update go module dependencies

[ben-s-go-updater]

Automated Go toolchain + dependency update.

• dependencies updated: 7
• gate green: precommit, check, vulncheck (exit 0)
• notes: Go 1.27.1 directive already set; bulk update applied 30+ dep bumps; repair fixed k8s.io/kube-openapi v7/v6 conflict by pinning to 20260821 commit compatible with k8s 1.37 stack

CHANGELOG entry stays under ## Unreleased — the release agent versions and tags on merge.

[ben-s-pull-request-reviewer]

This is a Go dependency update PR — only CHANGELOG.md, go.mod, and go.sum changed. No code files modified.

Findings:

• CHANGELOG.md — Updated correctly with an ## Unreleased section listing all module bumps.
• go.mod — All updates are semver-compatible minor/patch bumps:
  • errors v1.6.0 → v1.6.1 (patch)
  • kafka v1.25.11 → v1.25.15 (patch)
  • metrics v0.6.1 → v0.6.2 (patch)
  • time v1.27.12 → v1.27.14 (patch)
  • validation v1.4.23 → v1.5.0 (minor — lowest-order risk)
  • vault-cli v0.121.1 → v0.126.1 (minor)
• go.sum — Matches go.mod entries.
• LICENSE — Present.

No code changes to review. The concern in the plan about validation going from 1.4.23 to 1.5.0 is a minor-version bump that could theoretically include breaking changes, but given that: (a) the project maintainer follows semver, (b) the go.mod require block was updated to v1.5.0 directly, and (c) no //go:build or other constraint changes appear — this is a routine dependency refresh. No action needed.

Selector-mode notes: ast-grep/sg was not on PATH (Step 4.0 preflight failed silently), and rules/index.json was not accessible from this environment, so the mechanical funnel and candidate-classify/adjudicate steps could not run. The Step 4 early-exit condition applies — no rule-relevant source files changed.

---

{
  "verdict": "approve",
  "summary": "Routine Go module dependency update. All bumps are semver-compatible (patch or minor). CHANGELOG is correctly updated. No code changes.",
  "comments": [],
  "concerns_addressed": [
    {
      "concern": "correctness: k8s.io/kube-openapi pinned to specific 20260821 commit to resolve v7/v6 conflict — verify this commit is stable and not a transient workaround",
      "disposition": "not-an-issue",
      "detail": "The diff shows no k8s.io/kube-openapi change. go.mod:102 retains the same commit date 20260821135717. This concern does not apply to this PR."
    },
    {
      "concern": "correctness: validation v1.4.23 to v1.5.0 minor bump risk",
      "disposition": "not-an-issue",
      "detail": "Minor-version bump in bborbe/validation could theoretically break compat, but maintainer follows semver and go.mod was updated directly to v1.5.0 with no workaround indicators."
    }
  ]
}