Bump the aws-sdk group with 3 updates - #175
Conversation
Bumps the aws-sdk group with 3 updates: [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2), [github.com/aws/aws-sdk-go-v2/service/cloudtrail](https://github.com/aws/aws-sdk-go-v2) and [github.com/aws/aws-sdk-go-v2/service/ec2](https://github.com/aws/aws-sdk-go-v2). Updates `github.com/aws/aws-sdk-go-v2/config` from 1.32.32 to 1.32.34 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@config/v1.32.32...config/v1.32.34) Updates `github.com/aws/aws-sdk-go-v2/service/cloudtrail` from 1.58.1 to 1.58.3 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.58.1...service/s3/v1.58.3) Updates `github.com/aws/aws-sdk-go-v2/service/ec2` from 1.317.1 to 1.318.1 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/ec2/v1.317.1...service/ec2/v1.318.1) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/config dependency-version: 1.32.34 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aws-sdk - dependency-name: github.com/aws/aws-sdk-go-v2/service/cloudtrail dependency-version: 1.58.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: aws-sdk - dependency-name: github.com/aws/aws-sdk-go-v2/service/ec2 dependency-version: 1.318.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: aws-sdk ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
approved
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
2 similar comments
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
[APPROVALNOTIFIER] This PR is APPROVED Approval requirements bypassed by manually added approval. This pull-request has been approved by: dependabot[bot] The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
WalkthroughUpdated direct AWS SDK modules for config, CloudTrail, and EC2. Updated related indirect AWS SDK, Smithy, and service-support modules in ChangesAWS SDK dependency updates
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 11✅ Passed checks (11 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 21-33: Upgrade the vulnerable transitive dependencies used by the
E2E binary: set github.com/golang/glog to v1.2.4 or later and golang.org/x/text
to v0.39.0 or later in the module dependency configuration, then refresh the
dependency graph and rerun the vulnerability scan to confirm the resolved
versions.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift-online/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 2909b6db-ca11-4732-ae98-46a63fd1af3d
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
| github.com/aws/aws-sdk-go-v2 v1.43.3 // indirect | ||
| github.com/aws/aws-sdk-go-v2/credentials v1.19.33 // indirect | ||
| github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.34 // indirect | ||
| github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.34 // indirect | ||
| github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.34 // indirect | ||
| github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.35 // indirect | ||
| github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.15 // indirect | ||
| github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.34 // indirect | ||
| github.com/aws/aws-sdk-go-v2/service/signin v1.5.3 // indirect | ||
| github.com/aws/aws-sdk-go-v2/service/sso v1.33.3 // indirect | ||
| github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.3 // indirect | ||
| github.com/aws/aws-sdk-go-v2/service/sts v1.45.3 // indirect | ||
| github.com/aws/smithy-go v1.27.6 // indirect |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
test -f go.sum
go mod verify
osv-scanner scan source -r .
osv-scanner --licenses .
retracted_or_prerelease="$(
go list -m -json all |
jq -s -r '
.[]
| select(
(.Retracted != null) or
(((.Version // "") | test("-")))
)
| "\(.Path) \(.Version)"
'
)"
test -z "$retracted_or_prerelease"Repository: openshift-online/rosa-e2e
Length of output: 2052
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- module files ---'
git ls-files 'go.mod' 'go.sum' '.github/**' 'Dockerfile*' '*Containerfile*' | sed -n '1,160p'
printf '%s\n' '--- go.mod context ---'
cat -n go.mod | sed -n '1,90p'
