[dependabot]

Bumps the go group with 4 updates in the / directory: github.com/aws/aws-sdk-go-v2/config, github.com/stretchr/testify, github.com/twmb/franz-go and github.com/twmb/franz-go/pkg/kmsg.

Updates github.com/aws/aws-sdk-go-v2/config from 1.32.37 to 1.33.5

Commits

• 4e0240a Release 2026-09-14
• c2d42df Regenerated Clients
• 1548c19 Update endpoints model
• 9fab903 Update API model
• a7eaa10 Release 2026-09-11
• c6f53e8 Regenerated Clients
• e80f4fa Update endpoints model
• 55b26d7 Update API model
• 113bc91 Release 2026-09-10
• 0b5dc66 Regenerated Clients
• Additional commits viewable in compare view

Updates github.com/stretchr/testify from 1.12.0 to 1.12.1

Release notes

Sourced from github.com/stretchr/testify's releases.

v1.12.1

This is the first release which has the minimum dependencies practical in testify v1. The last remaining dependencies are github.com/stretchr/objx which itself has no dependencies, and go.yaml.in/yaml/v3. Removing objx would require v2, it cannot be vendored. Removing YAML would require vendoring the yaml library, which would do more harm than good. It's better to become aware of vulnerabilities in the official yaml package than to attempt to maintain our own.

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in stretchr/testify#1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

• @​harryzcy made their first contribution in stretchr/testify#1935
• @​boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

What's Changed

• Change yaml library to go.yaml.in/yaml/v3 by @​harryzcy in stretchr/testify#1935
• change yaml library to go.yaml.in/yaml/v3 by @​boekkooi-impossiblecloud in stretchr/testify#1772

New Contributors

• @​harryzcy made their first contribution in stretchr/testify#1935
• @​boekkooi-impossiblecloud made their first contribution in stretchr/testify#1772

Full Changelog: stretchr/testify@v1.12.0...v1.12.1

Commits

• 959dbda Merge pull request #1935 from harryzcy/yaml-update
• 9bb7176 Update go.yaml.in/yaml/v3 to v3.0.5
• 0358d0e change yaml library to go.yaml.in/yaml/v3
• See full diff in compare view

Updates github.com/twmb/franz-go from 1.21.6 to 1.22.0

Changelog

Sourced from github.com/twmb/franz-go's changelog.

v1.22.0

This release supports Kafka 4.3 and 4.4, has a few new APIs, and has a few big internal improvements. In particular, I recommend checking out the new StreamingCompression option, as well as evaluating if you'd like to use RackAwarePartitioning. There are some behavior changes that you should read about below. The "next gen" rebalancer is now usable via the new ServerSideBalancer option. It's had a few releases to shake out bugs internally (via integration tests and LLM audits), but if you do experience a bug, please open an issue straightaway.

Some minor bug fixes (that were never reported) were found during the implementation that are not worth mentioning.

kfake has also been significantly extended and I recommend checking out the new APIs, in particular:

• A new Fault type to make it easier to inject errors without Control functions
• Group introspection cluster APIs
• BlackholeProduce and SyntheticFetch APIs for benchmarking / play testing

My kcl CLI has been significantly expanded as well and is worth checking out. It supports essentially everything you can do with a cluster, and now allows you to run a full broker locally via kcl fake (in memory or a dumb disk backed localhost broker) - as well as setup the fake broker with fault injection. I've been running LLM audits and extensions to kcl in particular to try to shape it up to a "finalized" CLI shape. If you use it and have ideas for improvements, please open an issue.

Behavior changes

• Rack aware group partition assignment (KIP-881) now requires BalanceRacks. v1.21.0 enabled group balancers to assign partitions based on the rack that members were in if you used the range or sticky/cooperative-sticky balancers. Well, Rack is also used to opt into preferred read replica assignment when fetching by the broker itself. These two decisions conflict with each other. Now, BalanceRacks() is required to opt into group balancers using the rack while balancing. The client warns when balancing if BalanceRacks is on and the brokers have preferred read replicas enabled.

