chore(deps): bump the go-dependencies group across 1 directory with 5 updates

[dependabot]

Bumps the go-dependencies group with 5 updates in the / directory:

Package	From	To
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager	0.4.7	0.4.8
github.com/aws/aws-sdk-go-v2/service/lambda	1.108.0	1.109.0
github.com/aws/aws-sdk-go-v2/service/s3	1.113.1	1.113.2
github.com/go-playground/validator/v10	10.30.4	10.30.5
google.golang.org/api	0.298.0	0.299.0

Updates github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager from 0.4.7 to 0.4.8

Commits

• b85a735 Release 2026-09-21
• ceecc62 Regenerated Clients
• 48a4bd1 Update API model
• 901c19d Expand S3 operations that check for an error inside an HTTP 200 response (wav...
• 145ae38 schema-serde json 9/21 (#3562)
• 2a45d3f Release 2026-09-18
• eb31d96 Regenerated Clients
• 55f9850 Update API model
• 98cb1cb Release 2026-09-17
• f2bc6f7 Regenerated Clients
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/lambda from 1.108.0 to 1.109.0

Commits

• 893faa4 Release 2026-08-27
• 7263e51 Regenerated Clients
• 0d6ab44 Update API model
• f16c9f2 Fix route53 error close body (#3518)
• bc28b42 Move github workflows from inline scripts to actions (#3511)
• 7352017 support connection read timeouts (#3532)
• See full diff in compare view

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.113.1 to 1.113.2

Commits

• b85a735 Release 2026-09-21
• ceecc62 Regenerated Clients
• 48a4bd1 Update API model
• 901c19d Expand S3 operations that check for an error inside an HTTP 200 response (wav...
• 145ae38 schema-serde json 9/21 (#3562)
• 2a45d3f Release 2026-09-18
• eb31d96 Regenerated Clients
• 55f9850 Update API model
• 98cb1cb Release 2026-09-17
• f2bc6f7 Regenerated Clients
• Additional commits viewable in compare view

Updates github.com/go-playground/validator/v10 from 10.30.4 to 10.30.5

Release notes

Sourced from github.com/go-playground/validator/v10's releases.

Release 10.30.5

What's Changed

• fix: allow signed integer fields in port validation by @​EJJI0113 in go-playground/validator#1633
• Go 1.27 support by @​nodivbyzero in go-playground/validator#1637
• docs: add AI agent attribution requirements to CONTRIBUTING.md by @​deankarn in go-playground/validator#1640

New Contributors

• @​EJJI0113 made their first contribution in go-playground/validator#1633

Full Changelog: go-playground/validator@v10.30.4...v10.30.5

Commits

• 6a9b666 docs: add AI agent attribution requirements to CONTRIBUTING.md (#1640)
• 830a0b2 Go 1.27 support (#1637)
• c7f3d2c fix: allow signed integer fields in port validation (#1633)
• See full diff in compare view

Updates google.golang.org/api from 0.298.0 to 0.299.0

Release notes

Sourced from google.golang.org/api's releases.

v0.299.0

0.299.0 (2026-09-21)

Features

• all: Auto-regenerate discovery clients (#3734) (05c5fb0)
• all: Auto-regenerate discovery clients (#3737) (3b54280)
• all: Auto-regenerate discovery clients (#3738) (7089c40)

Changelog

Sourced from google.golang.org/api's changelog.

0.299.0 (2026-09-21)

Features

• all: Auto-regenerate discovery clients (#3734) (05c5fb0)
• all: Auto-regenerate discovery clients (#3737) (3b54280)
• all: Auto-regenerate discovery clients (#3738) (7089c40)

Commits

• 38da4c8 chore(main): release 0.299.0 (#3735)
• 87958bd chore(all): update all (#3740)
• 7089c40 feat(all): auto-regenerate discovery clients (#3738)
• 3b54280 feat(all): auto-regenerate discovery clients (#3737)
• adf75d8 chore(all): update all (#3721)
• 62460e9 chore: upgrade repo to use 1.27 latest, 1.26 earliest (#3736)
• 05c5fb0 feat(all): auto-regenerate discovery clients (#3734)
• 237a7dd testing: refine vet checks (#3733)
• See full diff in compare view

[claude]

Claude finished @dependabot[bot]'s task in 2m 37s —— View job

---

Dependency upgrade review

• Read the PR diff (go.mod / go.sum)
• Identify direct vs. transitive changes
• Map each upgraded dependency to its usage in this repo
• Assess breaking/behaviour changes per dependency
• Verify the module graph builds and is tidy — ⚠️ blocked, see note
• Post review summary

---

Verdict

Low risk. All five direct bumps are patch/minor within the same major version, no direct dependency changed its own go.mod requirements in a way that affects us, and the repo's usage of each is confined to a small, well-fenced API surface. Nothing here needs a code change.

