cue-lang/cue v0.18.0-alpha.3

on GitHub

Changes which may break some users are marked below with: ⚠️

Language

The new openlists experiment

This release introduces the openlists experiment, which makes lists open by default, just like structs. A list literal without a trailing ellipsis is no longer fixed to its length outside of definitions, so unifying [3] with [_, 4] yields [3, 4] rather than an incompatible list lengths error. Lists close where structs close: within a definition, or when passed to close, which now accepts lists as well as structs.

The experiment also introduces closed literals: #[1, 2] means what [1, 2] means without the experiment, and #{a: 1} closes a struct at its own level as close does. As #[ now starts a closed list, an index on a definition named # is written (#)[i].

You can try this experiment on a module at language version v0.18.0 via the @experiment(openlists) file attribute. cue fix --exp=openlists rewrites existing files so they keep their meaning, writing list literals as closed literals and wrapping slices and builtin results in close. See the proposal for the full design.

⚠️ Exact arithmetic

Integer addition, subtraction, and multiplication are now exact at any size, as the spec requires, rather than rounding to 34 digits. This also fixes strconv.FormatInt and uuid.FromInt failing on large integers (#3787, #4263), as well as SI multipliers on long literals, math.Floor, math.Ceil, and math.MultipleOf, which all rounded numbers beyond 34 digits.

Dividing two integers now yields an int when the quotient is exact, as the spec has always prescribed: 4 / 2 is the integer 2, so x: float & 10 / 5 is now a conflict. A quotient also keeps the decimal places its operands imply, so 6.00 / 3 is 2.00, and an exported float always carries a digit after its decimal point.

The list.Sum, list.Product, list.Avg, list.Range, list.Min, list.Max, math.Abs, math.Copysign, and math.Dim functions now follow the arithmetic operators, keeping the kinds of their arguments: list.Sum([1.5, 2.5]) is now the float 4.0 rather than the integer 4, so a field declared int no longer accepts it. The arithmetic functions in list are also now incomplete on open lists, as more elements may still be added (#2569).

Other changes

Multi-line strings now accept a backslash-escaped newline, as the spec has always allowed (#2317), and single-line strings discard carriage returns in all cases.

A for clause binding the same name twice, as in for k, k in x, is now rejected as a redeclaration (#4012).

Two values of the functions experiment introduced in v0.18.0-alpha.2 now compose when unified, calling both bodies and unifying their results, rather than conflicting. Unifying function types now matches parameters by label and combines optional, required, and regular parameters as for struct fields. Recursion via closures, such as with a fixed-point combinator, is now detected as a structural cycle rather than evaluating without bound (#4495).

Evaluator

⚠️ Selecting through a regular field which holds a definition now keeps the definition's closedness, just like selecting from the definition itself. Such selections inside a for comprehension's body are now closed as well, as they already were inside an if.

#D: s: {a: 1}
d: #D
x: #D.s & {extra: 1} // error: field not allowed
y: d.s & {extra: 1}  // now also an error

Error reporting is more complete in several ways. A missing required field now points at the data which omits the field, so that cue vet with many data files says which one is at fault (#2520). A failed lookup now also reports where the searched value is declared. A bound or validator which fails on a list or struct with erroneous elements now reports all of them rather than only the first (#4115), and fields not allowed by a closed struct are now reported even when a sibling field has an error.

Errors which were previously hidden or misreported have also been fixed: an error inside an interpolation, as in "\(x.foo & {})", no longer evaluates to an empty string (#2201), a builtin given a non-concrete argument now reports the error behind it (#3986), and matchN no longer reports a spurious error next to a conflict between kinds (#4462).

Fix a panic when a builtin propagates a user error from within a disjunction (#4490), a panic or misresolved reference in the fallback body of a try clause, and a spurious cyclic reference error with deeply nested comprehensions (#4487).

cmd/cue

⚠️ The -n/--name flag is now only accepted by cue import, the only command where it had any effect (#3048), and the -s/--simplify flag is now only accepted by cue eval, cue fix, cue fmt, and cue trim.

cue vet, cue export, and cue eval -c now report incomplete values alongside any other errors, rather than leaving them out whenever another field had a conflict (#1319, #4140).

cue trim now supports reading from standard input, writing the result to standard output (#346).

cue fmt now keeps the line breaks between function parameters and call arguments (#4497), and cue fmt -s rewrites a pattern constraint which only matches a single string, like ["^t"]: v, into an optional field, making clear that it is not a regular expression (#1045).

A --path value with a trailing component which is not a label, such as foo:bar:baz, is now rejected rather than silently ignored (#3368).

A task failing in cue cmd now names its path in the error (#2631). tool/http.Serve now sends every value of a repeated response header, fills in both the body and the form of a urlencoded request, and only starts accepting requests once every ready Serve task has run.

The new cue exp ast command prints the syntax tree of CUE files, which is useful when debugging tools built on the cue/ast Go API.

The cue binary is 7% smaller thanks to dropping most of the protobuf runtime from its dependencies.

⚠️ The cuelang/cue Docker images are no longer published under per-architecture tags such as 0.18.0-alpha.2-amd64; use the multi-platform tag, such as 0.18.0-alpha.3, which serves both linux/amd64 and linux/arm64. The images now also carry an SBOM attestation.

