[dependabot]

Bumps the go-dependencies group with 12 updates:

Package	From	To
cloud.google.com/go/asset	1.29.0	1.30.0
cloud.google.com/go/run	1.23.0	1.24.0
github.com/aws/aws-sdk-go-v2	1.47.3	1.47.4
github.com/aws/aws-sdk-go-v2/config	1.33.9	1.33.10
github.com/aws/aws-sdk-go-v2/credentials	1.20.9	1.20.10
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager	0.4.17	0.4.19
github.com/aws/aws-sdk-go-v2/service/ecs	1.101.0	1.102.1
github.com/aws/aws-sdk-go-v2/service/lambda	1.113.1	1.113.3
github.com/aws/aws-sdk-go-v2/service/s3	1.114.3	1.114.5
github.com/googleapis/gax-go/v2	2.26.2	2.27.0
google.golang.org/api	0.305.0	0.308.0
google.golang.org/genproto/googleapis/rpc	0.0.0-20261005182115-fad411399dd8	0.0.0-20261019180522-ce908d29299b

Updates cloud.google.com/go/asset from 1.29.0 to 1.30.0

Release notes

Sourced from cloud.google.com/go/asset's releases.

networkconnectivity: v1.30.0

1.30.0 (2026-10-22)

Features

• Update API sources and regenerate (#20728) (ab1da9d)

Changelog

Sourced from cloud.google.com/go/asset's changelog.

1.30.0 (2024-06-05)

Features

• documentai: Make Layout Parser generally available in V1 (#10286) (92dc381)

Commits

• 40f3888 chore: librarian release pull request: 20260430T204417Z (#14513)
• 820d0a2 fix(firestore): enforce backpressure in BulkWriter (#12938)
• 69993a5 chore(vertexai): block releases (#14512)
• 478f8e8 chore: begin migrating generation to use proto.CloneOf (#14507)
• b0a46e5 chore: disable vertexai releases (#14508)
• 9773f60 chore: update sources and regenerate (#14501)
• 6424c5a chore(all): update actions/github-script action to v9 (main) (#14454)
• 8d76f62 chore: exclude generated files from GCA review (#14503)
• 4e7669b Revert "chore: exclude generated protobuf files from GCA" (#14502)
• 8133e0a chore: exclude generated protobuf files from GCA (#14499)
• Additional commits viewable in compare view

Updates cloud.google.com/go/run from 1.23.0 to 1.24.0

Release notes

Sourced from cloud.google.com/go/run's releases.

osconfig: v1.24.0

1.24.0 (2026-10-22)

Features

• Update API sources and regenerate (#20728) (ab1da9d)

run: v1.24.0

1.24.0 (2026-10-22)

Features

• Update API sources and regenerate (#20728) (ab1da9d)

texttospeech: v1.24.0

1.24.0 (2026-10-22)

Features

• Update API sources and regenerate (#20728) (ab1da9d)

Changelog

Sourced from cloud.google.com/go/run's changelog.

1.24.0 (2024-02-06)

Features

• documentai: Add model_type in v1beta3 processor proto (#9355) (05e9e1f)

1.23.8 (2024-01-30)

Bug Fixes

• documentai: Enable universe domain resolution options (fd1d569)

1.23.7 (2023-12-13)

Documentation

• documentai: Clarify Properties documentation (757c1b0)

1.23.6 (2023-11-27)

Documentation

• documentai: Update comment for ProcessOptions.page_range (63ffff2)

1.23.5 (2023-11-01)

Bug Fixes

• documentai: Bump google.golang.org/api to v0.149.0 (8d2ab9f)

Documentation

• documentai: Updated comments (24e410e)

1.23.4 (2023-10-26)

Bug Fixes

• documentai: Update grpc-go to v1.59.0 (81a97b0)

1.23.3 (2023-10-17)

... (truncated)

Commits

• dfcb16f chore: release main (#12499)
• 4939f28 chore: redact bigquery/v2 from the common config/manifest (#12498)
• 737615d chore(main): release vertexai 0.15.0 (#12487)
• 9cc6c04 feat(vertexai): support ThinkingConfig (#12493)
• fe377af chore(main): release 0.121.3 (#12491)
• e655889 feat(spanner): wrap proto mutation (#12497)
• 2d66d4f feat(retail): add a user_attributes field in SearchRequest that can be used f...
• b560234 testing(bigquery/v2): add some basic smoketesting for bigquery/v2 (#12480)
• a961cb5 fix(vertexai): fix flaky test (#12492)
• dd096ec docs(impersonate): Address TODO in impersonate/example_test.go (#12401)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2 from 1.47.3 to 1.47.4

