chore(deps): bump the frequent group across 1 directory with 4 updates - #7322

rudder-go-kit is pinned to the commit from rudderlabs/rudder-go-kit#1205,
which requires Go 1.27.1, so the go directive, both Dockerfiles and
golangci-lint (v2.13.2) move up with it and `go fix` applies the Go 1.27
modernizers. Also folds in the open dependabot PRs: go modules (#7344,
#7322, #7338, #7336, #7335) and actions (#7289, #7288, #7287, #7286, #7285).

The new linter surfaced a missing call on a deferred crash.Notify in the
user transformer, so panics in its batch goroutines went unreported.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

rudder-go-kit is pinned to the commit from rudderlabs/rudder-go-kit#1205,
which requires Go 1.27.1, so the go directive, both Dockerfiles and
golangci-lint (v2.13.2) move up with it and `go fix` applies the Go 1.27
modernizers. Also folds in the open dependabot PRs: go modules (#7344,
#7322, #7338, #7336, #7335) and actions (#7289, #7288, #7287, #7286, #7285).

The new linter surfaced a missing call on a deferred crash.Notify in the
user transformer, so panics in its batch goroutines went unreported.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

rudder-go-kit is pinned to the commit from rudderlabs/rudder-go-kit#1205,
which requires Go 1.27.1, so the go directive, both Dockerfiles and
golangci-lint (v2.13.2) move up with it and `go fix` applies the Go 1.27
modernizers. Also folds in the open dependabot PRs: go modules (#7344,
#7322, #7338, #7336, #7335) and actions (#7289, #7288, #7287, #7286, #7285).

The new linter surfaced a missing call on a deferred crash.Notify in the
user transformer, so panics in its batch goroutines went unreported.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

rudder-go-kit is pinned to the commit from rudderlabs/rudder-go-kit#1205,
which requires Go 1.27.1, so the go directive, both Dockerfiles and
golangci-lint (v2.13.2) move up with it and `go fix` applies the Go 1.27
modernizers. Also folds in the open dependabot PRs: go modules (#7344,
#7322, #7338, #7336, #7335) and actions (#7289, #7288, #7287, #7286, #7285).

The new linter surfaced a missing call on a deferred crash.Notify in the
user transformer, so panics in its batch goroutines went unreported.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

rudder-go-kit is pinned to the commit from rudderlabs/rudder-go-kit#1205,
which requires Go 1.27.1, so the go directive, both Dockerfiles and
golangci-lint (v2.13.2) move up with it and `go fix` applies the Go 1.27
modernizers. Also folds in the open dependabot PRs: go modules (#7344,
#7322, #7338, #7336, #7335) and actions (#7289, #7288, #7287, #7286, #7285).

The new linter surfaced a missing call on a deferred crash.Notify in the
user transformer, so panics in its batch goroutines went unreported.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

rudder-go-kit is pinned to the commit from rudderlabs/rudder-go-kit#1205,
which requires Go 1.27.1, so the go directive, both Dockerfiles and
golangci-lint (v2.13.2) move up with it and `go fix` applies the Go 1.27
modernizers. Also folds in the open dependabot PRs: go modules (#7344,
#7322, #7338, #7336, #7335) and actions (#7289, #7288, #7287, #7286, #7285).

The new linter surfaced a missing call on a deferred crash.Notify in the
user transformer, so panics in its batch goroutines went unreported.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

rudder-go-kit is pinned to the commit from rudderlabs/rudder-go-kit#1205,
which requires Go 1.27.1, so the go directive, both Dockerfiles and
golangci-lint (v2.13.2) move up with it and `go fix` applies the Go 1.27
modernizers. Also folds in the open dependabot PRs: go modules (#7344,
#7322, #7338, #7336, #7335) and actions (#7289, #7288, #7287, #7286, #7285).

The new linter surfaced a missing call on a deferred crash.Notify in the
user transformer, so panics in its batch goroutines went unreported.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

rudder-go-kit moves to v0.79.0, which requires Go 1.27.1, so the go
directive, both Dockerfiles and golangci-lint (v2.13.2) move up with it and
`go fix` applies the Go 1.27 modernizers. Also folds in the open dependabot
PRs: go modules (#7344, #7322, #7338, #7336, #7335) and actions (#7289,
#7288, #7287, #7286, #7285).

