build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.32.7 to 1.32.17

[dependabot]

Bumps github.com/aws/aws-sdk-go-v2/config from 1.32.7 to 1.32.17.

Commits

• 2223642 Release 2026-04-29
• 04c7e46 Regenerated Clients
• 5f56925 Update endpoints model
• aac6d2b Update API model
• bdaead7 upgrade to smithy-go v1.25.1 (#3399)
• 008e12c Release 2026-04-27
• ef109d9 Regenerated Clients
• 6411e63 Update API model
• e5bf970 Release 2026-04-24
• bdbb88c Regenerated Clients
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[ghost]

✅ LGTM — approved (automated review)

Routine dependabot bump of aws-sdk-go-v2/config 1.32.7 → 1.32.16 and transitive AWS SDK dependencies.

Checked:

• Only go.mod and go.sum changed — zero application code touched
• All version bumps are patch/minor within the AWS SDK v2 ecosystem
• No new dependencies introduced, no non-AWS deps changed
• internal/ini indirect dep dropped (normal go mod tidy behavior)
• smithy-go 1.24.2 → 1.25.0 minor bump is compatible
• Not protocol-critical — no VTXO, signing, forfeit, round, or exit code affected

Low risk. Ship it.

[ghost]

✅ Re-approved after rebase (automated review)

New commit d2a5bf8 — same dependabot bump, rebased. Still only go.mod / go.sum:

• aws-sdk-go-v2 1.41.5 → 1.41.6
• aws-sdk-go-v2/config 1.32.7 → 1.32.16
• aws-sdk-go-v2/service/sts 1.41.6 → 1.42.0
• smithy-go 1.24.2 → 1.25.0
• Transitive AWS deps bumped accordingly; internal/ini indirect dep dropped

Zero application code changed. Not protocol-critical. Ship it.

[arkana-ai-bot]

Dependabot bump of aws-sdk-go-v2/config 1.32.7 → 1.32.17 and cascading AWS SDK indirect deps (sts 1.41.6 → 1.42.1, smithy-go 1.24.2 → 1.25.1, etc.), plus removal of the now-unused internal/ini indirect. All within the same v1 major line — no API breakage expected.

Scope observations:

• Module is github.com/ArkLabsHQ/introspector-enclave — an AWS-hosted enclave introspection binary using KMS/EC2/S3/SSM/CloudWatchLogs. Not on the VTXO/round/forfeit/signing path, so no protocol-critical review triggered.
• Only go.mod/go.sum touched; no consumer code changes needed to verify.
• Upstream changelogs for these config/sts/smithy-go micro-bumps are routine (endpoint model refreshes, regenerated clients, smithy-go v1.25.1 minor). Nothing flagged in known-CVE space at time of review.

Nothing to block on. Confirm go build ./... and go test ./... are green in CI before merge; note the PR has been open >30d so auto-rebase is disabled — a manual rebase against current main is worth doing to catch any drift in the transitive graph.

[arkana-ai-bot]

This dependabot PR has been open for 9+ days without review. Could someone take a look and merge or close it?