Bump the go-modules group with 7 updates

[dependabot]

Bumps the go-modules group with 7 updates:

Package	From	To
github.com/aws/smithy-go	1.28.1	1.28.2
github.com/bmatcuk/doublestar/v4	4.10.0	4.10.2
github.com/ebitengine/purego	0.11.0	0.11.1
github.com/googleapis/gax-go/v2	2.24.1	2.25.0
github.com/huandu/xstrings	1.6.0	1.6.1
github.com/spiffe/go-spiffe/v2	2.8.1	2.8.2
github.com/ulikunitz/xz	0.5.16	0.5.17

Updates github.com/aws/smithy-go from 1.28.1 to 1.28.2

Changelog

Sourced from github.com/aws/smithy-go's changelog.

Release (2026-09-18)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.28.2
  • Bug Fix: Avoid allocating a slice in ValidateEndpointHost by indexing into the hostname instead of using strings.Split.
  • Bug Fix: Fix event stream decode panic on unknown header value type.
  • Bug Fix: Fix schema-serde CBOR decode panic on malformed string/blob length.
  • Bug Fix: JoinPath keeps a trailing slash when the added path is a slash.

Release (2026-08-26)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.28.1
  • Bug Fix: Fix broken AddLogger middleware since its insert point was removed.

Release (2026-08-25.2)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.28.0
  • Feature: Set Content-Length inline when the request body is set via SetStream. The ComputeContentLength middleware is now deprecated.

Release (2026-08-25)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.27.10
  • Bug Fix: Fix a data race on the underlying writer when an event stream is closed while an event write is in flight.
  • Bug Fix: Restore draining the HTTP response body in CloseResponseBody to avoid issues with TCP connection reuse.

Release (2026-08-21)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.27.9
  • Bug Fix: Fix a generic event stream exception not carrying the error code and message from its payload.
  • Bug Fix: Fix an event stream not being closed when its connection is lost, which would cause a caller writing to the stream to block indefinitely.
  • Bug Fix: Fix deserialization of an empty list producing a nil slice instead of an empty one.

... (truncated)

Commits

• 9b28af0 Release 2026-09-18
• f59df88 Avoid slice allocation in ValidateEndpointHost (#705)
• 7c16d7f fix decode panic on event stream header type and bad cbor string/blob len (#713)
• c60819a fix initial-message race (#712)
• d05a672 fix v2 event streams orphaning the result channel on error paths in schema-se...
• fe95176 Revert "fix v2 event streams orphaning the result channel on error paths in s...
• 9847245 fix v2 event streams orphaning the result channel on error paths in schema-serde
• 9eba49f Print stacktrace when smithy-build fails (#708)
• 959c6ab Keep a trailing slash when JoinPath right operand is a slash. (#698)
• d253285 update README
• See full diff in compare view

Updates github.com/bmatcuk/doublestar/v4 from 4.10.0 to 4.10.2

Release notes

Sourced from github.com/bmatcuk/doublestar/v4's releases.

Better support for Windows "Junctions"

Has improved support for reading "junctions" in Windows (ie, Windows' version of symlinks).

Thanks @​x0Lazarus for the PR!

What's Changed

• Fix Windows junction traversal with Go 1.23 and later by @​x0Lazarus in bmatcuk/doublestar#117

New Contributors

• @​x0Lazarus made their first contribution in bmatcuk/doublestar#117

Full Changelog: bmatcuk/doublestar@v4.10.1...v4.10.2

Fixed issue with alternatives and character classes

There was an issue where commas or ending curly brackets inside a character class would cause code looking for the next alternative (commas) or the end of alternatives (ending curly brackets) to erroneously match those characters inside the character classes.

Thanks to @​sidsri14 for the fix!

