🌱 deps: switch from gopkg.in/yaml.vX to go.yaml.in/yaml/vX

The latter is a maintained fork of the former.
https://github.com/yaml/go-yaml#project-status

While at it, upgrade from 2.4.0 to 2.4.2 and 3.0.1 to 3.0.4, these were
already indirectly used.

2.4.0 are identical, 2.4.0...2.4.1 diff:
https://gist.github.com/scop/57f94f2bf97fb6a2d01349fa59d88530

3.0.1 are identical, 3.0.1..3.0.2 diff:
https://gist.github.com/scop/57f94f2bf97fb6a2d01349fa59d88530

Signed-off-by: Ville Skyttä <ville.skytta@iki.fi>

Author: scop

attestor/policy/attestation_policy.go

@@ -20,7 +20,7 @@ import (
 	"strings"
 
 	"github.com/gobwas/glob"
-	"gopkg.in/yaml.v2"
+	"go.yaml.in/yaml/v2"
 
 	"github.com/ossf/scorecard/v5/checker"
 	"github.com/ossf/scorecard/v5/checks"

config/config.go

@@ -20,7 +20,7 @@ import (
 	"io"
 	"strings"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	sce "github.com/ossf/scorecard/v5/errors"
 	"github.com/ossf/scorecard/v5/internal/checknames"

cron/config/config.go

@@ -26,7 +26,7 @@ import (
 	"strconv"
 	"strings"
 
-	"gopkg.in/yaml.v2"
+	"go.yaml.in/yaml/v2"
 )
 
 const (

docs/checks/internal/reader.go

@@ -20,7 +20,7 @@ import (
 	_ "embed"
 	"fmt"
 
-	"gopkg.in/yaml.v2"
+	"go.yaml.in/yaml/v2"
 )
 
 //go:embed checks.yaml

docs/probes/internal/generate/main.go

@@ -22,7 +22,7 @@ import (
 	"path/filepath"
 	"strings"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	pyaml "github.com/ossf/scorecard/v5/internal/probes/yaml"
 )

e2e/attestor_policy_test.go

@@ -22,7 +22,7 @@ import (
 
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
-	"gopkg.in/yaml.v2"
+	"go.yaml.in/yaml/v2"
 
 	"github.com/ossf/scorecard/v5/attestor/command"
 	"github.com/ossf/scorecard/v5/attestor/policy"

finding/finding.go

@@ -21,7 +21,7 @@ import (
 	"reflect"
 	"strings"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 // FileType is the type of a file.

finding/finding_test.go

@@ -21,7 +21,7 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 )
 
 func errCmp(e1, e2 error) bool {

finding/probe.go

@@ -19,7 +19,7 @@ import (
 	"fmt"
 	"strings"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	"github.com/ossf/scorecard/v5/clients"
 	pyaml "github.com/ossf/scorecard/v5/internal/probes/yaml"

go.mod

@@ -27,13 +27,13 @@ require (
 	github.com/spf13/cobra v1.10.2
 	github.com/xeipuuv/gojsonschema v1.2.0
 	go.opencensus.io v0.24.0
+	go.yaml.in/yaml/v2 v2.4.2
+	go.yaml.in/yaml/v3 v3.0.4
 	gocloud.dev v0.44.0
 	golang.org/x/text v0.32.0
 	golang.org/x/tools v0.39.0 // indirect
 	google.golang.org/genproto v0.0.0-20250922171735-9219d122eba9 // indirect
 	google.golang.org/protobuf v1.36.10
-	gopkg.in/yaml.v2 v2.4.0
-	gopkg.in/yaml.v3 v3.0.1
 	mvdan.cc/sh/v3 v3.12.0
 )
 
@@ -212,8 +212,6 @@ require (
 	go.opentelemetry.io/otel/trace v1.38.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.2 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	go.yaml.in/yaml/v4 v4.0.0-rc.3 // indirect
 	golang.org/x/mod v0.30.0 // indirect
 	golang.org/x/telemetry v0.0.0-20251111182119-bc8e575c7b54 // indirect
@@ -224,6 +222,8 @@ require (
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251111163417-95abcf5c77ba // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/api v0.29.3 // indirect
 	k8s.io/apimachinery v0.29.3 // indirect
 	k8s.io/client-go v0.29.3 // indirect