chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1

[dependabot]

Bumps github.com/stretchr/testify from 1.12.0 to 1.12.1.

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in stretchr/testify#1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

• @​harryzcy made their first contribution in stretchr/testify#1935
• @​boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in stretchr/testify#1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

• @​harryzcy made their first contribution in stretchr/testify#1935
• @​boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

Commits

• 959dbda Merge pull request #1935 from harryzcy/yaml-update
• 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
• 0358d0e change yaml library to go.yaml.in/yaml/v3
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 23, 2026, 4:15 PM ET / 20:15 UTC.

ClawSweeper review

What this changes

The PR updates the Go test assertion dependency Testify from v1.12.0 to v1.12.1 and refreshes its transitive YAML module checksums.

Merge readiness

⚠️ Ready for maintainer review - 3 items remain

Keep this focused dependency update open for the package-integrity code-owner review and completion of its in-progress Go checks; no patch defect was found.

Priority: P3
Reviewed head: ca4327bb164e5343384445142a7d87215062c2c6

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is focused and mechanically consistent, with remaining confidence dependent on module-integrity review and in-progress Go checks.
Proof confidence	🌊 off-meta tidepool	Not applicable: This bot-authored dependency-only PR does not require contributor real-behavior proof; the repository’s module and Go test checks are the relevant validation.
Patch quality	🦐 gold shrimp (3/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This bot-authored dependency-only PR does not require contributor real-behavior proof; the repository’s module and Go test checks are the relevant validation.
Evidence reviewed	6 items	Focused dependency diff: The PR changes only the Testify version and its transitive module metadata; it adds no Slacrawl application code. Test-only usage: All 30 in-tree Go imports of Testify are in *_test.go files, so the direct dependency supports test suites rather than production source imports. Transitive source change: The Testify patch replaces gopkg.in/yaml.v3 with go.yaml.in/yaml/v3 v3.0.5 in the resolved module graph.
Findings	None	None.
Security	Needs attention	Review the introduced YAML module source: The Testify upgrade replaces gopkg.in/yaml.v3 with go.yaml.in/yaml/v3 v3.0.5; this is expected from the stated upstream release but changes code resolved and executed by Go test jobs.

How this fits together

Slacrawl’s Go test suites use Testify assertion helpers while checking CLI, import, Slack, storage, and reporting behavior. Go resolves those test dependencies from go.mod and go.sum before package validation runs.

flowchart LR
A[Test suites] --> B[Go module manifest]
B --> C[Testify assertions]
C --> D[Transitive YAML module]
D --> E[Go package validation]
E --> F[Slacrawl behavior checks]

Loading

Before merge

• Resolve security concern: Review the introduced YAML module source - The Testify upgrade replaces gopkg.in/yaml.v3 with go.yaml.in/yaml/v3 v3.0.5; this is expected from the stated upstream release but changes code resolved and executed by Go test jobs.
• Resolve merge risk (P1) - The update introduces the new go.yaml.in/yaml/v3 module path through Testify; package-integrity review and the remaining Go checks should complete before merge.
• Complete next step (P2) - Await package-integrity code-owner review and completion of the existing Go validation jobs; no code repair is identified.

Findings

• [low] Review the introduced YAML module source — go.mod:43

Agent review details

Security

Needs attention: The patch changes the third-party Go module graph, including a new YAML module path, so package-integrity review should precede merge.

Review metrics

Metric	Value	Why it matters
Module metadata	2 files affected; +6, -7 lines	The branch is limited to the manifest and checksum lockfile.
Test-dependency reach	30 Go test files import Testify	The updated direct dependency is exercised by the repository test suite rather than production imports.

Merge-risk options

Maintainer options:

1. Verify the new module path before merge (recommended)
   Complete the package-integrity owner review and remaining Go validation for the introduced go.yaml.in/yaml/v3 dependency path.
2. Defer the update
   Pause the patch if the project does not want to adopt the upstream Testify release’s YAML module-path change yet.

Technical review

Best possible solution:

Merge the minimal Testify update once the resolved module identity is accepted by the package-integrity owners and the Go validation suite is green.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency metadata update, not a reported user-facing defect.

Is this the best way to solve the issue?

Yes, conditionally: updating go.mod and go.sum is the narrow Go module path, with package-integrity review appropriate for the new transitive module source.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against 526888485c56.

Labels

Label changes:

• add P3: This is a routine patch-level dependency maintenance update with no user-facing Slacrawl behavior change in the diff.
• add merge-risk: 🚨 security-boundary: Merging changes the third-party module graph by introducing a new YAML module namespace that runs within Go test and CI validation.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This bot-authored dependency-only PR does not require contributor real-behavior proof; the repository’s module and Go test checks are the relevant validation.

Label justifications:

• P3: This is a routine patch-level dependency maintenance update with no user-facing Slacrawl behavior change in the diff.
• merge-risk: 🚨 security-boundary: Merging changes the third-party module graph by introducing a new YAML module namespace that runs within Go test and CI validation.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This bot-authored dependency-only PR does not require contributor real-behavior proof; the repository’s module and Go test checks are the relevant validation.

Evidence

Security concerns:

• [low] Review the introduced YAML module source — go.mod:43
  The Testify upgrade replaces gopkg.in/yaml.v3 with go.yaml.in/yaml/v3 v3.0.5; this is expected from the stated upstream release but changes code resolved and executed by Go test jobs.
  Confidence: 0.93

What I checked:

• Focused dependency diff: The PR changes only the Testify version and its transitive module metadata; it adds no Slacrawl application code. (go.mod:11, ca4327bb164e)
• Test-only usage: All 30 in-tree Go imports of Testify are in *_test.go files, so the direct dependency supports test suites rather than production source imports. (internal/syncer/syncer_test.go:6, ca4327bb164e)
• Transitive source change: The Testify patch replaces gopkg.in/yaml.v3 with go.yaml.in/yaml/v3 v3.0.5 in the resolved module graph. (go.mod:43, ca4327bb164e)
• Repository validation coverage: The dependency workflow verifies modules, enforces tidy go.mod/go.sum, and runs govulncheck; package testing also runs go test -count=1 ./.... (.github/workflows/ci.yml:32, ca4327bb164e)
• Declared package-integrity ownership: The repository assigns both go.mod and go.sum to the openclaw/openclaw-secops team. (.github/CODEOWNERS:9, ca4327bb164e)
• Recent module-history provenance: Current main’s latest dependency refresh was authored by Peter Steinberger, making him a recent contributor to this module surface. (go.mod:11, 526888485c56)

Likely related people:

• openclaw/openclaw-secops: CODEOWNERS assigns the two changed module files to this team. (role: declared package-integrity code owner; confidence: high; files: .github/CODEOWNERS, go.mod, go.sum)
• Peter Steinberger: The latest main-branch dependency refresh changed the same Go module surface. (role: recent dependency maintainer; confidence: medium; commits: 526888485c56; files: go.mod, go.sum)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Complete package-integrity review of the new transitive module path and let the Go validation jobs finish on this head.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.