
Security News
TeamPCP and BreachForums Launch $1,000 Contest for Supply Chain Attacks
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.
psych-pure
Advanced tools
Psych::Pure is a YAML library written in Ruby. It functions as an extension of Psych, the main CRuby YAML library. The circumstances under which you may choose this library are:
libyaml and/or you want to avoid a native dependency.Note that this library comes with a couple of caveats:
Psych::Parser.Add this line to your application's Gemfile:
gem "psych-pure"
And then execute:
$ bundle install
Or install it yourself as:
$ gem install psych-pure
Psych::Pure largely mirrors the various Psych APIs. The main entrypoints are:
Psych::Pure.parse(source) - parses a YAML string into a YAML syntax treePsych::Pure.load(source) - loads a YAML string into a Ruby objectPsych::Pure.dump(object) - dumps a Ruby object to a YAML stringAll of the various parse APIs come with the additional comments: keyword option. This option tells the parser to parse out comments and attach them to the resulting tree. Nodes in the tree are then responsible for maintaining their own leading and trailing comments.
All of the various load APIs also come with the additional comments: keyword option. This also gets fed into the parser. Because load is responsible for loading Ruby objects, the comments are then attached to the loaded objects via delegators that wraps the objects and stores the leading and trailing comments. Those objects are then taken into account in the various dump APIs to dump out the comments as well. For example:
result = Psych::Pure.load("- a # comment1\n- c # comment2\n", comments: true)
# => ["a", "c"]
result.insert(1, "b")
# => ["a", "b", "c"]
puts Psych::Pure.dump(result)
# ---
# - a # comment1
# - b
# - c # comment2
Bug reports and pull requests are welcome on GitHub at https://github.com/kddnewton/psych-pure.
The gem is available as open source under the terms of the MIT License.
FAQs
Unknown package
We found that psych-pure demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.

Security News
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.

Research
GemStuffer abuses RubyGems as an exfiltration channel, packaging scraped UK council portal data into junk gems published from new accounts.