The new linter surfaced a missing call on a deferred crash.Notify in the
user transformer, so panics in its batch goroutines went unreported.

Three tests pinned values that these bumps legitimately move: two compared
gzip output, which go1.27 re-encodes via compress/flate, and one relied on
minio-go rejecting a scheme-qualified endpoint, which v7.3.0 accepts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

rudder-go-kit moves to v0.79.0, which requires Go 1.27.1, so the go
directive, both Dockerfiles and golangci-lint (v2.13.2) move up with it and
`go fix` applies the Go 1.27 modernizers. Also folds in the open dependabot
PRs: go modules (#7344, #7322, #7338, #7336, #7335) and actions (#7289,
#7288, #7287, #7286, #7285).

The new linter surfaced a missing call on a deferred crash.Notify in the
user transformer, so panics in its batch goroutines went unreported.

Three tests pinned values that these bumps legitimately move: two compared
gzip output, which go1.27 re-encodes via compress/flate, and one relied on
minio-go rejecting a scheme-qualified endpoint, which v7.3.0 accepts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

rudder-go-kit moves to v0.79.0, which requires Go 1.27.1, so the go
directive, both Dockerfiles and golangci-lint (v2.13.2) move up with it and
`go fix` applies the Go 1.27 modernizers. Also folds in the open dependabot
PRs: go modules (#7344, #7322, #7338, #7336, #7335) and actions (#7289,
#7288, #7287, #7286, #7285).

The new linter surfaced a missing call on a deferred crash.Notify in the
user transformer, so panics in its batch goroutines went unreported.

Three tests pinned values that these bumps legitimately move: two compared
gzip output, which go1.27 re-encodes via compress/flate, and one relied on
minio-go rejecting a scheme-qualified endpoint, which v7.3.0 accepts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

rudder-go-kit moves to v0.79.0, which requires Go 1.27.1, so the go
directive, both Dockerfiles and golangci-lint (v2.13.2) move up with it and
`go fix` applies the Go 1.27 modernizers. Also folds in the open dependabot
PRs: go modules (#7344, #7322, #7338, #7336, #7335) and actions (#7289,
#7288, #7287, #7286, #7285).

The new linter surfaced a missing call on a deferred crash.Notify in the
user transformer, so panics in its batch goroutines went unreported.

Three tests pinned values that these bumps legitimately move: two compared
gzip output, which go1.27 re-encodes via compress/flate, and one relied on
minio-go rejecting a scheme-qualified endpoint, which v7.3.0 accepts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

rudder-go-kit moves to v0.79.0, which requires Go 1.27.1, so the go
directive, both Dockerfiles and golangci-lint (v2.13.2) move up with it and
`go fix` applies the Go 1.27 modernizers. Also folds in the open dependabot
PRs: go modules (#7344, #7322, #7338, #7336, #7335) and actions (#7289,
#7288, #7287, #7286, #7285).

The new linter surfaced a missing call on a deferred crash.Notify in the
user transformer, so panics in its batch goroutines went unreported.

Three tests pinned values that these bumps legitimately move: two compared
gzip output, which go1.27 re-encodes via compress/flate, and one relied on
minio-go rejecting a scheme-qualified endpoint, which v7.3.0 accepts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

rudder-go-kit moves to v0.79.0, which requires Go 1.27.1, so the go
directive, both Dockerfiles and golangci-lint (v2.13.2) move up with it and
`go fix` applies the Go 1.27 modernizers. Also folds in the open dependabot
PRs: go modules (#7344, #7322, #7338, #7336, #7335) and actions (#7289,
#7288, #7287, #7286, #7285).

The new linter surfaced a missing call on a deferred crash.Notify in the
user transformer, so panics in its batch goroutines went unreported.

