chore(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.32.40 to 1.33.1

[dependabot]

Bumps github.com/aws/aws-sdk-go-v2/config from 1.32.40 to 1.33.1.

Commits

• 4164024 Release 2026-08-28
• 4defbf5 Fix getter partsizecorruption (#3537)
• d89aca4 fix downloadobject corruption caused by unequal part size (#3536)
• 8a0ed85 fix internal timeouts to not depend on the env (#3535)
• 893faa4 Release 2026-08-27
• 7263e51 Regenerated Clients
• 0d6ab44 Update API model
• f16c9f2 Fix route53 error close body (#3518)
• bc28b42 Move github workflows from inline scripts to actions (#3511)
• 7352017 support connection read timeouts (#3532)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

✅MegaLinter analysis: Success

✅ Linters with no issues

actionlint, bash-exec, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

Notices

⚠️ Your configuration references items that have been removed from MegaLinter and are ignored: REPOSITORY_GITLEAKS. See Removed linters to find their replacements.

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

[devantler]

🤖 Generated by the Agentic Engineer

Why this PR now carries a second commit

This bump could not merge on its own. desktop/ is a separate Go module that declares
replace github.com/devantler-tech/ksail/v7 => ../ and mirrors the root module's entire transitive
graph as // indirect requirements — including all of the aws-sdk-go-v2 packages this PR moves. A
root-only bump therefore leaves desktop/go.mod stale by construction, and both
🧩 Desktop App › 🧹 Verify desktop module is tidy and the required 🧪 Test job fail with
go: updates to go.mod needed.

That is #6862: since #6851, Dependabot does not update desktop/ for a root bump and CI no longer
pushes the tidy, so a shared-dependency bump lands permanently red with nothing to repair it.

What the commit is

Exactly the desktop-tidy-patch artifact this PR's own CI run computed (go mod tidy in desktop/,
run 33910835543) — nothing hand-written. The patch's post-image blob hashes match the objects that
were pushed, byte for byte:

file	patch post-image	pushed blob
desktop/go.mod	784e045	784e04598386fc1dedfeebb8d2c57ce54ea2224e
desktop/go.sum	5c9d1e7	5c9d1e766b5457154844e25cc59e72306bed407e

The resulting desktop/go.mod pins aws-sdk-go-v2 v1.45.1, config v1.33.1, credentials v1.20.1
and service/sts v1.47.1 — the same versions this PR sets at the root.

Consequences, stated plainly

• The PR was converted to draft and its auto-merge request cleared before the push, so the
  repository automation cannot merge a head that has not been re-reviewed.
• An agent commit on the branch forfeits Dependabot's rebase ability (ksail-bot's sync commit permanently disables Dependabot rebase, stranding ~half of dependency PRs #6832). That cost is
  accepted here because the intent is to merge this head now, not to keep it alive across rebases.
• This is a workaround, not the fix. The durable fix is fix(ci): since #6851, every root gomod bump the desktop module shares lands permanently red on a required check #6862.

Scope note

This PR's diff is a superset of #6872 (aws-sdk-go-v2 1.45.1) and #6873 (credentials 1.20.1) —
both are subsumed once this merges.

[devantler]

🤖 Generated by the Agentic Engineer

State at ae05fb975e43bec89e892f017d636af4ae5277bf — for whichever lane picks this up next

The fix worked. Every job that was red before the desktop sync is now green in the
✅ Validate Go Project run at this head: 🧪 Test (which was failing
TestClaircoreLinkedPackagesStayInert/desktop), 📊 Code Coverage, 📦 Tidy, 🏗️ Build, both lint
lanes and dead-code analysis. 🧩 Desktop App completed successfully. Current tally: 52 pass, 0 fail,
7 pending.

The one non-green was CANCELLED, not failed — do not re-diagnose it as a finding.
🛡️ Vulnerability Scan was cancelled mid-step at 21:36:50Z after 25m34s, with every setup step green
and only 🛡️ Scan for known vulnerabilities cancelled. The control is that this same job passed on the
pre-fix run of this PR, and a vulnerability finding fails rather than cancels. I have re-run it once as
a transient — the run is on attempt 2. Note gh run rerun returns 404 here because the workflow
file lives in devantler-tech/actions; the REST actions/runs/<id>/rerun-failed-jobs endpoint works.

Fence is intact and must stay that way until review: draft=true, auto-merge cleared. The
🔀 Enable Auto-Merge workflow has already run at this head and could not arm because of the draft
state. Promoting this before a green review would let it merge unreviewed.

Remaining steps: wait for the rerun plus the in-flight CI - KSail to settle → request a review
(CodeRabbit first; an agent adaptation commit restores the ordinary review gate) → merge. On merge,
#6872 and #6873 are subsumed.

Root cause and the durable fix remain #6862; the option-1 open question there is answered in
#6862 (comment)

[devantler]

🤖 Generated by the Agentic Engineer

CI is now fully green at this head — 60 pass, 17 skipped, 0 failing, 0 pending — including both
🧪 System Test (Docker) legs and the 🛡️ Vulnerability Scan whose earlier cancellation (not
failure) was re-run as a transient. mergeStateStatus is CLEAN.

This PR carries an agent adaptation commit on top of the Dependabot bump, which restores the ordinary
semantic-review gate, so it stays a draft until a green review lands at this exact head.

@coderabbitai full review

[coderabbitai]

@devantler, I will perform a full review of PR #6874 at ae05fb975e43bec89e892f017d636af4ae5277bf.

✅ Action performed

Full review finished.

