chore(deps): bump the go-dependencies group across 1 directory with 10 updates

[dependabot]

Bumps the go-dependencies group with 10 updates in the / directory:

Package	From	To
cloud.google.com/go/run	1.22.0	1.23.0
github.com/aws/aws-sdk-go-v2	1.47.0	1.47.1
github.com/aws/aws-sdk-go-v2/config	1.33.5	1.33.6
github.com/aws/aws-sdk-go-v2/credentials	1.20.5	1.20.6
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager	0.4.8	0.4.10
github.com/aws/aws-sdk-go-v2/service/ecs	1.99.0	1.99.1
github.com/aws/aws-sdk-go-v2/service/lambda	1.109.0	1.110.0
github.com/aws/aws-sdk-go-v2/service/s3	1.113.2	1.113.4
github.com/open-policy-agent/opa	1.20.2	1.21.0
k8s.io/kubernetes	1.37.0	1.37.1

Updates cloud.google.com/go/run from 1.22.0 to 1.23.0

Release notes

Sourced from cloud.google.com/go/run's releases.

osconfig: v1.23.0

1.23.0 (2026-09-23)

Features

• all: Update supported go versions (#20520) (90413d3)

run: v1.23.0

1.23.0 (2026-09-23)

Features

• all: Update supported go versions (#20520) (90413d3)

texttospeech: v1.23.0

1.23.0 (2026-09-23)

Features

• all: Update supported go versions (#20520) (90413d3)

Changelog

Sourced from cloud.google.com/go/run's changelog.

1.23.0 (2023-10-04)

Features

• documentai: Added SummaryOptions to ProcessOptions for the Summarizer processor (02a899c)
• documentai: Added field Processor.processor_version_aliases (02a899c)
• documentai: Make page_range field public (#8602) (02a899c)

1.22.1 (2023-09-12)

Documentation

• documentai: Update client libraries for Enterprise OCR add-ons (#8549) (0449518)

Commits

• 8332a9b chore: release main (#12344)
• e044c0d chore(all): update opentelemetry-go-contrib monorepo (#12337)
• e1c5ea9 chore(all): update opentelemetry-go monorepo to v1.36.0 (#12336)
• eeeeb82 feat(modelarmor): new clients (#12350)
• 6297761 feat(support): new client(s) (#12351)
• 49769e0 feat(aiplatform): A new field include_thoughts is added to message `.google...
• 0036073 fix(storage): add EnableNewAuthLibrary internalOption to HTTP newClient (#12320)
• 774621c fix(storage): omit check on MultiRangeDownloader (#12342)
• 2c78d19 chore(support): add v2beta client config (#12315)
• 963b5ab feat(modelarmor): add config for v1beta (#12345)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2 from 1.47.0 to 1.47.1

Commits

• 52ba256 Release 2026-09-24
• 21223cd Regenerated Clients
• 84d89bd Update endpoints model
• d9c59ff Update API model
• 8fd86b1 feat: Add aws-chunked response decoding reader (#3563)
• ff3ac6f Release 2026-09-23
• e57d2ff Regenerated Clients
• ef6fdb9 Update endpoints model
• 385ab15 Update API model
• fafcb4f Checksum non-200 HTTP responses (#3564)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/config from 1.33.5 to 1.33.6

Commits

• 52ba256 Release 2026-09-24
• 21223cd Regenerated Clients
• 84d89bd Update endpoints model
• d9c59ff Update API model
• 8fd86b1 feat: Add aws-chunked response decoding reader (#3563)
• ff3ac6f Release 2026-09-23
• e57d2ff Regenerated Clients
• ef6fdb9 Update endpoints model
• 385ab15 Update API model
• fafcb4f Checksum non-200 HTTP responses (#3564)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/credentials from 1.20.5 to 1.20.6

Commits

• 27acb6b Release 2023-12-15
• d3d958f Regenerated Clients
• b9e42b1 Update endpoints model
• d61965f Update API model
• dca6a24 Release 2023-12-14
• 65183ed Regenerated Clients
• 9a01654 Update endpoints model
• 87eb076 Update API model
• aaea7b5 Release 2023-12-13
• 8b61d81 Regenerated Clients
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager from 0.4.8 to 0.4.10

Commits

• 52ba256 Release 2026-09-24
• 21223cd Regenerated Clients
• 84d89bd Update endpoints model
• d9c59ff Update API model
• 8fd86b1 feat: Add aws-chunked response decoding reader (#3563)
• ff3ac6f Release 2026-09-23
• e57d2ff Regenerated Clients
• ef6fdb9 Update endpoints model
• 385ab15 Update API model
• fafcb4f Checksum non-200 HTTP responses (#3564)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/ecs from 1.99.0 to 1.99.1

