislyuk/yq, gojq, dasel, Kubernetes, Helm, Kustomize, GitHub Actions, Docker, and Podman.

Sicherheitslage

Risikostufe: grün

narrow executable package without higher-risk signals.

Risikoklassifikator

grün Risiko · niedrig Konfidenz · appliance

Warum

  • narrow executable package without higher-risk signals

Signale

  • metadata:no-higher-risk-signals

Installationsverhalten

  • Es wurden keine Homebrew-Bottle-Metadaten erfasst.

Empfohlene Prüfung

Prüfe vor unbeaufsichtigter Agent-Nutzung, ob das Tool Klartext-Credentials liest, Remote-Zustand schreibt, Artefakte veröffentlicht oder Plugins ausführt.

Executables

Installierte Executables

BefehlArtSichtbarkeitHinweis
yqExecutableindexiertes ExecutableAus dem lokalen Executable-Index erkannt.

Aktualität

Version und Aktualität

Diese Signale trennen das Alter der Seitengenerierung, Aktivität des Paketmanagers und Upstream-Release-Vergleich. Versionsrückstand wird nur gemeldet, wenn eine Evidenz-URL und vergleichbare Versionen vorhanden sind.

Seite generiert2026-08-03
Manager-Version4.53.3
Manager aktualisiert2026-07-25
lokale Datenunbekannt
Upstreamnicht verfügbar
neueste erkannte Versionnicht erkannt
  • OKEs wurden keine Aktualitätswarnungen generiert.

Installationsmetadaten

Paketmetadaten

Paketschlüsselbrew:yq
Version4.53.3
PaketmanagerHomebrew
Homepagehttps://github.com/mikefarah/yq
Repositoryhttps://github.com/mikefarah/yq
Zuletzt aktualisiert2026-07-25T21:32:50+02:00
Pulseupdated
Bottlenicht erfasst
Dienstkeiner deklariert

Quellspur

Aus Repository-Daten generiert

Diese Seite wird von av-web aus dem privaten Paket-SQLite-Artefakt bereitgestellt, das scripts/generate-pkg-sqlite.py erstellt.

Combined YAML source

View the package source record on GitHub.

combined/yq.yml

Verwendete Quellen

  • Geiger risk classifier
  • Nucleus package database
  • curated package history
  • pkgdb category and tag curation