build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0

[dependabot]

Bumps github.com/stretchr/testify from 1.11.1 to 1.12.0.

Commits

• 001eb79 Merge pull request #1905 from Kentzo/patch-1
• ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
• 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
• f8c01f3 mock: Mock.Return does not exist anymore
• 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
• a11649e assert: make *AssertionFunc type just aliases
• dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
• 098f8d7 _codegen: use strings.Builder
• d2699be _codegen: modernize
• a463c8c Merge pull request #1885 from stretchr/dolmen/ci-check-ghactions-hashes
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Super-linter summary

Language	Validation result
BASH	Pass ✅
BASH_EXEC	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
GITHUB_ACTIONS	Pass ✅
GITHUB_ACTIONS_ZIZMOR	Fail ❌
GITLEAKS	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
GO_MODULES	Pass ✅
GO_RELEASER	Pass ✅
JSCPD	Pass ✅
JSON	Pass ✅
JSON_PRETTIER	Pass ✅
MARKDOWN	Pass ✅
MARKDOWN_PRETTIER	Pass ✅
NATURAL_LANGUAGE	Pass ✅
PRE_COMMIT	Pass ✅
RENOVATE	Pass ✅
SHELL_SHFMT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌
YAML	Pass ✅
YAML_PRETTIER	Pass ✅

Super-linter detected linting errors

For more information, see the GitHub Actions workflow run

Powered by Super-linter

GITHUB_ACTIONS_ZIZMOR

�[1m�[33mwarning[ref-version-mismatch]�[0m�[1m: action's hash pin has mismatched or missing version comment�[0m
  �[1m�[94m--> �[0m/github/workspace/.github/workflows/format.yml:31:99
   �[1m�[94m|�[0m
�[1m�[94m31�[0m �[1m�[94m|�[0m         uses: flatt-security/setup-takumi-guard-golang@2e3c7c40b538cd68b2ac483def12982ebc8bc02e # v1
   �[1m�[94m|�[0m                                                                                                   �[1m�[33m^^�[0m �[1m�[33mpoints to commit 1c8aa7498f7f�[0m
   �[1m�[94m|�[0m
   �[1m�[94m= �[0m�[1mnote�[0m: audit confidence → High
   �[1m�[94m= �[0m�[1mhelp�[0m: audit documentation → �[32mhttps://docs.zizmor.sh/audits/#ref-version-mismatch�[39m

�[1m�[33mwarning[ref-version-mismatch]�[0m�[1m: action's hash pin has mismatched or missing version comment�[0m
  �[1m�[94m--> �[0m/github/workspace/.github/workflows/test.yml:35:99
   �[1m�[94m|�[0m
�[1m�[94m35�[0m �[1m�[94m|�[0m       - uses: flatt-security/setup-takumi-guard-golang@2e3c7c40b538cd68b2ac483def12982ebc8bc02e # v1
   �[1m�[94m|�[0m                                                                                                   �[1m�[33m^^�[0m �[1m�[33mpoints to commit 1c8aa7498f7f�[0m
   �[1m�[94m|�[0m
   �[1m�[94m= �[0m�[1mnote�[0m: audit confidence → High
   �[1m�[94m= �[0m�[1mhelp�[0m: audit documentation → �[32mhttps://docs.zizmor.sh/audits/#ref-version-mismatch�[39m

�[32m42�[39m findings (�[1m�[93m40�[39m suppressed�[0m): �[35m0�[39m informational, �[36m0�[39m low, �[33m2�[39m medium, �[31m0�[39m high�[32m INFO�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 zizmor v1.25.2
�[32m INFO�[0m �[1maudit�[0m�[2m:�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 completed /github/workspace/.github/dependabot.yml
�[32m INFO�[0m �[1maudit�[0m�[2m:�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 completed /github/workspace/.github/workflows/add-to-task-list.yml
�[32m INFO�[0m �[1maudit�[0m�[2m:�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 completed /github/workspace/.github/workflows/dependency_review.yml
�[32m INFO�[0m �[1maudit�[0m�[2m:�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 completed /github/workspace/.github/workflows/format-json-yml.yml
�[32m INFO�[0m �[1maudit�[0m�[2m:�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 completed /github/workspace/.github/workflows/format.yml
�[32m INFO�[0m �[1maudit�[0m�[2m:�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 completed /github/workspace/.github/workflows/github-actions-cache-cleaner.yml
�[32m INFO�[0m �[1maudit�[0m�[2m:�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 completed /github/workspace/.github/workflows/release.yml
�[32m INFO�[0m �[1maudit�[0m�[2m:�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 completed /github/workspace/.github/workflows/super-linter.yml
�[32m INFO�[0m �[1maudit�[0m�[2m:�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 completed /github/workspace/.github/workflows/test.yml
�[32m INFO�[0m �[1maudit�[0m�[2m:�[0m �[2mzizmor�[0m�[2m:�[0m 🌈 completed /github/workspace/.github/workflows/update-gitleaks.yml

TRIVY

Report Summary

┌────────┬───────┬─────────────────┬───────────────────┬─────────┐
│ Target │ Type  │ Vulnerabilities │ Misconfigurations │ Secrets │
├────────┼───────┼─────────────────┼───────────────────┼─────────┤
│ go.mod │ gomod │        2        │         -         │    -    │
└────────┴───────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.71/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


go.mod (gomod)
==============
Total: 2 (UNKNOWN: 2, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

┌──────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│     Library      │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                            │
├──────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ golang.org/x/mod │ CVE-2026-56864 │ UNKNOWN  │ fixed  │ v0.37.0           │ 0.40.0        │ A malicious GOSUMDB was capable of serving arbitrary module │
│                  │                │          │        │                   │               │ content no ......                                           │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-56864                  │
│                  ├────────────────┤          │        │                   │               ├─────────────────────────────────────────────────────────────┤
│                  │ CVE-2026-56865 │          │        │                   │               │ A malicious GOPROXY was previously capable of forging up to │
│                  │                │          │        │                   │               │ two sumdb...                                                │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-56865                  │
└──────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