build(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.22 to 1.19.23#479
Conversation
Bumps [github.com/aws/aws-sdk-go-v2/credentials](https://github.com/aws/aws-sdk-go-v2) from 1.19.22 to 1.19.23. - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@credentials/v1.19.22...credentials/v1.19.23) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/credentials dependency-version: 1.19.23 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
📝 WalkthroughWalkthroughAWS SDK Go v2 is upgraded from v1.41.12 to v1.42.0. A new conditional retry strategy mode ( ChangesAWS SDK v2 2026 Retry Mode and Long-Polling Implementation
🎯 3 (Moderate) | ⏱️ ~20 minutes Suggested reviewers
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
⚔️ Resolve merge conflicts
Comment |
|
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@vendor/github.com/aws/aws-sdk-go-v2/service/sts/go_module_metadata.go`:
- Line 6: The vendored constant goModuleVersion in go_module_metadata.go is set
to "1.43.3" but upstream has no v1.43.3 release; confirm whether the Dependabot
bump intended to update the vendor to an actual upstream tag or if the metadata
should instead reflect the last real release (e.g., "1.43.2"). If the intended
change was a metadata correction, update the const goModuleVersion in
go_module_metadata.go to the valid upstream release string; if the intention was
to upgrade, update the vendor files so they match an existing upstream tag and
set goModuleVersion to that tag.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 7a3ca6a8-627e-438b-85f4-888092b83349
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (29)
go.modvendor/github.com/aws/aws-sdk-go-v2/aws/go_module_metadata.govendor/github.com/aws/aws-sdk-go-v2/aws/retry/jitter_backoff.govendor/github.com/aws/aws-sdk-go-v2/aws/retry/middleware.govendor/github.com/aws/aws-sdk-go-v2/aws/retry/retry.govendor/github.com/aws/aws-sdk-go-v2/aws/retry/standard.govendor/github.com/aws/aws-sdk-go-v2/credentials/CHANGELOG.mdvendor/github.com/aws/aws-sdk-go-v2/credentials/go_module_metadata.govendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/CHANGELOG.mdvendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/go_module_metadata.govendor/github.com/aws/aws-sdk-go-v2/internal/configsources/CHANGELOG.mdvendor/github.com/aws/aws-sdk-go-v2/internal/configsources/go_module_metadata.govendor/github.com/aws/aws-sdk-go-v2/internal/context/context.govendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/CHANGELOG.mdvendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/go_module_metadata.govendor/github.com/aws/aws-sdk-go-v2/internal/v4a/CHANGELOG.mdvendor/github.com/aws/aws-sdk-go-v2/internal/v4a/go_module_metadata.govendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/CHANGELOG.mdvendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/go_module_metadata.govendor/github.com/aws/aws-sdk-go-v2/service/signin/CHANGELOG.mdvendor/github.com/aws/aws-sdk-go-v2/service/signin/go_module_metadata.govendor/github.com/aws/aws-sdk-go-v2/service/sso/CHANGELOG.mdvendor/github.com/aws/aws-sdk-go-v2/service/sso/go_module_metadata.govendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/CHANGELOG.mdvendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/go_module_metadata.govendor/github.com/aws/aws-sdk-go-v2/service/sts/CHANGELOG.mdvendor/github.com/aws/aws-sdk-go-v2/service/sts/api_client.govendor/github.com/aws/aws-sdk-go-v2/service/sts/go_module_metadata.govendor/modules.txt
|
|
||
| // goModuleVersion is the tagged release for this module | ||
| const goModuleVersion = "1.43.2" | ||
| const goModuleVersion = "1.43.3" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify the STS module version and check for security advisories.
# Check if version v1.43.3 exists for the STS module
echo "Checking if version v1.43.3 exists..."
git ls-remote --tags https://github.com/aws/aws-sdk-go-v2.git | grep -E 'service/sts/v1\.43\.3$'
# Check Go module proxy for the version
echo -e "\nChecking Go module proxy..."
curl -s "https://proxy.golang.org/github.com/aws/aws-sdk-go-v2/service/sts/@v/v1.43.3.info" | jq '.'