Commits

• 4aaad74 Release 2026-10-22
• 4c1f2f2 Regenerated Clients
• edb4ad6 Update endpoints model
• 414c9e4 Update API model
• 5bba534 Bump Smithy Go to 1.28.6 (#3600)
• 0d2e6fa Release 2026-10-21
• 0d7e55d Regenerated Clients
• d5bf455 Update endpoints model
• e92707e Update API model
• d980ed6 Enforce event stream header key value length limit instead of truncating (#3598)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/config from 1.33.9 to 1.33.10

Commits

• 4aaad74 Release 2026-10-22
• 4c1f2f2 Regenerated Clients
• edb4ad6 Update endpoints model
• 414c9e4 Update API model
• 5bba534 Bump Smithy Go to 1.28.6 (#3600)
• 0d2e6fa Release 2026-10-21
• 0d7e55d Regenerated Clients
• d5bf455 Update endpoints model
• e92707e Update API model
• d980ed6 Enforce event stream header key value length limit instead of truncating (#3598)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/credentials from 1.20.9 to 1.20.10

Commits

• 4b3b917 Release 2022-09-14
• 3ad6cfd Regenerated Clients
• abfad89 Update SDK's smithy-go dependency to v1.13.3
• b5262aa Update SDK with latest version of API models (#1844)
• a13b7a4 codegen: Upgrade to smithy 1.25.0 (#1835)
• 296bfb3 Update PULL_REQUEST_TEMPLATE.md (#1843)
• 63566f0 Update BuildAuthToken to validate endpoint contains a port (#1837)
• b011f04 Update credentials.go (#1841)
• 018b8c3 Amend typological errors in retryer package comments
• 5b135f8 Release 2022-09-02.2
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager from 0.4.17 to 0.4.19

Commits

• 4aaad74 Release 2026-10-22
• 4c1f2f2 Regenerated Clients
• edb4ad6 Update endpoints model
• 414c9e4 Update API model
• 5bba534 Bump Smithy Go to 1.28.6 (#3600)
• 0d2e6fa Release 2026-10-21
• 0d7e55d Regenerated Clients
• d5bf455 Update endpoints model
• e92707e Update API model
• d980ed6 Enforce event stream header key value length limit instead of truncating (#3598)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/ecs from 1.101.0 to 1.102.1

Commits

• 74c5011 Release 2026-05-28
• 7d82651 Regenerated Clients
• 79c63d9 Update endpoints model
• b15b3b8 Update API model
• 090e469 Feat tmv2 parity (#3424)
• d2133f0 credentials/logincreds: create new cache files with 0600 (#3425)
• 38fe976 Release 2026-05-27
• a7d5164 Regenerated Clients
• 5b79052 Update API model
• 5acd7b4 Add SHA-512 auto checksum calculation for S3 (#3422)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/lambda from 1.113.1 to 1.113.3

Commits

• ff3ac6f Release 2026-09-23
• e57d2ff Regenerated Clients
• ef6fdb9 Update endpoints model
• 385ab15 Update API model
• fafcb4f Checksum non-200 HTTP responses (#3564)
• 5452905 Release 2026-09-22
• 7356580 Regenerated Clients
• 7d28305 Update API model
• b85a735 Release 2026-09-21
• ceecc62 Regenerated Clients
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.114.3 to 1.114.5

Commits

• 4aaad74 Release 2026-10-22
• 4c1f2f2 Regenerated Clients
• edb4ad6 Update endpoints model
• 414c9e4 Update API model
• 5bba534 Bump Smithy Go to 1.28.6 (#3600)
• 0d2e6fa Release 2026-10-21
• 0d7e55d Regenerated Clients
• d5bf455 Update endpoints model
• e92707e Update API model
• d980ed6 Enforce event stream header key value length limit instead of truncating (#3598)
• Additional commits viewable in compare view

Updates github.com/googleapis/gax-go/v2 from 2.26.2 to 2.27.0

Release notes

Sourced from github.com/googleapis/gax-go/v2's releases.

v2.27.0

2.27.0 (2026-10-21)

Features

• add a path expression helper (#568) (7d7373f)

Commits

• 825555f chore(main): release 2.27.0 (#569)
• 7d7373f feat: add a path expression helper (#568)
• 87dc802 chore(all): update all to v7 (#567)
• b227403 chore(all): update all (#566)
• f3ab87e chore(all): update opentelemetry-go monorepo to v1.47.0 (#565)
• 68ee241 chore(all): update all (#564)
• 4916b19 chore: add mod compatibility testing to gax (#563)
• See full diff in compare view

Updates google.golang.org/api from 0.305.0 to 0.308.0

Release notes

Sourced from google.golang.org/api's releases.

v0.308.0

0.308.0 (2026-10-22)

Features

• all: Auto-regenerate discovery clients (#3787) (527f9a3)

v0.307.0

0.307.0 (2026-10-21)

Features

• all: Auto-regenerate discovery clients (#3785) (b2487a4)

v0.306.0

0.306.0 (2026-10-20)

Features

• all: Auto-regenerate discovery clients (#3779) (3b5f058)
• all: Auto-regenerate discovery clients (#3781) (795219d)

Bug Fixes

• gensupport: Defer chunk context cancellation until response body is closed (#3782) (ef4e011)

Changelog

Sourced from google.golang.org/api's changelog.

