chore(deps): bump the go-dependencies group with 4 updates - #1208

Claude finished @dependabot[bot]'s task in 2m 13s —— View job

Dependency review

• Identify changed dependencies
• Check release notes / semver for breaking changes
• Search repo for affected usage
• Assess CI coverage for the upgraded surfaces
• Post review summary

Verdict: safe to merge. All four bumps are patch releases, and none of them touch an API this repo calls.

What changed

Notes worth reading

1. transfermanager is the only dep this repo binds to structurally — and 0.4.7 is a no-op for it.
It's a v0.x module, so semver offers no compatibility guarantee, and this repo depends on its types across four files (interface at internal/aws/aws.go:151, plus hand-written fakes at internal/aws/fake_s3.go:144, s3_parallel_test.go:44, s3_fingerprint_test.go:39). However, every commit in the 0.4.6…0.4.7 range is release plumbing — "Release", "Regenerated Clients", "Update endpoints model", "Update API model" — with no change to the transfer manager source. DownloadObjectInput/Output and Options.Concurrency are unchanged.

The o.Concurrency = 5 pin at internal/aws/aws.go:175 is the right guard for exactly this dependency, and the comment there already says why. Nothing to do.

2. The indirect sts bump is a minor version, and the PR description doesn't mention it.
1.50.0 → 1.51.0 with an unchanged go.mod hash in go.sum ⇒ a regenerated-client/model change, which is additive by AWS's codegen convention. STS reaches this repo only transitively through config.LoadDefaultConfig (internal/aws/aws.go:124) for assume-role / SSO / web-identity resolution; the primary path here is static credentials (aws.go:95), so exposure is minimal.

3. Dependabot's commit list for credentials is for the wrong module — ignore it.
It compares service/mq/v1.20.4...service/mq/v1.20.5, so the seven commits shown are 2023 Amazon MQ commits, not the credentials provider. Don't read that section as this dependency's changelog. (Cosmetic — the version resolved in go.mod/go.sum is correct.)

4. google.golang.org/api 0.298.0 is regenerated discovery clients only.
The only direct import is api/iterator, one of the most stable packages in that module; the rest arrives transitively via cloud.google.com/go/run. The release also contains a revert of "move to go1.26.0 as the lowest supported go version" — and this repo is already on go 1.26.7 (go.mod:3), so it's a non-event either way.

Coverage gap worth knowing about

The only test that exercises the real transfermanager.Client is TestS3ContractAgainstAWS (internal/aws/s3_contract_test.go:200-206), and it's gated on AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY. Dependabot PRs generally don't receive repository secrets, so that test is almost certainly skipping here. A signature change in the SDK would still fail the build (the fakes implement S3DownloadAPI explicitly), but a behaviour change in ranged download would not be caught on this PR. Not a blocker for a release-plumbing-only bump — just don't treat green CI on a dependabot PR as proof the real S3 path was tested. If you want that signal, run make test_integration_full locally with AWS creds, or re-run the suite on main after merge where secrets are available.

Verification I could not perform

go build/go vet and outbound network fetches are both blocked in this sandbox, so the findings above come from the diff, the repo's usage sites, and the changelogs embedded in the PR description rather than from a local compile. The PR checks workflow has passed; the Main workflow (build + tests) was still in progress when I looked — check it here before merging.
· branch dependabot/go_modules/go-dependencies-46af3d3424