Bump the go-modules group with 5 updates

[dependabot]

Bumps the go-modules group with 5 updates:

Package	From	To
github.com/aws/smithy-go	1.28.1	1.28.2
github.com/bmatcuk/doublestar/v4	4.10.0	4.10.1
github.com/ebitengine/purego	0.11.0	0.11.1
github.com/spiffe/go-spiffe/v2	2.8.1	2.8.2
github.com/ulikunitz/xz	0.5.16	0.5.17

Updates github.com/aws/smithy-go from 1.28.1 to 1.28.2

Changelog

Sourced from github.com/aws/smithy-go's changelog.

Release (2026-09-18)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.28.2
  • Bug Fix: Avoid allocating a slice in ValidateEndpointHost by indexing into the hostname instead of using strings.Split.
  • Bug Fix: Fix event stream decode panic on unknown header value type.
  • Bug Fix: Fix schema-serde CBOR decode panic on malformed string/blob length.
  • Bug Fix: JoinPath keeps a trailing slash when the added path is a slash.

Release (2026-08-26)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.28.1
  • Bug Fix: Fix broken AddLogger middleware since its insert point was removed.

Release (2026-08-25.2)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.28.0
  • Feature: Set Content-Length inline when the request body is set via SetStream. The ComputeContentLength middleware is now deprecated.

Release (2026-08-25)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.27.10
  • Bug Fix: Fix a data race on the underlying writer when an event stream is closed while an event write is in flight.
  • Bug Fix: Restore draining the HTTP response body in CloseResponseBody to avoid issues with TCP connection reuse.

Release (2026-08-21)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.27.9
  • Bug Fix: Fix a generic event stream exception not carrying the error code and message from its payload.
  • Bug Fix: Fix an event stream not being closed when its connection is lost, which would cause a caller writing to the stream to block indefinitely.
  • Bug Fix: Fix deserialization of an empty list producing a nil slice instead of an empty one.

... (truncated)

Commits

• 9b28af0 Release 2026-09-18
• f59df88 Avoid slice allocation in ValidateEndpointHost (#705)
• 7c16d7f fix decode panic on event stream header type and bad cbor string/blob len (#713)
• c60819a fix initial-message race (#712)
• d05a672 fix v2 event streams orphaning the result channel on error paths in schema-se...
• fe95176 Revert "fix v2 event streams orphaning the result channel on error paths in s...
• 9847245 fix v2 event streams orphaning the result channel on error paths in schema-serde
• 9eba49f Print stacktrace when smithy-build fails (#708)
• 959c6ab Keep a trailing slash when JoinPath right operand is a slash. (#698)
• d253285 update README
• See full diff in compare view

Updates github.com/bmatcuk/doublestar/v4 from 4.10.0 to 4.10.1

Release notes

Sourced from github.com/bmatcuk/doublestar/v4's releases.

Fixed issue with alternatives and character classes

There was an issue where commas or ending curly brackets inside a character class would cause code looking for the next alternative (commas) or the end of alternatives (ending curly brackets) to erroneously match those characters inside the character classes.

Thanks to @​sidsri14 for the fix!

What's Changed

• fix brace alternation scanning with character classes by @​sidsri14 in bmatcuk/doublestar#115

New Contributors

• @​sidsri14 made their first contribution in bmatcuk/doublestar#115

Full Changelog: bmatcuk/doublestar@v4.10.0...v4.10.1

Commits

• 314a609 Merge branch 'sidsri14-master'
• f0902d5 small test changes
• bf0b1d6 fix brace alternation scanning with character classes
• See full diff in compare view

Updates github.com/ebitengine/purego from 0.11.0 to 0.11.1

Release notes

Sourced from github.com/ebitengine/purego's releases.

v0.11.1

• Fix SyscallN returning the third input argument as an error code on platforms that do not capture errno; it now returns 0 (#505)
• Fix 64-bit integer callback return values losing their upper 32 bits on 386 (#524)

Commits

• 15800b5 purego: return 64-bit callback results on 386 (#519)
• fc7e496 purego: clear uncaptured errno in syscall trampolines (#510)
• See full diff in compare view

Updates github.com/spiffe/go-spiffe/v2 from 2.8.1 to 2.8.2

Release notes

Sourced from github.com/spiffe/go-spiffe/v2's releases.

v2.8.2

Fixed

• Data race in workloadapi.X509Source and workloadapi.JWTSource when reading bundles while the Workload API watcher updates them (#420)

Changelog

Sourced from github.com/spiffe/go-spiffe/v2's changelog.

[2.8.2] - 2026-09-18

Fixed

• Data race in workloadapi.X509Source and workloadapi.JWTSource when reading bundles while the Workload API watcher updates them (#420)

Commits

• 2ae1759 v2.8.2 changelog (#421)
• 2b6d4ba Bump actions/setup-go from 6 to 7 (#403)
• 30be436 Bump github.com/stretchr/testify from 1.11.1 to 1.12.1 (#416)
• c43c434 Fix race condition when accessing bundle (#420)
• 9819590 Bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.5 (#419)
• cb388d8 Bump google.golang.org/protobuf from 1.36.11 to 1.36.12 (#414)
• See full diff in compare view

Updates github.com/ulikunitz/xz from 0.5.16 to 0.5.17

Commits

• 6ead826 Prepare release v0.5.17
• f5969eb Merge pull request #81 from clydeeshun94/master
• 591e09e fix: retry (0, nil) reads in breader.ReadByte
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.