Fixes #87.

PR #58 incorrectly added gopkg.in/yaml.v3 (abandoned library) instead of
github.com/goccy/go-yaml as required by issue #57.

Changes:
- Replace gopkg.in/yaml.v3 with github.com/goccy/go-yaml v1.19.2
- Update review/persona.go to use goccy/go-yaml API:
  - parser.ParseBytes for AST-based depth/node count checking
  - yaml.Strict() decoder option instead of KnownFields(true)
  - ast.Node types instead of yaml.Node for tree walking
- Update review/persona_test.go to use ast types for cycle tests
- Remove gopkg.in/yaml.v3 from go.mod and go.sum

All existing YAML tests pass with the new library.

@@ -2,4 +2,4 @@ module gitea.weiker.me/rodin/review-bot
 
 go 1.26.2
 

@@ -179,2 +183,3 @@
+
 	nodeCount := 0
-	if err := checkYAMLDepth(&node, 0, maxDepth, MaxYAMLNodes, make(map[*yaml.Node]struct{}), &nodeCount); err != nil {
+	if err := checkYAMLDepth(file.Docs[0].Body, 0, maxDepth, MaxYAMLNodes, make(map[ast.Node]struct{}), &nodeCount); err != nil {

@@ -210,16 +216,43 @@ func checkYAMLDepth(node *yaml.Node, depth, maxDepth, maxNodes int, seen map[*ya
 	}
 	seen[node] = struct{}{}
 

@@ -460,3 +460,3 @@
 
 	// Build a deeply nested YAML structure that exceeds MaxYAMLDepth (20).
-	// Each level adds 2 to the depth count (key + value mapping).
+	// Each level adds to the depth count via mapping values.

@@ -3,3 +3,3 @@
 go 1.26.2
 
-require gopkg.in/yaml.v3 v3.0.1
+require github.com/goccy/go-yaml v1.19.2

@@ -11,3 +11,3 @@
 	"unicode/utf8"
 
-	"gopkg.in/yaml.v3"
+	"github.com/goccy/go-yaml"

@@ -167,2 +166,2 @@
-	dec := yaml.NewDecoder(bytes.NewReader(data))
-	if err := dec.Decode(&node); err != nil {
+	// First pass: parse into AST to check depth limits, node counts, and
+	// multi-document rejection. This prevents stack exhaustion before we

@@ -8,3 +8,3 @@
 	"testing"
 
-	"gopkg.in/yaml.v3"
+	"github.com/goccy/go-yaml/ast"

@@ -2,4 +2,4 @@ module gitea.weiker.me/rodin/review-bot
 
 go 1.26.2
 

@@ -161,39 +163,43 @@ func parsePersona(data []byte, source string) (*Persona, error) {
 // nested structures and catches typos in field names.

@@ -2,4 +2,4 @@ module gitea.weiker.me/rodin/review-bot
 
 go 1.26.2
 

@@ -11,3 +11,3 @@
 	"unicode/utf8"
 
-	"gopkg.in/yaml.v3"
+	"github.com/goccy/go-yaml"

@@ -483,6 +484,37 @@ func TestYAMLDeeplyNestedRejection(t *testing.T) {
 	}

@@ -3,3 +3,3 @@
 go 1.26.2
 
-require gopkg.in/yaml.v3 v3.0.1
+require github.com/goccy/go-yaml v1.19.2

@@ -11,3 +10,4 @@
+	"github.com/goccy/go-yaml/ast"
 )
 
 func TestLoadBuiltinPersona(t *testing.T) {

@@ -2,4 +2,4 @@ module gitea.weiker.me/rodin/review-bot
 
 go 1.26.2
 

@@ -483,6 +484,37 @@ func TestYAMLDeeplyNestedRejection(t *testing.T) {
 	}

@@ -161,39 +163,45 @@ func parsePersona(data []byte, source string) (*Persona, error) {
 // nested structures and catches typos in field names.