printf '%s\n' '--- vulnerable module declarations and sums ---'
rg -n -C 2 'github.com/golang/glog|golang.org/x/text' go.mod go.sum
printf '%s\n' '--- release controls ---'
rg -n -i -C 2 'sbom|provenance|attest|cosign|sigstore|sign(ing|ed)? artifact|osv|govulncheck' .github go.mod go.sum 2>/dev/null || true
printf '%s\n' '--- resolved module metadata with CGO disabled ---'
CGO_ENABLED=0 go list -m -json all 2>/dev/null |
jq -r 'select(.Path == "github.com/golang/glog" or .Path == "golang.org/x/text" or .Path == "github.com/aws/aws-sdk-go-v2" or .Path == "github.com/aws/smithy-go") |
[.Path, (.Version // ""), ((.Retracted // []) | tostring)] | `@tsv`' || trueRepository: openshift-online/rosa-e2e
Length of output: 9794
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- dependency paths ---'
CGO_ENABLED=0 go mod why -m github.com/golang/glog
CGO_ENABLED=0 go mod why -m golang.org/x/text
printf '%s\n' '--- tracked container and workflow files ---'
for f in Containerfile .github/workflows/branch-protection-check.yml .github/workflows/dependabot-auto-merge.yml .github/dependabot.yml; do
if test -f "$f"; then
printf '\n--- %s ---\n' "$f"
cat -n "$f"
fi
done
printf '%s\n' '--- changed module entries ---'
git diff -- go.mod | sed -n '1,180p'Repository: openshift-online/rosa-e2e
Length of output: 16174
🌐 Web query:
OSV GO-2025-3372 github.com/golang/glog v1.0.0 affected versions fixed version
💡 Result:
The vulnerability identified as GO-2025-3372 (also tracked as CVE-2024-45339 and GHSA-6wxm-mpqj-6jpf) affects the github.com/golang/glog package [1][2][3]. Affected Versions: All versions of github.com/golang/glog prior to v1.2.4 are considered affected [4][2]. Fixed Version: The vulnerability was fixed in version v1.2.4 [5][2][3]. Explanation: The vulnerability concerns insecure temporary file usage. When logs are written to a widely-writable directory—which is the default behavior—an unprivileged attacker could predict a privileged process's log file path and create a symbolic link to a sensitive file. If the privileged process follows this link, it could overwrite the sensitive file [5][2]. The fix introduced in v1.2.4 causes the application to exit with status code 2 if it detects that the configured log file already exists [5][2][3].
Citations:
- 1: https://osv.dev/vulnerability/GO-2025-3372
- 2: https://pkg.go.dev/vuln/GO-2025-3372
- 3: x/vulndb: potential Go vuln in github.com/golang/glog: CVE-2024-45339 golang/vulndb#3372
- 4: https://nvd.nist.gov/vuln/detail/CVE-2024-45339
- 5: https://osv.dev/vulnerability/GHSA-6wxm-mpqj-6jpf
🌐 Web query:
OSV GO-2026-5970 golang.org/x/text v0.38.0 affected versions fixed version
💡 Result:
GO-2026-5970 is a vulnerability in the golang.org/x/text module characterized by an infinite loop that can be triggered when handling invalid UTF-8 byte sequences [1][2]. Affected Versions: The vulnerability affects versions of golang.org/x/text prior to v0.39.0 [2][3]. Fixed Version: The issue is resolved in version v0.39.0 [1][4]. While v0.39.0 is the minimum fixed version, some users have updated to v0.40.0 to address the vulnerability [5][6]. The vulnerability is also tracked as CVE-2026-56852 [7][8]. It specifically impacts the unicode/norm package, with various functions such as Form.Bytes, Form.IsNormal, Form.NextBoundary, and Iter.Next being identified as vulnerable entry points [1][3].
Citations:
- 1: https://osv.dev/vulnerability/GO-2026-5970
- 2: https://cve.circl.lu/vuln/cve-2026-56852
- 3: https://vulnerability.circl.lu/vuln/cve-2026-56852
- 4: fix: bump golang.org/x/text to v0.39.0 (GO-2026-5970) Technarion-Oy/thaw#834
- 5: [chore] Update golang.org/x/text to v0.40.0 to fix GO-2026-5970 open-telemetry/opentelemetry-collector#15633
- 6: https://pkg.go.dev/golang.org/x/text@v0.37.0
- 7: https://osv.dev/vulnerability/CVE-2026-56852
- 8: https://pkg.go.dev/vuln/list
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- repository imports and logging configuration ---'
rg -n -C 3 'ocm-sdk-go|logging|glog|idna|unicode/norm|LoadDefaultConfig|NewClient' --glob '*.go' .
