build(deps): bump within.website/x from 1.30.0 to 1.31.0

[dependabot]

Bumps within.website/x from 1.30.0 to 1.31.0.

Release notes

Sourced from within.website/x's releases.

v1.31.0

1.31.0 (2026-07-12)

Bug Fixes

• kube (af5066f)
• kube: add services lol (523adfe)
• lint-staged: remove unnecessary braces from go glob pattern (29c1e32)
• mi: resolve multiple bugs in cmd/mi (b8d7138)
• within.website: use for go get snippet (1344e4b)
• xess: drop blockquote left border (b4536b9)

Features

• add design.within.website demo site for xess (2331f46)
• kube/alrest: add lurker (57e00fe)
• kube: import base saga cluster config (d145106)
• license: add non-ai licenses (8ae3e94)
• mi/mcp: add event management tools (c0c0ef5)
• mi: add member name alias support to switch tracker (#863) (d3f7e04)
• mi: add Zoe as nickname for W'zamqo (585f90f)
• mimi: remove falin image generation service (a3a3e35)
• sigv4: add AWS SigV4 request authentication and IAM daemon (#957) (d2f2e00)
• skills: xe-go-style skill added (c79a11b)
• web: add alpine.js package (c0d23b4)
• xess: adopt xe-design-system tokens and add button/card/tag components (1c62860)

BREAKING CHANGES

• sigv4: iamsts.NewVerifier is replaced by iamsts.New(Config); iamsts.Identity now carries TokenIdentity fields (PrincipalID) instead of an iamv1.User.

Signed-off-by: Xe Iaso me@xeiaso.net

• test(iamd): cover the signing-key local-verification chain end to end

Signed-off-by: Xe Iaso me@xeiaso.net

• refactor(iam)!: delete the per-request STS verification flow

Removes STSService/GetCallerIdentity (proto, generated stubs, iamd handler, and sigv4.VerifySignature) now that downstream services verify locally with cached derived signing keys.

The deleted double-slash-path test guarded VerifySignature's synthetic request construction, which is removed with it; the local path reads

... (truncated)

Changelog

Sourced from within.website/x's changelog.

1.31.0 (2026-07-12)

Bug Fixes

• kube (af5066f)
• kube: add services lol (523adfe)
• lint-staged: remove unnecessary braces from go glob pattern (29c1e32)
• mi: resolve multiple bugs in cmd/mi (b8d7138)
• within.website: use for go get snippet (1344e4b)
• xess: drop blockquote left border (b4536b9)

Features

• add design.within.website demo site for xess (2331f46)
• kube/alrest: add lurker (57e00fe)
• kube: import base saga cluster config (d145106)
• license: add non-ai licenses (8ae3e94)
• mi/mcp: add event management tools (c0c0ef5)
• mi: add member name alias support to switch tracker (#863) (d3f7e04)
• mi: add Zoe as nickname for W'zamqo (585f90f)
• mimi: remove falin image generation service (a3a3e35)
• sigv4: add AWS SigV4 request authentication and IAM daemon (#957) (d2f2e00)
• skills: xe-go-style skill added (c79a11b)
• web: add alpine.js package (c0d23b4)
• xess: adopt xe-design-system tokens and add button/card/tag components (1c62860)

BREAKING CHANGES

• sigv4: iamsts.NewVerifier is replaced by iamsts.New(Config); iamsts.Identity now carries TokenIdentity fields (PrincipalID) instead of an iamv1.User.

Signed-off-by: Xe Iaso me@xeiaso.net

• test(iamd): cover the signing-key local-verification chain end to end

Signed-off-by: Xe Iaso me@xeiaso.net

• refactor(iam)!: delete the per-request STS verification flow

Removes STSService/GetCallerIdentity (proto, generated stubs, iamd handler, and sigv4.VerifySignature) now that downstream services verify locally with cached derived signing keys.

The deleted double-slash-path test guarded VerifySignature's synthetic request construction, which is removed with it; the local path reads r.URL from net/http's own parser.

• sigv4: the STSService Twirp/gRPC/Connect APIs no longer exist; downstream verifiers must upgrade to iamsts.New + SigningKeyService.

... (truncated)

Commits

• e254e54 chore(release): 1.31.0 [skip ci]
• 5a88a1c ci(release): set up qemu and buildx for multi-platform builds
• d2f2e00 feat(sigv4): add AWS SigV4 request authentication and IAM daemon (#957)
• 9f0973f build(deps): bump golang.org/x/image from 0.38.0 to 0.41.0 (#958)
• 88d9c0d build(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 (#956)
• ef2c58f build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 (#966)
• bee17fa build(deps-dev): bump @​semantic-release/github from 12.0.8 to 12.0.9 (#965)
• f3e3f98 build(deps-dev): bump prettier from 3.9.1 to 3.9.4 (#963)
• 9859a9a build(deps-dev): bump @​commitlint/cli from 21.1.0 to 21.2.0 (#962)
• 7b786ef build(deps-dev): bump @​commitlint/config-conventional (#964)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

🎉 This PR is included in version 4.12.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