build(deps): bump the build group across 1 directory with 12 updates

[dependabot]

Bumps the build group with 8 updates in the / directory:

Package	From	To
github.com/Azure/azure-sdk-for-go/sdk/azidentity	1.14.0	1.14.1
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob	1.8.0	1.8.1
github.com/aws/aws-sdk-go-v2	1.43.4	1.47.0
github.com/aws/aws-sdk-go-v2/credentials	1.19.34	1.20.4
github.com/aws/aws-sdk-go-v2/feature/s3/manager	1.22.41	1.23.6
github.com/beevik/etree	1.7.0	1.8.0
golang.org/x/oauth2	0.36.0	0.37.0
golang.org/x/sys	0.47.0	0.48.0

Updates github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.14.0 to 1.14.1

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azidentity's releases.

sdk/azidentity/v1.14.1

1.14.1 (2026-08-27)

Other Changes

• Upgraded dependencies

Commits

• 920e79a Prep azidentity for release (#27473)
• d86ae78 Prep azcore for release (#27471)
• 33dd768 [azwebpubsub] Fix GenerateClientAccessURL on the TokenCredential path (#27422)
• a27ca57 Upgrade TypeSpec Go emitter dependencies (#27466)
• af75eb0 [AutoPR sdk-resourcemanager/purestorageblock/armpurestorageblock]-generated-f...
• 8dcff8c [AutoPR sdk-resourcemanager/redisenterprise/armredisenterprise]-generated-fro...
• e4569f1 [AutoPR sdk-resourcemanager/chaos/armchaos]-generated-from-SDK Generation - G...
• 7069bf8 [AutoPR sdk-resourcemanager/horizondb/armhorizondb]-generated-from-SDK Genera...
• 5ceffce Bump gh-aw to v0.86.2 for mgmt review workflow (#27460)
• 663b6ce Enhance azblob perf tests with OAuth, parallel setup, and profiling (#27324)
• Additional commits viewable in compare view

Updates github.com/Azure/azure-sdk-for-go/sdk/storage/azblob from 1.8.0 to 1.8.1

Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/storage/azblob's releases.

sdk/storage/azblob/v1.8.1

1.8.1 (2026-09-09)

Breaking Changes

• DownloadBuffer and DownloadFile now use ETag locking to ensure consistency across parallel chunk requests when the blob size is not specified upfront (i.e., Range.Count is zero). If a blob is modified during a multi-chunk download, subsequent requests will fail with ConditionNotMet instead of silently returning data from mixed blob versions.

Bugs Fixed

• Fixed CRLF injection vulnerability in Blob Batch subrequest serialization. Header values containing CR or LF characters are now rejected before serialization, preventing header injection in batch requests.
• Fixed WASM compilation by using heap-allocated buffers on JS targets.
• Fixed Structured Message CRC64 download validation being skipped when the final payload byte exactly fills the caller's read buffer; the trailing segment footer and message trailer CRC64 are now drained and validated in the same Read.
• Fixed transient net.Error/io.ErrUnexpectedEOF failures during a Structured Message download not being retried: the decoder now preserves the error chain with %w and the retry reader classifies retryable errors with errors.Is/errors.As.
• Structured Message download now rejects a response missing the negotiated CRC64 flag instead of silently skipping validation.
• Fixed the Structured Message encoder emitting a valid, complete message when the source returned a non-EOF error exactly on a segment boundary; such errors are now propagated.
• Structured Message decoding now rejects a payload that declares fewer segments and appends unvalidated trailing bytes (SMDecode requires the parsed message to consume the entire input, and the streaming decoder validates the consumed byte count against the declared message length).
• Fixed the Structured Message encoder returning io.EOF when the source ends before the declared content length; a premature EOF is now surfaced as io.ErrUnexpectedEOF so callers do not accept a truncated message.
• Fixed Structured Message decoder discarding errors (including net.Error and io.EOF) when the returned bytes exactly complete a segment; such errors are now propagated so RetryReader can retry transient failures at segment boundaries.
• Premature EOF during Structured Message framing reads (header, segment footer, or message trailer) now wraps io.ErrUnexpectedEOF so RetryReader classifies truncated framing as retryable.

