[dependabot]

Bumps the gomod group with 12 updates in the / directory:

Package	From	To
github.com/aws/aws-sdk-go-v2	1.47.4	1.47.5
github.com/aws/aws-sdk-go-v2/service/ec2	1.341.0	1.343.0
github.com/aws/aws-sdk-go-v2/service/elasticache	1.64.1	1.64.2
github.com/aws/aws-sdk-go-v2/service/memorydb	1.42.6	1.42.8
github.com/aws/aws-sdk-go-v2/service/opensearch	1.86.1	1.87.1
github.com/aws/aws-sdk-go-v2/service/rds	1.131.1	1.131.2
github.com/aws/aws-sdk-go-v2/service/redshift	1.71.5	1.71.6
cloud.google.com/go/compute	1.74.0	1.74.1
github.com/aws/aws-sdk-go-v2/service/savingsplans	1.40.5	1.41.1
github.com/aws/smithy-go	1.28.6	1.28.7
google.golang.org/api	0.307.0	0.310.0
github.com/aws/aws-sdk-go-v2/service/sts	1.51.5	1.51.6

Updates github.com/aws/aws-sdk-go-v2 from 1.47.4 to 1.47.5

Commits

• c350990 Release 2026-10-27
• 4d2d256 Regenerated Clients
• d2bd6cc Update API model
• da4b3cc update to smithy-go v1.28.7 (#3608)
• c86b81b schema-serde: release final restjson services (#3605)
• 7393955 Fix login cred update token panic (#3558)
• 9626aa3 fix nil in stscreds (#3604)
• 0d657c0 Release 2026-10-26
• 77b7742 Regenerated Clients
• 54f1f5e Update endpoints model
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/ec2 from 1.341.0 to 1.343.0

Commits

• 47ec4b4 Release 2026-10-28
• 10aadc8 Regenerated Clients
• 836d535 Update API model
• c350990 Release 2026-10-27
• 4d2d256 Regenerated Clients
• d2bd6cc Update API model
• da4b3cc update to smithy-go v1.28.7 (#3608)
• c86b81b schema-serde: release final restjson services (#3605)
• 7393955 Fix login cred update token panic (#3558)
• 9626aa3 fix nil in stscreds (#3604)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/elasticache from 1.64.1 to 1.64.2

Commits

• 640b808 Release 2025-08-29
• 657a6e8 Regenerated Clients
• 34a91bb Update partitions file
• 09f5a9c Update endpoints model
• fff96ca Update API model
• d46f566 deprecate service/sms (#3176)
• de16d4d Release 2025-08-28
• d6b83a8 Regenerated Clients
• b0f9cb7 Update API model
• 8225491 Release 2025-08-27
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/memorydb from 1.42.6 to 1.42.8

Commits

• b84293d Release 2026-03-13
• 6f28694 Regenerated Clients
• f0f2436 Update endpoints model
• 042a1ea Update API model
• f3d4207 test sigv4 stream signer (#3347)
• 56f2f26 Add polly SynthesizeSpeech presign missing fields serd (#3344)
• a330a45 add changelog for #3283
• 58b98f6 Remove X-Amz-Security-Token header on redirect to different host (#3283)
• 238eead add changelog for #3238
• 65e8aea docs: fix typo (#3238)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/opensearch from 1.86.1 to 1.87.1

Commits

• ba4ee4d Release 2025-08-21
• 40e3d87 Regenerated Clients
• b2be019 Update partitions file
• dece4e7 Update endpoints model
• 294af19 Update API model
• 0df860a changelog
• df2bca2 feature(s3/manager): add option to control default checksums (#3151)
• 315de9c Release 2025-08-20
• 1a9d79d Regenerated Clients
• 7959412 Update endpoints model
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/rds from 1.131.1 to 1.131.2

Commits

• c350990 Release 2026-10-27
• 4d2d256 Regenerated Clients
• d2bd6cc Update API model
• da4b3cc update to smithy-go v1.28.7 (#3608)
• c86b81b schema-serde: release final restjson services (#3605)
• 7393955 Fix login cred update token panic (#3558)
• 9626aa3 fix nil in stscreds (#3604)
• 0d657c0 Release 2026-10-26
• 77b7742 Regenerated Clients
• 54f1f5e Update endpoints model
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/redshift from 1.71.5 to 1.71.6

Commits

• 74c5011 Release 2026-05-28
• 7d82651 Regenerated Clients
• 79c63d9 Update endpoints model
• b15b3b8 Update API model
• 090e469 Feat tmv2 parity (#3424)
• d2133f0 credentials/logincreds: create new cache files with 0600 (#3425)
• 38fe976 Release 2026-05-27
• a7d5164 Regenerated Clients
• 5b79052 Update API model
• 5acd7b4 Add SHA-512 auto checksum calculation for S3 (#3422)
• Additional commits viewable in compare view

Updates cloud.google.com/go/compute from 1.74.0 to 1.74.1

Commits

• 4f59665 chore: release main (#20756)
• b03cabc chore(main): release agentplatform 0.22.1 (#20758)
• 22c9ad5 feat(storage): add Storage.UploadChunk spans for resumable uploads (#20750)
• 232cbe4 fix(auth/grpctransport): use storage-direct authority for Interconnect (#20738)
• 932ca4a fix(firestore): set x-goog-is-transaction header for atomic transaction pipel...
• 50fd4eb fix(storage): use URL-safe base64 for the feature tracking header (#20684)
• aa773a1 fix(storage): do not discard seen bytes on 206 Partial Content during reader ...
• 1df7814 chore(preview): prepare compute preview bump (#20770)
• 4572f25 chore: update librarian version to v0.50.0 (#20769)
• a8a5ad9 chore(all): update module go.opentelemetry.io/otel/exporters/stdout/stdoutmet...
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/savingsplans from 1.40.5 to 1.41.1

Commits

• dcbed91 Release 2026-01-09
• 08120e8 Regenerated Clients
• 1d7a925 Update endpoints model
• 482067d Update API model
• 4662404 remove example (#3282)
• c28a6f4 Release 2026-01-07
• 2fa7a72 Regenerated Clients
• 077cbaa Update endpoints model
• 3282dbc Update API model
• 3daa74a Release 2026-01-06
• Additional commits viewable in compare view

Updates github.com/aws/smithy-go from 1.28.6 to 1.28.7

Changelog

Sourced from github.com/aws/smithy-go's changelog.

Release (2026-11-03)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.28.8
  • Bug Fix: Preserve the exact value of numbers in JSON codec instead of automatically parsing to float64.

Release (2026-10-27)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.28.7
  • Bug Fix: Fix a panic or EOF error when deserializing a JSON union that contains a member not modeled by the client and whose value is not null.
  • Bug Fix: Log the underlying error when dumping an HTTP request or response for logging fails

Release (2026-10-21)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.28.6
  • Bug Fix: Enforce event stream header key value length limit instead of truncating
  • Bug Fix: Retain the value in a list with the zero value when encountering a null entry on a dense list. This matches how legacy code-generated JSON deserializers behaved.

Release (2026-10-09)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.28.5
  • Bug Fix: Retain the key with the zero value when encountering a null-value key in a dense map. This matches how legacy code-generated JSON deserializers behaved.

Release (2026-10-07)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.28.4
  • Bug Fix: Revert #698 that fixed JoinPath with trailing slash. This has a side effect on certain S3 API paths in the downstream SDK that need more consideration.

Release (2026-10-06)

General Highlights

... (truncated)

Commits

• 37210e1 Release 2026-10-27
• d5b7eb0 fix(http): log the error when dumping a request or response for logging fails...
• 02853b0 fix panic for unknown union member collection in json (#735)
• See full diff in compare view

Updates google.golang.org/api from 0.307.0 to 0.310.0

Release notes

Sourced from google.golang.org/api's releases.

v0.310.0

0.310.0 (2026-10-28)

Features

• all: Auto-regenerate discovery clients (#3795) (2a636ad)
• all: Auto-regenerate discovery clients (#3797) (df2d2b0)

v0.309.0

0.309.0 (2026-10-25)

Features

• all: Auto-regenerate discovery clients (#3789) (e05cb39)
• all: Auto-regenerate discovery clients (#3791) (0aad672)
• all: Auto-regenerate discovery clients (#3792) (7a3948f)

v0.308.0

0.308.0 (2026-10-22)

Features

• all: Auto-regenerate discovery clients (#3787) (527f9a3)

Changelog

Sourced from google.golang.org/api's changelog.

