chore(deps): consolidate minor dependency updates (2026-08-26)

[Umang01-hash]

Consolidated Dependabot Updates (Minor/Patch)

This PR combines all minor/patch dependency updates from this week's Dependabot batch, applied per-module across the go.work workspace (root + affected pkg/ submodules + examples/using-s3-filestore).

Updates included

Package	Old	New
go.opentelemetry.io/otel	v1.44.0	v1.45.0
go.opentelemetry.io/otel/sdk	v1.44.0	v1.45.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp	v1.44.0	v1.45.0
github.com/aws/aws-sdk-go-v2/config	v1.32.37	v1.32.38
github.com/aws/aws-sdk-go-v2/service/sqs	v1.45.1	v1.46.7
google.golang.org/grpc	v1.83.0	v1.83.1
google.golang.org/api	v0.291.0	v0.293.0
cloud.google.com/go/pubsub	v1.51.0	v1.51.1
github.com/jlaffaye/ftp	v0.2.2	v0.2.4
github.com/redis/go-redis/extra/redisotel/v9	v9.21.0	v9.22.0

Verification

• Per-module go mod tidy -diff clean (reproduces CI code_quality tidy gate over pkg/).
• go build ./... passes on root + all changed library modules; go vet clean on the example.

Original Dependabot PRs (now closed)

#4096, #4095, #4094, #4093, #4092, #4091, #4090, #4089, #4088, #4087, #4086, #4085, #4084, #4083, #4082, #4081, #4080, #4079, #4078, #4077, #4076, #4075, #4074, #4073, #4072, #4071, #4070, #4069, #4068, #4067, #4066, #4065, #4063, #4062, #4061, #4060, #4059, #4058, #4057, #4056

All changes are minor/patch bumps with no breaking API changes expected.

[aryanmehrotra]

🔴 Changes requested — this cannot merge independently of #4048

Reviewed at 9b4cbdd72. The bumps themselves are correct and every gate I ran is green. The blocker is coordination, not content.

What I verified (all green)

Check	Result
CI tidy gate, verbatim (find pkg -name go.mod → go mod tidy -diff)	✅ all pkg/ tidy
downgrades vs development	none — every one of the 40 deps moves forward
root + examples/ tidiness	unchanged from base (using-cloudsql / using-gcp-metrics untidy before and after)
govulncheck ./... vs base	identical — no new module vulns, none closed either

👍 One thing this PR gets right that #4048 does not

development currently runs go-redis/v9 v9.22.0 (landed by #4051) against redisotel/rediscmd v9.21.0 — a version skew across the same release family. This PR is the only one of the two that closes it by taking both extras to v9.22.0. That should survive whatever rebase happens.

🔴 Blocker: 34-file conflict with #4048, in both directions

Both PRs branch from a base that does not contain the other. I ran both merges:

merge 4048 → then 4097 : 34 conflicted files
merge 4097 → then 4048 : 34 conflicted files   (symmetric)

The hunks are factual disagreements, so no --ours/--theirs answer is right. Example in pkg/gofr/datasource/pubsub/sqs/go.mod:

<<<<<<< #4048                  =======  this PR
sqs      v1.46.6                        v1.46.7    ← this PR is newer
aws-sdk  v1.43.6                        v1.43.7    ← this PR is newer
testify  v1.12.1                        v1.11.1    ← #4048 is newer
go.yaml.in/yaml/v3 present              go-spew present
>>>>>>>

I resolved the whole merge with -X theirs to measure it: testify lands split 16 modules on v1.11.1 / 13 on v1.12.1. The tidy gate does catch this (20 pkg/ modules go RED), so it fails loudly rather than silently — but it costs a full CI round.

What closes this review: merge #4048 first (it carries 361 dependency keys to this PR's 66), then rebase this branch on top and re-run go mod tidy per module rather than resolving hunks by hand. The remaining delta is small and clean — aws-sdk core chain, grpc 1.83.1, api 0.293.0, redisotel/rediscmd 9.22.0, sqs 1.46.7, otlp 1.11.0, auth 0.23.0, jlaffaye/ftp 0.2.4.

🟡 Description does not match the diff

The "Updates included" table lists 10 packages. The diff moves 40 distinct dependencies across 150 go.mod lines. Most of the extra is tidy-driven transitive movement and that is fine — but one is a direct require and worth naming:

github.com/stretchr/testify v1.11.1 → v1.12.1, in the root module and pkg/gofr/datasource/file/ftp only.

That is not a transitive bump — it is the shipped module's test dependency, and it carries the gopkg.in/yaml.v3 → go.yaml.in/yaml/v3 swap with it. It also leaves the tree in a split state: root + ftp on 1.12.1, the other 27 submodules still on 1.11.1. #4048 is what makes that uniform, which is a second argument for landing #4048 first.

Please add it to the table either way, so the diff can be read from the description.

[aryanmehrotra]

🔴 Changes requested — content is correct and all gates are green, but this cannot merge independently of #4048: the two conflict in 34 files in either order, and no --ours/--theirs resolution is right (a naive -X theirs leaves testify split 16 modules on v1.11.1 / 13 on v1.12.1).

To close this: merge #4048 first, then rebase this branch and re-run go mod tidy per module. Also please add the undocumented stretchr/testify v1.11.1 → v1.12.1 bump (root + file/ftp) to the description table.

Full detail: #4097 (comment)