The official test suite
The YAML project publishes a suite of 406 cases: valid documents with the JSON they must produce, and invalid documents that must be refused. The core runs all of them on every push with no skip list. The result is 406 of 406.
Since September 2026 the same cases run through every companion crate's own surface, from the same vendored suite at the same core commit:
| Entry point | Result | Outside its contract |
|---|---|---|
noyalib library, JSON projection |
406 of 406 | none |
noyavalidate exit code |
406 of 406 | none |
noyalib-lsp diagnostics |
406 of 406 | none |
noyalib-mcp tool result |
195 of 195 addressable | 211 cases have no top-level key to read |
noyalib-serde-yaml shim |
367 of 367 | 24 multi-document cases, 15 non-scalar keys the original also refused |
noyalib-wasm JSON model |
382 of 382 | 24 multi-document cases; parse is single-document |
The first run of that gate found two real defects: the language server
flagged valid multi-document files, and the MCP server reported a key with an
empty value as missing. Both were fixed before the next release. Reproduce
any row with cargo test --test yaml_test_suite in that crate.
Memory safety
Every crate root carries #![forbid(unsafe_code)], so the compiler refuses
any unsafe block. The parser is also run under Miri, which checks for
undefined behaviour the compiler cannot see, on every pull request.
Fuzzing
Fifteen libFuzzer targets cover the scanner, the parser, the serialiser, the
lossless editor, the schema validator and the round trip through Value.
Two of them build without the standard library, so the no_std path is
fuzzed too. Each push replays the seed corpus; a weekly job runs for longer.
The unterminated-tag bug fixed in v0.0.34 was found by that fuzzer in its
first minute.
Limits for untrusted input
Nesting depth, alias count, alias-to-anchor ratio, node count and document size all have defaults, and each is an error rather than a crash when it is exceeded. The limits are configurable per parser. The policies document lists them.
The family scorecard
A script in the core runs 131 probes across the six repositories: tests,
lints, formatting, audits, vetting, REUSE compliance, strict docs, README
examples, pinned actions, signed releases, SBOMs, open alerts and the state
of the main branch. The latest run scored A+ at 97.9%. Rerun it with
scripts/ecosystem-scorecard.sh; the
ecosystem document
holds the full table.
External checks
- OpenSSF Scorecard
- OpenSSF Best Practices, passing
- Benchmarks with host, toolchain and command disclosed