[devantler]

🤖 Generated by the Agentic Engineer

Hand-off at ae05fb975e43bec89e892f017d636af4ae5277bf — CodeRabbit request is LIVE, do not re-trigger

CI is fully green here: 60 pass, 17 skipped, 0 failing, 0 pending. mergeStateStatus reads
UNSTABLE only because CodeRabbit's own pending context is counted — every check-run and status on
this head is success or skipped.

CodeRabbit acknowledged the request at 22:12:43Z and its head status has read
Review in progress since 22:12:45Z. As of this note there is still no review object, no
auto-generated summary, and no verdict reply.

For whichever lane picks this up: the request marker for this head is already posted
(provider=cr, 22:12Z) and the provider has reacted, so this sits inside the acknowledged window —
be patient rather than impatient. Do not post another @coderabbitai trigger: a duplicate spends
a request that cannot succeed and resets the cooldown (full review costs ~6× the normal one). Only
once that envelope genuinely expires with no artifact should this record a cr:no-gate@ae05fb97
marker and advance to Codex — never before.

Then: promote and merge. ksail has no merge queue (its mergeQueue is null), so devantler
merges directly with --squash --match-head-commit ae05fb975e43bec89e892f017d636af4ae5277bf.

Merging this subsumes #6872 and #6873 — both are red at head with the same desktop-module
lockstep signature that the two-commit fix here resolves. Root cause and the durable fix remain #6862.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Team

Run ID: 9860667a-62ec-45db-8d01-5dd265d199ea

📥 Commits

Reviewing files that changed from the base of the PR and between f3ac2d4 and ae05fb9.

⛔ Files ignored due to path filters (2)

• desktop/go.sum is excluded by !**/*.sum
• go.sum is excluded by !**/*.sum

📒 Files selected for processing (2)

• desktop/go.mod
• go.mod

Included review availability: Your plan provides up to 2 included reviews per hour; 0 remain after this review.

📜 Recent review details

🔇 Additional comments (2)

go.mod (1)

63-65: LGTM!

Also applies to: 67-67, 246-246, 248-250, 256-256, 260-262

desktop/go.mod (1)

151-151: LGTM!

Also applies to: 153-155, 157-159, 166-166, 170-173

---

📝 Walkthrough

Walkthrough

The pull request upgrades AWS SDK for Go v2 dependencies in the root and desktop Go modules. It updates direct and indirect modules, including config, credentials, service/sts, IMDS, endpoint, signing, SSO, and presigned URL modules. Unchanged modules remain at their existing versions.

Merge Risk: ⚪ Minimal · up to ae05f

This updates AWS SDK dependencies and synchronizes the desktop module with the root dependency graph. The dependency declarations are aligned, with no current merge-blocking risk identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description directly explains the AWS SDK config dependency update and its upstream fixes. It also documents the related desktop module synchronization.
Title check	✅ Passed	The title clearly identifies the primary change: updating github.com/aws/aws-sdk-go-v2/config from 1.32.40 to 1.33.1. It does not mention the related dependency synchronization, but it accurately summ…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@devantler, acknowledged. I will not send a duplicate review request.

The existing full-review request remains associated with commit ae05fb975e43bec89e892f017d636af4ae5277bf. The desktop dependency synchronization is in scope for this PR. Issue #6862 remains the durable fix for Dependabot updates across the root and desktop/ Go modules. This PR subsumes #6872 and #6873.

---

✏️ Learnings added

Learnt from: devantler
URL: https://github.com/devantler-tech/ksail/pull/6874

Timestamp: 2026-09-04T22:24:08.653Z
Learning: In repository `devantler-tech/ksail`, the root Go module and `desktop/` are separate Go modules. The `desktop/` module uses `replace github.com/devantler-tech/ksail/v7 => ../` and mirrors root transitive dependencies as indirect requirements. A root AWS SDK dependency update can require a corresponding `go mod tidy` update to `desktop/go.mod` and `desktop/go.sum`; otherwise desktop tidy checks and tests fail with `go: updates to go.mod needed`. Issue `#6862` tracks the durable fix for Dependabot synchronization.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

You are interacting with an AI system.

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at ae05fb975e43bec89e892f017d636af4ae5277bf — promoting from draft.

1. Programmatically tested — 61 SUCCESS / 17 SKIPPED / 0 failing at this exact head.
   mergeStateStatus: CLEAN. Review threads: fetched == totalCount == 0, unresolved 0.
2. Reviewed — CodeRabbit green at this head: the auto-generated summary (updated
   22:23:21Z, postdating the 22:12:28Z request marker) names the full head SHA twice and
   reports "No actionable comments were generated in the recent review"; the only collapsed
   section is the excluded 🔇 Additional comments (2). Pre-merge checks 5/5 passed. Head
   commit status: CodeRabbit — success — Review completed. No refusal or rate-limit markers.
3. Tried and evaluated as a user — this head's CI exercises the real behaviour rather than
   just building it: the 🧪 System Test (Docker) matrix provisions K3s and KWOK clusters and
   drives ksail end-to-end across the CNI/CSI/GitOps-engine permutations, all green. The two
   checks that the adaptation commit exists to satisfy — 📦 Tidy and
   🧩 Verify Desktop Module Tidy — are both green, which is the direct observation that the
   desktop/ module is now consistent with the bumped root module rather than merely
   well-formed.

The draft fence was in place because this head carries an agent-authored adaptation commit on
top of the Dependabot head, which restores the normal current-head semantic-review gate. That
gate is now satisfied, so the fence comes down and the PR merges directly (ksail has no merge
queue) pinned to the evaluated head.