chore(deps): bump testify, x/text, and x/crypto - #50
Merged
Merged
Conversation
Consolidates three dependabot pull requests into one commit, superseding #41, #38 and #37: - github.com/stretchr/testify 1.11.1 -> 1.12.1 - golang.org/x/text 0.40.0 -> 0.41.0 - golang.org/x/crypto 0.54.0 -> 0.55.0 testify 1.12 replaces its gopkg.in/yaml.v3 dependency with go.yaml.in/yaml/v3 v3.0.5, so go.sum drops gopkg.in/yaml.v3 and its gopkg.in/check.v1 test dependency and gains the new module. Both are indirect and reached only through testify's assert package. go mod tidy also moves pgregory.net/rapid v1.3.0 from the indirect to the direct require block. That is pre-existing drift on main rather than a consequence of these bumps: tidy makes the same move with the three versions left alone. rapid is imported by internal/proptest test files, so direct is the correct classification, and the require-block marker is metadata that does not affect the import graph. go list -deps ./... still reports rapid absent and go list -deps -test ./... still reports it present, so the MPL-2.0 test-only invariant documented in internal/proptest/gen_test.go is preserved. Verified with gofmt -l, go build ./..., go vet ./..., go test ./... and go test -race ./..., all clean with every package reporting ok. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Aug 28, 2026
jonyoder
added a commit
that referenced
this pull request
Aug 28, 2026
Dates [Unreleased] as 0.9.0 (2026-08-28) and adds its compare link. CHANGELOG only. A minor bump under the 0.x policy because two changes alter observable behaviour: reqtxt now recognizes --all-releases/--only-final/--use-feature (an unrecognized option was assumed boolean, so its argument became a fabricated requirement), and a standalone --hash line is accepted rather than rejected, matching pip. Contents since v0.8.0: tags manylinux floor fix (#43), marker EvaluateUndecidable/Variables (#47), tags IsCompatibleOrNewer/CompileAnyLibc/Archs (#48), reqtxt Source and pip-parity fixes (#49), dependency bumps (#50).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Consolidates three open dependabot bumps into a single PR so the suite runs once against all three together rather than three times against each in isolation.
Bumps
github.com/stretchr/testifygolang.org/x/textgolang.org/x/cryptoAll three are minor/patch bumps with no documented breaking changes.
Supersedes #41, #38 and #37, which will be closed in favour of this PR.
Two go.mod changes that are not version numbers
gopkg.in/yaml.v3is replaced bygo.yaml.in/yaml/v3v3.0.5. This comes from testify 1.12, which moved its YAML dependency to the new upstream home.go.sumtherefore dropsgopkg.in/yaml.v3and itsgopkg.in/check.v1test dependency and gains the new module. Both are indirect and reached only throughtestify/assert.pgregory.net/rapidv1.3.0 moves from the indirect to the direct require block. This is pre-existing tidy drift onmain, not a consequence of these bumps: runninggo mod tidywith the three versions left alone makes the same move. CI does not rungo mod tidy -diff, which is why it went unnoticed. The version is unchanged.rapidis imported byinternal/proptesttest files, so direct is the correct classification. The require-block marker is metadata and does not affect the import graph, so the MPL-2.0 test-only invariant documented ininternal/proptest/gen_test.gostill holds. Verified with the two commands that doc comment cites:go list -deps ./...—rapidabsentgo list -deps -test ./...—rapidpresentVerification
Run locally on darwin/arm64 against this commit. This module's fidelity to Python's packaging ecosystem rests on generated golden fixtures and the ported PEP 440/508 conformance suites, so a fully green suite is the real signal that
x/textandx/cryptodid not shift version or marker behaviour.gofmt -l .go build ./...go vet ./...go test ./...ok, 0 failuresgo test -race ./...ok, 0 failuresEvery package that has tests reported
ok; the remaining four report[no test files].versiontook 11.9s without-raceand 126.6s with it, both in the normal range.-raceis included because CI runs it as a separate step.No test was changed, skipped, or relaxed to accommodate a bump.
Changelog
No
CHANGELOG.mdentry. The two dependency bumps previously merged here (#11, and thex/crypto0.53.0 to 0.54.0 bump) touched onlygo.modandgo.sum, so recording this one would break with the existing convention.🤖 Generated with Claude Code