deps: bump github.com/stretchr/testify from 1.11.1 to 1.12.1

[dependabot]

Bumps github.com/stretchr/testify from 1.11.1 to 1.12.1.

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in stretchr/testify#1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

• @​harryzcy made their first contribution in stretchr/testify#1935
• @​boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in stretchr/testify#1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

• @​harryzcy made their first contribution in stretchr/testify#1935
• @​boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

What's Changed

Functional Changes

• assert: make *AssertionFunc types just aliases by @​dolmen in stretchr/testify#1563

Fixes

• mock: avoid panic when expected type is nil in Arguments.Diff by @​mutaiib in stretchr/testify#1775
• mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by @​brackendawson in stretchr/testify#1786
• suite: validate method signatures and continue execution for valid tests by @​vyas-git in stretchr/testify#1665
• assert.PanicsWithError: report error message by @​olivergondza in stretchr/testify#1400
• assert: IsIncreasing et al can return false w/out failing by @​brackendawson in stretchr/testify#1787
• add type to error message of assert.Same by @​egawata in stretchr/testify#1792
• mock.AssertExpectationsForObjects fix panic with wrong testObject type. by @​brackendawson in stretchr/testify#1795
• assert: truncate very long objects in test failure messages by @​brackendawson in stretchr/testify#1646
• assert: fix NotSubset error messages using %#v instead of %q (fixes #1800) by @​nghiack7 in stretchr/testify#1888
• suite: prevent panic when SetupTest skips with HandleStats by @​blackwell-systems in stretchr/testify#1877

Documentation, Build & CI

• CI: test also with Go 1.23 by @​dolmen in stretchr/testify#1783
• Vendor unmaintained github.com/pmezard/go-difflib by @​brackendawson in stretchr/testify#1708
• Promote ccoVeille to maintainer by @​brackendawson in stretchr/testify#1784
• build(deps): bump actions/setup-go from 5 to 6 by @​dependabot[bot] in stretchr/testify#1790
• assert.YAMLEq: Document mutlidoc behavior by @​brackendawson in stretchr/testify#1791
• _codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by @​dolmen in stretchr/testify#1782
• doc: remove ineffective inline code blocks by @​brackendawson in stretchr/testify#1714
• Tag generated assertions as non-generated in new .gitattributes by @​ubunatic in stretchr/testify#1815

... (truncated)

Commits

• 959dbda Merge pull request #1935 from harryzcy/yaml-update
• 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
• 001eb79 Merge pull request #1905 from Kentzo/patch-1
• ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
• 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
• f8c01f3 mock: Mock.Return does not exist anymore
• 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
• a11649e assert: make *AssertionFunc type just aliases
• dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
• 098f8d7 _codegen: use strings.Builder
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[vyruss]

@coderabbitai assess risk and feasibility

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '--- PR metadata and changed files ---'
gh pr view 83 --repo pgEdge/coldfront --json title,body,files,commits \
  --jq '{title, body, commits: [.commits[].messageHeadline], files: [.files[] | {path, additions, deletions}]}'

echo
echo '--- go.mod ---'
cat go.mod

echo
echo '--- Relevant Go imports and dependency references ---'
rg -n -C 2 \
  '"(github\.com/stretchr/testify|go\.yaml\.in/yaml/v3|gopkg\.in/yaml\.v3|github\.com/davecgh/go-spew|github\.com/pmezard/go-difflib)' \
  -g '*.go' .

echo
echo '--- Module graph explanation ---'
go mod why -m github.com/stretchr/testify
go mod why -m go.yaml.in/yaml/v3
go mod why -m github.com/davecgh/go-spew
go mod why -m github.com/pmezard/go-difflib

Length of output: 21150

---

@vyruss, this update is feasible. I assess the production risk as low.

• Pull request #83 changes only go.mod and go.sum.
• github.com/stretchr/testify is used only by test files through assert and require.
• The application continues to use gopkg.in/yaml.v3 v3.0.1 for configuration parsing.
• go.yaml.in/yaml/v3 v3.0.5 is an indirect dependency introduced by testify. It does not replace the application YAML dependency.
• The removed github.com/davecgh/go-spew and github.com/pmezard/go-difflib checksums are expected. go mod why confirms that the resolved module graph no longer needs these modules.

The remaining risk is limited to test compatibility. The v1.12.x release includes assertion and diagnostic behavior changes. The repository does not import testify/mock, which reduces the main API-compatibility risk.

Recommendation: merge after the normal Go test suite passes. No source changes are required based on the current dependency graph.

_{You are interacting with an AI system.}

[vyruss]

@coderabbitai assess risk and feasibility

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '== Go module files =='
fd -a '^(go\.mod|go\.sum)$' . -x sh -c 'echo "--- $1"; sed -n "1,240p" "$1"' sh {}

echo
echo '== Testify and YAML imports in Go source =='
rg -n -C 2 --glob '*.go' \
  '"github\.com/stretchr/testify/|"gopkg\.in/yaml\.v3"|"go\.yaml\.in/yaml/v3"' \
  . || true

echo
echo '== Dependency declarations and sums for affected modules =='
rg -n \
  'github\.com/stretchr/testify|github\.com/davecgh/go-spew|github\.com/pmezard/go-difflib|gopkg\.in/yaml\.v3|go\.yaml\.in/yaml/v3' \
  go.mod go.sum 2>/dev/null || true

echo
echo '== Testify module metadata and dependency manifest =='
modcache="$(go env GOMODCACHE 2>/dev/null || true)"
if [ -n "$modcache" ]; then
  testify_mod="$(find "$modcache" -path '*/github.com/stretchr/testify@v1.12.1/go.mod' -print -quit 2>/dev/null || true)"
  if [ -n "$testify_mod" ]; then
    echo "--- $testify_mod"
    cat "$testify_mod"
  else
    echo 'testify v1.12.1 is not present in the local module cache.'
  fi
fi

echo
echo '== GitHub security advisories for testify v1.12.1 =='
gh api '/repos/stretchr/testify/security-advisories?state=published&per_page=100' \
  --jq '.[] | {ghsa_id, severity, published_at, vulnerable_version_range, patched_versions}' \
  2>/dev/null || echo 'GitHub advisory query was unavailable.'

Length of output: 39110

---

@vyruss, feasibility is high and functional risk is low for the root module.

• github.com/stretchr/testify is used only by root-module test files.
• The update does not change application imports or production code paths.
• gopkg.in/yaml.v3 v3.0.1 remains the YAML module used by production code.
• go.yaml.in/yaml/v3 v3.0.5 is a separate module path. No repository source imports it directly. Its addition affects the resolved test dependency graph only.
• Removing github.com/davecgh/go-spew and github.com/pmezard/go-difflib from go.mod is consistent with the new resolved graph. Their historical go.sum entries are harmless.
• The advisory query returned no published GitHub security advisories for Testify.

One scope note: cmd/compactor has its own go.mod and remains on github.com/stretchr/testify v1.11.1 indirectly. This root-module change does not update that module.

Residual risk: Testify can change assertion formatting or edge-case assertion behavior. CI should run the root module test suite before merge. The sandbox did not execute tests.

_{You are interacting with an AI system.}