[dependabot]

Bumps the go-dependencies group with 5 updates:

Package	From	To
github.com/aws/aws-sdk-go-v2/config	1.33.10	1.33.11
github.com/aws/aws-sdk-go-v2/credentials	1.20.10	1.20.11
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager	0.4.19	0.5.0
google.golang.org/api	0.308.0	0.309.0
google.golang.org/grpc	1.84.0	1.85.0

Updates github.com/aws/aws-sdk-go-v2/config from 1.33.10 to 1.33.11

Commits

• 0d657c0 Release 2026-10-26
• 77b7742 Regenerated Clients
• 54f1f5e Update endpoints model
• 4099cd1 Update API model
• aae188a Download directory objects through DownloadObject instead of GetObject (#3560)
• See full diff in compare view

Updates github.com/aws/aws-sdk-go-v2/credentials from 1.20.10 to 1.20.11

Commits

• 9c92421 Release 2022-09-20
• 389c50b Regenerated Clients
• 834dd34 Update endpoints model
• d8d5446 Update API model
• 4c9dc4d Merge pull request #1847 from RanVaknin/documentation-update-config
• 72c90fe updated linting ignore
• 3f34bd0 added changelog statment
• 3938bb7 Release 2022-09-19
• c547650 Regenerated Clients
• 2d3bbde Update endpoints model
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager from 0.4.19 to 0.5.0

Commits

• d52522b Release v2.0.0-preview.5 (2018-09-27) (#219)
• 9b23956 Fix hashbang typo in cleanup_models.sh (#211)
• 295bebb removing dependency of ini parse (#209)
• 4c3010b service/s3/s3manager: Add doc for sequential download (#201)
• d819711 changes to allow for go1.11 to work (#207)
• 6a8514b service/dynamodb/dynamodbattribute: Add support for custom struct tag keys (#...
• f401f4e aws/signer/v4: Fix X-Amz-Content-Sha256 being in to query for presign (#188)
• bd12807 syncing v1 rdsutils (#193)
• 166597d Update README.md (#191)
• 5a1e531 Fix a broken README link and minor wording issue (#192)
• Additional commits viewable in compare view

Updates google.golang.org/api from 0.308.0 to 0.309.0

Release notes

Sourced from google.golang.org/api's releases.

v0.309.0

0.309.0 (2026-10-25)

Features

• all: Auto-regenerate discovery clients (#3789) (e05cb39)
• all: Auto-regenerate discovery clients (#3791) (0aad672)
• all: Auto-regenerate discovery clients (#3792) (7a3948f)

Changelog

Sourced from google.golang.org/api's changelog.

0.309.0 (2026-10-25)

Features

• all: Auto-regenerate discovery clients (#3789) (e05cb39)
• all: Auto-regenerate discovery clients (#3791) (0aad672)
• all: Auto-regenerate discovery clients (#3792) (7a3948f)

Commits

• e701550 chore(main): release 0.309.0 (#3790)
• 7a3948f feat(all): auto-regenerate discovery clients (#3792)
• 0aad672 feat(all): auto-regenerate discovery clients (#3791)
• e05cb39 feat(all): auto-regenerate discovery clients (#3789)
• See full diff in compare view

Updates google.golang.org/grpc from 1.84.0 to 1.85.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.85.0

New Features

• stats: Expose the effective client authority (sent on the wire as the HTTP/2 :authority header) in client stats.OutHeader events. (#9296)
  • Special Thanks: @​aryansk
• metadata: Add ValueFromOutgoingContext, which reads a single metadata value from outgoing context without copying the entire outgoing metadata into a new map. (#9282)
  • Special Thanks: @​yuyangguo42

Bug Fixes

• transport: Refine control buffer throttling to only count peer-induced control frames, raise the default GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT from 100 to 10,000, and close client connections if reads remain throttled for 10s. (#9563)
• server: Ensure Stop() forcefully terminates the server while GracefulStop() is waiting for active handlers to complete. (#9394)
  • Special Thanks: @​stanhu
• server: Unconditionally increment the highest-seen stream ID on when handling HEADERS frames to comply with RFC 7540 §5.1.1. Previously, truncated HEADERS frames left the connection in an inconsistent state and allowed stream IDs to be reused by clients without resulting in a protocol error. (#9414)
• server: Terminate streams immediately when a HEADERS frame includes the EndStream bit. Previously, this caused server handlers to hang when reading a message. (#9391)
• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#9365)
• xds: Fix a bug where route header matchers with non-lowercase names failed to match routes. (#9353)
  • Special Thanks: @​winklemad
• client: Ensure retried RPCs use the correct :authority value specified by the LB policy instead of inheriting it from a previous attempt. (#9277)
  • Special Thanks: @​nvxbug
• transport: Fail streams with io.ErrUnexpectedEOF instead of io.EOF upon receiving truncated message headers or bodies after partial data has already been received. (#9204)
  • Special Thanks: @​buger