• ConsumeResetOffset defaults to RewindOffset(time.Minute) rather than NewOffset().AtStart(). Setting only ConsumeStartOffset no longer sets ConsumeResetOffset. I introduced ConsumeStartOffset a while back because it was really weird IMO to use a reset offset for both how a consumer starts and for how it recovers in the event of data loss or falling behind. They were bidirectional since introduction, but since start is newer and much less commonly used and you often don't want to recover from the start, I've removed the start -> reset mapping when you only set the start. I recommend reading the docs on both options for an updated understanding of when and how they apply. As well, I've introduced RewindOffset(d) which is only

... (truncated)

Commits

• 01f206a Merge pull request #1465 from twmb/cl
• 591da46 README: one KIP table separator, note KIP-848 in the feature list
• 5229a17 cl: note v1.22.0
• 02987d8 Merge pull request #1464 from twmb/decompress-rename
• 33656c4 kgo: rename MaxDecompressedBatchBytes to MaxDecompressBatchBytes
• ceb84a6 Merge pull request #1463 from twmb/decompress-bound
• 5c3b3d0 kgo: fix the merge sweep test to observe the merge
• 0a56a56 kgo: write the zstd frame checksum again
• f20ad4c kgo: default MaxDecompressedBatchBytes to 1 GiB, drop the merge constant
• 3724804 Merge pull request #1462 from twmb/kversion-features
• Additional commits viewable in compare view

Updates github.com/twmb/franz-go/pkg/kmsg from 1.13.1 to 1.14.0

Changelog

Sourced from github.com/twmb/franz-go/pkg/kmsg's changelog.

v1.14.0

This release contains a few new APIs, one behavior change, and one minor bugfix.

Bug fixes

Previously, HookBrokerRead and HookBrokerE2E could not be used at the same time. This has been fixed.

Behavior changes

PauseFetch{Topics,Partitions} now causes the client to drop all buffered fetches and kill all in-flight fetch requests. Importantly, this also means that once you pause, it is no longer possible for what you paused to be returned while polling. Previously, the client made no attempt to clear internal buffers / in flight requests, meaning you could receive paused data for a while.

Seed brokers now show up in logs as seed_### rather than seed ### (an underscore has been added).

Features

• kgo.Offset now has an EpochOffset getter function that allows access to the actual epoch and offset that are inside the opaque Offset type.
• AddConsumePartitions allows adding individual partitions to consume, and the new counterpart RemoveConsumePartitions allows removing individual partitions from being consumed. Removing is different from purging, please see the docs.
• KeepRetryableFetchErrors bubbles up retryable errors to the end user that are encountered while fetching. By default, these errors are stripped.
• kversion now supports Kafka 3.5
• kversion now supports version guessing against KRaft by default
• kgo.DialTLS now exists to even more easily opt into TLS.
• kgo.Client.Opts now exists to return the original options that were used to configure the client, making initializing new clients easier.
• kgo.NodeName returns a string form of a broker node name. Internally, seed brokers use math.MinInt32 for node IDs, which shows up as massively negative numbers in logs sometimes. NodeName can help convert that to seed_<#>.

Relevant commits

• c3b083b improvement kgo: do not returned paused topics/partitions after pausing
• e224e90 bugfix kgo: allow HookBrokerRead and HookBrokerE2E to both be called
• 875761a feature kgo Offset: add EpochOffset getter field
• c5d0fc5 kgo: add a debug log for stripping retryable errors from fetches
• b45d663 kgo: add more context to opportunistic metadata loads while fetching
• 9dae366 kgo: allow retries on dial timeouts
• 00e4e76 kgo: tolerate buggy v1 group member metadata

... (truncated)

Commits

• f132eaa Merge pull request #504 from twmb/bump_kmsg
• fa4e091 franz-go: bump kmsg to v1.6.1
• 7182514 Merge pull request #503 from twmb/kmsg_noretract
• 23c38ff plugin/klogrus: use fmt.Sprint
• 7ea9b09 pkg/kmsg: avoid retract v2 directive
• 063ab3e Merge pull request #502 from twmb/v1.14-changelog
• cd58477 CHANGELOG: note incoming v1.14
• 118e822 Merge pull request #470 from JGShaw/master
• 6fb7260 Merge pull request #498 from twmb/ft
• bc4b0e4 Merge pull request #496 from twmb/kadm_list
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.