Skip to content

Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.71.1 to 1.97.3#1137

Merged
calebbrown merged 1 commit into
mainfrom
dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/s3-1.97.3
May 15, 2026
Merged

Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.71.1 to 1.97.3#1137
calebbrown merged 1 commit into
mainfrom
dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/s3-1.97.3

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 14, 2026

Bumps github.com/aws/aws-sdk-go-v2/service/s3 from 1.71.1 to 1.97.3.

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels May 14, 2026
@dependabot dependabot Bot force-pushed the dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/s3-1.97.3 branch 4 times, most recently from 37a3691 to f179eed Compare May 15, 2026 00:14
@calebbrown
Copy link
Copy Markdown
Contributor

@dependabot rebase

Bumps [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) from 1.71.1 to 1.97.3.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.71.1...service/s3/v1.97.3)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/service/s3
  dependency-version: 1.97.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/s3-1.97.3 branch from f179eed to 1c44ee0 Compare May 15, 2026 00:28
@kusari-inspector
Copy link
Copy Markdown

kusari-inspector Bot commented May 15, 2026

Kusari Inspector

Kusari Analysis Results:

Proceed with these changes

✅ No Flagged Issues Detected
All values appear to be within acceptable risk parameters.

Both dependency and code security analyses independently recommend proceeding with no blocking issues. The PR updates 11 transitive AWS SDK for Go v2 packages (indirect dependencies via gocloud.dev@v0.40.0) and remediates GHSA-xmrv-pmrh-hhx2 (CVSS 5.9 Medium), a DoS vulnerability in the EventStream header decoder that could allow remote actors to crash the host process via malformed frames. The vulnerability is confirmed fixed in the new versions, as it only appears in OldVersionVulns for aws-sdk-go-v2/service/s3 (1.71.1) and aws/protocol/eventstream (1.6.7). All updated packages carry zero active advisories, are not deprecated or end-of-life, score 10/10 on maintenance, and use permissive licenses (Apache-2.0, BSD-3-Clause). The code analysis returned zero findings across all categories including no exposed secrets and no workflow issues. The combined risk profile is strictly positive: this PR reduces the attack surface with no new risks introduced.

Note

View full detailed analysis result for more information on the output and the checks that were run.


@kusari-inspector rerun - Trigger a re-analysis of this PR
@kusari-inspector feedback [your message] - Send feedback to our AI and team
See Kusari's documentation for setup and configuration.
Commit: 1c44ee0, performed at: 2026-05-15T02:01:54Z

Found this helpful? Give it a 👍 or 👎 reaction!

@calebbrown calebbrown enabled auto-merge (squash) May 15, 2026 00:32
@calebbrown calebbrown merged commit 1f10d9d into main May 15, 2026
10 of 12 checks passed
@calebbrown calebbrown deleted the dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/s3-1.97.3 branch May 15, 2026 00:34
@kusari-inspector
Copy link
Copy Markdown

Kusari PR Analysis rerun based on - 1c44ee0 performed at: 2026-05-15T00:47:40Z - link to updated analysis

@kusari-inspector
Copy link
Copy Markdown

Kusari PR Analysis rerun based on - 1c44ee0 performed at: 2026-05-15T02:02:15Z - link to updated analysis

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant