chore(deps): bump the go-dependencies group with 2 updates

[dependabot]

Bumps the go-dependencies group with 2 updates: github.com/aws/aws-sdk-go-v2/service/ecs and google.golang.org/grpc.

Updates github.com/aws/aws-sdk-go-v2/service/ecs from 1.98.0 to 1.99.0

Commits

• 159f4d2 Release 2026-04-07
• 50223dc Regenerated Clients
• af25337 Update endpoints model
• 277dc01 Update API model
• 22bc35c Release 2026-04-06
• 9a35fed Regenerated Clients
• 867b085 Update endpoints model
• 61d367c Update API model
• 8560a07 Release 2026-04-03
• a5aafdf Regenerated Clients
• Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.83.2 to 1.84.0

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.84.0

Behavior Changes

• stats/otel: The grpc.lb.pick_first.* metrics have been removed and replaced with grpc.subchannel.* metrics. See gRFC A94 for more details. (#9215)

New Features

• xds: Add support for contains_match in route header matchers. (#9223)
  • Special Thanks: @​nvxbug

Bug Fixes

• client: Fix a bug where a ClientConn could get permanently stuck in IDLE when an RPC was canceled during stream creation. Previously, such cancellations triggered stream cleanup twice, corrupting the channel's idleness state and causing subsequent RPCs to fail with deadline exceeded errors. (#9191)
  • Special Thanks: @​utkuozdemir
• client: Fix a bug where non-gRPC HTTP responses ending with an empty DATA frame failed the RPC with status code Internal instead of preserving the HTTP-mapped status code and response body. (#9217)
  • Special Thanks: @​chengxilo
• credentials: Validate metadata returned by per-RPC credentials, failing the RPC with status code Internal if invalid keys or values are found. Previously, invalid metadata from credentials was sent to the server in outgoing HTTP/2 requests. (#9202)
  • Special Thanks: @​buger
• credentials/sts: Prevent potential token leakage by disallowing HTTP redirects during STS token exchange. Previously, 3xx redirects were followed automatically, replaying the request body containing authentication tokens to the redirect destination. (#9299)
  • Special Thanks: @​nvxbug
• randomsubsetting: Ignore endpoints that contain no addresses. Previously, this could cause the policy to panic while computing hashes. (#9259)
  • Special Thanks: @​fallintoplace
• stats/otel: Ensure method names are populated in trace spans when metrics are disabled. Previously, running with tracing enabled and metrics disabled resulted in server trace spans lacking the RPC method name (recording only "Recv."). (#9262)
• transport: Return io.ErrUnexpectedEOF when EOF is encountered after partial header or message body reads. Previously, partial reads could return a plain io.EOF, failing to distinguish truncated data from a clean end of stream. (#9204)
  • Special Thanks: @​buger
• transport: Validate metadata supplied by balancers (in PickResult.Metadata) and resolver addresses, failing the RPC with status code Internal if invalid keys or values are found. Previously, invalid metadata from these sources was sent to the server in outgoing HTTP/2 requests. (#9203)
  • Special Thanks: @​buger
• xds: Fix a rare corner case that could prevent a cluster from being removed when it is no longer in use. (#9140)
• xds: Fix panic during route matching for routes containing header matchers with empty exact_match strings. (#9223)
  • Special Thanks: @​nvxbug
• xds: Reject routes containing header matchers with empty prefix_match or suffix_match strings. Previously, this caused a panic during route matching. (#9223)
  • Special Thanks: @​nvxbug
• xds: Fix EDS drop policies being applied at a much lower rate than configured due to an integer overflow. (#9257)
  • Special Thanks: @​nvxbug
• xds: Reject EDS resources containing drop policies with unsupported denominators. Previously, such resources caused the client to panic when calculating drop rates. (#9218)
  • Special Thanks: @​nvxbug
• xds/rbac: Reject RBAC configurations containing nested Principal or Permission rules with :scheme or grpc- prefixed header matchers. Previously, such configurations could cause DENY policies to fail open. (#9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Rewrite host header matchers to :authority in nested Principal and Permission rules. Previously, this rewrite only applied to top-level rules, causing nested host matchers to never match incoming requests and DENY policies to fail open. (#9258)
  • Special Thanks: @​nvxbug
• xds/rbac: Reject CidrRanges with an unset prefix length. Previously, an omitted prefix_len field caused a panic during RBAC configuration parsing. (#9250)
  • Special Thanks: @​nvxbug

Performance Improvements

• transport: Avoid a heap allocation when flushing shared write buffers. (#9233)
  • Special Thanks: @​zaidoon1
• credentials/alts: Support dynamic frame size negotiation and add the GRPC_GO_EXPERIMENTAL_ALTS_MAX_FRAME_SIZE environment variable (default 4KiB, max 512KiB) to configure the maximum ALTS record frame size. (#9268)

Commits

• e84aa5a Change version to 1.84.0 (#9324)
• c5ae88d Cherrypick #9204 and #9321 to v1.84.x (#9407)
• a592f6a Cherrypick #9351 and #9404 to v1.84.x (#9408)
• d5a4111 cherry-pick #9365 to v1.84.x (#9370)
• 89d55e0 cherry-pick #9346 to v1.84.x (#9372)
• 8a9f866 Cherry-pick #9332 to v1.84.x (#9338)
• f8b54e7 Cherry-pick #9331 to v1.84.x (#9334)
• 30ce1d5 xds: support injecting bootstrap and server config into HTTP filter config pa...
• 54c743e extproc : wait for async RPC to complete in test (#9311)
• 538bb2f endpointsharding: decouple locking, and simplify ChildState API (#9290)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[claude]

Claude finished @dependabot[bot]'s task in 1m 55s —— View job

---

Dependency upgrade review

• Read the PR diff
• Identify how aws-sdk-go-v2/service/ecs is used in the repo
• Identify how google.golang.org/grpc is used (direct vs transitive)
• Check release notes for breaking/behaviour changes
• Compatibility check (see note on local build below)
• Post review summary

Verdict: low risk — safe to merge. Both bumps are minor/compatible, and neither touches an API this repo calls.

---

github.com/aws/aws-sdk-go-v2/service/ecs 1.98.0 → 1.99.0

Code-generated service client; the bump is an API-model regeneration. Note the go.sum /go.mod hash is unchanged (only the h1: content hash moved), so there are no transitive dependency changes and no version skew with the other aws-sdk-go-v2 modules pinned in go.mod.

Usage in this repo (internal/aws/aws.go, internal/aws/fake_ecs.go):

• Operations: ListClusters, DescribeClusters, ListServices, DescribeServices, ListTasks, DescribeTasks — all long-stable.
• Types: only ecsTypes.Cluster and ecsTypes.Service structs. No switch on ECS enums anywhere, which is the usual way a generated-SDK bump bites you (new enum members). taskDesc.LastStatus is compared as a raw string at internal/aws/aws.go:997, so new service-side statuses can't cause a compile break either.
• ECSServicesAPI (internal/aws/aws.go:222-225) hand-mirrors the SDK method signatures, so a signature change there would be a compile error — it isn't one, since PR checks is green on this commit.

google.golang.org/grpc 1.83.2 → 1.84.0

Direct use is confined to codes + status in internal/cloudrun/errors.go (plus tests). No grpc.Dial/NewClient, no balancers, no xds, no OTel metric registration. That rules out nearly all of the 1.84 changelog:

• The grpc.lb.pick_first.* → grpc.subchannel.* OTel metric rename (gRFC A94) — the only listed behaviour change — is irrelevant; otelgrpc is an indirect dep and nothing here scrapes gRPC metrics.
• The xds/rbac/EDS fixes and ALTS frame-size work don't apply.

Two changes worth being aware of, both affecting the transitively-constructed clients (run.NewServicesClient / run.NewRevisionsClient at internal/cloudrun/cloudrun.go:90,94, and client-go):

1. [#9217] Non-gRPC HTTP responses ending in an empty DATA frame now preserve the HTTP-mapped status code instead of Internal. This can change which branch Classify takes: a corporate proxy or gateway rejecting the Cloud Run API with 401/403 previously fell through to default (error returned verbatim) and will now surface as Unauthenticated/PermissionDenied — i.e. the user gets the ADC-setup hint or "the caller needs roles/run.viewer on project X" for what is actually a proxy failure. Usually an improvement in fidelity, but it's the one place this repo's behaviour can visibly shift. Not worth changing anything pre-emptively; just the first thing to look at if someone reports a misleading kosli snapshot cloudrun auth message.
2. [#9202 / #9203] Metadata from per-RPC credentials and balancers is now validated, failing the RPC with Internal rather than being sent with invalid keys/values. ADC bearer tokens are ASCII, so this shouldn't fire; if it ever did, Classify's default branch passes the error through unchanged, which is the right outcome.

go 1.26.7 in go.mod is comfortably above grpc 1.84's minimum, so no toolchain bump is implied.

Suggested follow-up checks

Nothing blocking. If you want belt-and-braces beyond the green PR checks:

make test_integration_single TARGET=AWSTestSuite
make test_integration_single TARGET=SnapshotECSTestSuite
make test_integration_single TARGET=SnapshotCloudRunTestSuite

The Cloud Run suite is the only one that exercises status.FromError classification, so it's the one that would catch #9217 fallout.

Caveat on my verification: I could not run go build ./... or the test suites myself in this job — the sandbox declined the command — so the compile/test evidence here is the repo's own PR checks run (green on this commit) plus static reading of the call sites. I also had no network access to pull the upstream ECS CHANGELOG.md, so the ECS assessment rests on the unchanged go.mod hash and the call-site audit rather than on reading AWS's release notes directly.
· branch dependabot/go_modules/go-dependencies-ed51f4002c