Other Changes

• Optimized DownloadBuffer and DownloadFile to use an initial GET request instead of a HEAD (GetProperties) call for blob size discovery. For small blobs (<=4MB), the entire content is returned in a single request, reducing download latency by ~50%.
• Updated azcore to v1.23.1.

sdk/storage/azblob/v1.8.1-beta.1

1.8.1-beta.1 (2026-07-24)

Features Added

• Added support for Structured Message CRC64 content validation on upload and download operations using TransferValidationTypeComputeStructuredMessageCRC64.
• Added StorageResponseFormat enum (Auto, XML, Arrow) for list blobs operations. Set ResponseFormat on ListBlobsFlatOptions/ListBlobsHierarchyOptions to opt into Apache Arrow format for improved performance. Auto defaults to XML for this release.
• Added AccessTier, AccessTierInferred, AccessTierChangeTime, and SmartAccessTier fields to blob download response.
• Blob put operations now return both ContentMD5 and ContentCRC64 in the response when a Content-MD5 header is provided (service version 2026-10-06+).

Bugs Fixed

• Fixed UploadFile/UploadBuffer responses not including ContentCRC64 when returned by the service.

Other Changes

• Updated code generator to @autorest/go@4.0.0-preview.80.
• Default upload/download concurrency is now based on CPU core count (clamped between 8 and 96) instead of the fixed value of 5. Set AZURE_STORAGE_USE_LEGACY_DEFAULT_CONCURRENCY=true to revert to previous defaults.
• Updated azidentity version to 1.14.0

Commits

• d5e09ea Prepare azidentity v1.8.1 for release (#23954)
• af8249d Increment package version after release of storage/azblob (#23940)
• 8b21042 Increment package version after release of storage/azdatalake (#23958)
• a44e152 Release storage stg96 azdatalake preview (#23957)
• b11c1a5 Relax tenant verification for credentials having optional tenant IDs (#23951)
• e557039 remove erroneous package inclusion during package-properties evaluation (#23948)
• 0fb4336 Increment package version after release of messaging/azservicebus (#23950)
• b1480a2 Updating docs.microsoft.com to learn.microsoft.com (#23934)
• 786b0be Credential chains continue iterating after unexpected IMDS responses (#23894)
• 7d4721b add liftr base package dep to emitter dep list (#23938)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2 from 1.43.4 to 1.47.0

Commits

• b189f38 Release 2026-09-09
• 0905d5f Regenerated Clients
• 9cc4bc5 Update API model
• 126fe2d fix GetObject deadlock (#3554)
• 5126885 Remove retry metrics header middleware (#3546)
• bd8de4d Expand S3 operations that check for an error inside an HTTP 200 response (wav...
• 394ee64 Release 2026-09-08
• 3c9cb8b Regenerated Clients
• 6f85682 Update endpoints model
• cc3942b Update API model
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/credentials from 1.19.34 to 1.20.4

Commits

• 0d643a8 Release 2023-12-07
• e38b534 Regenerated Clients
• f394daf Update SDK's smithy-go dependency to v1.19.0
• 4fb654c Update endpoints model
• 8594ca0 Update API model
• e33a34c fix codegen ci (#2418)
• 57a201c regenerate partitions (#2415)
• be06f02 Merge pull request #2344 from aws/feat-request-compression-2
• 70bf410 Change config loading logic
• 8c02c46 Release 2023-12-06
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/feature/ec2/imds from 1.18.35 to 1.20.0

Changelog

Sourced from github.com/aws/aws-sdk-go-v2/feature/ec2/imds's changelog.