printf '%s\n' '--- module cache locations ---'
go env GOMODCACHE GOPATH
printf '%s\n' '--- vulnerable package references in cached modules ---'
modcache="$(go env GOMODCACHE)"
rg -n -C 3 'package logging|glog\.|package idna|unicode/norm|norm\.' \
"$modcache/github.com/openshift-online/ocm-sdk-go"* \
"$modcache/golang.org/x/net"* \
"$modcache/golang.org/x/text"* 2>/dev/null | sed -n '1,240p' || true
printf '%s\n' '--- E2E dependency inclusion ---'
CGO_ENABLED=0 go list -tags E2Etests -deps ./test/e2e/... 2>/dev/null |
rg 'github.com/golang/glog|golang.org/x/text/(secure/bidirule|unicode/norm)|golang.org/x/net/idna' || trueRepository: openshift-online/rosa-e2e
Length of output: 28537
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- OCM client construction ---'
rg -n -C 6 'New.*Connection|ConnectionBuilder|Logger|GlogLogger|WithLogger|NewGlogLogger' \
--glob '*.go' test pkg
printf '%s\n' '--- glog logger implementation and defaults ---'
sed -n '20,180p' /home/jailuser/go/pkg/mod/github.com/openshift-online/ocm-sdk-go@v0.1.507/logging/glog_logger.go
rg -n -C 4 'log_dir|logtostderr|alsologtostderr|stderrthreshold|log_file|Create|OpenFile|Mkdir' \
/home/jailuser/go/pkg/mod/github.com/golang/glog@v1.0.0 2>/dev/null | sed -n '1,220p'
printf '%s\n' '--- application-controlled host and URL inputs ---'
rg -n -C 4 'AWSRegion|ClusterID|OCM|URL|endpoint|kubeconfig|clientcmd|rest.Config|Host|Server' \
--glob '*.go' test pkg | sed -n '1,280p'Repository: openshift-online/rosa-e2e
Length of output: 38137
Known Vulnerable Transitive Dependencies (CWE-1104)
Reachability: Internal · Exploitability: Difficult
Upgrade vulnerable transitive dependencies.
The E2E binary includes github.com/golang/glog v1.0.0 and golang.org/x/text v0.38.0. Upgrade them to v1.2.4 and v0.39.0 or later, then rerun the vulnerability scan. go mod verify checks integrity but does not detect vulnerabilities.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` around lines 21 - 33, Upgrade the vulnerable transitive dependencies
used by the E2E binary: set github.com/golang/glog to v1.2.4 or later and
golang.org/x/text to v0.39.0 or later in the module dependency configuration,
then refresh the dependency graph and rerun the vulnerability scan to confirm
the resolved versions.
Source: Path instructions
Bumps the aws-sdk group with 3 updates: github.com/aws/aws-sdk-go-v2/config, github.com/aws/aws-sdk-go-v2/service/cloudtrail and github.com/aws/aws-sdk-go-v2/service/ec2.
Updates
github.com/aws/aws-sdk-go-v2/configfrom 1.32.32 to 1.32.34Commits
e022bf5Release 2026-07-31.237db31fRegenerated Clients743701aUpdate API model5555cc0upgrade to smithy-go v1.27.6 (#3505)b0c4f28Release 2026-07-318c94f29Regenerated Clientsd4d7af9Update endpoints model3dd4c38Update API model2f4fc72Release 2026-07-308348643Regenerated ClientsUpdates
github.com/aws/aws-sdk-go-v2/service/cloudtrailfrom 1.58.1 to 1.58.3Commits
5102c2eRelease 2024-08-02001b1fdRegenerated Clients0897137Update API modela274795add assurance tests for auth scheme select (#2730)2d43bf8Release 2024-08-015bd193dRegenerated Clients5954703Update API model0c73d2bRelease 2024-07-303102b1fRegenerated Clients348b939Update endpoints modelUpdates
github.com/aws/aws-sdk-go-v2/service/ec2from 1.317.1 to 1.318.1Commits
e022bf5Release 2026-07-31.237db31fRegenerated Clients743701aUpdate API model5555cc0upgrade to smithy-go v1.27.6 (#3505)b0c4f28Release 2026-07-318c94f29Regenerated Clientsd4d7af9Update endpoints model3dd4c38Update API model2f4fc72Release 2026-07-308348643Regenerated ClientsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsSummary by CodeRabbit