[go-fan] Go Module Review: github.com/itchyny/gojq #15557

🐹 Go Fan Report: gojq

Module Overview

gojq is a pure-Go jq implementation, embeddable as a library (Parse → Compile → Run).

Current Usage in gh-aw

• Files: ~6 non-test files (middleware/jqschema.go, jqutil/secure.go, config/validation_server.go) plus several tests
• Key APIs: gojq.Parse, gojq.Compile, WithEnvironLoader (disables $ENV), WithVariables, WithFunction (walk_schema), *gojq.Code, HaltError, ValueError, ParseError
• Compiled filters are cached; jqutil.SecureCompileOpts is the single source of truth for hardened options.

Research Findings

Pinned v0.12.19 is the latest release (2026-04-01). It includes fixes for gsub/sub, join, del on null, and regexp caching. No advisories were found.

Best Practices

• Compile once and reuse *Code (already done).
• Use RunWithContext for cancellation (already used via runJqCode).
• Disable $ENV and module loading for untrusted filters (done).

Improvement Opportunities

🏃 Quick Wins

• config/validation_server.go builds compile options via CompileOptsWithVariables. Its parse and compile steps could share a helper with the middleware cache path. This is minor duplication.

✨ Feature Opportunities

• Consider gojq.WithInputIter or WithIterFunction only if streaming filters are needed. There is no current need.

📐 Best Practice Alignment

• The startup init() compiles jqSchemaFilter only as a canary, since inferSchema runs natively. If startup time matters, move the canary into a test. It already has the TestInferSchema_MatchesJqOutput parity test.
• Confirm that user-supplied filters have bounded execution time. Context timeouts are the only guard against pathological filters.

🔧 General Improvements

• Add a few fuzz or table tests for filters that exhaust resources (deep recursion, range(1e9)) to check that context cancellation fires.

Module Summary

References

• Documentation: https://pkg.go.go.dev/github.com/itchyny/gojq
• Changelog: https://github.com/itchyny/gojq/releases

Recommendations

1. No upgrade needed.
2. Add resource-exhaustion cancellation tests.
3. Optionally move the init canary into tests.

Next Steps

Next in the round-robin: github.com/spf13/cobra.

Generated by Go Fan

Generated by Go Fan · copilot · auto · ~24 AIC · ⊞ 5.9K · ◷

• expires on Nov 2, 2026, 7:35 AM UTC