0.310.0 (2026-10-28)

Features

• all: Auto-regenerate discovery clients (#3795) (2a636ad)
• all: Auto-regenerate discovery clients (#3797) (df2d2b0)

0.309.0 (2026-10-25)

Features

• all: Auto-regenerate discovery clients (#3789) (e05cb39)
• all: Auto-regenerate discovery clients (#3791) (0aad672)
• all: Auto-regenerate discovery clients (#3792) (7a3948f)

0.308.0 (2026-10-22)

Features

• all: Auto-regenerate discovery clients (#3787) (527f9a3)

Commits

• de7f75e chore(main): release 0.310.0 (#3796)
• df2d2b0 feat(all): auto-regenerate discovery clients (#3797)
• 2a636ad feat(all): auto-regenerate discovery clients (#3795)
• 14f4a27 chore(all): update all (#3793)
• e701550 chore(main): release 0.309.0 (#3790)
• 7a3948f feat(all): auto-regenerate discovery clients (#3792)
• 0aad672 feat(all): auto-regenerate discovery clients (#3791)
• e05cb39 feat(all): auto-regenerate discovery clients (#3789)
• 5767912 chore(main): release 0.308.0 (#3788)
• 527f9a3 feat(all): auto-regenerate discovery clients (#3787)
• See full diff in compare view

Updates github.com/aws/aws-sdk-go-v2/service/sts from 1.51.5 to 1.51.6

Commits

• c350990 Release 2026-10-27
• 4d2d256 Regenerated Clients
• d2bd6cc Update API model
• da4b3cc update to smithy-go v1.28.7 (#3608)
• c86b81b schema-serde: release final restjson services (#3605)
• 7393955 Fix login cred update token panic (#3558)
• 9626aa3 fix nil in stscreds (#3604)
• 0d657c0 Release 2026-10-26
• 77b7742 Regenerated Clients
• 54f1f5e Update endpoints model
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: LeanerCloud/cloud-commitments-mcp
• Branch: main
• File: .coderabbit.yaml
• Commit: d1b9079
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: d0694ed2-1f9d-40e2-afd1-493be26f2c68

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[cristim]

Review verdict: APPROVE at 27a50bd

Reviewer: claude-ui-fix-2 (diff, release notes, advisories and CI only; nothing built locally).

• Scope: go.mod, go.sum and go.work.sum only. The direct bumps are aws-sdk-go-v2 1.47.4→1.47.5; ec2 1.341→1.343; elasticache, memorydb, rds, redshift and sts patches; opensearch 1.86→1.87; savingsplans 1.40→1.41; smithy-go 1.28.6→1.28.7; compute 1.74.0→1.74.1; and google.golang.org/api 0.307→0.310. All stay within their major versions, and they are the same module versions I reviewed in cloud-commitments-go #664 to #667.
• Advisories: I queried the GitHub advisory database (ecosystem go) for all 18 modules at their new versions: none. The query is the one that returns 6 advisories for google.golang.org/grpc@v1.55.0. Retractions: none for these versions (checked in the go-repo reviews). No change to the go directive or toolchain.
• Release notes: they include the fix that stops sending the security token on a redirect to a different host (aws-sdk-go-v2#3283). The only deprecation is service/sms, which isn't used here.
• This replaces build(deps): bump the gomod group across 1 directory with 10 updates #131 (closed and superseded by Dependabot before my rebase request). It is 0 commits behind main.
• CI: blocked by infrastructure, not this change. Lint, unit tests, security scans, Snyk and Build MCP (ubuntu-latest) pass. Build MCP (macos-latest) was cancelled after 15 minutes with no runner assigned, twice (the original run and a re-run). main's own CI run at 15:59Z hit the same cancelled-without-runner macOS job, while macOS passed on every run earlier today, so no macOS runner has been available since about 16:00Z. CI Success is red only because of that job. Re-run it once macOS runners are back; the merge gate still needs it green.

No findings in the diff.

[cristim]

APPROVE @ 27a50bd
Second review (claude-cc-libs): minor and patch bumps only, with no code changes. They cover aws-sdk-go-v2 core, ec2, elasticache, memorydb, opensearch, rds, redshift, savingsplans and sts; smithy-go; GCP compute and api; and their indirect dependencies. memorydb and sts are now direct requirements, which matches #127, and go.sum and go.work.sum are regenerated. The only red job was Build MCP (macos-latest), cancelled by the GitHub Actions incident; I have re-run it. The merge is pinned to this SHA and waits for green.