Three tests pinned values that these bumps legitimately move: two compared
gzip output, which go1.27 re-encodes via compress/flate, and one relied on
minio-go rejecting a scheme-qualified endpoint, which v7.3.0 accepts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

# Description

Supersedes #7344, #7322, #7338, #7336, #7335, #7289, #7288, #7287,
#7286, #7285.

Bumps `rudder-go-kit` to v0.79.0, which ships
rudderlabs/rudder-go-kit#1205 and requires Go 1.27.1, and folds in every
open dependabot PR on top of it.

## Go

| | From | To |
| --- | --- | --- |
| toolchain | 1.26.6 | 1.27.1 |

Go 1.27's modernizers, applied by `go fix ./...`:

- **embedlit** — embedded-struct literals collapsed to promoted fields.
- **atomictypes** — `atomic.AddInt32(&x, …)` sites became `atomic.Int32`
/ `Uint32` / `Int64` values.
- `errors.As` to `errors.AsType`, `strings.Split(s, sep)[0]` to
`strings.Cut`, reverse loops to `slices.Backward`.

## Docker images

Both Dockerfiles move to `golang:1.27.1-alpine3.24` for the builder
stage and `alpine:3.24` for the runtime stage, with all three digests
re-pinned:

| | From | To |
| --- | --- | --- |
| `GO_VERSION` | 1.26.6 | 1.27.1 |
| `ALPINE_VERSION` | 3.23 | 3.24 |

`ALPINE_VERSION` feeds both `FROM` lines, so `GO_VERSION_SHA256` moves
for the alpine bump as well as the Go one.

## Go modules

| Module | From | To |
| --- | --- | --- |
| `cloud.google.com/go/bigquery` | v1.78.0 | v1.81.0 |
| `cloud.google.com/go/pubsub/v2` | v2.6.1 | v2.6.2 |
| `cloud.google.com/go/storage` | v1.64.0 | v1.65.0 |
| `github.com/apache/pulsar-client-go` | v0.20.0 | v0.21.0 |
| `github.com/aws/aws-sdk-go-v2` | v1.42.1 | v1.43.7 |
| `github.com/aws/aws-sdk-go-v2/service/eventbridge` | v1.47.0 | v1.48.7
|
| `github.com/aws/aws-sdk-go-v2/service/firehose` | v1.45.0 | v1.46.7 |
| `github.com/aws/aws-sdk-go-v2/service/glue` | v1.148.0 | v1.153.1 |
| `github.com/aws/aws-sdk-go-v2/service/kinesis` | v1.45.0 | v1.47.0 |
| `github.com/aws/aws-sdk-go-v2/service/lambda` | v1.96.0 | v1.102.0 |
| `github.com/aws/aws-sdk-go-v2/service/personalizeevents` | v1.33.0 |
v1.34.7 |
| `github.com/aws/aws-sdk-go-v2/service/s3` | v1.105.0 | v1.107.3 |
| `github.com/aws/aws-sdk-go-v2/service/sts` | v1.44.0 | v1.45.7 |
| `github.com/aws/smithy-go` | v1.27.3 | v1.27.8 |
| `github.com/databricks/databricks-sql-go` | v1.13.1 | v1.14.0 |
| `github.com/dgraph-io/badger/v4` | v4.9.4 | v4.9.6 |
| `github.com/duckdb/duckdb-go/v2` | v2.10504.0 | v2.10505.0 |
| `github.com/fsouza/fake-gcs-server` | v1.54.0 | v1.56.1 |
| `github.com/go-chi/chi/v5` | v5.3.1 | v5.3.2 |
| `github.com/grpc-ecosystem/grpc-gateway/v2` | v2.29.0 | v2.30.0 |
| `github.com/klauspost/compress` | v1.19.1 | v1.19.2 |
| `github.com/microsoft/go-mssqldb` | v1.10.0 | v1.11.0 |
| `github.com/minio/minio-go/v7` | v7.2.1 | v7.3.0 |
| `github.com/onsi/ginkgo/v2` | v2.32.0 | v2.32.1 |
| `github.com/onsi/gomega` | v1.40.0 | v1.42.1 |
| `github.com/redis/go-redis/v9` | v9.21.0 | v9.22.0 |
| `github.com/rudderlabs/rudder-go-kit` | v0.78.2 | v0.79.1 |
| `github.com/rudderlabs/rudder-transformer/go` | v1.141.4 | v1.151.0 |
| `github.com/rudderlabs/sqlconnect-go` | v1.30.2 | v1.30.3 |
| `github.com/stretchr/testify` | v1.12.0 | v1.12.1 |
| `go.etcd.io/etcd/api/v3` | v3.7.0 | v3.7.1 |
| `go.etcd.io/etcd/client/v3` | v3.7.0 | v3.7.1 |
| `google.golang.org/api` | v0.287.1 | v0.293.0 |
| `google.golang.org/genproto/googleapis/rpc` | 20260803160001 |
20260807164820 |
| `google.golang.org/grpc` | v1.83.0 | v1.83.1 |
| `google.golang.org/protobuf` | v1.36.12-0.20260120151049 | v1.36.12 |
| `k8s.io/api` | v0.36.2 | v0.36.4 |
| `k8s.io/apimachinery` | v0.36.2 | v0.36.4 |
| `k8s.io/client-go` | v0.36.2 | v0.36.4 |

