Remarshal

Latest version: v0.18.0

Safety actively analyzes 624001 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 1 of 4

0.18.0

Breaking changes:

- Support for Python 3.7 has been dropped.
- Multiple small changes to the Python API when using Remarshal as a library. For example, the order of arguments to the function `remarshal` has changed. A type checker like mypy or Pyright can help you upgrade.
- Remarshal finally encodes and decodes YAML as **YAML 1.2**, not YAML 1.1 like before. We have migrated from PyYAML to ruamel.yaml. This means no more "Norway problem" (unquoted `no` being decoded as boolean false). Remarshal can now correctly process GitHub Actions YAML. Support for the option `--sort-keys` for YAML output has been dropped. Because ruamel.yaml is not yet considered stable, the 1.0 release is postponed.

Other changes:

- **TOML decoding** should be at least **10× faster** on average.
- There are new format command-line options `-f`/`--from` and `-t`/`--to` like in Pandoc and iconv(1). We have hidden (but kept) `-if` and `-of` with a single dash. Those are legacy options from the Go days of Remarshal.
- A new `--verbose` command-line option has been added for debugging.
- The command-line interface and the help message have color. Color is used where appropriate. You can disable it by setting the environment variable `NO_COLOR`.
- Remarshal is now tested in PyPy and on macOS.

0.17.1

* Fixed a [billion laughs](https://en.wikipedia.org/wiki/Billion_laughs_attack) DoS vulnerability when converting from YAML. More information: [JVN86156389](https://jvn.jp/en/jp/JVN86156389/). [CVE-2023-47163](https://www.cve.org/CVERecord?id=CVE-2023-47163).

0.17.0

Not secure
* BREAKING CHANGE: Remarshal no longer turns boolean and null keys into strings by default when converting to JSON. The default is to exit with an error. The previous default could cause silent data corruption, for example, when converting a GitHub Actions workflow file with an unquoted `on` key from YAML to JSON. While this is a breaking change, it should not affect most users.
* The new flag `-k`/`--stringify` restores the old JSON conversion behavior of turning boolean and null keys into strings. Additionally, it turns date-time keys into strings and works for both JSON and TOML. it also converts null _values_ to strings for TOML, since TOML does not have null.

0.16.1

Not secure
* This version fixes the default JSON indentation setting. Line breaks are once again absent when you don't use `--json-indent`.
* Types have been filled in for mypy strict mode.

0.16.0

Not secure
* This version adds new command-line options: `--json-indent n`, `-s`/`--sort-keys`, `--yaml-indent n`, `--yaml-width n`. `--json-indent n` is a synonym for `--indent-json n` consistent with the YAML options. Prefer it to the older option.
* Preserving key order in JSON, TOML, and YAML types is now the default. Remarshal accepts the flag `-p`/`--preserve-key-order` for compatibility, but it does nothing. Pass `-s`/`--sort-keys` to enable the previous default behavior.
* The code has type annotations.
* The readme has been improved. It suggests better ways to run and install Remarshal. The mistaken claim that you can use a blank string for standard input/output (no long true since the Python rewrite in 2016!) is gone.

0.15.1

Not secure
This release updates metadata and infrastructure. There are no user-visible changes.

Page 1 of 4

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.