chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 in the go-dependencies group

[dependabot]

Bumps the go-dependencies group with 1 update: github.com/stretchr/testify.

Updates github.com/stretchr/testify from 1.12.0 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in stretchr/testify#1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

• @​harryzcy made their first contribution in stretchr/testify#1935
• @​boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in stretchr/testify#1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

• @​harryzcy made their first contribution in stretchr/testify#1935
• @​boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

Commits

• 959dbda Merge pull request #1935 from harryzcy/yaml-update
• 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
• 0358d0e change yaml library to go.yaml.in/yaml/v3
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[claude]

Claude finished @dependabot[bot]'s task in 1m 1s —— View job

---

Dependency upgrade review

• Identify changed dependencies
• Check release notes / semver for breaking changes
• Search repo for affected usage (testify, yaml)
• Build + vet verification — ⚠️ not permitted in this sandbox (see note)
• Post review

---

Verdict: ✅ Safe to merge

What changed

Module	From	To	Kind
github.com/stretchr/testify	1.12.0	1.12.1	direct (test-only)
go.yaml.in/yaml/v3	3.0.4	3.0.5	indirect (pulled in transitively by the above)

The entire content of testify v1.12.1 is a dependency swap: gopkg.in/yaml.v3 → go.yaml.in/yaml/v3 (stretchr/testify#1935, #1772). Patch-level, no assertion API changes, no deprecations.

Impact on this repo

• Blast radius is limited to assert.YAMLEq / YAMLEqf — that's the only place testify touches YAML. grep -rn "YAMLEq" returns zero hits in this repo, so the swapped library is never exercised.
• Testify surface actually used across 131 test files: suite (103), require (74), assert (13), mock (1). None of these paths changed in 1.12.1.
• go.yaml.in/yaml/v3 was already an indirect dep at v3.0.4 before this PR, so this is a version bump within the existing graph, not a new module entering it.
• Testify is test-only here — it does not ship in the kosli binary (CGO_ENABLED=0 release build is unaffected).

go.sum hygiene

The diff drops the h1: line for go.yaml.in/yaml/v3 v3.0.4 while keeping its /go.mod hash. That's correct — the /go.mod hash is still needed for MVS graph resolution, the h1: is only needed for versions actually built.

Non-blocking follow-up (not for this PR)

This repo still directly imports the old, effectively-frozen gopkg.in/yaml.v3 v3.0.1 in one place — cmd/kosli/snapshotK8S.go:18 (used only at :89 for yaml.Unmarshal) — while the build graph now also carries go.yaml.in/yaml/v3 v3.0.5. Two copies of the same YAML library. No known open CVE against gopkg.in/yaml.v3 v3.0.1 (CVE-2022-28948 was fixed in v3.0.1), so this isn't urgent, but upstream maintenance has moved to go.yaml.in. Consolidating onto one is a drop-in import swap.

Migrate snapshotK8S.go to go.yaml.in/yaml/v3 →

Suggested checks before merge

Nothing dependency-specific. A normal green CI run is sufficient — make test_integration exercising the 131 testify-using test files is the real proof, and CI already runs it.

Note: I could not run go build ./... or go vet locally — those commands are outside my allowed tool set in this run. My analysis is based on the diff, the upstream changelog, and static inspection of usage. If you want me to compile-verify on future dependency PRs, add Bash(go build:*) and Bash(go vet:*) to --allowedTools.
· Branch