Release (2023-07-31)

General Highlights

• Feature: Adds support for smithy-modeled endpoint resolution. A new rules-based endpoint resolution will be added to the SDK which will supercede and deprecate existing endpoint resolution. Specifically, EndpointResolver will be deprecated while BaseEndpoint and EndpointResolverV2 will take its place. For more information, please see the Endpoints section in our Developer Guide.
• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/aws-sdk-go-v2/service/amplifyuibuilder: v1.12.0
  • Feature: Amplify Studio releases GraphQL support for codegen job action.
• github.com/aws/aws-sdk-go-v2/service/autoscaling: v1.30.0
  • Feature: You can now configure an instance refresh to set its status to 'failed' when it detects that a specified CloudWatch alarm has gone into the ALARM state. You can also choose to roll back the instance refresh automatically when the alarm threshold is met.
• github.com/aws/aws-sdk-go-v2/service/cleanrooms: v1.3.0
  • Feature: This release introduces custom SQL queries - an expanded set of SQL you can run. This release adds analysis templates, a new resource for storing pre-defined custom SQL queries ahead of time. This release also adds the Custom analysis rule, which lets you approve analysis templates for querying.
• github.com/aws/aws-sdk-go-v2/service/codestarconnections: v1.15.0
  • Feature: New integration with the Gitlab provider type.
• github.com/aws/aws-sdk-go-v2/service/drs: v1.15.0
  • Feature: Add support for in-aws right sizing
• github.com/aws/aws-sdk-go-v2/service/inspector2: v1.16.0
  • Feature: This release adds 1 new API: BatchGetFindingDetails to retrieve enhanced vulnerability intelligence details for findings.
• github.com/aws/aws-sdk-go-v2/service/lookoutequipment: v1.18.0
  • Feature: This release includes new import resource, model versioning and resource policy features.
• github.com/aws/aws-sdk-go-v2/service/omics: v1.6.0
  • Feature: Add CreationType filter for ListReadSets
• github.com/aws/aws-sdk-go-v2/service/rds: v1.49.0
  • Feature: This release adds support for Aurora MySQL local write forwarding, which allows for forwarding of write operations from reader DB instances to the writer DB instance.
• github.com/aws/aws-sdk-go-v2/service/route53: v1.29.0
  • Feature: Amazon Route 53 now supports the Israel (Tel Aviv) Region (il-central-1) for latency records, geoproximity records, and private DNS for Amazon VPCs in that region.
• github.com/aws/aws-sdk-go-v2/service/scheduler: v1.2.0
  • Feature: This release introduces automatic deletion of schedules in EventBridge Scheduler. If configured, EventBridge Scheduler automatically deletes a schedule after the schedule has completed its last invocation.

Release (2023-07-28.2)

Module Highlights

• github.com/aws/aws-sdk-go-v2/service/applicationinsights: v1.18.0
  • Feature: This release enable customer to add/remove/update more than one workload for a component
• github.com/aws/aws-sdk-go-v2/service/cloudformation: v1.33.0
  • Feature: This SDK release is for the feature launch of AWS CloudFormation RetainExceptOnCreate. It adds a new parameter retainExceptOnCreate in the following APIs: CreateStack, UpdateStack, RollbackStack, ExecuteChangeSet.
• github.com/aws/aws-sdk-go-v2/service/cloudfront: v1.27.0
  • Feature: Add a new JavaScript runtime version for CloudFront Functions.
• github.com/aws/aws-sdk-go-v2/service/connect: v1.62.0
  • Feature: This release adds support for new number types.
• github.com/aws/aws-sdk-go-v2/service/kafka: v1.21.0
  • Feature: Amazon MSK has introduced new versions of ListClusterOperations and DescribeClusterOperation APIs. These v2 APIs provide information and insights into the ongoing operations of both MSK Provisioned and MSK Serverless clusters.
• github.com/aws/aws-sdk-go-v2/service/pinpoint: v1.21.0
  • Feature: Added support for sending push notifications using the FCM v1 API with json credentials. Amazon Pinpoint customers can now deliver messages to Android devices using both FCM v1 API and the legacy FCM/GCM API