@@ -191,2 +193,4 @@
+	dec := yaml.NewDecoder(bytes.NewReader(data), yaml.Strict())
+	return dec.Decode(out)
 }
 

@@ -483,6 +484,37 @@ func TestYAMLDeeplyNestedRejection(t *testing.T) {
 	}

@@ -12,3 +12,3 @@
-- Library: use `gopkg.in/yaml.v3` (approved in CONVENTIONS.md) with explicit depth limiting
+- Library: use `github.com/goccy/go-yaml` v1.16.0+ (approved in CONVENTIONS.md); has built-in depth protection via `MaxYAMLDepth`/`MaxYAMLNodes` constants
 
 ## Proposed Approach

@@ -10,3 +10,3 @@
 - Security: protect against DoS via deeply nested YAML (AIKIDO-2024-10486)
 - Consistency: use `.yaml` extension (not `.yml`)
-- Library: use `gopkg.in/yaml.v3` (approved in CONVENTIONS.md) with explicit depth limiting
+- Library: use `github.com/goccy/go-yaml` v1.16.0+ (approved in CONVENTIONS.md); has built-in depth protection via `MaxYAMLDepth`/`MaxYAMLNodes` constants

@@ -168,1 +166,3 @@
-	if err := dec.Decode(&node); err != nil {
+	// First pass: parse into AST to check depth limits, node counts, and
+	// multi-document rejection. This prevents stack exhaustion before we
+	// attempt to decode into structs.

@@ -191,2 +193,4 @@
+	dec := yaml.NewDecoder(bytes.NewReader(data), yaml.Strict())
+	return dec.Decode(out)
 }
 

@@ -189,2 +192,2 @@
-	strictDec.KnownFields(true)
-	return strictDec.Decode(out)
+	// Strict() rejects unknown keys, catching typos like "focuss" or "identiy".
+	dec := yaml.NewDecoder(bytes.NewReader(data), yaml.Strict())

@@ -208,1 +216,4 @@
+	// concrete node types are pointers) to detect revisits. This intentionally
+	// compares pointer identity, not structural equality, since we want to track
+	// specific node instances in the parsed AST graph.
 	if _, ok := seen[node]; ok {

@@ -223,0 +243,4 @@
+			}
+		}
+	case *ast.AliasNode:
+		// Follow alias to its target, incrementing depth since aliases expand

@@ -10,3 +10,3 @@
 | Package | Use Case | Scope |
 |---------|----------|-------|
-| `gopkg.in/yaml.v3` | YAML parsing (persona files, config) | production |
+| `github.com/goccy/go-yaml` | YAML parsing (persona files, config) | production |

