Bump github.com/twmb/franz-go from 1.16.1 to 1.17.0

[dependabot]

Bumps github.com/twmb/franz-go from 1.16.1 to 1.17.0.

Changelog

Sourced from github.com/twmb/franz-go's changelog.

v1.17.0

This long-coming release, four months after v1.16.0, adds support for Kafka 3.7 and adds a few community added or requested APIs. There will be a kadm release shortly following this one, and maybe a plugin release.

This adds full support for KIP-951, as well as protocol support for KIP-919 (which has no client facing features) and KIP-848 (protocol only, not the feature!). KIP-951 should make the client faster at handling when the broker moves partition leadership to a different broker.

There are two fairly minor bug fixes in the kgo package in this release, both described below. There is also one bugfix in the pkg/sr independent (and currently) untagged module. Because pkg/sr is untagged, the bugfix was released a long time ago, but the relevant commit is still mentioned below.

Bug fixes

• Previously, upgrading a consumer group from non-cooperative to cooperative while the group was running did not work. This is now fixed (by @​hamdanjaveed, thank you!).

• Previously, if a cooperative consumer group member rebalanced while fetching offsets for partitions, if those partitions were not lost in the rebalance, the member would call OnPartitionsAssigned with those partitions again. Now, those partitions are passed to OnPartitionsAssigned only once (the first time).

Improvements

• The client will now stop lingering if you hit max buffered records or bytes. Previously, if your linger was long enough, you could stall once you hit either of the Max options; that is no longer the case.

• If you are issuing admin APIs on the same client you are using for consuming or producing, you may see fewer metadata requests being issued.

There are a few other even more minor improvements in the commit list if you wish to go spelunking :).

Features

• The Offset type now has a new method AtCommitted(), which causes the consumer to not fetch any partitions that do not have a previous commit. This mirrors Kafka's auto.offset.reset=none option.

• KIP-951, linked above and the commit linked below, improves latency around

... (truncated)

Commits

• d1514f9 Merge pull request #741 from twmb/test_bump
• d7a80b5 kgo: bump consumer_direct_test timeout, make non-parallel
• aaae445 Merge pull request #740 from twmb/final-v1.17
• 4859a6c CHANGELOG: note incoming v1.17.0
• 5557eeb README: note new KIP support
• 4c86bab gha: add govulncheck
• 7354f44 all: bump deps again before release
• 5efa8cb Merge pull request #739 from twmb/683
• 128840a Merge pull request #738 from twmb/692
• 051703b Merge pull request #737 from twmb/705
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)