Bump the go-dependencies group across 1 directory with 2 updates

[dependabot]

Bumps the go-dependencies group with 2 updates in the / directory: github.com/oschwald/maxminddb-golang/v2 and github.com/stretchr/testify.

Updates github.com/oschwald/maxminddb-golang/v2 from 2.5.0 to 2.7.0

Release notes

Sourced from github.com/oschwald/maxminddb-golang/v2's releases.

2.7.0

• Go 1.26 or later is now required. CI now tests Go 1.26 and 1.27.
• Fixed Reader.Verify() rejecting a search-tree record that points to a value nested in another data record. The MaxMind DB spec permits this, and mmdbwriter can write such databases. GitHub #250.
• Decoding now rejects extended type bytes 0 and 250 through 255, which the MaxMind DB spec does not define. Before, they decoded as other types. For example, 0x00 0xfb decoded as a string.
• Reader.Verify() now rejects a data pointer that points into the middle of a field.
• Reader.Verify() now also checks the metadata section. Its pointers must point to the start of a field, and all data after the metadata map must be valid values.

2.6.0

• Fixed a denial-of-service issue where a crafted database could use repeated pointers to cause excessive CPU and memory use during reflection decoding. The decoder now limits decoding work and decoded payload size.
• Made search-tree verification visit shared subtrees only once, bounding work while still rejecting cycles and overlong paths.
• Added the maxsize:N struct-tag option to limit maps, arrays, strings, and bytes in reflection and generated decoders, plus bounded cursor reads. Field names containing commas must now be single-quoted.
• Made generated decoders reject duplicate recognized map keys.
• Added mmdbdata.Cursor.Offset() to retrieve a value's resolved control-byte offset for caching within a database. It returns an error when resolution fails; the legacy Decoder.Offset() retains its original-offset fallback.
• Improved performance:
  • Reduced 28-bit search-tree lookup overhead with single-word node reads.
  • Extended bounded cursor string fast paths to wider data pointers.
  • Avoided repeated reflection dispatch for pointer-backed strings.
  • Inlined compact header reads when skipping values during budgeted decoding.
  • Avoided repeated type dispatch for unsigned integers decoded into any.
  • Cached validated struct-field matches to speed up repeated decoding.

Changelog

Sourced from github.com/oschwald/maxminddb-golang/v2's changelog.

2.7.0 - 2026-09-29

• Go 1.26 or later is now required. CI now tests Go 1.26 and 1.27.
• Fixed Reader.Verify() rejecting a search-tree record that points to a value nested in another data record. The MaxMind DB spec permits this, and mmdbwriter can write such databases. GitHub #250.
• Decoding now rejects extended type bytes 0 and 250 through 255, which the MaxMind DB spec does not define. Before, they decoded as other types. For example, 0x00 0xfb decoded as a string.
• Reader.Verify() now rejects a data pointer that points into the middle of a field.
• Reader.Verify() now also checks the metadata section. Its pointers must point to the start of a field, and all data after the metadata map must be valid values.

2.6.0 - 2026-09-07

• Fixed a denial-of-service issue where a crafted database could use repeated pointers to cause excessive CPU and memory use during reflection decoding. The decoder now limits decoding work and decoded payload size.
• Made search-tree verification visit shared subtrees only once, bounding work while still rejecting cycles and overlong paths.
• Added the maxsize:N struct-tag option to limit maps, arrays, strings, and bytes in reflection and generated decoders, plus bounded cursor reads. Field names containing commas must now be single-quoted.
• Made generated decoders reject duplicate recognized map keys.
• Added mmdbdata.Cursor.Offset() to retrieve a value's resolved control-byte offset for caching within a database. It returns an error when resolution fails; the legacy Decoder.Offset() retains its original-offset fallback.
• Improved performance:
  • Reduced 28-bit search-tree lookup overhead with single-word node reads.
  • Extended bounded cursor string fast paths to wider data pointers.
  • Avoided repeated reflection dispatch for pointer-backed strings.
  • Inlined compact header reads when skipping values during budgeted decoding.
  • Avoided repeated type dispatch for unsigned integers decoded into any.
  • Cached validated struct-field matches to speed up repeated decoding.

Commits

• e228017 Set release date and set version in doc
• faf39ba Merge pull request #247 from oschwald/dependabot/go_modules/golang.org/x/tool...
• 8002482 Merge pull request #249 from database64128/v6-zone
• 737b5b3 Merge pull request #254 from oschwald/dependabot/github_actions/github/codeql...
• 5de4d13 Merge pull request #255 from oschwald/greg/stf-1863
• 1167020 Check metadata pointers and the values after the metadata map
• 6c3604e Reject data pointers that point into the middle of a field
• 7e05d3d Reject extended type bytes outside the spec
• 00b036c Accept search-tree records that point to nested fields
• 731ece0 Bump github/codeql-action from 4.37.9 to 4.38.2
• Additional commits viewable in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in stretchr/testify#1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

• @​harryzcy made their first contribution in stretchr/testify#1935
• @​boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in stretchr/testify#1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

• @​harryzcy made their first contribution in stretchr/testify#1935
• @​boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

What's Changed

Functional Changes

• assert: make *AssertionFunc types just aliases by @​dolmen in stretchr/testify#1563

Fixes

• mock: avoid panic when expected type is nil in Arguments.Diff by @​mutaiib in stretchr/testify#1775
• mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by @​brackendawson in stretchr/testify#1786
• suite: validate method signatures and continue execution for valid tests by @​vyas-git in stretchr/testify#1665
• assert.PanicsWithError: report error message by @​olivergondza in stretchr/testify#1400
• assert: IsIncreasing et al can return false w/out failing by @​brackendawson in stretchr/testify#1787
• add type to error message of assert.Same by @​egawata in stretchr/testify#1792
• mock.AssertExpectationsForObjects fix panic with wrong testObject type. by @​brackendawson in stretchr/testify#1795
• assert: truncate very long objects in test failure messages by @​brackendawson in stretchr/testify#1646
• assert: fix NotSubset error messages using %#v instead of %q (fixes #1800) by @​nghiack7 in stretchr/testify#1888
• suite: prevent panic when SetupTest skips with HandleStats by @​blackwell-systems in stretchr/testify#1877

Documentation, Build & CI

• CI: test also with Go 1.23 by @​dolmen in stretchr/testify#1783
• Vendor unmaintained github.com/pmezard/go-difflib by @​brackendawson in stretchr/testify#1708
• Promote ccoVeille to maintainer by @​brackendawson in stretchr/testify#1784
• build(deps): bump actions/setup-go from 5 to 6 by @​dependabot[bot] in stretchr/testify#1790
• assert.YAMLEq: Document mutlidoc behavior by @​brackendawson in stretchr/testify#1791
• _codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by @​dolmen in stretchr/testify#1782
• doc: remove ineffective inline code blocks by @​brackendawson in stretchr/testify#1714
• Tag generated assertions as non-generated in new .gitattributes by @​ubunatic in stretchr/testify#1815

... (truncated)

Commits

• 959dbda Merge pull request #1935 from harryzcy/yaml-update
• 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
• 001eb79 Merge pull request #1905 from Kentzo/patch-1
• ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
• 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
• f8c01f3 mock: Mock.Return does not exist anymore
• 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
• a11649e assert: make *AssertionFunc type just aliases
• dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
• 098f8d7 _codegen: use strings.Builder
• Additional commits viewable in compare view