Skip to content

build(deps): bump the gomod group with 14 updates - #88

Merged
cristim merged 1 commit into
mainfrom
dependabot/go_modules/gomod-f04a8eb643
Oct 17, 2026
Merged

build(deps): bump the gomod group with 14 updates#88
cristim merged 1 commit into
mainfrom
dependabot/go_modules/gomod-f04a8eb643

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 17, 2026

Copy link
Copy Markdown
Contributor

Bumps the gomod group with 14 updates:

Package From To
github.com/aws/aws-sdk-go-v2 1.41.5 1.47.3
github.com/aws/aws-sdk-go-v2/service/ec2 1.251.2 1.338.4
github.com/aws/aws-sdk-go-v2/service/elasticache 1.50.3 1.63.3
github.com/aws/aws-sdk-go-v2/service/opensearch 1.52.3 1.85.1
github.com/aws/aws-sdk-go-v2/service/rds 1.97.3 1.130.3
github.com/aws/aws-sdk-go-v2/service/redshift 1.58.3 1.71.4
github.com/stretchr/testify 1.11.1 1.12.1
cloud.google.com/go/compute 1.54.0 1.72.0
github.com/aws/aws-sdk-go-v2/service/savingsplans 1.31.0 1.40.4
github.com/googleapis/gax-go/v2 2.21.0 2.26.2
golang.org/x/sys 0.48.0 0.49.0
google.golang.org/api 0.274.0 0.288.0
google.golang.org/protobuf 1.36.11 1.36.12
github.com/modelcontextprotocol/go-sdk 1.6.1 1.8.0

Updates github.com/aws/aws-sdk-go-v2 from 1.41.5 to 1.47.3

Commits

Updates github.com/aws/aws-sdk-go-v2/service/ec2 from 1.251.2 to 1.338.4

Commits

Updates github.com/aws/aws-sdk-go-v2/service/elasticache from 1.50.3 to 1.63.3

Commits

Updates github.com/aws/aws-sdk-go-v2/service/opensearch from 1.52.3 to 1.85.1

Commits

Updates github.com/aws/aws-sdk-go-v2/service/rds from 1.97.3 to 1.130.3

Commits

Updates github.com/aws/aws-sdk-go-v2/service/redshift from 1.58.3 to 1.71.4

Commits

Updates github.com/stretchr/testify from 1.11.1 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

New Contributors

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

What's Changed

Functional Changes

Fixes

Documentation, Build & CI

... (truncated)

Commits
  • 959dbda Merge pull request #1935 from harryzcy/yaml-update
  • 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
  • 001eb79 Merge pull request #1905 from Kentzo/patch-1
  • ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
  • 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
  • f8c01f3 mock: Mock.Return does not exist anymore
  • 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
  • a11649e assert: make *AssertionFunc type just aliases
  • dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
  • 098f8d7 _codegen: use strings.Builder
  • Additional commits viewable in compare view

Updates cloud.google.com/go/compute from 1.54.0 to 1.72.0

Release notes

Sourced from cloud.google.com/go/compute's releases.

compute: v1.72.0

1.72.0 (2026-10-08)

Features

compute: v1.72.0-preview.1

1.72.0-preview.1 (2026-09-30)

Features

Documentation

compute: v1.71.0

1.71.0 (2026-10-01)

Features

Bug Fixes

  • all AggregatedList RPCs behavior is now return_partial_success=true
  • all AggregatedList RPCs return_partial_success fields removed
  • remove several enums and fields that no longer exist in the API

Documentation

storage: v1.69.0

1.69.0 (2026-10-01)

Features

... (truncated)

