build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.32.12 to 1.32.17 in /runtime

[dependabot]

Bumps github.com/aws/aws-sdk-go-v2/config from 1.32.12 to 1.32.17.

Commits

• 2223642 Release 2026-04-29
• 04c7e46 Regenerated Clients
• 5f56925 Update endpoints model
• aac6d2b Update API model
• bdaead7 upgrade to smithy-go v1.25.1 (#3399)
• 008e12c Release 2026-04-27
• ef109d9 Regenerated Clients
• 6411e63 Update API model
• e5bf970 Release 2026-04-24
• bdbb88c Regenerated Clients
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[ghost]

Review: ✅ APPROVE

Dependabot patch-version bump of AWS SDK Go v2 dependencies.

Changes reviewed

• runtime/go.mod: version bumps for aws-sdk-go-v2 (1.41.5→1.41.6), config (1.32.12→1.32.16), sts (1.41.9→1.42.0), smithy-go (1.24.2→1.25.0), plus transitive indirect deps (credentials, ec2/imds, configsources, endpoints, v4a, accept-encoding, presigned-url, signin, sso, ssooidc). Dropped internal/ini indirect dep (removed upstream).
• runtime/go.sum: corresponding hash updates.

Assessment

• No source code changes. Only go.mod and go.sum modified.
• No protocol-critical code touched. No VTXO, signing, forfeit, round, or exit path changes.
• No API surface changes. All bumps are patch/minor on internal AWS SDK modules.
• No cross-repo impact. This is an internal runtime dependency.
• smithy-go minor bump (1.24→1.25): upstream changelog shows no breaking changes — adds AccountIDEndpointRouting awareness for BDD endpoints.
• internal/ini removal: expected — AWS SDK consolidated this into the config module in this version range.

CI

Checks (enclave-test, lint, unit-test) are currently pending. Merge after CI passes.

Low-risk. Ship it. 🚢

[ghost]

Re-review after force-push: ✅ APPROVE

Delta since last review: Dependabot rebased/updated the version targets slightly higher:

• aws-sdk-go-v2: 1.41.5 → 1.41.7 (was 1.41.6)
• config: 1.32.12 → 1.32.17 (was 1.32.16)
• sts: 1.41.9 → 1.42.1 (was 1.42.0)
• smithy-go: 1.24.2 → 1.25.1 (was 1.25.0)
• Transitive indirects bumped accordingly. internal/ini still removed.

Assessment unchanged:

• No source code changes. Only go.mod + go.sum.
• No protocol-critical code touched.
• No API surface changes. No cross-repo impact.
• All patch/minor bumps on AWS SDK internals.

Merge after CI goes green. 🚢

[arkana-ai-bot]

Scope: runtime/go.mod only (go.sum excluded from review). No source changes, no protocol surface touched. The bumps themselves are patch/minor across the AWS SDK v2 constellation and smithy-go — low risk in isolation.

Blocker: this PR is stale and would regress master. It's been open >30 days, dependabot rebases are disabled, and master has moved well past the branch base. Comparing PR head (def2e3e) against runtime/go.mod on master today:

module	PR sets	master already at	direction
aws-sdk-go-v2	v1.41.7	v1.42.0	downgrade
smithy-go	v1.25.1	v1.27.1	downgrade
internal/configsources	v1.4.23	v1.4.29	downgrade
internal/endpoints/v2	v2.7.23	v2.7.29	downgrade
service/internal/accept-encoding	v1.13.9	v1.13.12	downgrade
config	v1.32.17	v1.32.12	upgrade
sts	v1.42.1	v1.41.9	upgrade
credentials, ec2/imds, v4a, presigned-url, signin, sso, ssooidc	various	older	upgrade

Master also carries deps this PR's base didn't (dynamodb, dynamodb/attributevalue, expression, endpoint-discovery, dynamodbstreams) and the module path is now github.com/ArkLabsHQ/introspector-enclave/runtime rather than the enclave path this branch was cut from. Merging as-is would revert aws-sdk-go-v2 and smithy-go to older majors of the transitive graph and almost certainly wedge the tree — three-way merge on go.mod won't rescue the module-path rename.

Recommendation: close this PR and let dependabot open a fresh one against current master, or close and let a targeted bump land manually. Do not merge.

[arkana-ai-bot]

Changes were requested 9+ days ago. Is there a blocker here?