deps(deps): bump the minor-and-patch group across 1 directory with 8 updates

[dependabot]

Bumps the minor-and-patch group with 6 updates in the / directory:

Package	From	To
github.com/aws/aws-sdk-go-v2	1.41.9	1.43.3
github.com/aws/aws-sdk-go-v2/config	1.32.17	1.32.34
github.com/aws/aws-sdk-go-v2/service/ec2	1.301.0	1.318.1
github.com/aws/aws-sdk-go-v2/service/pricing	1.42.2	1.44.3
github.com/aws/aws-sdk-go-v2/service/servicequotas	1.34.7	1.37.3
github.com/scttfrdmn/substrate	0.85.0	0.88.0

Updates github.com/aws/aws-sdk-go-v2 from 1.41.9 to 1.43.3

Commits

• e022bf5 Release 2026-07-31.2
• 37db31f Regenerated Clients
• 743701a Update API model
• 5555cc0 upgrade to smithy-go v1.27.6 (#3505)
• b0c4f28 Release 2026-07-31
• 8c94f29 Regenerated Clients
• d4d7af9 Update endpoints model
• 3dd4c38 Update API model
• 2f4fc72 Release 2026-07-30
• 8348643 Regenerated Clients
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/config from 1.32.17 to 1.32.34

Commits

• e022bf5 Release 2026-07-31.2
• 37db31f Regenerated Clients
• 743701a Update API model
• 5555cc0 upgrade to smithy-go v1.27.6 (#3505)
• b0c4f28 Release 2026-07-31
• 8c94f29 Regenerated Clients
• d4d7af9 Update endpoints model
• 3dd4c38 Update API model
• 2f4fc72 Release 2026-07-30
• 8348643 Regenerated Clients
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/credentials from 1.19.16 to 1.19.33

Commits

• e022bf5 Release 2026-07-31.2
• 37db31f Regenerated Clients
• 743701a Update API model
• 5555cc0 upgrade to smithy-go v1.27.6 (#3505)
• b0c4f28 Release 2026-07-31
• 8c94f29 Regenerated Clients
• d4d7af9 Update endpoints model
• 3dd4c38 Update API model
• 2f4fc72 Release 2026-07-30
• 8348643 Regenerated Clients
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/ec2 from 1.301.0 to 1.318.1

Commits

• e022bf5 Release 2026-07-31.2
• 37db31f Regenerated Clients
• 743701a Update API model
• 5555cc0 upgrade to smithy-go v1.27.6 (#3505)
• b0c4f28 Release 2026-07-31
• 8c94f29 Regenerated Clients
• d4d7af9 Update endpoints model
• 3dd4c38 Update API model
• 2f4fc72 Release 2026-07-30
• 8348643 Regenerated Clients
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/pricing from 1.42.2 to 1.44.3

Commits

• 70e9f3d Release 2025-09-10
• e620ecb Regenerated Clients
• b412203 Update endpoints model
• 89f42ef Update API model
• d71b109 Bump smithy go version to allow unused required parameter in endpoint rule se...
• f68827f Release 2025-09-09
• d1748bf Regenerated Clients
• 00307c0 Update endpoints model
• 424be93 Update API model
• 648027e Release 2025-09-08
• Additional commits viewable in compare view

Updates github.com/aws/aws-sdk-go-v2/service/servicequotas from 1.34.7 to 1.37.3

Commits

• 9a3190f Release 2026-06-08
• b20dd5b Regenerated Clients
• 75a45ea Update API model
• e736f55 Add preview of changes for standard retry mode behind flag (#3400)
• ba08dc9 Release 2026-06-05.2
• 9a67e21 Revert schema serde (#3442)
• 51692f8 s3/transfermanager: avoid double-closing concurrentReader channel after read ...
• f696d5b Release 2026-06-05
• 7efb8fd Regenerated Clients
• 1a420c5 Update endpoints model
• Additional commits viewable in compare view

Updates github.com/aws/smithy-go from 1.26.0 to 1.27.6

Changelog

Sourced from github.com/aws/smithy-go's changelog.

