build(deps): bump the go-dependencies group with 5 updates

[dependabot]

Bumps the go-dependencies group with 5 updates:

Package	From	To
golang.org/x/mod	0.39.0	0.40.0
github.com/stretchr/testify	1.12.0	1.12.1
github.com/mattn/go-runewidth	0.0.27	0.0.28
github.com/pierrec/lz4/v4	4.1.28	4.1.29
golang.org/x/net	0.57.0	0.58.0

Updates golang.org/x/mod from 0.39.0 to 0.40.0

Commits

• d3398d0 go.mod: update golang.org/x dependencies
• 57549bf sumdb: ignore unrelated hashes in Lookup
• 96f62ae sumdb/tlog: fix TileHashReader authentication bypass
• See full diff in compare view

Updates github.com/stretchr/testify from 1.12.0 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in stretchr/testify#1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

• @​harryzcy made their first contribution in stretchr/testify#1935
• @​boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in stretchr/testify#1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

• @​harryzcy made their first contribution in stretchr/testify#1935
• @​boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

Commits

• 959dbda Merge pull request #1935 from harryzcy/yaml-update
• 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
• 0358d0e change yaml library to go.yaml.in/yaml/v3
• See full diff in compare view

Updates github.com/mattn/go-runewidth from 0.0.27 to 0.0.28

Commits

• 554428c Merge pull request #105 from mattn/lazy-width-lut
• 27d1448 Avoid regexp and map construction at package load
• 69a63c6 Build the strict width LUT lazily to fix startup regression
• See full diff in compare view

Updates github.com/pierrec/lz4/v4 from 4.1.28 to 4.1.29

Commits

• 8708173 Merge pull request #250 from LambdaLabs/fix-xxh32-sum32-truncated-length
• b8b61d1 Merge pull request #248 from honeycombio/lizf.arm64-neoverse-match-copy
• d0008a1 arm64: Neoverse-tuned match copies: sequenced shortcut, offset 8-31 tiles
• caa2992 test: cover the tail path and keep the large-input test off -race
• 6052a21 fix: select Sum32's hash path using the untruncated length
• See full diff in compare view

Updates golang.org/x/net from 0.57.0 to 0.58.0

Commits

• acc78e0 go.mod: update golang.org/x dependencies
• 90d10f0 internal/http3: delete invalid Content-Length if declared in server handler
• 08abf4d internal/http3: infer headers when Content-Encoding is set but is empty
• 8d10596 http2: avoid deadlocks in wrapped ClientConn state callback
• 99c3b0a http2/hpack: build the table lookup maps lazily, only for encoders
• 5a920b1 http3: rework registration to allow using a fake network
• 7fd2842 quic: return an error from Accept after PacketConn reader exits
• 825111d quic: avoid busy-loop when keep-alive is blocked by congestion control
• a02ddfa http/httpproxy: prioritize lowercase proxy environment variables
• 574e5eb quic: halt conn goroutines on close when listener exits early
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
golang.org/x/net	[>= 0.38.a, < 0.39]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions