
Security News
Free Certified Patch for Critical Rails Active Storage Vulnerability
Socket has released a free Certified Patch for a critical Rails Active Storage vulnerability, giving developers time to upgrade to a secure Rails version.
zeroparse.dev/alpha-parsers
Advanced tools
Parsers for common languages, written in ZeroParse and generated into Go with zp gen. They are packages of the one Go
module zeroparse.dev/alpha-parsers and depend only on the standard library and the ZeroParse runtime
(zeroparse.dev/zp/runtime): import one and parse, with nothing to generate or compile at run time.
| Language | Module | Specification | Checked against |
|---|---|---|---|
| CEL | zeroparse.dev/alpha-parsers/cel | The CEL language definition, as cel-go parses it | All 2,527 conformance tests of cel-spec; cel-go v0.32.0 (trees, offsets and literal values on 32,794 expressions; fuzz tests) |
| CSV | zeroparse.dev/alpha-parsers/csv | RFC 4180, with the leniencies of encoding/csv | 73 edge cases, encoding/csv (differential and fuzz tests) |
| CUE | zeroparse.dev/alpha-parsers/cue | The CUE Language Specification, as cue/parser v0.17.1 parses it | cue/parser: 4,061 sources of the CUE repository, 32,488 mutants, 15,000 generated inputs and 4,126 literals (trees, offsets and comments; no difference); fuzz tests |
| DuckDB SQL | zeroparse.dev/alpha-parsers/duckdb | DuckDB 1.5.6's SQL dialect | DuckDB 1.5.6 on 158,605 texts (acceptance, statement splitting and the AST of SELECT statements; 13 known deviations) |
| Go | zeroparse.dev/alpha-parsers/golang | The Go Programming Language Specification (go1.27), as go/parser parses it; ParseFile returns go/ast | go/parser: every file of GOROOT/src (whole trees, positions included), the programs embedded in its tests, mutations and fuzz tests (no difference) |
| JSON | zeroparse.dev/alpha-parsers/json | RFC 8259 | JSONTestSuite (every y_ and n_ case), encoding/json (differential and fuzz tests) |
| Python | zeroparse.dev/alpha-parsers/python | Python 3.14, as CPython 3.14.0 parses it | CPython's ast.dump, positions included, on the standard library, Lib/test and its 61,540 code snippets (no difference); mutation and fuzz tests |
| TypeScript | zeroparse.dev/alpha-parsers/typescript | TypeScript 5.9 and TSX, as the TypeScript 5.9.3 compiler parses them | The compiler's trees on its own test cases (14,799 of 14,804 files agree), its lib declaration files and mutated sources |
| XML | zeroparse.dev/alpha-parsers/xml | XML 1.0 (Fifth Edition), non-validating, with Namespaces in XML 1.0 | W3C XML Conformance Test Suite (no failure among the XML 1.0 tests that need no external entity), encoding/xml (differential and fuzz tests) |
| YAML | zeroparse.dev/alpha-parsers/yaml | YAML 1.2.2, with the core schema for Go values | yaml-test-suite (all 402 tests: events and JSON values) |
The module zeroparse.dev/alpha-parsers is not published, so go get zeroparse.dev/alpha-parsers/json does not work
from another module. It requires published versions of zeroparse.dev/zp and zeroparse.dev/zp/runtime, so a checkout
of this repository is all a parser needs. Use it in one of two ways.
With a go.work file next to your module's go.mod:
go work init .
go work use ~/src/alpha-parsers
or with a replace directive in your own go.mod:
require zeroparse.dev/alpha-parsers v0.0.0
replace zeroparse.dev/alpha-parsers => /path/to/alpha-parsers
(/path/to/alpha-parsers is the full path of your checkout; go.mod does not expand ~.) Run go mod tidy afterwards
to record the requirements of the module.
import "zeroparse.dev/alpha-parsers/json"
v, err := json.Decode(`{"name": "zp", "tags": ["peg", "operators-rule"]}`) // map[string]any{...}
ast, err := json.ParseAST(src) // typed values with positions
Every parser has the API of a parser generated with zp gen -types -recognize (see
code generation), plus functions written for its language:
ParseAST(input, opts...) | The document as the Go types the grammar declares, each with its Span in the input |
Parse(input, opts...) | The document as a tree of *Node, as the engine returns it |
Recognize(input, opts...) | Only checks the input, without building anything |
*SyntaxError | The position (Line, Col, Pos) and the expected tokens of a syntax error |
Positions are in code points by default; pass Bytes for byte offsets.
Each directory holds:
| File | Contents |
|---|---|
<language>.zp | The grammar. It can be used with the engine too (zp.CompileSource), for streaming, incremental parsing or the zp tools. |
parser.go, api.go, types/types.go | The parser generated from the grammar, the names it re-exports from the runtime, and the Go types of the grammar (the package types). The parser imports the runtime package zeroparse.dev/zp/runtime (generated with -runtime import). Do not edit them. |
other .go files | Code written for the language: documentation, conversions to Go values, helpers. Those in types/ hold the methods of the types of the grammar (a method can only be declared in the package of its type); what needs the parser or the decoder is a function of the module instead. |
*_test.go | Tests against the language's specification, conformance suites and reference implementations; examples; benchmarks |
testdata/*.txt, *.golden | Inputs and the expected trees and errors, checked on the generated parser here and on every backend of the engine by parsers_test.go |
From the root of the repository:
go generate . # regenerate every parser (after changing a grammar, the runtime or the generator)
go test . # generated files up to date; golden files on every backend of the engine
go test . -update # rewrite the golden files from the engine
./test.sh # fetch the test corpora, then vet and test every package
go test ./json/... # the tests of one parser
The generation commands are the go:generate lines of generate.go; the up-to-date test reads them, so a
new parser needs only a new line there. The third-party corpora of the tests are fetched, not stored here (see
development); a test whose corpus is not fetched is skipped with the command to run. Run ./test.sh against a
checkout of ZeroParse (with a go.work that uses both) after changing its engine or generator.
alpha-parsers is a preview of the ready-made parsers, kept apart from the ZeroParse repository. It requires
development versions of ZeroParse, and it is discarded when ZeroParse publishes its first release.
The grammars under testdata/grammars/ of ZeroParse are the copies that its tests read; the ones here are the sources
the parsers are generated from.
FAQs
Unknown package

Security News
Socket has released a free Certified Patch for a critical Rails Active Storage vulnerability, giving developers time to upgrade to a secure Rails version.

Security News
/Threat Research
A malicious Ruby gem runs a credential-stealing worm during installation, poisons AI coding tools, and can wipe files when a stolen GitHub token is revoked.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.