pkg.sopackage field notes

brew / rank 118

Install yq with Homebrew

Process YAML, JSON, XML, CSV and properties documents from the CLI. Version 4.53.3 via Homebrew; verified 2026-07-25.

install

Additional install commands

macOS

Homebrewverified · 100%
brew install yq

provider-native install command

overview

Package summary

Process YAML, JSON, XML, CSV and properties documents from the CLI

Commands and aliases

  • yq

history

Project history and usage

Mike Farah’s yq is a portable Go command-line processor for YAML and neighboring structured formats, best understood as the “jq-shaped” tool package users reach for when sed, awk, or ad hoc Python would be too brittle for configuration files.

Project history

The mikefarah/yq repository was created in 2015 and grew out of a very practical niche: manipulating YAML from shell scripts. Older v3 documentation described the goal as being the jq or sed of YAML files; the modern README broadens that into a lightweight processor for YAML, JSON, INI, XML, TOML, properties, CSV, and TSV while retaining jq-like expression syntax.

The v4 line became the modern identity of the project: a dependency-free Go binary, installable through package managers or containers, with a richer expression language for reading, updating, merging, converting, and editing files in place. That v3-to-v4 split is historically important because many examples, packages, and user questions distinguish Mike Farah’s yq from both older yq syntax and the separate kislyuk/yq wrapper around jq.

Adoption history

Adoption followed the rise of YAML-heavy infrastructure work: Kubernetes manifests, CI configuration, GitHub Actions workflows, Helm and Kustomize adjunct scripts, and release automation. The project documents Homebrew, snap, Docker/Podman, GitHub Action, and direct binary installation, and its repository badges track Docker pulls and GitHub release downloads.

The tool also became popular enough to create name-collision folklore: multiple unrelated tools are called yq, and users often have to verify whether their package manager installed Mike Farah’s Go implementation, kislyuk’s Python/jq wrapper, or an older major version.

How it is used

Typical usage is one-liner data surgery: read nested fields, update YAML in place, inject environment variables, merge files, convert YAML to JSON or XML to YAML, and compose expressions in CI scripts. Package users value that yq ships as a static-style Go binary, so it works well in minimal containers and build agents.

In package-nerd workflows, yq often sits next to jq: jq remains the canonical JSON processor, while yq handles the messy real-world files that package manifests, deployment descriptors, and CI systems store in YAML or adjacent formats.

Why package nerds care

yq is one of the canonical examples of a small CLI becoming infrastructure glue. It saves package maintainers from writing custom parsers for YAML edits, and its availability across Homebrew, Linux distributions, Windows package managers, containers, and GitHub Actions makes it a dependable assumption in cross-platform scripts.

Its significance is also social: when someone says “install yq,” package nerds immediately ask which yq and which major version. That ambiguity is part of the package’s history.

Timeline

  • 2015-09-26: The mikefarah/yq GitHub repository is created.
  • 2019-2020: v3 documentation describes yq as a lightweight portable YAML processor aiming to be the jq or sed of YAML files.
  • 2021: The v4 release line is active, with GitHub releases such as v4.9.0 and v4.10.0 published in May and July 2021.
  • 2020s: The project expands its documented format support beyond YAML and JSON to XML, INI, properties, CSV, TSV, TOML, and related structured data.

Related projects

  • Related projects include jq, kislyuk/yq, gojq, dasel, Kubernetes, Helm, Kustomize, GitHub Actions, Docker, and Podman.

security posture

Risk level: green

narrow executable package without higher-risk signals.

Risk classifier

green risk · low confidence · appliance

Why

  • narrow executable package without higher-risk signals

Signals

  • metadata:no-higher-risk-signals

Install behavior

  • No Homebrew bottle metadata was recorded.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

CommandKindExposureNote
yqexecutableindexed executableDiscovered from the local executable index.

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-08-03
manager version4.53.3
manager updated2026-07-25
local dataunknown
upstreamnot available
latest detectednot detected
  • okNo freshness warnings were generated.

install metadata

Package metadata

Package keybrew:yq
Version4.53.3
Package managerHomebrew
Homepagehttps://github.com/mikefarah/yq
Repositoryhttps://github.com/mikefarah/yq
Last updated2026-07-25T21:32:50+02:00
Pulseupdated
Bottlenot recorded
Servicenone declared

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Combined YAML source

View the package source record on GitHub.

combined/yq.yml

Used sources

  • Geiger risk classifier
  • Nucleus package database
  • curated package history
  • pkgdb category and tag curation