Release (2023-07-28)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

... (truncated)

Commits

• 787a818 Release 2023-07-31
• 953c852 Regenerated Clients
• 9ad4f50 Update SDK's smithy-go dependency to v1.14.0
• bd77e8d Update partitions file
• 7a0433f Update endpoints model
• cdfb4c4 Update API model
• 5cff0c4 fix ep20 refs in GH workflows (#2218)
• 26bf48f Add a new smithy-modeled rules based endpoint resolution. (#2214)
• 28c87cc Release 2023-07-28.2
• 4f4efd2 Regenerated Clients
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/feature/s3/manager from 1.22.41 to 1.23.6

Commits

• c964dbd Release 2024-05-15
• ce84395 Regenerated Clients
• 8de9119 Update API model
• 05fcf66 internal: true up internal metrics collection for post-SRA middleware (#2642)
• 1148427 reformat signer/v4 package doc (#2640)
• b238d3f Release 2024-05-14
• 85f8268 Regenerated Clients
• ebaee4c Update endpoints model
• 593b966 Update API model
• bfb02f0 Merge customizations for S3
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/s3 from 1.107.0 to 1.113.1

Commits

• a7eaa10 Release 2026-09-11
• c6f53e8 Regenerated Clients
• e80f4fa Update endpoints model
• 55b26d7 Update API model
• 113bc91 Release 2026-09-10
• 0b5dc66 Regenerated Clients
• 625a568 Update endpoints model
• 9ab2e92 Update API model
• f0c4cca Don't notify on draft PR until ready for review (#3549)
• b189f38 Release 2026-09-09
• Additional commits viewable in compare view

Updates github.com/beevik/etree from 1.7.0 to 1.8.0

Release notes

Sourced from github.com/beevik/etree's releases.

Release v1.8.0

Changes

• Added the Remove function to all token types, allowing for the easy removal of a token from its parent element.

Fixes

• Cleaned up several comments for clarity and typo corrections.

Release v1.7.1

Changes

• Improve efficiency of Element.Text and Element.Tail.

Changelog

Sourced from github.com/beevik/etree's changelog.

Release 1.8.0

Changes

• Added the Remove function to all token types, allowing for the easy removal of a token from its parent element.

Fixes

• Cleaned up several comments for clarity and typo corrections.

Release 1.7.1

Changes

• Improve efficiency of Element.Text and Element.Tail.

Commits

• 1850f3e Release v1.8.0
• c9eec49 Add Remove function to all tokens
• 17e6ce6 Release v1.7.1
• e1824d7 Improve efficiency of Element.Text and Element.Tail
• See full diff in compare view

Updates github.com/stretchr/testify from 1.11.1 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in stretchr/testify#1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

• @​harryzcy made their first contribution in stretchr/testify#1935
• @​boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in stretchr/testify#1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

• @​harryzcy made their first contribution in stretchr/testify#1935
• @​boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

v1.12.0

What's Changed

Functional Changes

• assert: make *AssertionFunc types just aliases by @​dolmen in stretchr/testify#1563

Fixes

• mock: avoid panic when expected type is nil in Arguments.Diff by @​mutaiib in stretchr/testify#1775
• mock: revert to pre-v1.11.0 argument matching behavior for mutating stringers by @​brackendawson in stretchr/testify#1786
• suite: validate method signatures and continue execution for valid tests by @​vyas-git in stretchr/testify#1665
• assert.PanicsWithError: report error message by @​olivergondza in stretchr/testify#1400
• assert: IsIncreasing et al can return false w/out failing by @​brackendawson in stretchr/testify#1787
• add type to error message of assert.Same by @​egawata in stretchr/testify#1792
• mock.AssertExpectationsForObjects fix panic with wrong testObject type. by @​brackendawson in stretchr/testify#1795
• assert: truncate very long objects in test failure messages by @​brackendawson in stretchr/testify#1646
• assert: fix NotSubset error messages using %#v instead of %q (fixes #1800) by @​nghiack7 in stretchr/testify#1888
• suite: prevent panic when SetupTest skips with HandleStats by @​blackwell-systems in stretchr/testify#1877

