fix(deps): update module go.yaml.in/yaml/v2 to v3 (main)

[renovate-sh-app]

This PR contains the following updates:

Package	Change	Age	Confidence
go.yaml.in/yaml/v2	v2.4.4 → v3.0.4

---

Release Notes

yaml/go-yaml (go.yaml.in/yaml/v2)

v3.0.4

Compare Source

v3.0.3

Compare Source

v3.0.2

Compare Source

v3.0.1

Compare Source

v3.0.0

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

[cursor]

#7284: yaml v3 API break -> adapted strict decode/unmarshalers, opened #7435 -> main. CI green; CLA pending.

View PR

  

_{Sent by Cursor Automation: Renovate PR Unblocker}

[cursor]

#7284: YAML v3 API break -> adapted strict decoding/unmarshalers, opened #7436 -> main. CI passed; CLA pending.

View PR

  

_{Sent by Cursor Automation: Renovate PR Unblocker}

[tempo-ci-app]

🤖 fix-renovate-prs failed_to_fix: yaml.v2→v3 is a breaking API change: UnmarshalYAML signature changes (6 sites in overrides/listtomap/duration) and yaml.UnmarshalStrict (12 call sites) was removed in v3. A naive signature port would silently break modules/overrides/config.go:317 and runtime_config_overrides.go:39 — they detect legacy-format YAML by catching strict-mode errors from the inner unmarshal callback, but in v3 Node.Decode always creates an inner decoder with knownFields=false, so legacy tenant override files would parse as ConfigTypeNew with all limits zeroed. A correct fix needs hand-rolled key validation inside each UnmarshalYAML against the *yaml.Node — a real refactor of the overrides module rather than a Renovate cleanup. Next step: a human should redo the overrides UnmarshalYAML methods using the Node API (or revisit whether the legacy-fallback pattern can be dropped entirely).

[tempo-ci-app]

🤖 fix-renovate-prs: opened a CI fix → #7484

[github-actions]

⚠️ The workflow jobs listed below don't declare a permissions: block and may break when the organization's default GITHUB_TOKEN permissions are restricted to read-only.

Expand for findings

warning[excessive-permissions]: overly broad permissions
  --> ./.github/workflows/deploy-pr-preview.yml:13:3
   |
13 | /   deploy-pr-preview:
14 | |     if: "!github.event.pull_request.head.repo.fork"
15 | |     uses: grafana/writers-toolkit/.github/workflows/deploy-preview.yml@4dbecae7443c69b3e5fdfeeac7037a339cb82e4c # main
16 | |     with:
...  |
31 | |       title: ${{ github.event.pull_request.title }}
   | |                                                    ^
   | |                                                    |
   | |____________________________________________________this job
   |                                                      default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium
   = help: audit documentation → https://docs.zizmor.sh/audits/#excessive-permissions

[renovate-sh-app]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 3.x releases. But if you manually upgrade to 3.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.