# Check for security advisories
echo -e "\nChecking for security advisories..."
gh api graphql -f query='
{
securityVulnerabilities(first: 5, ecosystem: GO, package: "github.com/aws/aws-sdk-go-v2/service/sts") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'Repository: kubeservice-stack/modelx
Length of output: 1941
🏁 Script executed:
#!/bin/bash
set -euo pipefail
VERSION="1.43.3"
MODULE="github.com/aws/aws-sdk-go-v2/service/sts"
TAG="service/sts/v${VERSION}"
echo "== Go module proxy: ${MODULE} @ v${VERSION} =="
curl -fsSL "https://proxy.golang.org/${MODULE}/@v/v${VERSION}.info" | cat
echo
echo "== Upstream Git tag/ref existence: aws/aws-sdk-go-v2 @ ${TAG} =="
curl -fsSL "https://api.github.com/repos/aws/aws-sdk-go-v2/git/ref/tags/${TAG}" | jq '{ref,object:{sha}}'
echo
echo "== Vulnerabilities (OSV) for ${MODULE} @ ${VERSION} =="
curl -fsSL https://api.osv.dev/v1/query -H 'content-type: application/json' \
-d "{\"package\":{\"name\":\"${MODULE}\"},\"version\":\"${VERSION}\"}" | jq '.'Repository: kubeservice-stack/modelx
Length of output: 1960
🌐 Web query:
Go module proxy github.com/aws/aws-sdk-go-v2/service/sts v1.43.3.info
💡 Result:
The URL https://proxy.golang.org/github.com/aws/aws-sdk-go-v2/service/sts/@v/v1.43.3.info points to a Go module proxy endpoint that provides JSON-formatted metadata for version v1.43.3 of the github.com/aws/aws-sdk-go-v2/service/sts module [1][2]. Under the Go module proxy protocol, the .info endpoint returns metadata such as the canonical version string, the time the version was created, and, if applicable, the name of the original revision [1][3]. As of June 9, 2026, version v1.43.3 is not listed in the standard version history for this module [4][5][6]; the latest versions shown in official records are v1.43.2 (published June 4, 2026) and v1.43.1 (published June 3, 2026) [4][6]. If the requested version v1.43.3 does not exist, the proxy will return a 404 Not Found or 410 Gone error [1][7]. To verify the availability or metadata of a specific version, you can perform a GET request to that URL using a tool like curl or a web browser, or query the module via the Go CLI [8][1].
Citations:
- 1: https://pkg.go.dev/github.com/golang-design/under-the-hood/gosrc/cmd/go/internal/modfetch
- 2: https://proxy.golang.org/
- 3: cmd/go: module proxy protocol, extending the information endpoint golang/go#41902
- 4: https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/sts
- 5: https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/sts@v1.41.9
- 6: https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/sts@v1.23.1
- 7: https://go.dev/ref/mod
- 8: https://pkg.go.dev/cmd/go/internal/modfetch
🌐 Web query:
OSV vulnerabilities github.com/aws/aws-sdk-go-v2/service/sts v1.43.3
💡 Result:
As of June 9, 2026, there are no known security vulnerabilities associated with github.com/aws/aws-sdk-go-v2/service/sts version v1.43.3. While the AWS SDK for Go v2 has had documented security advisories in the past—such as GHSA-xmrv-pmrh-hhx2, which involved a Denial of Service vulnerability in the EventStream decoder [1][2]—these issues were addressed in earlier versions of the affected components [2][3]. Publicly available vulnerability databases and security advisories from the official aws/aws-sdk-go-v2 repository do not list any critical, high, or medium vulnerabilities for version v1.43.3 of the STS service module [4][5][6]. You can continue to monitor the official GitHub security advisories page for the AWS SDK for Go v2 to stay informed about future security disclosures: https://github.com/aws/aws-sdk-go-v2/security/advisories [7][2].