Documentation, Build & CI

• CI: test also with Go 1.23 by @​dolmen in stretchr/testify#1783
• Vendor unmaintained github.com/pmezard/go-difflib by @​brackendawson in stretchr/testify#1708
• Promote ccoVeille to maintainer by @​brackendawson in stretchr/testify#1784
• build(deps): bump actions/setup-go from 5 to 6 by @​dependabot[bot] in stretchr/testify#1790
• assert.YAMLEq: Document mutlidoc behavior by @​brackendawson in stretchr/testify#1791
• _codegen: copy dependency github.com/ernesto-jimenez/gogen/imports by @​dolmen in stretchr/testify#1782
• doc: remove ineffective inline code blocks by @​brackendawson in stretchr/testify#1714
• Tag generated assertions as non-generated in new .gitattributes by @​ubunatic in stretchr/testify#1815

... (truncated)

Commits

• 959dbda Merge pull request #1935 from harryzcy/yaml-update
• 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
• 001eb79 Merge pull request #1905 from Kentzo/patch-1
• ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
• 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
• f8c01f3 mock: Mock.Return does not exist anymore
• 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
• a11649e assert: make *AssertionFunc type just aliases
• dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
• 098f8d7 _codegen: use strings.Builder
• Additional commits viewable in compare view

Updates golang.org/x/net from 0.57.0 to 0.58.0

Commits

• acc78e0 go.mod: update golang.org/x dependencies
• 90d10f0 internal/http3: delete invalid Content-Length if declared in server handler
• 08abf4d internal/http3: infer headers when Content-Encoding is set but is empty
• 8d10596 http2: avoid deadlocks in wrapped ClientConn state callback
• 99c3b0a http2/hpack: build the table lookup maps lazily, only for encoders
• 5a920b1 http3: rework registration to allow using a fake network
• 7fd2842 quic: return an error from Accept after PacketConn reader exits
• 825111d quic: avoid busy-loop when keep-alive is blocked by congestion control
• a02ddfa http/httpproxy: prioritize lowercase proxy environment variables
• 574e5eb quic: halt conn goroutines on close when listener exits early
• Additional commits viewable in compare view

Updates golang.org/x/oauth2 from 0.36.0 to 0.37.0

Commits

• c624b89 google: change the snake case endpoint to kebab-case
• 09a82f6 all: upgrade go directive to at least 1.26.0 [generated]
• See full diff in compare view

Updates golang.org/x/sys from 0.47.0 to 0.48.0

Commits

• 613e257 cpu: add riscv64 hwprobe drift test
• 6f7b10f unix: add MLOCK_ONFAULT constant
• 663e7c8 cpu: add basic support for GOARCH=sparc64
• de5f12f cpu: add ppc64le POWER10 detection
• 80e8acf unix: run go fix
• 1e3c182 unix: add IPMI interface
• d429e20 unix: stop generating sparc termbits from the generic header
• bd3bddf unix: add missing HWTSTAMP_* constants
• e812f53 windows: add SO_SNDTIMEO constant for socket options
• f6989c5 unix: align Ifreq so its union accessors cannot fault
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: f4830c6e-dccc-4660-ab8a-67efcade12c4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Binary size report (bin/amd64/ignition)

	Size
Base (main)	33MiB
PR (#2324)	40MiB
Delta	+7.1MiB (21.44%)

[angelcerveraroldan]

Ah - the binary size here is too large. It would probably be good to see what packages caused that. Merging this will lead to the same issues we are already seeing in aarch64 and ppc64le hitting us on x86 too I think.