chore(deps): bump the go-dependencies group with 2 updates

[dependabot]

Bumps the go-dependencies group with 2 updates: github.com/aws/aws-sdk-go-v2/service/lambda and google.golang.org/api.

Updates github.com/aws/aws-sdk-go-v2/service/lambda from 1.95.0 to 1.96.0

Commits

• bdb98c5 Release 2026-01-28
• c878d57 Regenerated Clients
• 4f5d503 Update API model
• b7bf952 Feat release s3 transfer manager v2 (#3293)
• 0baa1dc Release 2026-01-27
• 11eae4b Regenerated Clients
• 297caa5 Update endpoints model
• 43d96e4 Update API model
• de58dc6 Release 2026-01-26
• dba39e6 Regenerated Clients
• Additional commits viewable in compare view

Updates google.golang.org/api from 0.287.0 to 0.287.1

Release notes

Sourced from google.golang.org/api's releases.

v0.287.1

0.287.1 (2026-07-07)

Documentation

• Remove old TODO file (#3645) (9d7a6b8)

Changelog

Sourced from google.golang.org/api's changelog.

0.287.1 (2026-07-07)

Documentation

• Remove old TODO file (#3645) (9d7a6b8)

Commits

• 93d63e8 chore(main): release 0.287.1 (#3646)
• 9d7a6b8 docs: remove old TODO file (#3645)
• 576018f chore(all): update all (#3644)
• cc70265 chore(deps): bump golang.org/x/net in /internal/kokoro/discogen (#3642)
• 9858f66 chore: downgrade go version in go.work (#3641)
• 3cb00c0 chore: downgrade min Go version (#3640)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[claude]

Claude finished @dependabot[bot]'s task in 47s —— View job

---

Dependency update review

• Identify changed dependencies
• Assess semver/changelogs for breaking changes
• Check repo usage of each dependency
• Post summary

Verdict: ✅ Safe to merge. Both are non-breaking updates, and the codebase's usage is narrow and unaffected.

1. github.com/aws/aws-sdk-go-v2/service/lambda 1.95.0 → 1.96.0

• Minor version bump — SDK regenerated clients from an updated API model (additive). No breaking changes expected under semver.
• The module's own go.mod hash is unchanged between versions (gKWVtxlMTgoLU9m6FDw7z6FAEFh8u8CoaPJx0zWk5J8=), so no transitive dependency shifts came with this bump.
• Repo usage lives in internal/aws/aws.go and is limited to stable, long-standing APIs:
  • lambda.NewFromConfig (aws.go:140)
  • ListFunctions / ListFunctionsInput (aws.go:146, 184)
  • GetFunctionConfiguration / GetFunctionConfigurationInput (aws.go:147, 286)
  • A local LambdaClient interface abstracts these, and internal/aws/fake_lambda.go fakes it for tests — so any signature drift would surface at compile time.
• No action needed.

2. google.golang.org/api 0.287.0 → 0.287.1

• Patch release. Changelog contains a documentation-only change (removed an old TODO file, #3645). No code changes.
• Repo usage is a single import of google.golang.org/api/iterator in internal/cloudrun/cloudrun.go:19, which is unaffected.
• No action needed.

Transitive

• google.golang.org/genproto/googleapis/rpc moved to a newer pseudo-version (pulled in by the google.golang.org/api bump). Its go.mod hash is unchanged, so no further dependency churn.

Suggested follow-up

• CI (make build + make test_integration) is sufficient to confirm; no dependency-specific tests are required beyond the existing internal/aws lambda contract tests.