Citations:
- 1: https://test.osv.dev/vulnerability/GHSA-xmrv-pmrh-hhx2
- 2: GHSA-xmrv-pmrh-hhx2
- 3: https://scout.docker.com/vulnerabilities/id/GHSA-xmrv-pmrh-hhx2?n=eventstream&ns=github.com%2Faws%2Faws-sdk-go-v2%2Faws%2Fprotocol&s=github&t=golang&vr=%3C1.7.8
- 4: https://guide.sonatype.com/component/golang/github.com%2Faws%2Faws-sdk-go-v2%2Fservice%2Fsts/v1.42.1
- 5: https://guide.sonatype.com/component/golang/github.com%2Faws%2Faws-sdk-go-v2%2Fservice%2Fsts/v1.42.2
- 6: https://guide.sonatype.com/component/golang/github.com%2Faws%2Faws-sdk-go-v2%2Fservice%2Fsts/v1.42.0
- 7: GHSA-3jcv-796g-cpjg
🌐 Web query:
aws-sdk-go-v2 tag service/sts/v1.43.3
💡 Result:
As of June 9, 2026, the specific version "v1.43.3" for the github.com/aws/aws-sdk-go-v2/service/sts module has not been released [1]. The latest available version of the service/sts module in the AWS SDK for Go v2 as of this date is v1.43.2, which was published on June 4, 2026 [1]. The version v1.43.0 was released on June 2, 2026 [1][2]. The AWS SDK for Go v2 uses a modular versioning system where individual service packages (like service/sts) are tagged and versioned independently [1]. You can track the release history and latest tags for this specific module via its Go package registry page or the main repository's release history [1][3].
Citations:
- 1: https://pkg.go.dev/github.com/aws/aws-sdk-go-v2/service/sts
- 2: https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-06-02
- 3: https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-06-04
STS module metadata: goModuleVersion set to 1.43.3, but upstream appears to have no such release
In vendor/github.com/aws/aws-sdk-go-v2/service/sts/go_module_metadata.go (line 6: const goModuleVersion = "1.43.3"), public module/version records indicate v1.43.3 for github.com/aws/aws-sdk-go-v2/service/sts has not been released (latest shown is v1.43.2). That means this vendored metadata value likely doesn’t match an upstream tag—please confirm the intended Dependabot version update (and adjust to an existing release if needed). Vulnerability lookups for v1.43.3 don’t show known issues, but the primary concern is the apparent version mismatch.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@vendor/github.com/aws/aws-sdk-go-v2/service/sts/go_module_metadata.go` at
line 6, The vendored constant goModuleVersion in go_module_metadata.go is set to
"1.43.3" but upstream has no v1.43.3 release; confirm whether the Dependabot
bump intended to update the vendor to an actual upstream tag or if the metadata
should instead reflect the last real release (e.g., "1.43.2"). If the intended
change was a metadata correction, update the const goModuleVersion in
go_module_metadata.go to the valid upstream release string; if the intention was
to upgrade, update the vendor files so they match an existing upstream tag and
set goModuleVersion to that tag.
1 participant
Bumps github.com/aws/aws-sdk-go-v2/credentials from 1.19.22 to 1.19.23.
Commits
9a3190fRelease 2026-06-08b20dd5bRegenerated Clients75a45eaUpdate API modele736f55Add preview of changes for standard retry mode behind flag (#3400)ba08dc9Release 2026-06-05.29a67e21Revert schema serde (#3442)51692f8s3/transfermanager: avoid double-closing concurrentReader channel after read ...f696d5bRelease 2026-06-057efb8fdRegenerated Clients1a420c5Update endpoints modelDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit
Release Notes
Chores
Bug Fixes