Commits
  • 37f936a chore: release main (#20633)
  • f150f97 chore(main): release spanner 1.96.1 (#20649)
  • 00f8c41 fix(spanner): disable DirectPath fallback by default (#20648)
  • a46bbaa chore(storage): update BufferPool Get/TryGet semantics (#20647)
  • 4ad5d50 feat: update API sources and regenerate (#20646)
  • 8edc425 test(firestore): enable BSON integration tests (#20639)
  • f00e293 chore(main): release spanner 1.96.0 (#20543)
  • fdbd4f4 feat(spanner): add experimental vtprotobuf decoding with ExperimentalBorrowR...
  • f9eec5d fix(storage): correct remaining bytes for gRPC bidi range reads (#20619)
  • 54c1ee9 chore: update librarian version to v0.47.0 (#20643)
  • Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/savingsplans from 1.31.0 to 1.40.4

Commits

Updates github.com/googleapis/gax-go/v2 from 2.21.0 to 2.26.2

Release notes

Sourced from github.com/googleapis/gax-go/v2's releases.

v2.26.2

2.26.2 (2026-09-26)

Bug Fixes

  • o11y: name client request spans as {Service}.{Method} (#560) (1a022c8)

v2.26.1

2.26.1 (2026-09-26)

Bug Fixes

  • correct 1.27 protojson handling (#558) (c1e035d)
  • o11y: remove deprioritized gcp.resource.destination.id span attribute (#559) (a6f48a2)

v2.26.0

2.26.0 (2026-09-22)

Features

  • o11y: add ClientLogging configuration (95a5614)
  • o11y: add recordActionableLog helper for L3 error logs (3d6918a)
  • o11y: add WithClientLogging CallOption (0393829)
  • o11y: implement actionable error logging in Invoke (a6867ed)

v2.25.0

2.25.0 (2026-09-21)

Features

v2.24.1

2.24.1 (2026-09-03)

Bug Fixes

  • split implementation of ProtoJSONStream for 1.27 and later (#532) (d0623a1)

v2.24.0

2.24.0 (2026-08-20)

Features

... (truncated)

Commits
  • cfbefc8 chore(main): release 2.26.2 (#562)
  • 1a022c8 fix(o11y): name client request spans as {Service}.{Method} (#560)
  • c6b778b chore(main): release 2.26.1 (#561)
  • a6f48a2 fix(o11y): remove deprioritized gcp.resource.destination.id span attribute (#...
  • c1e035d fix: correct 1.27 protojson handling (#558)
  • db37545 chore(main): release 2.26.0 (#555)
  • 0b45074 Revert "chore(main): release 2.26.0 (#554)" (#556)
  • 7e3bd0a chore(main): release 2.26.0 (#554)
  • a6867ed impl(o11y): implement actionable error logging in Invoke (#553)
  • 3d6918a impl(o11y): add recordActionableLog helper for L3 error logs (#552)
  • Additional commits viewable in compare view

Updates golang.org/x/sys from 0.48.0 to 0.49.0

Commits
  • b6b8557 unix/linux: unify ppc64x syscall wrappers
  • aab6988 unix: add PrctlArg5Ptr
  • cdfd984 unix: pass fcntl data as unsafe.Pointer in FcntlF{lock,store} on darwin
  • 782b836 unix/linux: don't warn about closed stderr from child process
  • 61592fb unix: return syscall error in *listxattrNS on BSD
  • c136fda unix/linux/Dockerfile: update to Go 1.26.8
  • f1d0d79 unix: pass xattr data as unsafe.Pointer in BSD xattr syscalls
  • 67f850b unix: update linux to v7.2
  • eb1f659 unix: add O_EXEC and O_SEARCH on darwin
  • 51bc731 unix: add Mmsghdr for linux
  • Additional commits viewable in compare view

Updates google.golang.org/api from 0.274.0 to 0.288.0

Release notes

Sourced from google.golang.org/api's releases.

v0.288.0

0.288.0 (2026-07-09)

Features

v0.287.1

0.287.1 (2026-07-07)

Documentation

v0.287.0

0.287.0 (2026-06-30)

Features

v0.286.0

0.286.0 (2026-06-22)

Features

v0.285.0

0.285.0 (2026-06-16)

Features

... (truncated)

Changelog

Sourced from google.golang.org/api's changelog.

