fix(deps): update module sigs.k8s.io/yaml to v1.4.0 - autoclosed

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
sigs.k8s.io/yaml	require	minor	v1.3.0 -> v1.4.0

---

Release Notes

kubernetes-sigs/yaml (sigs.k8s.io/yaml)

v1.4.0

Compare Source

• Adds a goyaml.v2 subpackage containing a fork of gopkg.in/yaml.v2 at v2.4.0
• Adds a goyaml.v3 subpackage containing a fork of gopkg.in/yaml.v3 at v3.0.1
• Adds an Encoder#CompactSeqIndent() encoder option to sigs.k8.io/goyaml.v3 to allow opting into indentation compatible with gopkg.in/yaml.v2

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: renovate[bot]
Once this PR has been reviewed and has the lgtm label, please assign zhangguanzhang for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[mheon]

Failing due to bloat; 343488 bytes.

Since this is our preferred YAML library, we may have to live with it.

[mheon]

@baude @Luap99 @vrothberg Good to merge this despite the bloat?

[vrothberg]

Bloat is always bad. But I'd need more context to say with confidence what to do.

[Luap99]

Well they hard forked gopkg.in/yaml.v2 and v3 as well (kubernetes-sigs/yaml#76)

That means the we effectively have two copies of gopkg.in/yaml.v2 in our code with minor changes. So we can either accept that or somehow figure out a way to replace the gopkg.in/yaml.v2 dep in https://github.com/go-openapi/runtime/blob/master/yamlpc/yaml.go (also see containers/image#1818 ) or drop the sigs.k8s.io/yaml dependency or well not update it (which is not sustainable long term anyway).

So for now I think accepting that is the only choice.