[reuvenharrison]

Picks up the three fixes released in oasdiff/yaml3 v0.0.15 and v0.0.16:

• A block scalar whose first line starts with a tab after the required indentation decodes that tab as content, per YAML 1.2.2 example 8.2 (Accept a tab after the indentation of a block scalar's first line yaml3#18, upstream backport Accept a tab after the indentation of a block scalar's first line (backport of #440) yaml/go-yaml#453).
• An unhashable key in a merged mapping returns an error instead of panicking (Report an unhashable merged key as an error, not a panic yaml3#19).
• A mapping ending in an explicit key with no value no longer reports an end past its own text, or past the whole document (A mapping ends with the text it has, not at a supplied null yaml3#20).

Through this package the second one turns a panic into an error:

Unmarshal([]byte("<<:\n  ? [1]\n  : v\n1: x\n"), &out, DecodeOpts{})
before: panic: runtime error: hash of unhashable type []interface {}
after:  error converting YAML to JSON: yaml: runtime error: hash of unhashable type []interface {}

Both the panic and the out-of-bounds end were found by fuzzing kin-openapi's loader, where they have been failing its origins target on master. With these three in place that target ran 3,128,089 executions clean.

go mod tidy, the suite and golangci-lint are all clean. The branch name still says v0.0.15, from before v0.0.16 existed; renaming it would mean a new PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_017e285CvofYf6joqC98gTXz