@@ -64,3 +64,3 @@
 ```
 
-The `gopkg.in/yaml.v3` library does not have built-in depth protection, so we implement explicit depth checking by first decoding into a `yaml.Node`, walking the tree to verify depth (including alias resolution), then decoding into the target struct.
+The `github.com/goccy/go-yaml` library provides built-in depth protection via `MaxYAMLDepth` and `MaxYAMLNodes` decoder options. We use these instead of a manual depth-checking walk.

@@ -161,39 +163,53 @@ func parsePersona(data []byte, source string) (*Persona, error) {
 // nested structures and catches typos in field names.

@@ -204,22 +220,64 @@ func checkYAMLDepth(node *yaml.Node, depth, maxDepth, maxNodes int, seen map[*ya
 		return fmt.Errorf("YAML node count exceeds maximum (%d)", maxNodes)

@@ -221,0 +244,4 @@
+	// Walk children based on node type.
+	switch n := node.(type) {
+	case *ast.MappingNode:
+		for _, value := range n.Values {

@@ -483,6 +484,37 @@ func TestYAMLDeeplyNestedRejection(t *testing.T) {
 	}

@@ -10,3 +10,3 @@
 | Package | Use Case | Scope |
 |---------|----------|-------|
-| `gopkg.in/yaml.v3` | YAML parsing (persona files, config) | production |
+| `github.com/goccy/go-yaml` | YAML parsing (persona files, config) | production |

@@ -161,39 +163,53 @@ func parsePersona(data []byte, source string) (*Persona, error) {
 // nested structures and catches typos in field names.

@@ -204,22 +220,64 @@ func checkYAMLDepth(node *yaml.Node, depth, maxDepth, maxNodes int, seen map[*ya
 		return fmt.Errorf("YAML node count exceeds maximum (%d)", maxNodes)

@@ -486,0 +489,4 @@
+
+	tests := []struct {
+		name    string
+		content string

@@ -10,3 +10,3 @@
 | Package | Use Case | Scope |
 |---------|----------|-------|
-| `gopkg.in/yaml.v3` | YAML parsing (persona files, config) | production |
+| `github.com/goccy/go-yaml` | YAML parsing (persona files, config) | production |

@@ -161,39 +163,53 @@ func parsePersona(data []byte, source string) (*Persona, error) {
 // nested structures and catches typos in field names.

@@ -217,1 +226,4 @@
+	// property, not a depth violation.
+	if visiting[node] {
+		return nil
 	}

@@ -10,3 +10,3 @@
 | Package | Use Case | Scope |
 |---------|----------|-------|
-| `gopkg.in/yaml.v3` | YAML parsing (persona files, config) | production |
+| `github.com/goccy/go-yaml` | YAML parsing (persona files, config) | production |

@@ -10,3 +10,3 @@
 - Security: protect against DoS via deeply nested YAML (AIKIDO-2024-10486)
 - Consistency: use `.yaml` extension (not `.yml`)
-- Library: use `gopkg.in/yaml.v3` (approved in CONVENTIONS.md) with explicit depth limiting
+- Library: use `github.com/goccy/go-yaml` v1.16.0+ (approved in CONVENTIONS.md); we implement custom AST-based depth/node-count checks for precise alias-aware validation

@@ -194,3 +198,1 @@
-// or the total node count limit. It also detects alias cycles to prevent infinite
-// recursion from crafted YAML with self-referential aliases.
-func checkYAMLDepth(node *yaml.Node, depth, maxDepth, maxNodes int, seen map[*yaml.Node]struct{}, nodeCount *int) error {
+// checkYAMLDepth recursively checks that YAML AST nodes don't exceed the depth

@@ -197,0 +210,4 @@
+	if node == nil {
+		return nil
+	}
+

@@ -459,7 +459,8 @@ func TestYAMLDeeplyNestedRejection(t *testing.T) {
 	path := filepath.Join(dir, "deeply-nested.yaml")
 
 	// Build a deeply nested YAML structure that exceeds MaxYAMLDepth (20).

@@ -162,2 +164,3 @@
-// Multi-document YAML files are rejected to prevent silent data loss.
+// Multi-document YAML files are rejected to prevent confusing behavior
+// where additional documents are silently ignored.
 func unmarshalYAMLWithDepthLimit(data []byte, out any, maxDepth int) error {

@@ -11,3 +11,3 @@
 |---------|----------|-------|
-| `gopkg.in/yaml.v3` | YAML parsing (persona files, config) | production |
