Choosing it
Is noyalib a drop-in replacement for serde_yaml?
Yes, through noyalib-serde-yaml. Rename the package in Cargo.toml and keep
every call site. The migration page shows the one line and the
three behaviours that differ.
How is it different from the serde_yaml forks?
The forks kept the original code and its gaps. noyalib was written from the specification and passes all 406 official test cases with no skips. It has no unsafe code, documented limits for untrusted input, a lossless editor and a language server, an MCP server and a WebAssembly build that share the parser.
How fast is it?
Faster than every other pure-Rust YAML crate on every deserialise fixture measured, by 1.1 to 2 times, and 3 to 4 times faster at serialising than the closest maintained fork. The benchmarks disclose the host, toolchain and command.
What does it need?
Rust 1.86 or newer. It builds on Linux, macOS and Windows, and for no_std
targets with an allocator. The default profile has eight runtime
dependencies; the minimal profile has five.
Using it
Does it keep comments?
Through the lossless editor, yes: cst::Document reproduces the source byte
for byte and rewrites only what you change. Through the typed API, no. The
YAML data model has no comments, so no library can round-trip them through a
struct.
What happens to custom tags?
They are kept. from_str::<Value> returns a tagged value with the tag name
and the payload. A typed deserialise ignores the tag, and untag strips
every tag for a plain JSON view. The WebAssembly parseJson does the same.
Does it handle the Norway problem?
By default no is a string, as YAML 1.2 requires. A YAML 1.1 preset turns
on the old rules for booleans, octal numbers and sexagesimal values when a
legacy file needs them.
Can it read several documents from one file?
Yes. load_all returns every document in a stream, and the parallel parser
splits large streams across threads. The language server and the CLI
understand multi-document files too.
Trusting it
Is it safe on untrusted input?
That is the design goal. Nesting depth, alias count, node count and input size are capped by default, and each cap is an error rather than a crash. There is no unsafe code, and fuzzing and Miri run on every change. The security page has the details.
Who maintains it?
Sebastien Rousseau, with contributors. The six crates release together at one version. The about page says more, and the governance document says how decisions are made.
What licence is it under?
Apache-2.0 or MIT, at your option, for every crate.