0.288.0 (2026-07-09)

Features

0.287.1 (2026-07-07)

Documentation

0.287.0 (2026-06-30)

Features

0.286.0 (2026-06-22)

Features

0.285.0 (2026-06-16)

Features

0.284.0 (2026-06-09)

Features

... (truncated)

Commits

Updates google.golang.org/protobuf from 1.36.11 to 1.36.12

Updates github.com/modelcontextprotocol/go-sdk from 1.6.1 to 1.8.0

Release notes

Sourced from github.com/modelcontextprotocol/go-sdk's releases.

v1.8.0

This release is equivalent to v1.8.0-pre.2. Thank you to those who tested the pre-release.

In this release we introduce several fixes and improvements on top of v1.7.0. It adds no new protocol revision: the supported set is unchanged, and 2026-07-28 remains the newest version the SDK negotiates.

The bulk of the work is hardening the transports against resource exhaustion, closing session leaks, deadlocks and teardown hangs found by users running the new protocol at scale, and giving servers explicit control over which protocol versions they advertise.

Two behavior changes are guarded by new MCPGODEBUG flags; see the section below.

Hardening against resource exhaustion

Every decoding path that buffers incoming input is now bounded. JSON payloads are rejected past 1000 levels of nesting, before the parser recurses. Both SSE readers cap the bytes buffered for a single event via MaxEventSize on SSEClientTransport and StreamableClientTransport, and the stdio transport caps a single JSON-RPC frame via StdioTransport.MaxLineLength.

On the OAuth side, dynamic client registration responses are bounded to 1 MB, and the discovery code now validates metadata documents rather than trusting them.

Restricting the protocol versions a server supports

ServerOptions.SupportedProtocolVersions lets a server narrow the set of versions it advertises and negotiates. The list can only narrow, never widen; naming a version the SDK does not implement panics at construction. Relatedly, a stateful streamable handler receiving a 2026-07-28 request now returns that same JSON-RPC error instead of a plain-text 400, so the client can renegotiate down instead of losing the connection.

Per-request cache control

ServerOptions.SetCacheable is a new hook that decides the ttlMs and cacheScope fields of every result carrying them: server/discover, the four list methods, and resources/read. It runs once per result, after the handler returns, with the values that handler produced, so it can set a policy globally while still letting an individual handler override it. Anything left unset falls back to the protocol default of public.

Behavior changes guarded by MCPGODEBUG

Two new escape-hatch flags restore the previous behavior of the changes above. Both will be removed in v1.9.0.

  • plaintextstatefulrejection=1 — restore the plain-text http.Error 400 body a stateful StreamableHTTPHandler previously returned for a request carrying per-request metadata. The default is now a JSON-RPC -32022 CodeUnsupportedProtocolVersion error with an UnsupportedProtocolVersionData payload advertising the legacy versions the server supports. Introduced by #1143.
  • blockingcancelnotify=1 — restore the previous behavior where a cancelled call waits synchronously for notifications/cancelled to be delivered (up to 5s) before returning, joining any delivery error into the caller's error. The default now retires the call immediately and sends the notification asynchronously. Introduced by #1151.

Options below were removed, according to plan:

  • seterroroverwrite
  • enableoriginverification
  • disablecontenttypecheck

... (truncated)

Commits
  • 3f3b699 refactor: remove legacy MCPGODEBUG compatibility for new protocol release (#1...
  • 830f0b7 mcp: update conformance tests (#1231)
  • 12cbafe oauthex: oauth discovery checks (#1220)
  • 3632967 mcp: add an sse event size cap (#1205)
  • 0d3036f mcp: allow per request Cacheable customization (#1203)
  • cb0de64 mcp: add a max request body size of the old transport (#1224)
  • 2fdabde mcp: do not check metatada on notifications (#1215)
  • 59185e6 build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#1217)
  • a6764cf build(deps): bump golang/govulncheck-action from 1.0.4 to 1.1.0 (#1218)
  • 8227246 fix: only subscribe when server advertises capability (#1221)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the gomod group with 14 updates
148d8da 
Bumps the gomod group with 14 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.41.5` | `1.47.3` |
| [github.com/aws/aws-sdk-go-v2/service/ec2](https://github.com/aws/aws-sdk-go-v2) | `1.251.2` | `1.338.4` |
| [github.com/aws/aws-sdk-go-v2/service/elasticache](https://github.com/aws/aws-sdk-go-v2) | `1.50.3` | `1.63.3` |
| [github.com/aws/aws-sdk-go-v2/service/opensearch](https://github.com/aws/aws-sdk-go-v2) | `1.52.3` | `1.85.1` |
| [github.com/aws/aws-sdk-go-v2/service/rds](https://github.com/aws/aws-sdk-go-v2) | `1.97.3` | `1.130.3` |
| [github.com/aws/aws-sdk-go-v2/service/redshift](https://github.com/aws/aws-sdk-go-v2) | `1.58.3` | `1.71.4` |
| [github.com/stretchr/testify](https://github.com/stretchr/testify) | `1.11.1` | `1.12.1` |
| [cloud.google.com/go/compute](https://github.com/googleapis/google-cloud-go) | `1.54.0` | `1.72.0` |
| [github.com/aws/aws-sdk-go-v2/service/savingsplans](https://github.com/aws/aws-sdk-go-v2) | `1.31.0` | `1.40.4` |
| [github.com/googleapis/gax-go/v2](https://github.com/googleapis/gax-go) | `2.21.0` | `2.26.2` |
| [golang.org/x/sys](https://github.com/golang/sys) | `0.48.0` | `0.49.0` |
| [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.274.0` | `0.288.0` |
| google.golang.org/protobuf | `1.36.11` | `1.36.12` |
| [github.com/modelcontextprotocol/go-sdk](https://github.com/modelcontextprotocol/go-sdk) | `1.6.1` | `1.8.0` |


Updates `github.com/aws/aws-sdk-go-v2` from 1.41.5 to 1.47.3
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.41.5...v1.47.3)

Updates `github.com/aws/aws-sdk-go-v2/service/ec2` from 1.251.2 to 1.338.4
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/ec2/v1.251.2...service/ec2/v1.338.4)

Updates `github.com/aws/aws-sdk-go-v2/service/elasticache` from 1.50.3 to 1.63.3
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.50.3...service/s3/v1.63.3)

Updates `github.com/aws/aws-sdk-go-v2/service/opensearch` from 1.52.3 to 1.85.1
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/ssm/v1.52.3...service/s3/v1.85.1)

Updates `github.com/aws/aws-sdk-go-v2/service/rds` from 1.97.3 to 1.130.3
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.97.3...service/rds/v1.130.3)

Updates `github.com/aws/aws-sdk-go-v2/service/redshift` from 1.58.3 to 1.71.4
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.58.3...service/wafv2/v1.71.4)

Updates `github.com/stretchr/testify` from 1.11.1 to 1.12.1
- [Release notes](https://github.com/stretchr/testify/releases)
- [Commits](stretchr/testify@v1.11.1...v1.12.1)

Updates `cloud.google.com/go/compute` from 1.54.0 to 1.72.0
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md)
- [Commits](googleapis/google-cloud-go@compute/v1.54.0...compute/v1.72.0)

Updates `github.com/aws/aws-sdk-go-v2/service/savingsplans` from 1.31.0 to 1.40.4
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.31.0...service/efs/v1.40.4)

Updates `github.com/googleapis/gax-go/v2` from 2.21.0 to 2.26.2
- [Release notes](https://github.com/googleapis/gax-go/releases)
- [Commits](googleapis/gax-go@v2.21.0...v2.26.2)

Updates `golang.org/x/sys` from 0.48.0 to 0.49.0
- [Commits](golang/sys@v0.48.0...v0.49.0)

Updates `google.golang.org/api` from 0.274.0 to 0.288.0
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](googleapis/google-api-go-client@v0.274.0...v0.288.0)

