[dependabot]

Bumps the go-modules group in /apps/server with 7 updates:

Package	From	To
github.com/aws/aws-sdk-go-v2	1.47.3	1.47.4
github.com/aws/aws-sdk-go-v2/service/bedrockruntime	1.63.6	1.63.7
github.com/aws/smithy-go	1.28.5	1.28.6
github.com/openai/openai-go/v3	3.85.0	3.86.0
github.com/posthog/posthog-go	1.35.1	1.37.0
google.golang.org/api	0.307.0	0.308.0
google.golang.org/genai	1.75.0	1.76.0

Updates github.com/aws/aws-sdk-go-v2 from 1.47.3 to 1.47.4

Commits

• 4aaad74 Release 2026-10-22
• 4c1f2f2 Regenerated Clients
• edb4ad6 Update endpoints model
• 414c9e4 Update API model
• 5bba534 Bump Smithy Go to 1.28.6 (#3600)
• 0d2e6fa Release 2026-10-21
• 0d7e55d Regenerated Clients
• d5bf455 Update endpoints model
• e92707e Update API model
• d980ed6 Enforce event stream header key value length limit instead of truncating (#3598)
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/bedrockruntime from 1.63.6 to 1.63.7

Commits

• 70e9f3d Release 2025-09-10
• e620ecb Regenerated Clients
• b412203 Update endpoints model
• 89f42ef Update API model
• d71b109 Bump smithy go version to allow unused required parameter in endpoint rule se...
• f68827f Release 2025-09-09
• d1748bf Regenerated Clients
• 00307c0 Update endpoints model
• 424be93 Update API model
• See full diff in compare view

Updates github.com/aws/smithy-go from 1.28.5 to 1.28.6

Changelog

Sourced from github.com/aws/smithy-go's changelog.

Release (2026-10-27)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.28.7
  • Bug Fix: Fix a panic or EOF error when deserializing a JSON union that contains a member not modeled by the client and whose value is not null.
  • Bug Fix: Log the underlying error when dumping an HTTP request or response for logging fails

Release (2026-10-21)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.28.6
  • Bug Fix: Enforce event stream header key value length limit instead of truncating
  • Bug Fix: Retain the value in a list with the zero value when encountering a null entry on a dense list. This matches how legacy code-generated JSON deserializers behaved.

Release (2026-10-09)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.28.5
  • Bug Fix: Retain the key with the zero value when encountering a null-value key in a dense map. This matches how legacy code-generated JSON deserializers behaved.

Release (2026-10-07)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.28.4
  • Bug Fix: Revert #698 that fixed JoinPath with trailing slash. This has a side effect on certain S3 API paths in the downstream SDK that need more consideration.

Release (2026-10-06)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.28.3
  • Bug Fix: Accept either casing of message/Message on modeled JSON error structures in schema-based deserialization, and emit the smithy.api#error trait in generated schemas
  • Bug Fix: Include the underlying error when logging failures to discard or close an HTTP response body

Release (2026-09-18)

... (truncated)

Commits

• f0c489f Release 2026-10-21
• 43007bd Enforce event stream header key value length limit instead of truncating (#733)
• fc207dc Serialize null values in lists not marked with @​sparse with their zero value ...
• See full diff in compare view

Updates github.com/openai/openai-go/v3 from 3.85.0 to 3.86.0

Release notes

Sourced from github.com/openai/openai-go/v3's releases.

v3.86.0

3.86.0 (2026-10-23)

Features

• api: Breaking change in a minor release. Decisions and Live question Instructions fields now use typed unions to support a string or a list of text, image, or JSON parts. Existing Go code that assigns a string directly, such as Instructions: "check", no longer compiles; wrap it in the field’s union type, for example Instructions: openai.DecisionNewParamsQuestionPredicateInstructionsUnion{OfString: openai.String("check")}. For Live responses, check question.Instructions.JSON.OfString.Valid() before reading question.Instructions.OfString, and handle question.Instructions.OfArrayOfDecisionQuestionInputPartUnion for the list case. Decisions request inputs also support additional message roles and tool-history items; update code that assumes it knows every input type. String instructions remain supported through the union, and the existing DecisionInputMessageParam user-message input form still works. (#1147) (bc63762)

Chores

• align generated SDK maintenance tooling (#1146) (bcb69a7)

v3.85.1

3.85.1 (2026-10-22)

Bug Fixes

• api: respect each WebSocket authentication attempt timeout (#1142) (e7c9fe9)

Chores

• api: clarify service-account API key deletion (#1144) (58b1902)

Changelog

Sourced from github.com/openai/openai-go/v3's changelog.