Modules

@embed attributes in a file without @extern(embed) now report the missing declaration rather than being silently ignored (#4010), and cue def now omits @embed attributes from its output, as their values are already included.

cue mod get can now move a dependency off a version which no longer exists in the registry (#3965), and cue mod publish now reports when the module directory is ignored by the VCS rather than claiming that cue.mod/module.cue is missing (#3400).

Module zips now order files before directories, as documented, which changes the digests of newly published modules. Publishing a version again with the same files now reuses the archive already in the registry, so republishing, such as when retrying a release job, keeps working against registries with immutable tags even when a newer cue produces a different archive. cue mod publish also no longer uploads blobs which the registry already holds (#3340).

Several bugs in package loading have been fixed: a hang when loading a directory whose name has the module root as a string prefix, a missed module root for one-letter directories, cue.mod/pkg imports failing when loading via cue/load.Config.FS (#4494), and the "*" package pattern dropping packages after the first one that failed. Login token refreshes now follow each request's cancellation, and a canceled module fetch is no longer remembered as a failure.

LSP server

Fix two crashes in the language server: when opening an embedded file in an encoding which does not decode into a package, such as TOML, and when a package file fails to parse fully.

As always, the language server is under active development: please report any bugs or missing features you encounter via the Issue tracker or via the #lsp channels on Discord or Slack. See our Getting Started wiki page for instructions on how to set it up with your editor.

Encodings

Experimental INI support

INI files can now be both imported and exported, such as via cue import config.ini or cue export --out ini (#2689). As INI has no specification, the default generic flavor only accepts the syntax which all flavors share, so that no data is lost; the flavor file tag selects the syntax of a particular tool, as in ini+flavor=git: for a git config file, with git, python, systemd, and windows supported. The encoding is experimental, so both the flavors and the CUE they decode to may still change.

cue get go

cue get go now follows encoding/json for embedded structs, promoting their fields without requiring an inline tag option (#1026), and supports the encoding/json additions of Go 1.27, such as the embed option, as well as the string option. The new jsonv2 codec follows encoding/json/v2 instead, and each field now takes its optionality from the tag of the codec which names it (#4471).

The new --omit flag takes selectors such as pkg.Name, replacing the deprecated --exclude flag. Its pkg.Name.Method form translates a type as if it lacked an encoding method like MarshalJSON, so that a schema can be generated for types which only implement such methods to validate their input (#2466).

cue exp gengotypes now generates omitzero rather than omitempty, which behaves the same under encoding/json and encoding/json/v2, keeps ? and ! in quoted field names, and reports @go attributes misplaced in a file's preamble (#3904) as well as inputs without a package name (#3764).

Other changes

The JSON Schema decoder now supports unevaluatedProperties where the evaluated properties are known statically, such as via allOf and $ref, and unifies allOf subschemas so their fields and documentation appear in the result. It also compares const and enum numbers by value, so const: 1 accepts 1.0 (#4121), narrows the allowed types by the target of a $ref, decodes OpenAPI's float and double formats as float32 and float64 (#4437), and only allows null when OpenAPI's nullable is true.

The JSON Schema encoder now generates exact numeric bounds, such as the limits of int64 and uint64 (#4438), keeps the bounds of a type with a default such as *20 | int & >=1 (#4305), and no longer emits a redundant number type next to integer. The deprecated OpenAPI encoder no longer splits a default list of definitions into a oneOf (#4156).

The TOML decoder now rejects a table array at a key already declared as a table, which could panic, and importing JSON or YAML strings starting with two quotes no longer produces invalid CUE.

Go API

cue.IsIncomplete now reports an error combining several others as incomplete only when all of them are, so that a permanent error is never mistaken for an incomplete one. It also recognizes the incomplete errors from cue.Value.MarshalJSON, and looks through errors.Join and cue/errors.Wrapf.

Lists of errors from cue/errors now implement Unwrap, returning all of their errors, so that code walking a tree of errors such as those built by errors.Join can see into them.

cue.Value.Allows and cue.Value.Subsume no longer treat a closed value such as #Def & {...} as open (#4496), and cue.Value.Expr now reports a disjunction where only one disjunct survives as that disjunct (#4305).

cue.Value.Decode once again prefers a tagged field over an untagged one at the same depth, fixing a regression introduced in v0.9.0, and converting a Go struct to CUE now names its fields as encoding/json does (#2261). cue.Value.Int64 now accepts math.MinInt64, and cue.Value.Float64 returns a negative zero on negative underflow, as documented.

A number of APIs no longer modify the values or syntax trees given to them, which also fixes data races when exporting concurrently: among others, exporting values, cue/ast.AddComment, and cue/ast/astutil.Sanitize, as well as cue.Path values appended to the same base. cue/ast/astutil.Apply now stops when its after hook returns false, and Cursor.Replace keeps the replacement's comments, both as documented.

tools/flow no longer leaks task goroutines when Run stops early (#2663), and cuego.Constrain now reports compile errors and no longer loses constraints registered concurrently.

The new CRDConfig.TargetLanguageVersion field lets encoding/jsonschema.ExtractCRDs generate schemas for modules declaring an older language version.