fix(ai): use go.yaml.in/yaml/v3 to parse model card frontmatter (#5328)

* fix(ai): use go.yaml.in/yaml/v3 to parse model card frontmatter

gopkg.in/yaml.v3 panics on some malformed merge-key payloads (for
example "<<:\r? 0:"), which crashed the gguf and safetensors catalogers
when a model README contained such frontmatter. Switch the Hugging Face
frontmatter parser to the maintained go.yaml.in/yaml/v3 fork, which is
already used by the other catalogers and returns an error instead of
panicking. The existing error path logs and skips the frontmatter.

Fixes #5327

Signed-off-by: tk1475 <118763009+tk1475@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* chore: finish moving off gopkg.in/yaml.v3

- move the snap catalogers and `internal/capabilities` to `go.yaml.in/yaml/v3`. The snap parsers decode yaml from scanned sources and hit the same merge-key panic as #5327
- enable `depguard` with a deny rule for `gopkg.in/yaml.v3` so it can't be reintroduced

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: tk1475 <118763009+tk1475@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>

.golangci.yaml

@@ -7,6 +7,7 @@ linters:
     - asciicheck
     - bodyclose
     - copyloopvar
+    - depguard
     - dogsled
     - dupl
     - errcheck
@@ -29,6 +30,13 @@ linters:
     - unused
     - whitespace
   settings:
+    depguard:
+      rules:
+        yaml:
+          deny:
+            # gopkg.in/yaml.v3 is unmaintained and panics on some malformed input (see #5327)
+            - pkg: gopkg.in/yaml.v3
+              desc: use go.yaml.in/yaml/v3 instead
     funlen:
       lines: 70
       statements: 50
@@ -71,7 +79,6 @@ linters:
 
 # do not enable...
 #    - deadcode          # The owner seems to have abandoned the linter. Replaced by "unused".
-#    - depguard          # We don't have a configuration for this yet
 #    - goprintffuncname  # does not catch all cases and there are exceptions
 #    - nakedret          # does not catch all cases and should not fail a build
 #    - gochecknoglobals

go.mod

@@ -97,7 +97,6 @@ require (
 	golang.org/x/net v0.59.0
 	golang.org/x/time v0.16.0
 	golang.org/x/tools v0.50.0
-	gopkg.in/yaml.v3 v3.0.1
 	modernc.org/sqlite v1.59.0
 )
 

internal/capabilities/capabilities.go

@@ -9,7 +9,7 @@ import (
 	"sort"
 
 	"github.com/scylladb/go-set/strset"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	"github.com/anchore/syft/internal/task"
 )

internal/capabilities/generate/io.go

@@ -1,4 +1,4 @@
-// this file handles YAML file reading and writing with comment preservation, using gopkg.in/yaml.v3's node tree to maintain all existing comments during regeneration.
+// this file handles YAML file reading and writing with comment preservation, using go.yaml.in/yaml/v3's node tree to maintain all existing comments during regeneration.
 package main
 
 import (
@@ -6,7 +6,7 @@ import (
 	"os"
 	"regexp"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	"github.com/anchore/syft/internal/capabilities"
 	"github.com/anchore/syft/internal/capabilities/internal"

internal/capabilities/generate/io_test.go

@@ -4,7 +4,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 func TestFindFieldValue(t *testing.T) {

internal/capabilities/internal/load_capabilities.go

@@ -5,7 +5,7 @@ import (
 	"os"
 	"path/filepath"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	"github.com/anchore/syft/internal/capabilities"
 )

internal/capabilities/model_test.go

@@ -5,7 +5,7 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 func TestConfigSchemaExtensions(t *testing.T) {

syft/pkg/cataloger/ai/huggingface.go

@@ -3,7 +3,7 @@ package ai
 import (
 	"bytes"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg"

syft/pkg/cataloger/ai/parse_safetensors_test.go

@@ -1066,6 +1066,12 @@ func TestParseFrontmatter(t *testing.T) {
 			input:   "---\nlicense: mit\n",
 			wantNil: true,
 		},
+		{
+			// https://github.com/anchore/syft/issues/5327
+			name:    "malformed frontmatter that panics the yaml decoder",
+			input:   "---\n<<:\r? 0:\n---\nbody",
+			wantNil: true,
+		},
 	}
 
 	for _, tt := range tests {
@@ -1157,6 +1163,12 @@ limitations:
 			input: "---\nspdx-id: MIT\n(never closes)\n",
 			want:  "",
 		},
+		{
+			// https://github.com/anchore/syft/issues/5327
+			name:  "malformed frontmatter that panics the yaml decoder",
+			input: "---\n<<:\r? 0:\n---\nbody\n",
+			want:  "",
+		},
 	}
 
 	for _, tt := range tests {

syft/pkg/cataloger/snap/parse_base_dpkg.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"strings"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"

syft/pkg/cataloger/snap/parse_snapd_snapcraft.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"strings"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"

syft/pkg/cataloger/snap/parse_system_manifest.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"strings"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"