Updates `google.golang.org/protobuf` from 1.36.11 to 1.36.12

Updates `github.com/modelcontextprotocol/go-sdk` from 1.6.1 to 1.8.0
- [Release notes](https://github.com/modelcontextprotocol/go-sdk/releases)
- [Commits](modelcontextprotocol/go-sdk@v1.6.1...v1.8.0)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-version: 1.47.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ec2
  dependency-version: 1.338.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/service/elasticache
  dependency-version: 1.63.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/service/opensearch
  dependency-version: 1.85.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/service/rds
  dependency-version: 1.130.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/service/redshift
  dependency-version: 1.71.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/stretchr/testify
  dependency-version: 1.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: cloud.google.com/go/compute
  dependency-version: 1.72.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/aws/aws-sdk-go-v2/service/savingsplans
  dependency-version: 1.40.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: github.com/googleapis/gax-go/v2
  dependency-version: 2.26.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: golang.org/x/sys
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: google.golang.org/api
  dependency-version: 0.288.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
- dependency-name: google.golang.org/protobuf
  dependency-version: 1.36.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: gomod
- dependency-name: github.com/modelcontextprotocol/go-sdk
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: gomod
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Oct 17, 2026
@coderabbitai

coderabbitai Bot commented Oct 17, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: Repository: LeanerCloud/cloud-commitments-mcp/.coderabbit.yaml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: efefaa60-5a81-4d8a-8bc0-668ab9226bf5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

This was referenced Oct 17, 2026
Closed
Open
@cristim

cristim commented Oct 17, 2026

Copy link
Copy Markdown
Member

Merge-driver verdict: CLEAN at 148d8da39fb201bd3618aa69333a291d03f05ffd

An independent adversarial reviewer (Sonnet, high effort, cold brief) reviewed this Dependabot PR. It found no blocking findings.

Scope: go.mod and go.sum only. The four cloud-commitments-go pins are unchanged. Through MVS, the library's AWS and GCP code now runs on these newer SDK versions.

Purchase-path drift, checked by comparing old and new SDK module sources (real):

  • Input and Output structs are identical for the purchase and describe calls of all six services: ec2, rds, elasticache, redshift, opensearch and savingsplans.
  • The money fields are unchanged: ec2 InstanceCount *int32 and ReservedInstancesOfferingId; SP Commitment, SavingsPlanOfferingId, ClientToken and UpfrontPaymentAmount.
  • savingsplans enums.go only adds values.
  • The library's ec2 purchase sets per-call RetryMaxAttempts = 1 to avoid a double buy. That path (finalizeOperationRetryMaxAttempts and retry.AddWithMaxAttempts) is unchanged. The new 2026 retry logic only turns on with AWS_NEW_RETRIES_2026=true.
  • The MCP go-sdk moves from v1.6.1 to v1.8.0. The root, cmd and tools tests pass under -race.

Supply chain:

  • go mod verify reports "all modules verified".
  • The only new go.sum module is go.yaml.in/yaml/v3 v3.0.5, a test-only dependency via testify v1.12.1.
  • There are no major-path changes.

Local verification on macOS (real runs, mock providers, GOTOOLCHAIN=go1.26.9):

  • go build and go vet pass.
  • go test -race -count=1 ./... passes in all 3 packages.
  • govulncheck finds 0 vulnerabilities reachable from this code.

Coverage gap, recorded. OpenSearch requests now go through smithy-go's new schema-based serializer. The struct fields are identical, but the mocked tests don't cover the wire encoding of the purchase request, and no real-account call was made. If the encoding were wrong, the most likely failure is AWS rejecting the request rather than a different purchase. Follow-up: #89.

Gate items:

  • CI: all green at this SHA.
  • Merge state: CLEAN.
  • No closing issue, so label mirroring does not apply.
  • CR waived: quota, adversarial review + local verification + green CI.

@cristim
cristim merged commit b173b02 into main Oct 17, 2026
13 checks passed
@dependabot
dependabot Bot deleted the dependabot/go_modules/gomod-f04a8eb643 branch October 17, 2026 19:04
@IAmJSD IAmJSD mentioned this pull request Oct 19, 2026
Draft
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@cristim