Commits

• 9bc9c51 Release 2026-04-17
• 2b41455 Regenerated Clients
• 2327a1b Update endpoints model
• 9225797 Update API model
• 7b6f675 Bump smithy-go to 1.25 (again) (#3390)
• c8b6a97 Release 2026-04-16
• 4a05c2b Regenerated Clients
• 6cd4cc9 Update endpoints model
• 3153bed Update API model
• fe3cef6 Make AccountIDEndpointRouting aware of bdd endpoints (#3387)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/lambda from 1.109.0 to 1.110.0

Commits

• 5a5ee7a Release 2026-08-31.2
• bb72816 Regenerated Clients
• 4167234 Update API model
• 85ddf74 Remove credential source middleware (#3539)
• 258c696 Release 2026-08-31
• 029ffeb Regenerated Clients
• c884b0f Update API model
• 71ac84b schema-serde: json wave 3 (#3538)
• b63d8be Release 2026-08-28.2
• 43288f7 Regenerated Clients
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.113.2 to 1.113.4

Commits

• 52ba256 Release 2026-09-24
• 21223cd Regenerated Clients
• 84d89bd Update endpoints model
• d9c59ff Update API model
• 8fd86b1 feat: Add aws-chunked response decoding reader (#3563)
• ff3ac6f Release 2026-09-23
• e57d2ff Regenerated Clients
• ef6fdb9 Update endpoints model
• 385ab15 Update API model
• fafcb4f Checksum non-200 HTTP responses (#3564)
• Additional commits viewable in compare view

Updates github.com/open-policy-agent/opa from 1.20.2 to 1.21.0

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.21.0

This release contains a mix of new features and bug fixes. Notably:

• Improved rule indexing
• Improved rule recursion check
• YAML is parsed against the 1.2 core schema (breaking change)

Rules with general refs no longer collide in the recursion check (#6813)

Before, this was a recursion error:

package play
p[x].foo.bar if {
x := "a"
not p[x].foo.baz
}
p[x].foo.baz if {
x := "a"
false
}

Rules with a variable in their head are all stored at the ground prefix of their ref, so p[x].foo.bar and p[x].foo.baz looked like dependencies of each other. The compiler is now less conservative and compares the ref parts past the prefix. Genuine cycles are still reported.

The IR and Wasm targets however still return an error: they plan one function per ground path prefix, and cannot evaluate part of a function that is still being planned.

Authored by @​sspaink, reported by @​tsandall

Data and Query APIs can return rule labels in the response (#9211)

# METADATA labels for evaluated rules were only available in decision log events. The Data API (GET/POST /v1/data) and Query API (GET/POST /v1/query) now accept a rule_labels query parameter to include the same merged labels in the response payload, under a rule_labels key.

Authored by @​srenatus

Behavior change: response gzip compression now bounds its buffer to min_length (#9205)

The server's gzip response compression (server.encoding.gzip) buffered an entire incoming Write call before deciding whether to compress, so a single large write could grow the buffer well past min_length before that decision was made. The handler is now built on klauspost/compress/gzhttp

... (truncated)

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.21.0

This release contains a mix of new features and bug fixes. Notably:

• Improved rule indexing
• Improved rule recursion check
• YAML is parsed against the 1.2 core schema (breaking change)

Rules with general refs no longer collide in the recursion check (#6813)

Before, this was a recursion error:

package play
p[x].foo.bar if {
x := "a"
not p[x].foo.baz
}
p[x].foo.baz if {
x := "a"
false
}

Rules with a variable in their head are all stored at the ground prefix of their ref, so p[x].foo.bar and p[x].foo.baz looked like dependencies of each other. The compiler is now less conservative and compares the ref parts past the prefix. Genuine cycles are still reported.

The IR and Wasm targets however still return an error: they plan one function per ground path prefix, and cannot evaluate part of a function that is still being planned.

Authored by @​sspaink, reported by @​tsandall

Data and Query APIs can return rule labels in the response (#9211)

# METADATA labels for evaluated rules were only available in decision log events. The Data API (GET/POST /v1/data) and Query API (GET/POST /v1/query) now accept a rule_labels query parameter to include the same merged labels in the response payload, under a rule_labels key.