Release (2026-08-07)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.27.7
  • Bug Fix: Don't serialize unset JSON documents as nil in structure members.
  • Bug Fix: Fix a deserialization panic around collection members in recursive shape configs.

Release (2026-07-31)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.27.6
  • Bug Fix: Fix failure to deserialize any @httpPayload struct with a non-string member.
  • Bug Fix: Fix failure to serialize any @httpPayload struct with a nested struct.

Release (2026-07-27)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.27.5
  • Bug Fix: Fix a performance issue in awsQuery with large response payloads.

Release (2026-07-16)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go/aws-http-auth: v1.2.1
  • Bug Fix: Use r.URL.Host when r.Host is unset.
• github.com/aws/smithy-go/aws-http-auth-schemes: v1.0.0
  • Release: Module github.com/aws/smithy-go/aws-http-auth-schemes adds generic smithy-go client support for AWS Sigv4 and Sigv4a.

Release (2026-06-26)

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/smithy-go: v1.27.3
  • Bug Fix: Fix bug in JSON doc encoder and endpoint host label format validation

Release (2026-06-05)

... (truncated)

Commits

• adb847f Release 2026-07-31
• 96461b2 fix bad http binding deser (#690)
• 055e50f handle null cbor struct val (#689)
• 7016ea0 Release 2026-07-27
• cb3e15c add fine-grained benchmark codegen (#688)
• f23de1a revert codegen version to 0.1.0
• 5dd90af update README
• 526ee94 remove wrapper and only sign release-built bundle
• 870555a Release 2026-07-16
• b06f353 changelogs
• Additional commits viewable in compare view

Updates github.com/scttfrdmn/substrate from 0.85.0 to 0.88.0

Release notes

Sourced from github.com/scttfrdmn/substrate's releases.

v0.88.0

Six issues, one defect shape: substrate returned HTTP 200 while the observable a caller parses was wrong. A len() assertion passed, a stack reached CREATE_COMPLETE, a template deployed — and the value the consumer then read was empty, truncated, or under a key their SDK does not look at. Nothing errored, which is what made each one survivable in a smoke test and fatal in real use.

Four of them are CloudFormation's intrinsic resolver, which turned out to be a single weakness seen from four angles: it resolved a scalar at the top level of a property and nothing else. Split a string and you kept one field. Nest a Ref one level down and it stayed a literal map. Look up an AMI in Mappings and you got JSON where an AMI ID belonged — then the instance launched anyway.

Fixed

• Fn::Split resolves to a list, not its first element (#521). A resolver that returns string cannot return a list, so !Split was silently truncated to [0] — a three-element container command deployed as one. Adds a list-returning sibling, which also fixes !Select ['2', !Split [':', arn]], the idiom the AWS reference leads with and which returned "" throughout.
• Intrinsics resolve at any depth inside a structured property (#526). A {"Ref": …} inside ContainerDefinitions or KeySchema was forwarded verbatim to the service plugin, which stored the map as a literal or rejected it as a SerializationException. A multi-key map is deliberately not an intrinsic — that is user data — and Fn::If → AWS::NoValue now removes the property as CloudFormation does, rather than leaving an empty string.
• A deployed task definition's container keys are the ECS API's (#527). CloudFormation spells them PascalCase, ECS's API camelCase, and ContainerDefinitions was []any at both boundaries, so nothing rejected the mismatch: describe-task-definition echoed [{}]. Mapped per-service, not generically — DynamoDB's API is natively PascalCase and a generic converter would have broken it.
• Mappings, Fn::FindInMap, Fn::GetAZs, Fn::Cidr, Fn::ImportValue and the last four pseudo-parameters (#522). An unknown FindInMap key now fails the resource rather than falling back to a JSON literal. Fn::GetAZs resolves against the same zone list DescribeAvailabilityZones reports, so the two cannot disagree. Fn::ImportValue resolves against a real cross-stack export registry, and deleting a stack whose export is still imported is refused — which is the entire reason to model exports rather than fake them.
• CloudWatch Logs reads put the API's member names on the wire (#528). An SDK matches response members case-sensitively, so a PascalCase member does not fail to parse — it parses to nothing. describe_log_groups() returned one empty dict per group with a 200 and no error. FilterLogEvents was already correct because it declared its own response element instead of reusing the state struct; the other three now do the same. DescribeLogGroups reports both documented ARN forms (logGroupArn without the trailing :*, arn with it) rather than one value under two names.