0.308.0 (2026-10-22)

Features

• all: Auto-regenerate discovery clients (#3787) (527f9a3)

0.307.0 (2026-10-21)

Features

• all: Auto-regenerate discovery clients (#3785) (b2487a4)

0.306.0 (2026-10-20)

Features

• all: Auto-regenerate discovery clients (#3779) (3b5f058)
• all: Auto-regenerate discovery clients (#3781) (795219d)

Bug Fixes

• gensupport: Defer chunk context cancellation until response body is closed (#3782) (ef4e011)

Commits

• 5767912 chore(main): release 0.308.0 (#3788)
• 527f9a3 feat(all): auto-regenerate discovery clients (#3787)
• fbb4c3c chore(main): release 0.307.0 (#3786)
• b2487a4 feat(all): auto-regenerate discovery clients (#3785)
• 0d9c67e chore(main): release 0.306.0 (#3780)
• ef4e011 fix(gensupport): defer chunk context cancellation until response body is clos...
• 795219d feat(all): auto-regenerate discovery clients (#3781)
• 0bd75b9 chore(all): update all to ce908d2 (#3778)
• 3b5f058 feat(all): auto-regenerate discovery clients (#3779)
• See full diff in compare view

Updates google.golang.org/genproto/googleapis/rpc from 0.0.0-20261005182115-fad411399dd8 to 0.0.0-20261019180522-ce908d29299b

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[claude]

Claude finished @dependabot[bot]'s task in 33s —— View job

---

Dependency upgrade review: no blockers found ✅

• Find which dependencies changed
• Check changelogs and semver for each one
• Search the repo for how each upgraded dependency is used
• Check CI: PR checks passed

Summary: Every direct bump is a patch or minor version, so none of them should break existing APIs. The one pre-1.0 module is transfermanager, and the code that uses it builds, because PR checks passed. I'm OK to merge.

What changed, and where the repo uses it

Dependency	Bump	Used in	Risk
aws-sdk-go-v2 core, config, credentials, smithy-go	patch	internal/aws/aws.go	Low. Regenerated clients and endpoint models only.
service/s3, service/lambda	patch	internal/aws	Low.
service/ecs	1.101.0 → 1.102.1 (minor)	internal/aws (ecs, ecs/types)	Low. In AWS service clients, a minor bump means new API operations or fields, not removals.
feature/s3/transfermanager	0.4.17 → 0.4.19	internal/aws/aws.go:151,186,840, fake_s3.go, s3_*_test.go	Medium in principle, because v0.x has no API stability promise. The DownloadObject signature that S3DownloadAPI and the fakes implement is unchanged, so it still compiles.
cloud.google.com/go/asset, run	minor	GCP asset and Cloud Run listing (apiv1, apiv2/runpb)	Low. Generated API source updates only.
gax-go/v2	2.26.2 → 2.27.0	internal/gke/gke.go:116 (gax.WithRetry, OnCodes, Backoff)	Low. The release only adds a path expression helper; the retry APIs are unchanged.
google.golang.org/api	0.305 → 0.308	iterator only	Low. The gensupport chunk-cancel fix only affects media uploads, which this repo doesn't do.
genproto/googleapis/rpc, plus indirect iam, longrunning, otel 1.47	—	indirect	Low. otel/log is a new indirect module; nothing in the repo imports it.

Notes

• The release notes in the PR body are partly wrong. For asset, credentials, ecs and lambda, Dependabot linked notes for other modules (documentai, kms, emr, an s3 compare range, and a 2022 release). Ignore those sections; the actual bumps above are routine.
• Two AWS changes don't touch this code. "Enforce event stream header key value length limit" only applies to event streams, which the repo doesn't use. "Checksum non-200 HTTP responses" only affects how error responses are validated.
• Suggested follow-up check: the S3 download path (kosli snapshot s3 / fingerprinting) goes through the v0.x transfermanager module, and only the fakes exercise it in unit tests. If s3_contract_test.go runs against real S3 or MinIO in the Main workflow, check that it passes before merging.

I couldn't run go build or the tests myself because the command wasn't permitted in this environment, so I relied on the passing PR checks run. The Main workflow was still running when I wrote this.