## GitHub Actions

| Action | From | To | PR |
| --- | --- | --- | --- |
| `actions/checkout` | v7.0.0 | v7.0.1 | #7288 |
| `actions/labeler` | v6.1.0 | v7.0.0 | #7286 |
| `actions/stale` | v10.3.0 | v11.0.0 | #7285 |
| `slackapi/slack-github-action` | v3.0.3 | v4.0.0 | #7289 |
| `step-security/harden-runner` | v2.19.4 | v2.20.1 | #7287 |

## Lint

Bumped golangci-lint to v2.13.2 in `Makefile` and `verify.yml`. The
newer linter reported 16 findings on existing code:

- **1 staticcheck `SA9010`.** Real, and fixed:
`processor/internal/transformer/user_transformer` had `defer
crash.Notify("Core")` without the trailing `()`. `Notify` returns the
handler to defer, so panics in those batch goroutines were never
reported — every other call site in the repo gets this right.
- **10 staticcheck `QF1012`** (capped by `max-same-issues`; 35 sites
across 13 warehouse integrations). Autofixed to `fmt.Fprintf`.
- **1 staticcheck `SA1019`.** `clickhouse-go`'s `Options.Debug` is
deprecated in favour of `Logger`. Excluded by path — migrating the query
debug logs to a structured logger is a behaviour change in a warehouse
integration and does not belong in a dependency bump.
- **4 gosec taint-analysis rules**, all false positives, excluded
alongside the rules already listed in `.golangci.yml`. Two of them
supersede exclusions this repo already carries: `G704` (SSRF) replaces
`G107`, and `G702` (command injection) replaces `G204`. The other two
are `G704` on the backend-config HTTP client wrapper, whose URL is
control-plane configuration, and `G705` (XSS) on an `rsources` handler
that writes a JSON-marshalled body.

## Tests

Three tests pinned values these bumps legitimately move:

- **`TestBatchDelete`** (`regulation-worker/internal/delete/batch`)
byte-compared gzipped golden files; go1.27 changed `compress/flate`, so
the same records re-encode differently. Now compares them after
decompression. Golden files unchanged.
- **`TestAPIIntegration`** (`snowpipestreaming/internal/api`) pinned the
gzipped insert body at 378 bytes; go1.27 produces 375. The compressed
case now asserts `0 < size < 839`; the uncompressed case keeps its exact
839.
- **`TestSlaveJob/upload_load_files/Invalid_endpoint`** relied on
minio-go rejecting `http://localhost:1234`, which v7.3.0 accepts. Now
uses `http://localhost:1234/some/path`, still rejected, so the expected
error is unchanged.

The minio change is worth noting beyond the test: an `endPoint`
configured with a scheme previously failed fast and now connects.

## Security

- [x] The code changed/added as part of this pull request won't create
any security issues with how the software is being used.

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>