What's Changed

• fix brace alternation scanning with character classes by @​sidsri14 in bmatcuk/doublestar#115

New Contributors

• @​sidsri14 made their first contribution in bmatcuk/doublestar#115

Full Changelog: bmatcuk/doublestar@v4.10.0...v4.10.1

Commits

• fc7b711 update CI
• 7b00623 Merge branch 'x0Lazarus-fix/windows-junction-traversal'
• 146da9c small test changes
• dbb13b8 fix brace alternation scanning with character classes
• 314a609 Merge branch 'sidsri14-master'
• f0902d5 small test changes
• ee530d0 Fix traversal of Windows junctions reported as irregular files
• bf0b1d6 fix brace alternation scanning with character classes
• See full diff in compare view

Updates github.com/ebitengine/purego from 0.11.0 to 0.11.1

Release notes

Sourced from github.com/ebitengine/purego's releases.

v0.11.1

• Fix SyscallN returning the third input argument as an error code on platforms that do not capture errno; it now returns 0 (#505)
• Fix 64-bit integer callback return values losing their upper 32 bits on 386 (#524)

Commits

• 15800b5 purego: return 64-bit callback results on 386 (#519)
• fc7e496 purego: clear uncaptured errno in syscall trampolines (#510)
• See full diff in compare view

Updates github.com/googleapis/gax-go/v2 from 2.24.1 to 2.25.0

Release notes

Sourced from github.com/googleapis/gax-go/v2's releases.

v2.25.0

2.25.0 (2026-09-21)

Features

• update go min version to 1.26 (#548) (b943a7d)

Commits

• 0c567ee chore(main): release 2.25.0 (#549)
• b943a7d feat: update go min version to 1.26 (#548)
• 70cba90 chore(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 (#545)
• 2a1344f impl(o11y): implement client request spans in Invoke (#547)
• 6bcd109 impl(o11y): add startSpan helper for client request spans (#546)
• 4aa492c impl(o11y): add endSpan helper for client request spans (#543)
• 820c09c impl(o11y): add span name resolution for client request spans (#542)
• 0e86bbe impl(o11y): add WithClientTracing CallOption (#541)
• 00e2eb6 impl(o11y): add ClientTracing configuration (#540)
• 29d82d4 chore: migrate repo to use 1.27 as latest, 1.26 as earliest (#538)
• Additional commits viewable in compare view

Updates github.com/huandu/xstrings from 1.6.0 to 1.6.1

Commits

• f835cc2 Merge pull request #68 from x0Lazarus/docs-scrub-replacement-character
• affb8e6 Merge pull request #69 from jakezwang/fix/camelcase-trailing-initial
• cedef93 fix: preserve trailing uppercase initials in camel case
• 86af16d docs: clarify Scrub handling of replacement characters
• See full diff in compare view

Updates github.com/spiffe/go-spiffe/v2 from 2.8.1 to 2.8.2

Release notes

Sourced from github.com/spiffe/go-spiffe/v2's releases.

v2.8.2

Fixed

• Data race in workloadapi.X509Source and workloadapi.JWTSource when reading bundles while the Workload API watcher updates them (#420)

Changelog

Sourced from github.com/spiffe/go-spiffe/v2's changelog.

[2.8.2] - 2026-09-18

Fixed

• Data race in workloadapi.X509Source and workloadapi.JWTSource when reading bundles while the Workload API watcher updates them (#420)

Commits

• 2ae1759 v2.8.2 changelog (#421)
• 2b6d4ba Bump actions/setup-go from 6 to 7 (#403)
• 30be436 Bump github.com/stretchr/testify from 1.11.1 to 1.12.1 (#416)
• c43c434 Fix race condition when accessing bundle (#420)
• 9819590 Bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.5 (#419)
• cb388d8 Bump google.golang.org/protobuf from 1.36.11 to 1.36.12 (#414)
• See full diff in compare view

Updates github.com/ulikunitz/xz from 0.5.16 to 0.5.17

Commits

• 6ead826 Prepare release v0.5.17
• f5969eb Merge pull request #81 from clydeeshun94/master
• 591e09e fix: retry (0, nil) reads in breader.ReadByte
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.