Direct dependencies

Dependency	Bump	Used in	Risk
aws-sdk-go-v2/feature/s3/transfermanager	0.4.7 → 0.4.8	internal/aws/aws.go:175, :762	⚠️ Low — but v0.x, see below
aws-sdk-go-v2/service/lambda	1.108.0 → 1.109.0	internal/aws/aws.go:190-202, :240, :344	✅ Negligible
aws-sdk-go-v2/service/s3	1.113.1 → 1.113.2	internal/aws/aws.go (ListObjectsV2 only)	✅ Negligible
go-playground/validator/v10	10.30.4 → 10.30.5	cmd/kosli/snapshotPaths.go:150	✅ No impact
google.golang.org/api	0.298.0 → 0.299.0	internal/cloudrun/cloudrun.go:19 (api/iterator only)	✅ Negligible

Per-dependency notes

transfermanager v0.4.8 — the only bump worth a second look, because it's a pre-1.0 AWS module with no compatibility guarantee. The repo depends on three things from it: transfermanager.New(client, func(o *transfermanager.Options){ o.Concurrency = 5 }) (internal/aws/aws.go:175), the DownloadObject method signature that S3DownloadAPI mirrors (:151), and DownloadObjectOutput.ContentLength (:770). If any of those moved, internal/aws fails to compile and FakeS3Client stops satisfying the interface — a loud failure, not a silent one, so CI will catch it. The Concurrency = 5 pin (with its "pinned so the connection count cannot move with an SDK upgrade" comment) does exactly its job here.

service/s3 v1.113.2 — the release range includes "Expand S3 operations that check for an error inside an HTTP 200 response." Historically this guard covers CopyObject / UploadPartCopy / CompleteMultipartUpload; this repo uses only ListObjectsV2 plus the transfer manager's ranged GetObject/HeadObject, so it's outside the blast radius. Worth knowing the shape of the risk though: if a download path were covered, a previously-silent truncation would now surface as an error from downloadAndHashS3Object (internal/aws/aws.go:747) — i.e. a correct fingerprint failure replacing a wrong fingerprint. TestS3Contract_RealAWS (internal/aws/s3_contract_test.go:199) exercises the real endpoint and is the check that would catch it.

service/lambda v1.109.0 — a minor bump, but the repo touches only ListFunctions and GetFunctionConfiguration, reading LastModified, CodeSha256, FunctionName, PackageType. Lambda minors add fields and enum values rather than remove them. One nit for the record: the PR body's "compare view" link for lambda points at service/s3/v1.108.0...service/s3/v1.109.0 — dependabot linked the wrong module, so the commit list shown for lambda isn't actually lambda's. Cosmetic, but don't read those commits as the lambda changelog.

validator v10.30.5 — the one behaviour change is "allow signed integer fields in port validation." The repo's only validation tags are required and oneof=1 (internal/server/server.go:27,33-34); no port tag anywhere. Zero impact.

google.golang.org/api v0.299.0 — auto-regenerated discovery clients, none of which this repo imports; the only import is google.golang.org/api/iterator for Cloud Run pagination, and cloud.google.com/go/run stays pinned at v1.22.0. The upstream repo moved its own CI to "1.26 earliest / 1.27 latest", which matches go.mod's go 1.26.7 and .go-version's 1.26 — no Go-version pressure from this bump.

Transitive changes (all pulled by the google-api bump)

x/crypto 0.56→0.57, x/net 0.58→0.59, x/text 0.41→0.42, x/time 0.15→0.16, plus s2a-go 0.1.10, gax-go 2.24.1, enterprise-certificate-proxy 0.3.22, cloud.google.com/go/auth 0.23.3, compute/metadata 0.9.1. All routine; the x/crypto and x/net bumps are the kind you want to take promptly.

x/mod 0.38→0.41 and x/tools 0.48→0.49 look like large jumps but are build-tooling only — not linked into the kosli binary.

Two reassuring signals from go.sum: the AWS SDK core stays at v1.47.0 and smithy-go is untouched, so the "support connection read timeouts (#3532)" change visible in the AWS commit lists is not pulled in by this PR — it lives in the core module. And the /go.mod hashes for both service/s3 and service/lambda are byte-identical across the bump, meaning neither module changed its own requirements.

⚠️ What I could not verify

I was unable to run go build ./..., go vet, or make lint — the Go module cache is empty in this environment and the build commands were denied by the sandbox (This command requires approval). Every conclusion above is from reading the diff, the release notes, and the call sites; none of it is compile-verified locally. CI is the source of truth here, and for a go.mod-only change a green build is most of the review.

Suggested checks before merge

1. CI green — a clean compile alone rules out the transfermanager v0.x signature risk, which is the only structural concern in this PR.
2. internal/aws contract tests against real AWS — TestS3Contract_RealAWS and TestLambdaContract_RealAWS are the tests that would catch behavioural (not compile-time) drift in the S3/Lambda bumps. These need AWS credentials, so confirm they actually ran rather than skipped.
3. Re the earlier "Needs fix(tests): MiniIO image replacement #1214 to fix tests" — for the record, that's resolved: this branch is rebased onto main and 3b50e33b fix: MiniIO image replacement (#1214) is its parent, with nothing on main ahead of it.
   · branch dependabot/go_modules/go-dependencies-d4a649e917

[mbevc1]

Needs #1214 to fix tests

[mbevc1]

@dependabot recreate