Skip to content

build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 - #187

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/stretchr/testify-1.12.1
Closed

build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1#187
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/stretchr/testify-1.12.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps github.com/stretchr/testify from 1.11.1 to 1.12.1.

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

... (truncated)

Commits
  • 959dbda Merge pull request #1935 from harryzcy/yaml-update
  • 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
  • 001eb79 Merge pull request #1905 from Kentzo/patch-1
  • ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
  • 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
  • f8c01f3 mock: Mock.Return does not exist anymore
  • 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
  • a11649e assert: make *AssertionFunc type just aliases
  • dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
  • 098f8d7 _codegen: use strings.Builder
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1
57a0da6 
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.11.1 to 1.12.1.
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.11.1...v1.12.1)

---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 22, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 22, 2026 12:52
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 22, 2026
@clawsweeper

clawsweeper Bot commented Aug 22, 2026

Copy link
Copy Markdown
Contributor

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

@clawsweeper clawsweeper Bot added P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Aug 22, 2026
@clawsweeper

clawsweeper Bot commented Aug 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed August 23, 2026, 7:55 AM ET / 11:55 UTC.

ClawSweeper review

What this changes

This PR updates the Go test assertion library testify from 1.11.1 to 1.12.1 and refreshes the resolved Go module graph.

Merge readiness

⚠️ Ready for maintainer review - 1 item remains

Keep this PR open: current main and the latest release still use testify 1.11.1, while this is a small, cleanly mergeable dependency update with successful recorded checks.

Priority: P3
Reviewed head: 57a0da6968647ae45bacff60c9685ebbb3a6691c

Review scores

Measure Result What it means
Overall readiness 🐚 platinum hermit (4/6) A narrow dependency update with a coherent resolved graph, clean merge state, and successful recorded checks.
Proof confidence 🌊 off-meta tidepool Not applicable: This bot-authored dependency-only PR is exempt from the external-contributor real-behavior-proof gate; the recorded CI checks are supplemental validation.
Patch quality 🐚 platinum hermit (4/6) No actionable review findings were identified.

Verification

Check Result Evidence
Real behavior Not applicable Not applicable: This bot-authored dependency-only PR is exempt from the external-contributor real-behavior-proof gate; the recorded CI checks are supplemental validation.
Evidence reviewed 5 items Current main remains on the old version: Current main declares github.com/stretchr/testify v1.11.1, so the requested upgrade is not already implemented.
Proposed change is narrow: The PR head changes the direct testify declaration to v1.12.1 and adjusts only the resolved module metadata.
Dependency use is test-only: All 51 Go files importing testify are *_test.go files; no non-test Go source imports it.
Findings None None.
Security None None.

How this fits together

discrawl’s Go module files define dependencies used to compile and test the CLI. Test packages import testify assertions, and Go resolves the manifest into the CI test dependency graph.

flowchart LR
  A[Go test packages] --> B[Go module manifest]
  B --> C[Go module resolver]
  C --> D[Testify 1.12.1]
  D --> E[CI test suite]
  E --> F[discrawl validation]
Loading

Before merge

  • Complete next step (P2) - This is a complete open PR; normal maintainer merge review is the remaining action, not an automated repair.
Agent review details

Security

None.

Review metrics

Metric Value Why it matters
Module surface 2 files affected; +8, -30 The update is confined to the Go manifest and checksums, with no application or test-source edits.

Technical review

Best possible solution:

Land the reviewed testify upgrade after normal dependency-maintenance approval so CI uses the updated assertion library and resolved module graph.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates dependency metadata rather than addressing a reported runtime bug.

Is this the best way to solve the issue?

Yes. Updating the existing direct module declaration and letting Go refresh the resolved graph is the narrowest maintainable path.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 938b6b279dfc.

Labels

Label justifications:

  • P3: This is a routine, test-only dependency refresh with limited user-facing blast radius.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This bot-authored dependency-only PR is exempt from the external-contributor real-behavior-proof gate; the recorded CI checks are supplemental validation.

Evidence

What I checked:

  • Current main remains on the old version: Current main declares github.com/stretchr/testify v1.11.1, so the requested upgrade is not already implemented. (go.mod:9, 938b6b279dfc)
  • Proposed change is narrow: The PR head changes the direct testify declaration to v1.12.1 and adjusts only the resolved module metadata. (go.mod:9, 57a0da696864)
  • Dependency use is test-only: All 51 Go files importing testify are *_test.go files; no non-test Go source imports it. (internal/cli/analytics_test.go:11, 938b6b279dfc)
  • Module-history provenance: Blame attributes the current testify declaration to the v0.13.3 release-preparation commit; later main history has no go.mod or go.sum changes. (go.mod:9, 089c1f5b6ae4)
  • Release provenance: The current 1.11.1 declaration was shipped in v0.13.3; the proposed head is not contained by a release tag. (go.mod:9, 089c1f5b6ae4)

Likely related people:

  • Peter Steinberger: He authored the v0.13.3 release commit that current blame associates with the testify declaration and leads module-file history. (role: recent dependency-maintenance contributor; confidence: high; commits: 089c1f5b6ae4, 5519d84f81f9; files: go.mod, go.sum)
  • Vincent Koc: Module history includes recent dependency-maintenance work from this contributor, including crawlkit updates. (role: adjacent dependency contributor; confidence: medium; commits: cfe1506d5de6; files: go.mod, go.sum)

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)
  • reviewed 2026-08-22T12:55:18.738Z sha 57a0da6 :: needs maintainer review before merge. :: none

@steipete steipete mentioned this pull request Aug 23, 2026
Merged
@dependabot @github

dependabot Bot commented on behalf of github Aug 23, 2026

Copy link
Copy Markdown
Contributor Author

Looks like github.com/stretchr/testify is up-to-date now, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 23, 2026
@dependabot
dependabot Bot deleted the dependabot/go_modules/github.com/stretchr/testify-1.12.1 branch August 23, 2026 16:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants