chore(deps): bump the go-dependencies group with 4 updates

[dependabot]

Bumps the go-dependencies group with 4 updates: github.com/aws/aws-sdk-go-v2/service/lambda, github.com/open-policy-agent/opa, google.golang.org/api and google.golang.org/genproto/googleapis/rpc.

Updates github.com/aws/aws-sdk-go-v2/service/lambda from 1.112.1 to 1.112.2

Commits

• a6c9072 Release 2026-10-12
• 82673af Regenerated Clients
• 76c7d18 Update API model
• See full diff in compare view

Updates github.com/open-policy-agent/opa from 1.21.1 to 1.21.2

Release notes

Sourced from github.com/open-policy-agent/opa's releases.

v1.21.2

This release builds the OPA binary artifacts with the latest version of Go (v1.27.2), its standard library, and the golang.org/x/net dependency (v0.60.0).

See these security advisories:

• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI
• https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs

Furthermore, it addresses a mismatch in how encoded slashes were handled in the input to a basic authorization policy and the Data API (#9323, reported by @​abhishekkushwaha4u, fixed by @​sspaink).

Changelog

Sourced from github.com/open-policy-agent/opa's changelog.

1.21.2

This release builds the OPA binary artifacts with the latest version of Go (v1.27.2), its standard library, and the golang.org/x/net dependency (v0.60.0).

See these security advisories:

• https://groups.google.com/g/golang-announce/c/U2fTuyDJznI
• https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs

Furthermore, it addresses a mismatch in how encoded slashes were handled in the input to a basic authorization policy and the Data API (#9323, reported by @​abhishekkushwaha4u, fixed by @​sspaink).

Commits

• 3f7474e Release 1.21.2
• a48c42a server: resolve encoded request paths consistently in authorizer and handlers...
• 60edfb2 build: bump go (1.27.1 -> 1.27.2) (#9340)
• See full diff in compare view

Updates google.golang.org/api from 0.301.0 to 0.302.0

Release notes

Sourced from google.golang.org/api's releases.

v0.302.0

0.302.0 (2026-10-12)

Features

• all: Auto-regenerate discovery clients (#3762) (9fc8aaa)
• all: Auto-regenerate discovery clients (#3764) (47c34e8)
• all: Auto-regenerate discovery clients (#3765) (3e43226)
• all: Auto-regenerate discovery clients (#3766) (b11bdec)

Changelog

Sourced from google.golang.org/api's changelog.

0.302.0 (2026-10-12)

Features

• all: Auto-regenerate discovery clients (#3762) (9fc8aaa)
• all: Auto-regenerate discovery clients (#3764) (47c34e8)
• all: Auto-regenerate discovery clients (#3765) (3e43226)
• all: Auto-regenerate discovery clients (#3766) (b11bdec)

Commits

• a723189 chore(main): release 0.302.0 (#3763)
• 9ca924e chore(all): update all (#3767)
• b11bdec feat(all): auto-regenerate discovery clients (#3766)
• 3e43226 feat(all): auto-regenerate discovery clients (#3765)
• 47c34e8 feat(all): auto-regenerate discovery clients (#3764)
• 9fc8aaa feat(all): auto-regenerate discovery clients (#3762)
• See full diff in compare view

Updates google.golang.org/genproto/googleapis/rpc from 0.0.0-20260928230214-8a89bd6388cc to 0.0.0-20261005182115-fad411399dd8

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[claude]

Claude finished @dependabot[bot]'s task in 36s —— View job

---

Dependency review: go-dependencies group (4 updates)

Verdict: low risk. All four direct bumps are patch releases or auto-regenerated releases. None of them changes an API this repo calls.

Dependency	Change	Used in	Risk
aws-sdk-go-v2/service/lambda	1.112.1 → 1.112.2	internal/aws/aws.go, fake_lambda.go, contract tests	Very low: regenerated client, API model refresh only
open-policy-agent/opa	1.21.1 → 1.21.2	internal/evaluate/rego.go (v1/ast, v1/rego, v1/storage/inmem)	Very low: see below
google.golang.org/api	0.301.0 → 0.302.0	internal/cloudrun/cloudrun.go, internal/gke/gke.go (only iterator)	Very low: discovery clients regenerated; iterator is untouched
genproto/googleapis/rpc	2026-09-28 → 2026-10-05 pseudo-version	indirect via gRPC	Very low

Notes

• OPA 1.21.2: the behaviour change in this release (how encoded slashes are resolved, #9323) lives in OPA's server authorizer and Data API. Kosli embeds only the rego, ast and inmem library packages and does not run the OPA server, so the change doesn't reach us. The Go toolchain and x/net security fixes mentioned in the release notes apply to OPA's own binaries, not to this module.
• Transitive bumps: golang.org/x/net 0.59 → 0.61, x/crypto 0.57 → 0.58, x/text, x/mod, x/tools, and enterprise-certificate-proxy 0.3.22 → 0.3.23 all move forward too. Picking up the x/net fix is welcome. Separately, the advisories linked from the OPA notes are Go stdlib fixes (Go 1.27.2), so the toolchain version in CI and GoReleaser should be checked as well.
• Safety net: internal/evaluate/opa_contract_test.go and internal/aws/lambda_contract_test.go cover the OPA and Lambda surfaces. They will catch any drift in parsing, compiling or the client.

Checks

• The PR checks workflow passed. Main (the integration tests) was still running when I wrote this. Merge once it's green.
• I couldn't run go build or go test locally because the command wasn't permitted in this job, so I'm relying on CI.

No changes requested.