chore(deps): bump github.com/aws/aws-sdk-go-v2/credentials from 1.19.7 to 1.19.9#7
Closed
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [github.com/aws/aws-sdk-go-v2/credentials](https://github.com/aws/aws-sdk-go-v2) from 1.19.7 to 1.19.9. - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json) - [Commits](aws/aws-sdk-go-v2@service/m2/v1.19.7...service/m2/v1.19.9) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/credentials dependency-version: 1.19.9 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
|
Consider updating CHANGELOG.md to document this change. If this change doesn't need a changelog entry, add the |
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Author
|
Looks like github.com/aws/aws-sdk-go-v2/credentials is up-to-date now, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/go_modules/develop/github.com/aws/aws-sdk-go-v2/credentials-1.19.9
branch
jgbr1el93
added a commit
that referenced
this pull request
May 15, 2026
Addresses 6 actionable findings from the CodeRabbit Cloud review of the re-submitted security fix. All are quality refinements on artifacts we authored; no behavior change to the security contract itself. Code fixes: - fuzz test buildActorMapping (#5): validate UTF-8 only on fields the caller marks as present. The previous guard rejected the entire mapping when an absent field happened to carry invalid bytes — those bytes are never read in the absent branch, so the rejection only shrank the valid input space without protecting any assertion. - integration test idempotency assertions (#6): switch from .Unix() epoch-seconds comparison to time.Time.Equal(). Sub-second drift was previously absorbed by the seconds-precision rounding; the tighter comparison now surfaces any spurious updated_at write introduced by a future regression. Applied at both call sites in the AC2 and AC8-identical-payload tests. - chaos harness fatal message (#10): the t.Fatalf text on the testLockHeld CAS used to say "called twice on the same test", but the CAS is harness-scoped, so any second acquirer (including a future parallel test if the suite is ever de-serialized) would land in the same branch. Rephrase the message to reference the chaos suite serial-execution invariant and the docstring that explains it. Applied to both ResetDatabase and LockHarnessForTest. Documentation: - ActorMappingRepository.Upsert contract (#7): the docstring said identity fields must match "exactly", but the adapter helpers (stringPtrEqual / actorMappingPIIDiffers) intentionally treat nil-pointer and empty-string as equivalent because the DB stores NULL for both. Document the equivalence explicitly in the contract so future maintainers don't read "exactly" as byte-strict including nil-vs-empty. - Task spec PoC step 1 (#4): the pentest reproduction in docs/tasks/fix-actor-mapping-pseudonymization-bypass.md said "POST /v1/governance/actor-mappings/{ID} creates mapping". The actual route is PUT — there is no POST create endpoint. Corrected with a clarifying parenthetical. - Cycle state metrics (#1): docs/ring:dev-cycle/current-cycle.json had accumulated_metrics.review_iterations: 0 despite the cycle documenting Gate 8 iteration 1 plus 4 MEDIUM findings resolved. Updated to review_iterations: 1 and populated issues_by_severity with the actual counts (4 MEDIUM, 22 LOW) so the state file truthfully audits the cycle. Findings #2, #3, #8, #9 are tracked as deferred with replies on the PR threads — they cover policy decisions (pre-launch patch posture), process documentation that was already conscious, sibling-method consistency, and an intentional defensive check.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps github.com/aws/aws-sdk-go-v2/credentials from 1.19.7 to 1.19.9.
Commits
54aed73Release 2025-02-18082781fRegenerated Clients3ed185bUpdate endpoints model03da737Update API modelc8a8ccbBump go version to 1.22 (#3010)8b7c7bffix missing AccountIDEndpointMode binding (#3013)90f9d10Release 2025-02-1740dd351Regenerated Clients06352dfUpdate endpoints model833566bUpdate API modelDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)