chore(deps): bump the go-dependencies group with 6 updates

[dependabot]

Bumps the go-dependencies group with 6 updates:

Package	From	To
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager	0.3.2	0.3.4
github.com/aws/aws-sdk-go-v2/service/lambda	1.98.0	1.99.0
github.com/aws/aws-sdk-go-v2/service/s3	1.105.1	1.105.2
github.com/aws/smithy-go	1.27.3	1.27.4
google.golang.org/api	0.288.0	0.289.0
google.golang.org/grpc	1.82.0	1.82.1

Updates github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager from 0.3.2 to 0.3.4

Commits

• f4fd272 Release 2026-07-17
• 8e4cbc8 Regenerated Clients
• 25e01e0 Update endpoints model
• 947fccf Update API model
• 769233f Fix transfermanager GetObject ContentRange to use HTTP format (#3473)
• 0ffbcb9 Release 2026-07-16
• 2a0ecfb Regenerated Clients
• 20ba39f Update endpoints model
• 8925213 Update API model
• 47e09a2 add replace annotations for new generic client auth/endpoints (#3477)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/lambda from 1.98.0 to 1.99.0

Commits

• 159f4d2 Release 2026-04-07
• 50223dc Regenerated Clients
• af25337 Update endpoints model
• 277dc01 Update API model
• 22bc35c Release 2026-04-06
• 9a35fed Regenerated Clients
• 867b085 Update endpoints model
• 61d367c Update API model
• 8560a07 Release 2026-04-03
• a5aafdf Regenerated Clients
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.105.1 to 1.105.2

Commits

• 0ffbcb9 Release 2026-07-16
• 2a0ecfb Regenerated Clients
• 20ba39f Update endpoints model
• 8925213 Update API model
• 47e09a2 add replace annotations for new generic client auth/endpoints (#3477)
• 1dc42b2 Release 2026-07-15
• b945893 Regenerated Clients
• ccbf00c Update API model
• b8df6dc enable schema-serde cbor wave 1 (#3478)
• 00daf36 Release 2026-07-14
• Additional commits viewable in compare view

Updates github.com/aws/smithy-go from 1.27.3 to 1.27.4

Commits

• 870555a Release 2026-07-16
• b06f353 changelogs
• 25d4f57 add temporary maven manual publish
• 90775c9 make generic clients work mostly (#687)
• da34ee1 add maven staging artifact
• 1eb963b add serde response snapshot gen (#685)
• a349439 replace literal unicodes with escaped forms (#684)
• 82c5631 generate serde snapshot tests (#682)
• See full diff in compare view

Updates google.golang.org/api from 0.288.0 to 0.289.0

Release notes

Sourced from google.golang.org/api's releases.

v0.289.0

0.289.0 (2026-07-16)

Features

• all: Auto-regenerate discovery clients (#3649) (6e259cb)
• all: Auto-regenerate discovery clients (#3652) (5116a48)
• all: Auto-regenerate discovery clients (#3653) (6c876b4)
• all: Auto-regenerate discovery clients (#3655) (69af635)
• all: Auto-regenerate discovery clients (#3656) (1fc8f45)
• all: Auto-regenerate discovery clients (#3657) (aa8d256)
• all: Auto-regenerate discovery clients (#3659) (af8d033)

Changelog

Sourced from google.golang.org/api's changelog.

