chore(all): update deps

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
github.com/CycloneDX/cyclonedx-go	v0.11.0 → v0.12.0			require	minor
github.com/google/sbom-conformance	06e987e → 28115fb			require	digest
github.com/stretchr/testify	v1.11.1 → v1.12.1			require	minor
go	1.26.4 → 1.27.1			uses-with	minor

---

Release Notes

CycloneDX/cyclonedx-go (github.com/CycloneDX/cyclonedx-go)

v0.12.0

Compare Source

Changelog

Building and Packaging

• 5dfc64a: build(deps): bump actions/checkout from 6.0.2 to 7.0.1 (@​dependabot[bot])
• 1ede59b: build(deps): bump actions/checkout from 6.0.2 to 7.0.1 (@​dependabot[bot])
• 0802b20: build(deps): bump actions/setup-go from 6.4.0 to 7.0.0 (@​dependabot[bot])
• 912c033: build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (@​dependabot[bot])
• 3b6942c: build(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (@​dependabot[bot])
• 14a734c: build(deps): bump github.com/terminalstatic/go-xsd-validate (@​dependabot[bot])
• c3551dd: build(deps): bump github.com/terminalstatic/go-xsd-validate (@​dependabot[bot])
• 4598c3a: build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.3.0 (@​dependabot[bot])
• 0d3dc12: build(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.3 (@​dependabot[bot])

Others

• ed2c60e: Encode evidence identity as a single object when downgrading below 1.6 (@​sueun-dev)
• 3d9769a: Strip fields newer than the target spec version when downgrading (@​sueun-dev)
• cdee31c: chore: bump minimum go version to 1.25 (@​nscuro)
• b3fcca5: chore: harden GHA workflows; add zizmor job (@​nscuro)
• cbc84f9: chore: refresh goreleaser setup (@​nscuro)

stretchr/testify (github.com/stretchr/testify)

v1.12.1

Compare Source

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in #​1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in #​1772

New Contributors

• @​harryzcy made their first contribution in #​1935
• @​boekkooi-impossiblecloud made their first contribution in #​1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in #​1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in #​1772

New Contributors

• @​harryzcy made their first contribution in #​1935
• @​boekkooi-impossiblecloud made their first contribution in #​1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

Compare Source

What's Changed

Functional Changes

• assert: make *AssertionFunc types just aliases by @​dolmen in #​1563

Fixes

• mock: avoid panic when expected type is nil in Arguments.Diff by @​mutaiib in #​1775
• mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by @​brackendawson in #​1786
• suite: validate method signatures and continue execution for valid tests by @​vyas-git in #​1665
• assert.PanicsWithError: report error message by @​olivergondza in #​1400
• assert: IsIncreasing et al can return false w/out failing by @​brackendawson in #​1787
• add type to error message of assert.Same by @​egawata in #​1792
• mock.AssertExpectationsForObjects fix panic with wrong testObject type. by @​brackendawson in #​1795
• assert: truncate very long objects in test failure messages by @​brackendawson in #​1646
• assert: fix NotSubset error messages using %#v instead of %q (fixes #​1800) by @​nghiack7 in #​1888
• suite: prevent panic when SetupTest skips with HandleStats by @​blackwell-systems in #​1877

Documentation, Build & CI

• CI: test also with Go 1.23 by @​dolmen in #​1783
• Vendor unmaintained github.com/pmezard/go-difflib by @​brackendawson in #​1708
• Promote ccoVeille to maintainer by @​brackendawson in #​1784
• build(deps): bump actions/setup-go from 5 to 6 by @​dependabot[bot] in #​1790
• assert.YAMLEq: Document mutlidoc behavior by @​brackendawson in #​1791
• _codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by @​dolmen in #​1782
• doc: remove ineffective inline code blocks by @​brackendawson in #​1714
• Tag generated assertions as non-generated in new .gitattributes by @​ubunatic in #​1815
• chore: vendor go-spew from https://github.com/davecgh/go-spew by @​ccoVeille in #​1827
• require: fix godoc generation for assertions returning a bool by @​Baxromumarov in #​1850
• docs(require): correct example usage to use assert.CollectT (require.CollectT does not exist) by @​a2not in #​1821
• docs: Fix EventuallyWithTf documentation with proper placement of formatting arguments by @​a2not in #​1842
• EMERITUS.md: add @​tylerb by @​dolmen in #​1812
• CI: test also with Go 1.24 by @​alexandear in #​1856
• deps: bump objx to v0.5.3 and remove dependency cycle issue by @​ccoVeille in #​1823
• CI: upgrade GitHub Actions and pin hashes by @​SuperQ in #​1883
• CI: add _readme-gofmt tool to reformat Go code in README by @​dolmen in #​1889
• CI: add check of GitHub Action pinned hashes against tag by @​dolmen in #​1885
• _codegen: modernize by @​dolmen in #​1890
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in #​1906
• mock: Mock.Return does not exist anymore by @​Kentzo in #​1905

