Update gomod dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
github.com/aws/aws-sdk-go-v2	v1.43.6 → v1.43.7			require	patch	v1.45.1 (+3)
github.com/aws/aws-sdk-go-v2/config	v1.32.37 → v1.32.38			require	patch	v1.33.1 (+3)
github.com/aws/aws-sdk-go-v2/credentials	v1.19.36 → v1.19.37			require	patch	v1.20.1 (+3)
github.com/aws/aws-sdk-go-v2/feature/rds/auth	v1.6.37 → v1.6.38			require	patch	v1.7.1 (+3)
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager	v0.3.14 → v0.3.15			require	patch	v0.4.1 (+3)
github.com/aws/aws-sdk-go-v2/service/kms	v1.55.6 → v1.55.7			require	patch	v1.57.1 (+3)
github.com/aws/aws-sdk-go-v2/service/s3	v1.107.2 → v1.107.3			require	patch	v1.109.1 (+3)
github.com/aws/aws-sdk-go-v2/service/ses	v1.37.6 → v1.37.7			require	patch	v1.39.1 (+3)
github.com/aws/aws-sdk-go-v2/service/sts	v1.45.6 → v1.45.7			require	patch	v1.47.1 (+3)
github.com/aws/smithy-go	v1.27.8 → v1.27.9			require	patch	v1.28.1 (+2)
github.com/cockroachdb/pebble/v2	v2.1.6 → v2.1.7			require	patch
github.com/jackc/pglogrepl	e37c414 → 4ae5c49			require	digest
k8s.io/apimachinery	v0.36.3 → v0.36.4			require	patch	v0.37.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2)

v1.43.7

Compare Source

Module Highlights

• github.com/aws/aws-sdk-go-v2/service/aiops: v1.7.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/applicationcostprofiler: v1.28.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/apprunner: v1.40.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/backup: v1.57.0
  • Feature: Launching S3 PITR malware scanning support for AWS Backup
• github.com/aws/aws-sdk-go-v2/service/batch: v1.65.0
  • Feature: Increase the maximum value of jobExecutionTimeoutMinutes to support longer job timeouts during compute environment infrastructure updates.
• github.com/aws/aws-sdk-go-v2/service/bcmdataexports: v1.16.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/bedrockagentcore: v1.27.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/bedrockagentcorecontrol: v1.40.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/bedrockdataautomation: v1.15.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/billing: v1.11.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/budgets: v1.43.7
  • Documentation: AWS Budget Name Validation Documentation Updates.
• github.com/aws/aws-sdk-go-v2/service/chimesdkidentity: v1.28.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/chimesdkmediapipelines: v1.27.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/cleanrooms: v1.45.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/cleanroomsml: v1.24.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/codeconnections: v1.11.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/connecthealth: v1.2.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/controlcatalog: v1.15.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/datazone: v1.62.0
  • Feature: Added resourceConfigurations and allowUserProvidedConfigurations fields to environment blueprint configuration APIs, enabling customers who migrated from V1 to V2 domains to update resource configurations (such as lineage schedules) programmatically via the SDK.
• github.com/aws/aws-sdk-go-v2/service/devopsguru: v1.41.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/emrserverless: v1.41.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/evs: v1.10.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/greengrassv2: v1.43.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/guardduty: v1.78.0
  • Feature: Add malware scan support for Continuous Backups, also known as Point-In-Time Recovery Points (PITR).
• github.com/aws/aws-sdk-go-v2/service/identitystore: v1.37.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/iotmanagedintegrations: v1.10.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/ivschat: v1.22.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/keyspacesstreams: v1.7.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/kinesisvideowebrtcstorage: v1.21.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/managedblockchainquery: v1.23.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/marketplaceagreement: v1.16.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/mediapackagev2: v1.39.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/medicalimaging: v1.26.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/notifications: v1.8.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/observabilityadmin: v1.16.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/odb: v1.11.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/osis: v1.22.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/partnercentralchannel: v1.2.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/pcaconnectorscep: v1.12.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/pipes: v1.24.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/redshiftserverless: v1.35.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/resiliencehub: v1.36.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/resourcegroupstaggingapi: v1.32.0
  • Feature: The GetResources API now returns MissingTagKeys in ComplianceDetails, listing tag keys defined as required in the ReportRequiredTagBlock block of the effective tag policy that are absent from the resource.
• github.com/aws/aws-sdk-go-v2/service/rolesanywhere: v1.23.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/route53globalresolver: v1.3.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/s3tables: v1.16.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/sagemakeredge: v1.32.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/sagemakergeospatial: v1.20.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/scheduler: v1.18.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/servicediscovery: v1.40.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/servicequotas: v1.35.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/ssmquicksetup: v1.9.0
  • Feature: Adding new BDD representation of endpoint ruleset
• github.com/aws/aws-sdk-go-v2/service/workspacesthinclient: v1.21.0
  • Feature: Adding new BDD representation of endpoint ruleset

aws/smithy-go (github.com/aws/smithy-go)

v1.27.9

Compare Source

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.27.9
  • Bug Fix: Fix a generic event stream exception not carrying the error code and message from its payload.
  • Bug Fix: Fix an event stream not being closed when its connection is lost, which would cause a caller writing to the stream to block indefinitely.
  • Bug Fix: Fix deserialization of an empty list producing a nil slice instead of an empty one.
  • Bug Fix: Restore draining the HTTP response body in CloseResponseBody to avoid issues with TCP connection reuse.

cockroachdb/pebble (github.com/cockroachdb/pebble/v2)

v2.1.7

Compare Source

Pebble release used in production by CockroachDB 25.3.x, with v2 path.

Caution! v2.x no longer supports the oldest on-disk formats; see README.

What's Changed

• pebble-release-2.1: go.mod: bump swiss by @​RaduBerinde in #​6178

Full Changelog: cockroachdb/pebble@v2.1.6...v2.1.7

kubernetes/apimachinery (k8s.io/apimachinery)

v0.36.4

Compare Source

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • "after 5pm on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: flow/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 11 additional dependencies were updated

Details:

Package	Change
github.com/aws/aws-sdk-go-v2/feature/ec2/imds	v1.18.37 -> v1.18.38
github.com/aws/aws-sdk-go-v2/internal/configsources	v1.4.37 -> v1.4.38
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2	v2.7.37 -> v2.7.38
github.com/aws/aws-sdk-go-v2/internal/v4a	v1.4.38 -> v1.4.39
github.com/aws/aws-sdk-go-v2/service/internal/checksum	v1.9.30 -> v1.9.31
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url	v1.13.37 -> v1.13.38
github.com/aws/aws-sdk-go-v2/service/internal/s3shared	v1.19.38 -> v1.19.39
github.com/aws/aws-sdk-go-v2/service/signin	v1.5.6 -> v1.5.7
github.com/aws/aws-sdk-go-v2/service/sso	v1.33.6 -> v1.33.7
github.com/aws/aws-sdk-go-v2/service/ssooidc	v1.38.6 -> v1.38.7
github.com/cockroachdb/swiss	v0.0.0-20251224182025-b0f6560f979b -> v0.0.0-20260820225851-333444432258

[claude]

Renovate dependency bump — reviewed ✅

Diff is flow/go.mod + flow/go.sum only (+72/−72). No Go source changes, so the "no PII/secrets in new stdout/stderr/log output" check is trivially satisfied.

I read the upstream commit logs for the bumped ranges. Findings below — nothing blocking.

jackc/pglogrepl e37c414 → 4ae5c49 (digest bump, the only non-patch change)

Exactly one commit in range: Expose the size of PGDATA when starting a base backup (jackc/pglogrepl#85). It adds BaseBackupResult.PgDataSize and changes the unexported getTableSpaceInfo signature. StartBaseBackup keeps its signature; the parse/replication paths PeerDB actually depends on (Parse, ParseXLogData, ParsePrimaryKeepaliveMessage, StartReplication, SendStandbyStatusUpdate, LSN/ParseLSN) are untouched. A grep confirms PeerDB never calls StartBaseBackup, so this is a no-op for us. No CDC regression risk.

aws-sdk-go-v2 core v1.43.6 → v1.43.7 — two behavioral changes worth knowing

1. SigV4 now signs X-Amz-Checksum-* headers (added as a pattern to RequiredSignedHeaders). Relevant because flow/connectors/utils/aws.go:435 re-signs GCS-interop requests with RecalculateV4Signature. That path calls v4.NewSigner() from the same package and does a full SignHTTP, so client-side signing and re-signing stay consistent — no mismatch. Worth remembering if an S3-compatible endpoint or proxy ever strips checksum headers in flight.
2. S3ErrorWith200Status wave 2 enabled (service/s3 v1.107.3: "Expand S3 operations that check for an error inside an HTTP 200 response (wave 2/4)"). More operations now parse a 200 body looking for an embedded <Error> and surface it as a real error. Wave 2 is bucket-config GetBucket*/PutBucket*, ListBuckets, ListDirectoryBuckets, GetObjectLockConfiguration — a repo-wide grep finds zero call sites for any of them. The high-traffic ops PeerDB does use (PutObject, ListObjectsV2, HeadObject, UploadPart, CompleteMultipartUpload) are still in the disabled waves 3/4. No impact this release, but a behavior shift to watch as later waves land — previously-silent 200 failures will start surfacing as errors.

feature/s3/transfermanager v0.3.15 is a metadata/go.mod-only bump despite being pre-1.0.

Everything else — no-ops

• smithy-go v1.27.9: one substantive commit (event stream + empty-collection serde). Fixes are in internal/eventstream and codegen; PeerDB uses no event-stream APIs, and the nil-slice → empty-slice change only affects code doing slice == nil, whereas our S3 list handling is range page.Contents (nil-safe).
• cockroachdb/pebble/v2 v2.1.7: single commit bumping cockroachdb/swiss, which itself is only "enable go 1.27 support" plus a CI update.
• k8s.io/apimachinery v0.36.4: golang.org/x dep refresh only.
• All other aws-sdk-go-v2 service/internal modules: coordinated patch bumps.

go.sum entries line up with every go.mod version, including the transitive credentials v1.19.37 and swiss digest that are not listed in the PR table.

One caveat on verification: I could not run go build ./... in this environment, so compile confirmation rests on CI (lint, docker-build, flow_test) — all still pending at review time.

[claude]

Dependency bump review — no findings

Reviewed per .claude/REVIEW.md. No code changes, so no new stdout/stderr/log output and no PII/secret exposure surface. Only flow/go.mod + flow/go.sum; the module set added/removed is symmetric with no unexpected transitive additions or drops.

Went through the upstream commit logs/release notes for the bumped ranges:

jackc/pglogrepl e37c414 → 4ae5c49 (digest bump, no release notes in the PR body — this was the one worth checking closely). Exactly one commit in the range: Expose the size of PGDATA when starting a base backup (#85). It adds BaseBackupResult.PgDataSize (additive field) and changes the signature of the unexported getTableSpaceInfo. It touches only the StartBaseBackup path — PeerDB uses StartReplication/ParseXLogData/Parse*Message/SendStandbyStatusUpdate and never calls base backup, so no impact on CDC.

aws/aws-sdk-go-v2 v1.43.6 → v1.43.7 and friends.

• Core: adds X-Amz-Checksum-* to RequiredSignedHeaders in the v4 signer. This only changes presigner behavior (which headers stay headers vs. hoisted to query); normal signed requests are unaffected, and we don't presign anywhere.
• service/s3 v1.107.3: "expand HTTP-200-error checking (wave 2/4)" enables the customization for GetBucket* / ListBuckets / PutBucketAcl / PutBucketPolicy etc. — none of which we call. The ops we do use (PutObject, ListObjectsV2, DeleteObject) sit in waves 3/4 and are still disabled upstream, so no new error paths for S3-compatible stores here. Worth keeping in mind for a future bump when wave 4 lands, since that's the wave that covers our hot path.
• The other s3 fix — forwarding the original body's Closer instead of io.NopCloser in 200-error handling — is a positive for us: it was observed on CompleteMultipartUpload, which our transfermanager uploads (flow/connectors/utils/avro_writer.go, flow/connectors/clickhouse/staging_s3.go) go through, and it fixes TCP connection reuse.
• feature/s3/transfermanager v0.3.15 is a dependency-update-only release, so the context.Canceled unwrap workaround at avro_writer.go:142-147 is still needed and still correct.

aws/smithy-go v1.27.9: event-stream error-code/close fixes (we don't use event streams — no SelectObjectContent or similar) and empty-list deserialization now yielding an empty slice instead of nil. The latter is the only behavior change with any reach, and every place we consume list results (page.Contents, files.Contents) is a range loop, so nil-vs-empty is indistinguishable.

cockroachdb/pebble/v2 v2.1.7: go.mod/go.sum only — the sole change is the cockroachdb/swiss bump, which itself is just widening the build tag from !go1.27 to !go1.28 plus CI matrix updates. No code change; strictly a compatibility widening.

k8s.io/apimachinery v0.36.4: go.mod/go.sum only (golang.org/x dependency refresh).

Nothing regression-worthy found. Note that lint and the flow_test matrix were still pending when this review ran, so the usual build/test signal should be confirmed green before merge.

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

[claude]

Renovate dependency bump review — looks clean ✅

Reviewed per .claude/REVIEW.md. Diff is flow/go.mod (24 lines) + flow/go.sum (48 lines = 24 modules × 2) — version-only changes, consistent with each other. No go/toolchain directive changes, no replace/exclude additions, and no code/logging changes (so no PII or secret-exposure surface).

Upstream change review (regression check)

github.com/jackc/pglogrepl e37c414 → 4ae5c49 (Apr → Aug 2026; the only digest bump, and the most CDC-critical dep). Exactly one commit in range: "Expose the size of PGDATA when starting a base backup" (jackc/pglogrepl PR 85). It adds BaseBackupResult.PgDataSize and changes the unexported getTableSpaceInfo signature. Public API is otherwise unchanged, and nothing touches the logical-replication paths PeerDB uses (StartReplication, SendStandbyStatusUpdate, ParseXLogData, v2 protocol parsing). There are zero BaseBackup call sites in this repo, so this is effectively a no-op for us.

aws-sdk-go-v2 core v1.43.6 → v1.43.7: the bulk of the range is regenerated clients and API models for services we do not import. The non-generated commits:

• aws-sdk-go-v2 PR 3514 — close each file after its transfer finishes during directory upload/download (transfermanager fd-leak fix; an improvement, and we do not use the directory APIs).
• aws-sdk-go-v2 PR 3523 — expand the set of S3 operations that check for an error embedded in an HTTP 200 response. Behavioral, but scoped to bucket-config operations (GetBucket*, PutBucketAcl/Encryption/Policy, ListBuckets, ListDirectoryBuckets), none of which PeerDB calls.
• aws-sdk-go-v2 PR 3522 — presigner checksum headers; no presign usage in the repo.

aws/smithy-go v1.27.8 → v1.27.9: smithy-go PR 699 fixes regressions in the new schema-serde path — explicit empty lists deserializing to a nil slice instead of an empty one, plus event-stream close and generic-error forwarding. The nil-vs-empty change is the only one with behavioral reach here; I grepped for .Contents == nil-style checks on AWS response slices and found none (call sites use len()/range). No event-stream usage in the codebase.

cockroachdb/pebble/v2 v2.1.6 → v2.1.7: the release contains only a cockroachdb/swiss bump, which is the indirect bump in this diff. That swiss commit widens the runtime build tag from !go1.27 to !go1.28 plus CI matrix updates — pure forward-compat (prevents a build break on Go 1.27; repo is on go 1.26.0). No runtime behavior change.

k8s.io/apimachinery v0.36.3 → v0.36.4: golang.org/x dependency updates only.

The remaining AWS service modules (config, credentials, rds/auth, kms, s3, ses, sts, transfermanager, and internals) are lockstep patch releases tracking the core bump.

Verdict: no regressions identified, no findings to report. Build/test verification is left to CI (lint and the flow_test matrix were still pending at review time).