3.86.0 (2026-10-23)

Features

• api: Breaking change in a minor release. Decisions and Live question Instructions fields now use typed unions to support a string or a list of text, image, or JSON parts. Existing Go code that assigns a string directly, such as Instructions: "check", no longer compiles; wrap it in the field’s union type, for example Instructions: openai.DecisionNewParamsQuestionPredicateInstructionsUnion{OfString: openai.String("check")}. For Live responses, check question.Instructions.JSON.OfString.Valid() before reading question.Instructions.OfString, and handle question.Instructions.OfArrayOfDecisionQuestionInputPartUnion for the list case. Decisions request inputs also support additional message roles and tool-history items; update code that assumes it knows every input type. String instructions remain supported through the union, and the existing DecisionInputMessageParam user-message input form still works. (#1147) (bc63762)

Chores

• align generated SDK maintenance tooling (#1146) (bcb69a7)

3.85.1 (2026-10-22)

Bug Fixes

• api: respect each WebSocket authentication attempt timeout (#1142) (e7c9fe9)

Chores

• api: clarify service-account API key deletion (#1144) (58b1902)

Commits

• 9548c0a chore: release main (#1148)
• bc63762 feat(api): expand Decisions input and question types (#1147)
• bcb69a7 chore: align generated SDK maintenance tooling (#1146)
• 81ee867 chore: release main (#1143)
• 58b1902 chore(api): clarify service-account API key deletion (#1144)
• e7c9fe9 fix(api): respect each WebSocket authentication attempt timeout (#1142)
• See full diff in compare view

Updates github.com/posthog/posthog-go from 1.35.1 to 1.37.0

Release notes

Sourced from github.com/posthog/posthog-go's releases.

1.37.0

Unreleased

1.36.2

Unreleased

1.36.1

Unreleased

1.36.0

Unreleased

1.35.3

Unreleased

1.35.2

Unreleased

Changelog

Sourced from github.com/posthog/posthog-go's changelog.

1.37.0

Minor Changes

• 729bcf7: Add an opt-in OpenTelemetry enqueue helper that adds active trace and span IDs to exception events.

1.36.2

Patch Changes

• e8c7d37: Fall back to remote feature flag evaluation for regex syntax and character-class semantics that cannot be evaluated consistently with the flags service, including through negated cohorts.

1.36.1

Patch Changes

• 6b734dd: Preserve captured events with non-finite numeric properties by serializing NaN and infinities as null in both capture protocols. Arbitrary structs containing these numbers are replaced with null as a whole property.

1.36.0

Minor Changes

• d170fc5: Local flag evaluation honors experiment holdouts. A flag whose definition carries filters.holdout now resolves a held-out identifier to holdout-<id> before its release conditions, matching the server instead of silently bucketing the identifier into a regular variant.

1.35.3

Patch Changes

• 870af8a: Fix local feature flag string and regex operators to stringify explicit null values as "null", matching the flags service. Flag results and variant selection can change for explicit-null properties; missing properties remain inconclusive and eligible for remote evaluation.

1.35.2

Patch Changes

• de638c7: posthogmcp now sets $exception_source: "mcp.tool_call" on the $exception it emits alongside a failed tool call, and strips caller-supplied reserved exception metadata from MCP events.