+| `github.com/goccy/go-yaml` | YAML parsing (persona files, config) | production |
 | `github.com/google/go-cmp` | Test comparisons (`cmp.Diff`) | test only |

@@ -191,2 +194,4 @@
+	dec := yaml.NewDecoder(bytes.NewReader(data), yaml.Strict())
+	return dec.Decode(out)
 }
 

@@ -218,3 +249,2 @@
 
-	for _, child := range node.Content {
-		if err := checkYAMLDepth(child, depth+1, maxDepth, maxNodes, seen, nodeCount); err != nil {
+	// Walk children based on node type.

@@ -483,6 +489,36 @@ func TestYAMLDeeplyNestedRejection(t *testing.T) {
 	}

@@ -144,3 +146,3 @@
 		// Use json.Decoder with DisallowUnknownFields for consistency with
-		// YAML's KnownFields(true) - both reject unknown fields to catch typos.
+		// YAML's Strict() - both reject unknown fields to catch typos.
 		dec := json.NewDecoder(bytes.NewReader(data))

@@ -197,0 +207,4 @@
+// at a shallow depth could be referenced via alias at a greater depth, effectively
+// exceeding MaxYAMLDepth.
+func checkYAMLDepth(node ast.Node, depth, maxDepth, maxNodes int, validated map[ast.Node]int, visiting map[ast.Node]bool, nodeCount *int) error {
+	if node == nil {

@@ -149,0 +151,4 @@
+			// Reject trailing content after the first valid JSON object.
+			// Without this check, input like `{"name":"x"}garbage` would
+			// silently succeed because Decoder stops after one object.
+			var dummy json.RawMessage

@@ -201,1 +231,4 @@
+		return nil
+	}
+
 	// Track total nodes visited as defense-in-depth against wide-but-shallow attacks.

@@ -483,6 +489,36 @@ func TestYAMLDeeplyNestedRejection(t *testing.T) {
 	}

@@ -146,3 +147,4 @@
 		dec := json.NewDecoder(bytes.NewReader(data))
 		dec.DisallowUnknownFields()
 		err = dec.Decode(&p)
+		if err == nil {

@@ -181,4 +197,4 @@
 		return err
 	}
 
 	// Second pass: decode with strict field checking enabled.

@@ -179,3 +195,3 @@
 	nodeCount := 0
-	if err := checkYAMLDepth(&node, 0, maxDepth, MaxYAMLNodes, make(map[*yaml.Node]struct{}), &nodeCount); err != nil {
+	if err := checkYAMLDepth(file.Docs[0].Body, 0, maxDepth, MaxYAMLNodes, make(map[ast.Node]int), make(map[ast.Node]bool), &nodeCount); err != nil {
 		return err

@@ -209,1 +245,3 @@
-		return nil // Already validated this subtree, skip to avoid infinite recursion.
+	// Depth-aware short-circuit: only skip re-checking a node if we previously
+	// validated it at the same or deeper effective depth. If this visit is at a
+	// greater depth than before (e.g., alias referenced deeper in the tree),

@@ -483,6 +489,36 @@ func TestYAMLDeeplyNestedRejection(t *testing.T) {
 	}

@@ -11,3 +11,3 @@
 |---------|----------|-------|
-| `gopkg.in/yaml.v3` | YAML parsing (persona files, config) | production |
+| `github.com/goccy/go-yaml` | YAML parsing (persona files, config) | production |
 | `github.com/google/go-cmp` | Test comparisons (`cmp.Diff`) | test only |

@@ -191,2 +202,4 @@
+	dec := yaml.NewDecoder(bytes.NewReader(data), yaml.Strict())
+	return dec.Decode(out)
 }
 

@@ -208,2 +245,2 @@
-	if _, ok := seen[node]; ok {
-		return nil // Already validated this subtree, skip to avoid infinite recursion.
+	// Depth-aware short-circuit: only skip re-checking a node if we previously
+	// validated it at the same or deeper effective depth. If this visit is at a

@@ -223,0 +273,4 @@
+	case *ast.SequenceNode:
+		for _, value := range n.Values {
+			if err := checkYAMLDepth(value, depth+1, maxDepth, maxNodes, validated, visiting, nodeCount); err != nil {
+				return err

@@ -463,1 +466,4 @@
+	//   - Each levelN mapping adds +1 depth (MappingNode → MappingValueNode → value)
+	//   - After 25 levels: effective depth reaches ~27, well past MaxYAMLDepth (20)
+	// The test uses 25 levels to provide a comfortable margin above the limit.
 	var sb strings.Builder

@@ -33,37 +33,16 @@ func parsePersona(data []byte, source string) (*Persona, error) {
 

@@ -197,4 +222,4 @@
 	if depth > maxDepth {
