Update all

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
docker/setup-buildx-action	action	minor	v4.2.0 → v4.3.0
github.com/stretchr/testify	require	patch	v1.12.0 → v1.12.1

---

Release Notes

docker/setup-buildx-action (docker/setup-buildx-action)

v4.3.0

Compare Source

• Bump @​docker/actions-toolkit from 0.92.0 to 0.95.0 in #​595
• Bump brace-expansion from 1.1.13 to 1.1.18 in #​600
• Bump js-yaml from 5.2.0 to 5.3.0 in #​585
• Bump postcss from 8.5.10 to 8.5.25 in #​598
• Bump undici from 6.27.0 to 6.28.0 in #​601

Full Changelog: docker/setup-buildx-action@v4.2.0...v4.3.0

stretchr/testify (github.com/stretchr/testify)

v1.12.1

Compare Source

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in #​1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in #​1772

New Contributors

• @​harryzcy made their first contribution in #​1935
• @​boekkooi-impossiblecloud made their first contribution in #​1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in #​1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in #​1772

New Contributors

• @​harryzcy made their first contribution in #​1935
• @​boekkooi-impossiblecloud made their first contribution in #​1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • "before 8am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying vaku with    Cloudflare Pages

Latest commit:	eccfb3c
Status:	✅  Deploy successful!
Preview URL:	https://600915cb.vaku.pages.dev
Branch Preview URL:	https://renovate-all.vaku.pages.dev

View logs

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
go.yaml.in/yaml/v3	v3.0.4 -> v3.0.5

[claude]

Claude finished @renovate[bot]'s task in 1m 13s —— View job

---

Review

• Gather context / read diff
• Analyze dependency changes
• Check go.mod / go.sum consistency
• Post review

---

The two bumps themselves are safe. testify v1.12.1 is a yaml-library swap only (gopkg.in/yaml.v3 → go.yaml.in/yaml/v3), no assertion API surface change, and the repo only uses assert/require. docker/setup-buildx-action@v4.3.0 is transitive-dependency bumps. Nothing to change in this PR.

Two pre-existing issues this PR makes visible:

1. go.sum is accumulating stale entries — the tidy check in CI is a no-op

.github/workflows/validate.yml:48:

run: test -z $(go mod tidy)

go mod tidy writes nothing to stdout (diagnostics go to stderr), so $(go mod tidy) is always empty and test -z "" always succeeds. The step rewrites go.mod/go.sum in the CI checkout and then throws the result away — it has never actually validated anything.

Consequence is visible in this diff and across the file: superseded versions keep their full h1: module-zip lines instead of being pruned.

github.com/stretchr/testify v1.11.1 h1:...   # stale
github.com/stretchr/testify v1.12.0 h1:...   # stale after this PR
github.com/stretchr/testify v1.12.1 h1:...
go.yaml.in/yaml/v3 v3.0.4 h1:...             # stale after this PR
golang.org/x/sync v0.20.0 h1:...             # stale
golang.org/x/sync v0.21.0 h1:...             # stale

Renovate appends without tidying, and nothing catches it, so go.sum grows monotonically with every dependency PR. Suggested fix:

- name: go mod tidy
  run: |
    go mod tidy
    git diff --exit-code go.mod go.sum

Fix this →

2. Two yaml v3 implementations in the module graph

go.mod:73 now has go.yaml.in/yaml/v3 v3.0.5 (via testify) while go.mod:78 still has gopkg.in/yaml.v3 v3.0.1 (via the Vault deps). Both are indirect, both are the same library under different import paths. Harmless at build time, just worth knowing that govulncheck/dependency-scanning results need to be read against both paths until the Vault side migrates.

Not verified: I couldn't run go build, go test, or go mod tidy locally — those commands were blocked by the sandbox in this run, so the tidy claim above is based on reading go.sum directly, not on executing tidy. Repo CI is the authority on build/test.
· renovate/all