Commits

• c9ab42c Change version to 1.85.0 (#9434)
• bfb7561 cherry pick (#9433) and (#9563) (#9566)
• 46a2db2 *: update dockerfiles to build using go1.26 to match go.mod (#9548)
• 076bb1c Cherrypick #9533 to v1.85.x. (#9534)
• baaf083 *: update the net package and go version (#9506)
• 678b9b3 Cherrypick #9385 to v1.85.x (#9504)
• 705f9b9 Cherry-pick #9425 into v1.85.x (#9438)
• 1648161 transport: stop read throttling due to controlBuf size, on the client (#9431)
• 1863b59 protoc-gen-go-grpc: Update supported Edition to 2026 (#9426)
• d331f11 server: release mutex while waiting for handlers in stop() (#9394)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[claude]

Claude finished @dependabot[bot]'s task in 45s —— View job

---

Dependency review: go-dependencies group (5 updates)

Verdict: Probably safe to merge. The only bump that could break the API is transfermanager 0.4.19 → 0.5.0. I couldn't build or run tests here, so wait for the Main workflow to pass before merging.

Package	Bump	How this repo uses it	Risk
aws-sdk-go-v2/config	1.33.10 → 1.33.11 (patch)	AWS credential/config loading in internal/aws	Low. Regenerated clients and endpoint updates only
aws-sdk-go-v2/credentials	1.20.10 → 1.20.11 (patch)	Static creds (AWSStaticCreds)	Low
aws-sdk-go-v2/feature/s3/transfermanager	0.4.19 → 0.5.0 (v0 minor, so the API may break)	internal/aws/aws.go:151,186,840, internal/aws/fake_s3.go:191	Medium, see below
google.golang.org/api	0.308.0 → 0.309.0	Only api/iterator, in internal/gke and internal/cloudrun	Low. Regenerated discovery clients only; iterator is stable
google.golang.org/grpc	1.84.0 → 1.85.0	Only grpc/codes and grpc/status, for error mapping in internal/gke/errors.go and internal/cloudrun/errors.go	Low. The transport and server fixes don't touch these packages

Indirect bumps: cel.dev/expr 0.25.2 → 0.25.3 and aws-sdk-go-v2/service/signin 1.10.5 → 1.11.0. Neither is used directly.

transfermanager 0.5.0

In a v0 module a minor bump can contain breaking changes. The only upstream change listed in the PR body is aws/aws-sdk-go-v2#3560, "Download directory objects through DownloadObject instead of GetObject". That changes DownloadDirectory, which this repo doesn't call. We only call DownloadObject.

This codebase depends on these parts of the API:

• transfermanager.New(client, func(o *transfermanager.Options) { o.Concurrency = 5 }) at aws.go:186.
• DownloadObjectInput{Bucket, Key, WriterAt} and DownloadObjectOutput.ContentLength at aws.go:840-849.
• FakeS3Client.DownloadObject must keep matching the S3DownloadAPI method signature exactly (fake_s3.go:191).

If any of these were renamed or retyped in 0.5.0, the build fails at compile time, so it can't slip through quietly. The PR checks workflow has passed; Main (build and integration tests) was still running when I wrote this.

Follow-up checks:

• Confirm the Main workflow passes. It compiles internal/aws and runs the S3 snapshot tests, which use FakeS3Client.
• Optional: a real kosli snapshot s3 run against a test bucket would confirm that object downloads and fingerprints are unchanged. The fake doesn't exercise the transfer manager's internal ranged-GET logic.

What I couldn't run

go build / go test and fetching the upstream CHANGELOG need permissions this job doesn't have. To let future runs check this directly, add Bash(go build:*), Bash(go test:*) and WebFetch to --allowedTools.