chore(deps): bump github.com/twmb/franz-go from 1.21.6 to 1.22.0

[dependabot]

Bumps github.com/twmb/franz-go from 1.21.6 to 1.22.0.

Changelog

Sourced from github.com/twmb/franz-go's changelog.

v1.22.0

This release supports Kafka 4.3 and 4.4, has a few new APIs, and has a few big internal improvements. In particular, I recommend checking out the new StreamingCompression option, as well as evaluating if you'd like to use RackAwarePartitioning. There are some behavior changes that you should read about below. The "next gen" rebalancer is now usable via the new ServerSideBalancer option. It's had a few releases to shake out bugs internally (via integration tests and LLM audits), but if you do experience a bug, please open an issue straightaway.

Some minor bug fixes (that were never reported) were found during the implementation that are not worth mentioning.

kfake has also been significantly extended and I recommend checking out the new APIs, in particular:

• A new Fault type to make it easier to inject errors without Control functions
• Group introspection cluster APIs
• BlackholeProduce and SyntheticFetch APIs for benchmarking / play testing

My kcl CLI has been significantly expanded as well and is worth checking out. It supports essentially everything you can do with a cluster, and now allows you to run a full broker locally via kcl fake (in memory or a dumb disk backed localhost broker) - as well as setup the fake broker with fault injection. I've been running LLM audits and extensions to kcl in particular to try to shape it up to a "finalized" CLI shape. If you use it and have ideas for improvements, please open an issue.

Behavior changes

• Rack aware group partition assignment (KIP-881) now requires BalanceRacks. v1.21.0 enabled group balancers to assign partitions based on the rack that members were in if you used the range or sticky/cooperative-sticky balancers. Well, Rack is also used to opt into preferred read replica assignment when fetching by the broker itself. These two decisions conflict with each other. Now, BalanceRacks() is required to opt into group balancers using the rack while balancing. The client warns when balancing if BalanceRacks is on and the brokers have preferred read replicas enabled.

• ConsumeResetOffset defaults to RewindOffset(time.Minute) rather than NewOffset().AtStart(). Setting only ConsumeStartOffset no longer sets ConsumeResetOffset. I introduced ConsumeStartOffset a while back because it was really weird IMO to use a reset offset for both how a consumer starts and for how it recovers in the event of data loss or falling behind. They were bidirectional since introduction, but since start is newer and much less commonly used and you often don't want to recover from the start, I've removed the start -> reset mapping when you only set the start. I recommend reading the docs on both options for an updated understanding of when and how they apply. As well, I've introduced RewindOffset(d) which is only

... (truncated)

Commits

• 01f206a Merge pull request #1465 from twmb/cl
• 591da46 README: one KIP table separator, note KIP-848 in the feature list
• 5229a17 cl: note v1.22.0
• 02987d8 Merge pull request #1464 from twmb/decompress-rename
• 33656c4 kgo: rename MaxDecompressedBatchBytes to MaxDecompressBatchBytes
• ceb84a6 Merge pull request #1463 from twmb/decompress-bound
• 5c3b3d0 kgo: fix the merge sweep test to observe the merge
• 0a56a56 kgo: write the zstd frame checksum again
• f20ad4c kgo: default MaxDecompressedBatchBytes to 1 GiB, drop the merge constant
• 3724804 Merge pull request #1462 from twmb/kversion-features
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 1d1bbbbe-480f-4cbd-8f96-b4fdb4a95dab

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​twmb/​franz-go@​v1.21.6 ⏵ v1.22.0	+4
	github.com/​twmb/​franz-go/​pkg/​kmsg@​v1.13.1 ⏵ v1.14.0	+1

View full report

[lerian-studio]

🔒 Security Scan Results — lib-streaming

✅ PR Mergeable — no blocking findings

Stage	Status	Blocking?
Filesystem Scan	✅ Clean	—
Docker Image Scan	➖ Skipped	—
Docker Hub Health Score	➖ Skipped	—
Pre-release Version Check	✅ Clean	—

Trivy

Filesystem Scan

✅ No vulnerabilities or secrets found.

---

Pre-release Version Check

✅ No unstable version pins found.

---

_{🔍 View full scan logs}

[github-actions]

🔍 PR Validation Summary

🚫 PR Blocked — 2 blocking failures

Check	Status	Blocking
Source Branch	❌ failure	yes
PR Title	✅ success	yes
PR Description	✅ success	yes
Breaking Change Guard	✅ success	yes
Blocking Checks Runtime	❌ failure	yes
Commit Signatures	✅ success	yes
PR Size	⏭️ skipped	no
Auto Labels	⏭️ skipped	no
PR Metadata	⏭️ skipped	no

Fix the blocking checks above before merge.

---

_{🔍 View workflow run}

[lerian-studio]

📊 Unit Test Coverage Report: app

Metric	Value
Overall Coverage	86.8% ✅ PASS
Threshold	80%

Coverage by Package

Package	Coverage
github.com/LerianStudio/lib-streaming/v4/billing	97.3%
github.com/LerianStudio/lib-streaming/v4/internal/cloudevents	93.7%
github.com/LerianStudio/lib-streaming/v4/internal/config	86.8%
github.com/LerianStudio/lib-streaming/v4/internal/consumer	92.3%
github.com/LerianStudio/lib-streaming/v4/internal/contract	85.0%
github.com/LerianStudio/lib-streaming/v4/internal/dlqheader	40.0%
github.com/LerianStudio/lib-streaming/v4/internal/emitter	100.0%
github.com/LerianStudio/lib-streaming/v4/internal/kafkasec	84.9%
github.com/LerianStudio/lib-streaming/v4/internal/manifest	84.0%
github.com/LerianStudio/lib-streaming/v4/internal/producer	89.1%
github.com/LerianStudio/lib-streaming/v4/internal/transport/eventbridge	87.3%
github.com/LerianStudio/lib-streaming/v4/internal/transport/kafka	56.4%
github.com/LerianStudio/lib-streaming/v4/internal/transport/rabbitmq	93.2%
github.com/LerianStudio/lib-streaming/v4/internal/transport/sqs	84.4%
github.com/LerianStudio/lib-streaming/v4/internal/transport	96.7%
github.com/LerianStudio/lib-streaming/v4/streamingtest	90.7%
github.com/LerianStudio/lib-streaming/v4	86.2%

---

Generated by Go PR Analysis workflow

[github-actions]

⚠️ Invalid Source Branch

Pull requests to main can only come from:

• develop
• release-candidate
• hotfix/*

Your source branch: dependabot/go_modules/develop/github.com/twmb/franz-go-1.22.0

Please change the base branch or create a PR from an allowed branch.