Commits

• 5d73532 chore: release v1.37.0 [version bump] [skip ci]
• 729bcf7 feat(otel): add opt-in exception trace context (#374)
• 32f2522 chore: release v1.36.2 [version bump] [skip ci]
• e8c7d37 fix(flags): fall back for incompatible local regex evaluation (#387)
• 56aa91d docs: require signed commits in contributor docs (#388)
• aef332c chore: release v1.36.1 [version bump] [skip ci]
• 6b734dd fix: preserve events with non-finite numeric properties (#382)
• 6ffac5a chore(deps): bump the github-actions group with 4 updates (#385)
• 4f9ba34 chore: release v1.36.0 [version bump] [skip ci]
• d170fc5 feat(flags): honor experiment holdouts in local flag evaluation (#360)
• Additional commits viewable in compare view

Updates google.golang.org/api from 0.307.0 to 0.308.0

Release notes

Sourced from google.golang.org/api's releases.

v0.308.0

0.308.0 (2026-10-22)

Features

• all: Auto-regenerate discovery clients (#3787) (527f9a3)

Changelog

Sourced from google.golang.org/api's changelog.

0.308.0 (2026-10-22)

Features

• all: Auto-regenerate discovery clients (#3787) (527f9a3)

Commits

• 5767912 chore(main): release 0.308.0 (#3788)
• 527f9a3 feat(all): auto-regenerate discovery clients (#3787)
• See full diff in compare view

Updates google.golang.org/genai from 1.75.0 to 1.76.0

Release notes

Sourced from google.golang.org/genai's releases.

v1.76.0

1.76.0 (2026-10-22)

Features

• Add store to GenerateContentConfig (Gemini Developer API only) and labels to LiveConnectConfig. (2ca47f8)
• add base_voice to PromptedVoice in GAOS SDK (bfc9e1c)
• Add generation_output_config to GenerateContentConfig (6ae1299)
• Add Live API in-session context updates (send_context_update) and types across GenAI SDKs. (f1d0c6c)
• include AudioContent, DocumentContent, and VideoContent in FunctionResultSubContent (68f1351)
• interactions: populate output_text and output media helpers in the Go SDK (db2b842)
• sdks: enable fixes.openSingleValueEnumsOct2026 across all SDKs (3892a92)
• update discovery doc (525f275)

Bug Fixes

• genai: raise mid-stream SSE errors and dropped connections consistently across SDKs; add continuation conformance tests (9aa2634)
• interactions: sync InteractionSseEventInteractionStatus enum with InteractionStatus (7c129ed)
• keep streamed chat turns in curated history when the stream ends with an empty chunk (4dd02c1), refs #795

Changelog

Sourced from google.golang.org/genai's changelog.

1.76.0 (2026-10-22)

Features

• Add store to GenerateContentConfig (Gemini Developer API only) and labels to LiveConnectConfig. (2ca47f8)
• add base_voice to PromptedVoice in GAOS SDK (bfc9e1c)
• Add generation_output_config to GenerateContentConfig (6ae1299)
• Add Live API in-session context updates (send_context_update) and types across GenAI SDKs. (f1d0c6c)
• include AudioContent, DocumentContent, and VideoContent in FunctionResultSubContent (68f1351)
• interactions: populate output_text and output media helpers in the Go SDK (db2b842)
• sdks: enable fixes.openSingleValueEnumsOct2026 across all SDKs (3892a92)
• update discovery doc (525f275)

Bug Fixes

• genai: raise mid-stream SSE errors and dropped connections consistently across SDKs; add continuation conformance tests (9aa2634)
• interactions: sync InteractionSseEventInteractionStatus enum with InteractionStatus (7c129ed)
• keep streamed chat turns in curated history when the stream ends with an empty chunk (4dd02c1), refs #795

Commits

• a66c527 chore(main): release 1.76.0 (#1001)
• 2ca47f8 feat: Add store to GenerateContentConfig (Gemini Developer API only) and ...
• 68f1351 feat: include AudioContent, DocumentContent, and VideoContent in FunctionResu...
• c06dee9 chore(cli): update Speakeasy OpenAPI generator to v2.950.8
• 9aa2634 fix(genai): raise mid-stream SSE errors and dropped connections consistently ...
• 3f4e702 docs: Update unenforced JSON Schema keywords on Interactions schema fields.
• 254286a chore: ignore union type-set expansions in Go apidiff workflow
• 708e310 chore: make bash the valid return type
• 498491d chore(cli): update Speakeasy OpenAPI generator to v2.950.5
• 6ae1299 feat: Add generation_output_config to GenerateContentConfig
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.