0.289.0 (2026-07-16)

Features

• all: Auto-regenerate discovery clients (#3649) (6e259cb)
• all: Auto-regenerate discovery clients (#3652) (5116a48)
• all: Auto-regenerate discovery clients (#3653) (6c876b4)
• all: Auto-regenerate discovery clients (#3655) (69af635)
• all: Auto-regenerate discovery clients (#3656) (1fc8f45)
• all: Auto-regenerate discovery clients (#3657) (aa8d256)
• all: Auto-regenerate discovery clients (#3659) (af8d033)

Commits

• 783bf4b chore(main): release 0.289.0 (#3650)
• af8d033 feat(all): auto-regenerate discovery clients (#3659)
• 080002a chore: constrain go version updates in renovate (#3658)
• aa8d256 feat(all): auto-regenerate discovery clients (#3657)
• 1fc8f45 feat(all): auto-regenerate discovery clients (#3656)
• 7ac76e4 chore(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 in /internal/koko...
• 8a47d2a chore(all): update all (#3654)
• 69af635 feat(all): auto-regenerate discovery clients (#3655)
• 6c876b4 feat(all): auto-regenerate discovery clients (#3653)
• 5116a48 feat(all): auto-regenerate discovery clients (#3652)
• Additional commits viewable in compare view

Updates google.golang.org/grpc from 1.82.0 to 1.82.1

Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.82.1

Security

• server: Stop reading from the connection when flooded by HTTP/2 frames. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
• xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
• xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
• xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.

Commits

• ebd8f06 Change version to 1.82.1 (#9238)
• 4ea465d Cherry-pick commits (#9236)
• 9494a2c Change version to 1.82.1-dev (#9171)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[claude]

Claude finished @dependabot[bot]'s task in 1m 23s —— View job

---

Dependency upgrade review

• Identify changed dependencies
• Check changelogs/release notes for breaking changes
• Search repo for usage of upgraded deps
• Flag risks & suggest follow-up checks
• Verify build/compile

All 6 grouped bumps are patch/minor versions — low risk overall. Details below.

Direct dependencies

Package	Bump	Usage in repo	Assessment
feature/s3/transfermanager	0.3.2 → 0.3.4	internal/aws/aws.go:446,513 (DownloadObject for S3 snapshots)	⚠️ Contains a behavior fix — see note below
service/lambda	1.98.0 → 1.99.0	internal/aws/aws.go, snapshotLambda*	Regenerated client; standard ListFunctions/GetFunction usage unaffected
service/s3	1.105.1 → 1.105.2	internal/aws/aws.go	Regenerated client (CBOR serde wave); no API surface change for our calls
smithy-go	1.27.3 → 1.27.4	transitive AWS runtime	Internal generic-client changes only
google.golang.org/api	0.288.0 → 0.289.0	internal/cloudrun/*	Auto-regenerated discovery clients; non-breaking minor
google.golang.org/grpc	1.82.0 → 1.82.1	transitive (google api / otel)	✅ Security patch — worth taking

Points worth a closer look

1. transfermanager fix — Fix transfermanager GetObject ContentRange to use HTTP format (#3473)
This is the one change in this PR that alters runtime behavior for code we actually exercise. We use downloader.DownloadObject(...) in internal/aws/aws.go:513 to pull objects during S3 snapshots, and the transfer manager performs ranged/multipart GETs under the hood. The fix corrects the Content-Range handling — it's a correctness improvement, not a breaking change, but it's the change most likely to surface differences.
→ Suggested follow-up: a quick sanity run of an S3 snapshot against a large / multipart object to confirm downloads still complete and byte counts match.

2. grpc 1.82.1 is a security release
Adds HTTP/2 frame-flood throttling (default 100 non-DATA/HEADERS frames, tunable via GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT) plus xds/rbac fixes. gRPC is transitive here (not directly imported), so no code impact — good to merge.

Transitive bumps (informational)

golang.org/x/crypto 0.53→0.54, net 0.56→0.57, text 0.38→0.40, tools 0.45→0.47, mod 0.36→0.37, sync 0.21→0.22, enterprise-certificate-proxy 0.3.17→0.3.18, and a genproto/googleapis/rpc timestamp bump — all routine.

Note on verification

I could not run go build ./... / make lint in this environment (the commands require manual approval, so they were blocked). CI on the PR should cover compile + tests; if it's green, this is safe to merge. The only manual check I'd recommend beyond CI is the S3 multipart-download sanity run described in point 1.