chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 - #58
chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0#58dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.11.1 to 1.12.0. - [Release notes](https://github.com/stretchr/testify/releases) - [Commits](stretchr/testify@v1.11.1...v1.12.0) --- updated-dependencies: - dependency-name: github.com/stretchr/testify dependency-version: 1.12.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![ev-vaultkeeper[bot]](https://avatars.githubusercontent.com/u/47702631?s=60&v=4){kind=small}
There was a problem hiding this comment.
Dependabot review: github.com/stretchr/testify 1.11.1 → 1.12.0 ✅
Verdict: safe to merge. No code changes required.
What changed
go.mod/go.sumonly (semver-minor bump).- Also drops
github.com/davecgh/go-spewandgithub.com/pmezard/go-difflibfrom testify's indirect deps, because testify 1.12.0 vendored both internally (upstream #1708 and #1827).go-spewremains in the module graph as a transitive dep ofjarcoal/httpmock; neither lib is imported directly anywhere in this repo.
How we use testify
Test-only (plus internal/testhelper/env_loader.go). Only the assert and require sub-packages are used — no mock, no suite. Functions in use: NoError, Equal, New, True, False, Error, ErrorIs, Contains, Truef.
Changelog (v1.11.0…v1.12.0) impact
- Only functional change is
assert: make *AssertionFunc types just aliases(#1563) — not used here. - Remaining fixes target
mock/suite/other assertions (PanicsWithError,Same,NotSubset,IsIncreasing) that this repo doesn't use. asserttruncates very long objects in failure messages (#1646) — cosmetic, affects only failure output.- None of the functions we rely on changed behaviour.
Verification
go build ./...,go vet ./..., andgo mod tidy(produces no diff) all clean.go test --short ./...passes; the only local failures are from unsetEV_*secret env vars (sandbox limitation), not testify.- CI
lintjobs (which run the unit tests) already pass on Go 1.24 & 1.25 across ubuntu/macos/windows; Socket Security reports no vulnerabilities (score 100). E2E failures/cancellations are due to live-service/secret requirements, unrelated to this bump.
No suspicious, security, or performance concerns identified.
|
Superseded by #59. |
Bumps github.com/stretchr/testify from 1.11.1 to 1.12.0.
Release notes
Sourced from github.com/stretchr/testify's releases.
... (truncated)
Commits
001eb79Merge pull request #1905 from Kentzo/patch-1ad40f38Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...3bae017build(deps): bump actions/checkout from 6.0.2 to 6.0.3f8c01f3mock: Mock.Return does not exist anymore12f8b56Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliasesa11649eassert: make *AssertionFunc type just aliasesdc20f41Merge pull request #1890 from stretchr/dolmen/codegen-modernize098f8d7_codegen: use strings.Builderd2699be_codegen: modernizea463c8cMerge pull request #1885 from stretchr/dolmen/ci-check-ghactions-hashesDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)