fix(deps): update module gopkg.in/yaml.v2 to v3

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
gopkg.in/yaml.v2	v2.4.0 -> v3.0.1

---

Release Notes

go-yaml/yaml (gopkg.in/yaml.v2)

v3.0.1

Compare Source

v3.0.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
gopkg.in/yaml.v3	v3.0.1 -> v3.0.1

[druid-infra]

Daily Renovate audit (druid-infra): inspected head da2aff5ac572d099421f9aab4d761792eb452e76, metadata/diff/files, release notes, review state, mergeability, and check runs. The actual diff does not upgrade yaml v2 to v3; it only changes the existing gopkg.in/yaml.v3 v3.0.1 declaration from indirect to direct (and changes no lock/checksum file). Checks: no check runs reported; no reviews reported; GitHub mergeability was unknown. Local reproduction used isolated worktree /tmp/druid-cli-pr35. git diff --check passed. Dockerized Go golang:1.23-bookworm /usr/local/go/bin/go test ./test ./internal/... did not complete within 180s after package compilation. Browser coverage: not applicable. Decision: not merged — title/diff mismatch, no dependency version bump, required checks absent, and mergeability unknown.

[druid-infra]

Daily Renovate audit (druid-infra): inspected PR metadata/head da2aff5ac572d099421f9aab4d761792eb452e76, go.mod diff (changes gopkg.in/yaml.v3 v3.0.1 from indirect to direct; no actual v2→v3 upgrade in the diff), mergeability (clean), review state (no reviews), and check runs (none). Ran Dockerized Go 1.23 compile-only validation: go test ./... -run ^$ -count=0; it failed on the existing debug/exec.go:54 vet/build diagnostic, while unrelated packages compiled. git diff --check passed. No browser coverage was applicable. Decision: not merged — no CI checks, local validation is not clean, and the PR title/body do not match the actual dependency diff sufficiently for high-confidence merge.

[druid-infra]

druid-infra daily Renovate audit (2026-09-11 UTC): inspected metadata, changed files/diff, head da2aff5ac572d099421f9aab4d761792eb452e76, review state, mergeability, and check runs. The actual diff only changes gopkg.in/yaml.v3 v3.0.1 from indirect to direct; it does not upgrade yaml.v2 to v3. Ran Dockerized Go 1.24 go test ./...; the full suite did not complete within the audit window and was stopped after more than five minutes. No browser test: backend dependency metadata-only change. Not merged: although mergeability was clean, there were no successful check runs and local verification was incomplete; the PR title does not match the actual diff.

[druid-infra]

Renovate audit (druid-infra, 2026-09-13): inspected PR metadata, head da2aff5ac572d099421f9aab4d761792eb452e76, mergeability/review state, all check runs (0 check runs; combined status pending), and the full diff. The actual diff only changes gopkg.in/yaml.v3 v3.0.1 from // indirect to a direct requirement; it does not update yaml from v2 to v3 as the title/body claim, and no go.sum change is present. git diff --check passed. Dockerized compile coverage passed: docker run --rm -v <checkout>:/src -w /src golang:1.24.7 /usr/local/go/bin/go test -vet=off -run '^$' ./.... Full runtime tests were not claimed because the repository’s untagged integration packages run long-lived Docker tests; the compile-only command covered all packages. No browser test applies to this Go-only dependency diff. Decision: NOT MERGED — the actual diff is not the advertised dependency update, and required checks are absent/pending with mergeability reported unknown.

[druid-infra]

Daily Renovate audit (druid-infra): inspected head da2aff5ac572d099421f9aab4d761792eb452e76, metadata/mergeability, diff, reviews, commit status, and check runs. Diff changes gopkg.in/yaml.v3 v3.0.1 from indirect to direct; there is no actual version change in the checked-out diff, so this Renovate PR is effectively a dependency classification/no-op update. Checks/status: no check runs; combined status pending; mergeability clean. Tests: docker run --rm -v "$PWD":/src -w /src golang:1.23 go test ./... did not complete cleanly on the repository baseline; focused docker run --rm -v "$PWD":/src -w /src golang:1.23 go test ./test passed (ok, 0.025s). git diff --check passed. Browser coverage: not applicable (Go dependency metadata only). Decision: NOT MERGED — no successful required checks; recommend closing/recreating only if a real yaml version update is intended.

[druid-infra]

Daily Renovate audit (druid-infra): inspected PR metadata/head da2aff5ac572d099421f9aab4d761792eb452e76, diff, mergeability, reviews, and check runs. Despite the title, the diff does not change gopkg.in/yaml.v2 to v3; it only removes the // indirect annotation from the already-present gopkg.in/yaml.v3 v3.0.1 requirement. Release notes contain no actionable version change. No check runs are reported; mergeability is clean; no reviews/change requests are reported. In an isolated checkout, git diff --check passed. Dockerized test attempt: docker run --rm -v /tmp/druid-pr35:/app -w /app golang:1.23 bash -lc '/usr/local/go/bin/go test ./... && /usr/local/go/bin/go vet ./...'; it did not pass (existing debug/exec.go:54 vet diagnostic and unrelated repository test failures; command timed out before vet completion). Decision: not merged; no successful required checks and local verification did not pass; title/diff mismatch also requires Renovate correction.

[druid-infra]

Daily Renovate audit (druid-infra): inspected PR metadata, head da2aff5ac572d099421f9aab4d761792eb452e76, diff, changed files, reviews, mergeability, and check/status surfaces. Despite the title, the actual diff only changes gopkg.in/yaml.v3 v3.0.1 from indirect to direct; no yaml.v2 -> v3 version bump is present. Dockerized Go 1.24: go test -vet=off ./test -count=1 passed. go mod tidy -diff reports the yaml requirement should remain // indirect. No browser coverage (non-UI). No reviews/check runs were present; GitHub reports mergeability clean/status pending. Decision: not merged; the PR is mis-scoped relative to its title, has go.mod drift, and lacks required checks.