New Contributors

• @​mutaiib made their first contribution in #​1775
• @​vyas-git made their first contribution in #​1665
• @​olivergondza made their first contribution in #​1400
• @​egawata made their first contribution in #​1792
• @​ubunatic made their first contribution in #​1815
• @​Baxromumarov made their first contribution in #​1850
• @​a2not made their first contribution in #​1821
• @​nghiack7 made their first contribution in #​1888
• @​blackwell-systems made their first contribution in #​1877
• @​Kentzo made their first contribution in #​1905

Full Changelog: stretchr/testify@v1.11.0...v1.12.0

What's Changed

• mock: avoid panic when expected type is nil in Arguments.Diff by @​mutaiib in #​1775
• CI: test also with Go 1.23 by @​dolmen in #​1783
• mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by @​brackendawson in #​1786
• suite: validate method signatures and continue execution for valid tests by @​vyas-git in #​1665
• Vendor unmaintained github.com/pmezard/go-difflib by @​brackendawson in #​1708
• Promote ccoVeille to maintainer by @​brackendawson in #​1784
• build(deps): bump actions/setup-go from 5 to 6 by @​dependabot[bot] in #​1790
• assert.PanicsWithError: report error message by @​olivergondza in #​1400
• assert: IsIncreasing et al can return false w/out failing by @​brackendawson in #​1787
• add type to error message of assert.Same by @​egawata in #​1792
• assert.YAMLEq: Document mutlidoc behavior by @​brackendawson in #​1791
• mock.AssertExpectationsForObjects fix panic with wrong testObject type. by @​brackendawson in #​1795
• _codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by @​dolmen in #​1782
• assert: truncate very long objects in test failure messages by @​brackendawson in #​1646
• doc: remove ineffective inline code blocks by @​brackendawson in #​1714
• Tag generated assertions as non-generated in new .gitattributes by @​ubunatic in #​1815
• chore: vendor go-spew from https://github.com/davecgh/go-spew by @​ccoVeille in #​1827
• require: fix godoc generation for assertions returning a bool by @​Baxromumarov in #​1850
• docs(require): correct example usage to use assert.CollectT (require.CollectT does not exist) by @​a2not in #​1821
• docs: Fix EventuallyWithTf documentation with proper placement of formatting arguments by @​a2not in #​1842
• EMERITUS.md: add @​tylerb by @​dolmen in #​1812
• CI: test also with Go 1.24 by @​alexandear in #​1856
• deps: bump objx to v0.5.3 and remove dependency cycle issue by @​ccoVeille in #​1823
• CI: upgrade GitHub Actions and pin hashes by @​SuperQ in #​1883
• assert: fix NotSubset error messages using %#v instead of %q (fixes #​1800) by @​nghiack7 in #​1888
• suite: prevent panic when SetupTest skips with HandleStats by @​blackwell-systems in #​1877
• CI: add _readme-gofmt tool to reformat Go code in README by @​dolmen in #​1889
• CI: add check of GitHub Action pinned hashes against tag by @​dolmen in #​1885
• _codegen: modernize by @​dolmen in #​1890
• assert: make *AssertionFunc types just aliases by @​dolmen in #​1563
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in #​1906
• mock: Mock.Return does not exist anymore by @​Kentzo in #​1905

New Contributors

• @​mutaiib made their first contribution in #​1775
• @​vyas-git made their first contribution in #​1665
• @​olivergondza made their first contribution in #​1400
• @​egawata made their first contribution in #​1792
• @​ubunatic made their first contribution in #​1815
• @​Baxromumarov made their first contribution in #​1850
• @​a2not made their first contribution in #​1821
• @​nghiack7 made their first contribution in #​1888
• @​blackwell-systems made their first contribution in #​1877
• @​Kentzo made their first contribution in #​1905

Full Changelog: stretchr/testify@v1.11.0...v1.12.0

actions/go-versions (go)

v1.27.1: 1.27.1

Compare Source

Go 1.27.1

v1.27.0: 1.27.0

Compare Source

Go 1.27.0

v1.26.8: 1.26.8

Compare Source

Go 1.26.8

v1.26.7: 1.26.7

Compare Source

Go 1.26.7

v1.26.6: 1.26.6

Compare Source

Go 1.26.6

v1.26.5: 1.26.5

Compare Source

Go 1.26.5

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Monday through Friday (* * * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[forking-renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.24.4 -> 1.25