Added

• CloudWatch Logs PutRetentionPolicy / DeleteRetentionPolicy (#528), which returned InvalidAction while RetentionInDays was already modeled and settable

... (truncated)

Changelog

Sourced from github.com/scttfrdmn/substrate's changelog.

[v0.88.0] - 2026-08-03

Added

• ListExports and ListImports (#522), which were InvalidAction before there was anything to list. ListExports reports every export in the caller's account and Region with the ExportingStackId ARN DescribeStacks reports for the same stack, in one page with no NextToken; ListImports reports stack names, and an export nothing imports — including one that does not exist — is an empty list rather than an error, since the reference documents no service-specific errors for it. DescribeStacks additionally reports each output's ExportName beside it, saving a caller a second call to learn whether an output is importable.

• CloudWatch Logs PutRetentionPolicy and DeleteRetentionPolicy (#528), which returned InvalidAction while RetentionInDays was already modeled, settable through CloudFormation, and reported by DescribeLogGroups — so a retention a template set could be read but never changed. retentionInDays accepts only the 22 values the reference enumerates (1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653); anything else, including a plausible-looking 45 or 100, is an InvalidParameterException, since accepting one would let a template pass under test that the real service rejects. The error message lists the valid values in ascending order so an assertion on it is stable. Delete ships with Put because it is the documented way to make a group's events never expire — there is no retentionInDays value meaning "never", so a group with no policy omits the member rather than reporting 0. Both report ResourceNotFoundException at HTTP 400, as their references document: this service carries the error code in the body's __type, not the status line.

Fixed

• CloudWatch Logs read operations put camelCase members on the wire, so an SDK no longer parses every field to null (#528). DescribeLogGroups, DescribeLogStreams and GetLogEvents emitted PascalCase members where this JSON-1.1 service uses camelCase. An SDK matches response members against the service model case-sensitively, so a PascalCase member does not fail to parse — it parses to nothing. The caller received one empty object per resource with an HTTP 200 and no error: the count was right and every field read raised KeyError, which is why a len() assertion passed. Reported against v0.87.1/botocore 1.42.59 with a reproducer using a directly created group, so this was never CloudFormation-specific.

  FilterLogEvents was already correct, and that is what made the defect easy to miss — a smoke test using it passes — because it alone declared its own response element type instead of reusing the state struct. That is the pattern the fix copies: each read now projects CWLogGroup/CWLogStream/CWLogEvent onto a response-only type. Retagging the state structs would have been the shorter edit and the wrong one: those structs are also the persisted encoding that Snapshot/Restore round-trips and betty_debug replays, and LambdaPlugin.autoCreateLambdaLogGroup writes one directly to dodge a registry cycle, so a retag would have changed the wire and the on-disk format together. A v0.87 snapshot still restores unchanged.

... (truncated)

Commits

• 59ab3df chore(release): v0.88.0 (#539)
• 7c6b317 fix(logs): put camelCase member names on the wire for the read operations (#5...
• a1a92a3 fix(cfn): resolve Fn::ImportValue against a cross-stack export registry (#522...
• 79ba8c6 chore(cfn): classify StackDeployer failures with sentinels, not substrings (#...
• ef9550f fix(cfn): read Mappings and resolve FindInMap, GetAZs, Cidr and the pseudo-pa...
• 0532f94 fix(cfn): resolve intrinsics at any depth, and map ECS member names (#526, #5...
• 13411aa fix(cfn): Fn::Split resolves to a list, not its first element (#521) (#531)
• 7a76ced chore(release): v0.87.1 (#525)
• 3ae048a fix(cloudformation): deploy a stack into the calling account and region (#517...
• f0d7d2a fix(cloudformation): expand YAML short-form intrinsics, report a refused reso...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!