Authored by @​srenatus

Behavior change: response gzip compression now bounds its buffer to min_length (#9205)

The server's gzip response compression (server.encoding.gzip) buffered an entire incoming Write call before deciding whether to compress, so a single large write could grow the buffer well past min_length before that decision was made. The handler is now

... (truncated)

Commits

• dc6269f Release v1.21.0 (#9258)
• f6aa85f ast: count a ref once when an index entry replaces its var entry
• b7a4a42 build(deps): bump the dependencies group across 2 directories with 11 updates
• 3f11d3a docs: update Agent Evidence Admission repo links (#9255)
• 2dcd8ab topdown: fix flaky TestRegexBuiltinCache (#9254)
• c327a14 docs: ecosystem entry for Agent Evidence Admission (#9213)
• a83674f docs: Address incorrect package name in example (#9250)
• 620b7a5 website: Implement local search based on Pagefind (#9249)
• 959890c topdown: add stack traces to evaluation errors (#9242)
• 455aebd ast: don't box a slice header on the way out of Transform
• Additional commits viewable in compare view

Updates k8s.io/kubernetes from 1.37.0 to 1.37.1

Release notes

Sourced from k8s.io/kubernetes's releases.

v1.37.1

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

Commits

• f78e722 Release commit for Kubernetes v1.37.1
• b051586 Merge pull request #142167 from natherz97/automated-cherry-pick-of-100-upstre...
• 03207d5 Merge pull request #142179 from cpanato/update-go-rel-1.37
• 9fe0cc3 Merge pull request #142163 from natherz97/automated-cherry-pick-of-104-upstre...
• 66c7450 Bump images and versions to go 1.26.8 and distroless iptables
• aa1a2c9 Refuse UNC symlink targets in Windows subPath resolution
• f7558bb Restore only .spec part from ControllerRevision for any StatefulSet
• 7b8fc6e Merge pull request #141922thc1006/automated-cherry-pick-of-#141307
• d259327 Merge pull request #141627HirazawaUi/automated-cherry-pick-of-#141337
• 4fa5a27 Merge pull request #141775249043822/automated-cherry-pick-of-#141329
• Additional commits viewable in compare view

[claude]

Claude finished @dependabot[bot]'s task in 44s —— View job

---

Dependency upgrade review for #1222

Verdict: low risk, OK to merge once CI passes. "PR checks" passed. "Main" was still running when I checked. I couldn't run go build or the tests myself because the runner's tool permissions blocked them, so this review is static.

What changed

Dependency	Bump	Where it's used	Risk
open-policy-agent/opa	1.20.2 → 1.21.0 (minor)	internal/evaluate/rego.go (ast.ParseModuleWithOpts, rego.New, inmem)	Low, see below
aws-sdk-go-v2 core, config, credentials, ecs, s3, transfermanager	patch	internal/aws (ECS, S3 snapshots)	Very low
aws-sdk-go-v2/service/lambda	1.109.0 → 1.110.0 (minor)	internal/aws (Lambda snapshots)	Very low, just a regenerated client
cloud.google.com/go/run	1.22.0 → 1.23.0	Cloud Run snapshots	Very low: the only change is the supported Go versions, and go.mod already requires 1.26.7
k8s.io/kubernetes	1.37.0 → 1.37.1 (patch)	internal/kube	Very low: cherry-picked fixes and a Go toolchain bump
Indirect: gobwas/glob 0.2.3 → 1.0.0, lestrrat-go/jwx/v3 3.2 → 3.3, dsig 1.3 → 1.4, gqlparser, prometheus/client_model	transitive	Not imported directly (checked with grep)	Very low

Notes on OPA 1.21.0

• YAML now parses against the 1.2 core schema (breaking change). This changes how the yaml.unmarshal / yaml.is_valid builtins read unquoted values. For example, yes, no, on and off stay strings instead of becoming booleans, and values like 0755 are no longer read as octal. The CLI passes JSON input to Rego, and no policy or fixture in this repo uses the YAML builtins. User-written policies passed to kosli evaluate could still call yaml.unmarshal on YAML-1.1 style values and get different results. This is worth a line in the release notes, but nothing in the codebase needs to change.
• Recursion check is less conservative. Some policies that used to fail to compile with a recursion error will now compile. This only loosens behaviour, so it doesn't affect policies that already work.
• Rule indexing changes and stack traces on evaluation errors. Error message wording from rego.Eval may differ slightly. The golden files for kosli evaluate error cases would catch that in the integration run, so check that job if it fails.
• Server-side changes (gzip handler, rule_labels on the Data/Query API) don't apply, because the CLI embeds OPA as a library.

Suggested follow-ups

• Confirm the "Main" workflow, which runs the integration tests including kosli evaluate and the snapshot suites, passes on this branch.
• Optionally add a changelog note for users with custom Rego that the YAML builtins now follow YAML 1.2 (OPA 1.21).

I found no problems in specific lines, so there are no inline comments.

[mbevc1]

@dependabot recreate

[mbevc1]

@dependabot recreate