fix(deps): update module cloud.google.com/go/storage to v1.62.1 (main)

[renovate-sh-app]

This PR contains the following updates:

Package	Change	Age	Confidence
cloud.google.com/go/storage	v1.61.3 → v1.62.1

---

Release Notes

googleapis/google-cloud-go (cloud.google.com/go/storage)

v1.62.1

v1.62.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

---

Note

Medium Risk
Updates vendored Google Cloud Storage/IAM clients and adjusts retry/streaming behavior in both gRPC and HTTP paths, which could subtly change object I/O and error handling. Risk is moderate because changes are dependency-driven but touch upload/download, retries, and request metadata injection.

Overview
Updates cloud.google.com/go/storage to v1.62.1 (and related transitive deps like cloud.google.com/go/iam, google.golang.org/genproto/googleapis/api, and otel stdout metric exporter), refreshing the vendored GCS and IAM client code.

The vendored Storage client changes include new parallel upload documentation/behavior updates, improved retry handling (including retries for HTTP2 connection loss and safer response-body cleanup on read retries), and more structured request/feature tracking metadata (adding operation/bucket/object attributes to run() calls and injecting a feature-tracker header for gRPC).

It also refactors gRPC upload stream handling to split send/recv loops and centralize final error selection (pickStreamError), and updates retry hooks to accept an optional retry context.

^{Reviewed by Cursor Bugbot for commit ffdf568. Bugbot is set up for automated code reviews on this repo. Configure here.}

[renovate-sh-app]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Details:

Package	Change
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric	v1.42.0 -> v1.43.0
cloud.google.com/go/iam	v1.5.3 -> v1.7.0
google.golang.org/genproto/googleapis/api	v0.0.0-20260319201613-d00831a3d3e7 -> v0.0.0-20260401024825-9d38bb4040a9

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Double close of response body in parseReadResponse
  • When handling zero-length reads, parseReadResponse now reassigns res.Body to emptyBody immediately after the explicit close so deferred error cleanup cannot close the original body twice.

Or push these changes by commenting:

@cursor push 378c7f9da1

Preview (378c7f9da1)

diff --git a/vendor/cloud.google.com/go/storage/http_client.go b/vendor/cloud.google.com/go/storage/http_client.go
--- a/vendor/cloud.google.com/go/storage/http_client.go
+++ b/vendor/cloud.google.com/go/storage/http_client.go
@@ -1600,6 +1600,7 @@
 	if params.length == 0 {
 		remain = 0
 		body.Close()
+		res.Body = emptyBody
 		body = emptyBody
 	}
 	var metaGen int64

_{You can send follow-ups to the cloud agent here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: pickStreamError doesn't clear sendErr io.EOF like old code
  • Updated pickStreamError to return nil when sendErr is io.EOF so successful stream completion no longer surfaces a spurious EOF error.

Or push these changes by commenting:

@cursor push 495b1bdf67

Preview (495b1bdf67)

diff --git a/vendor/cloud.google.com/go/storage/grpc_writer.go b/vendor/cloud.google.com/go/storage/grpc_writer.go
--- a/vendor/cloud.google.com/go/storage/grpc_writer.go
+++ b/vendor/cloud.google.com/go/storage/grpc_writer.go
@@ -1630,5 +1630,8 @@
 	if recvErr != nil && recvErr != io.EOF {
 		return recvErr
 	}
+	if sendErr == io.EOF {
+		return nil
+	}
 	return sendErr
 }

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit acc4a07. Configure here.}

[cursor]

pickStreamError doesn't clear sendErr io.EOF like old code

Low Severity

pickStreamError only filters io.EOF from recvErr but not from sendErr. The old inline logic for the resumable and append senders cleared any io.EOF result via if s.streamErr == io.EOF { s.streamErr = nil }. Now, when recvErr is io.EOF (successful completion) and sendErr is also io.EOF (send failed because server already closed stream), the function returns io.EOF instead of nil, potentially surfacing a spurious error for what was a successful stream.

Additional Locations (2)

• vendor/cloud.google.com/go/storage/grpc_writer.go#L1236-L1237
• vendor/cloud.google.com/go/storage/grpc_writer.go#L1358-L1359

 

^{Reviewed by Cursor Bugbot for commit acc4a07. Configure here.}

[Segflow]

Approving: clean dep version bump (cloud.google.com/go/storage → v1.62.1). Changes limited to go.mod, go.sum, and vendor/. All CI checks pass.