 		return fmt.Errorf("YAML nesting depth exceeds maximum (%d)", maxDepth)
 	}
 

@@ -21,6 +21,8 @@ To request a new dependency:
 2. Requires explicit approval from Aaron
 3. After merge, a separate PR may use the package
 
+<!-- Deviation from step 1+3 for go-yaml migration: see #91 for rationale. -->

@@ -181,3 +196,4 @@
+	if err := checkYAMLDepth(file.Docs[0].Body, 0, maxDepth, MaxYAMLNodes, make(map[ast.Node]int), make(map[ast.Node]bool), &nodeCount); err != nil {
 		return err
 	}
 

@@ -483,6 +490,35 @@ func TestYAMLDeeplyNestedRejection(t *testing.T) {
 	}
 }
 

@@ -223,0 +308,4 @@
+			return err
+		}
+	default:
+		// Scalar leaf nodes (StringNode, IntegerNode, FloatNode, BoolNode,

@@ -176,4 +192,4 @@
 		return fmt.Errorf("multi-document YAML is not supported; only single-document files are allowed")
 	}
 
 	nodeCount := 0

@@ -194,3 +211,1 @@
-// or the total node count limit. It also detects alias cycles to prevent infinite
-// recursion from crafted YAML with self-referential aliases.
-func checkYAMLDepth(node *yaml.Node, depth, maxDepth, maxNodes int, seen map[*yaml.Node]struct{}, nodeCount *int) error {
+// checkYAMLDepth recursively checks that YAML AST nodes don't exceed the depth

@@ -210,0 +255,4 @@
+	// Note: using ast.Node (interface) as map key relies on pointer identity,
+	// which is correct because all goccy/go-yaml AST node types are pointer
+	// receivers (*MappingNode, *SequenceNode, etc.), never value types.
+	if prevDepth, ok := validated[node]; ok && depth <= prevDepth {

@@ -486,3 +521,4 @@
+
 func TestYAMLFileSizeLimit(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "huge.yaml")

@@ -21,6 +21,8 @@ To request a new dependency:
 2. Requires explicit approval from Aaron
 3. After merge, a separate PR may use the package
 
+<!-- Deviation from step 1+3 for go-yaml migration: see #91 for rationale. -->

@@ -172,0 +183,4 @@
+	// The parser returns a single doc with nil body for these cases.
+	if len(file.Docs) == 0 || file.Docs[0].Body == nil {
+		return fmt.Errorf("empty YAML document")
+	}

@@ -197,0 +221,4 @@
+func checkYAMLDepth(node ast.Node, depth, maxDepth, maxNodes int, validated map[ast.Node]int, visiting map[ast.Node]bool, nodeCount *int) error {
+	if node == nil {
+		return nil
+	}

@@ -9,7 +9,7 @@
 

@@ -191,0 +203,4 @@
+	// recursively — it resolves them via the pre-built AST, which our first
+	// pass already depth-checked. Alias chains that would exceed depth limits
+	// are caught above; the decoder merely reads the resolved scalar values.
+	dec := yaml.NewDecoder(bytes.NewReader(data), yaml.Strict())

@@ -11,3 +11,3 @@
 |---------|----------|-------|
-| `gopkg.in/yaml.v3` | YAML parsing (persona files, config) | production |
+| `github.com/goccy/go-yaml` | YAML parsing (persona files, config) | production |
 | `github.com/google/go-cmp` | Test comparisons (`cmp.Diff`) | test only |

@@ -191,0 +202,4 @@
+	// Safety note: goccy/go-yaml's decoder does not expand YAML aliases
+	// recursively — it resolves them via the pre-built AST, which our first
+	// pass already depth-checked. Alias chains that would exceed depth limits
+	// are caught above; the decoder merely reads the resolved scalar values.

@@ -202,3 +243,4 @@
+	// security posture for untrusted YAML input.
 	*nodeCount++
 	if *nodeCount > maxNodes {
 		return fmt.Errorf("YAML node count exceeds maximum (%d)", maxNodes)

@@ -221,0 +273,4 @@
+			if err := checkYAMLDepth(value, depth+1, maxDepth, maxNodes, validated, visiting, nodeCount); err != nil {
+				return err
+			}
+		}

@@ -463,0 +466,4 @@
+	//   - Each levelN adds depth via MappingValueNode traversal (key + value)
+	//   - Exact depth per level depends on AST structure (MappingNode wrapping),
+	//     but 25 levels reliably exceeds MaxYAMLDepth (20) with comfortable margin.
+	// The test uses 25 levels rather than exactly 21 to avoid brittleness.