You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
|
[github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream](https://redirect.github.com/aws/aws-sdk-go-v2)
| indirect | patch | `v1.7.2` -> `v1.7.8` |
|
[github.com/aws/aws-sdk-go-v2/service/lambda](https://redirect.github.com/aws/aws-sdk-go-v2)
| require | minor | `v1.78.1` -> `v1.88.5` |
|
[github.com/aws/aws-sdk-go-v2/service/s3](https://redirect.github.com/aws/aws-sdk-go-v2)
| require | minor | `v1.88.5` -> `v1.97.3` |
---
> [!WARNING]
> Some dependencies could not be looked up. Check the Dependency
Dashboard for more information.
### GitHub Vulnerability Alerts
####
[GHSA-xmrv-pmrh-hhx2](https://redirect.github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2)
**CVSSv3.1 Rating**: [Medium]
**CVSSv3.1 Score**: [5.9]
**CVSSv3.1 Vector String**:
[CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H]
## Summary and Impact
An issue exists in the the EventStream header decoder in AWS SDK for Go
v2 in versions predating
[2026-03-23](https://redirect.github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23).
An actor can send a malformed EventStream response frame containing a
crafted header value type byte outside the valid range, which can cause
the host process to terminate.
Impacted versions: <
[2026-03-23](https://redirect.github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23)
## Patches
This issue has been addressed in versions
[2026-03-23](https://redirect.github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23)
and above. We recommend upgrading to the latest version and ensuring any
forked or derivative code is patched to incorporate the new fixes.
## Workarounds
Not Applicable
## References
If you have any questions or comments about this advisory, we ask that
you contact [AWS/Amazon] Security via our [vulnerability reporting
page](https://aws.amazon.com/security/vulnerability-reporting) or
directly via email to
[aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not
create a public GitHub issue.
---
### Configuration
📅 **Schedule**: Branch creation - "" (UTC), Automerge - Monday through
Friday ( * * * * 1-5 ) (UTC).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4yNjQuMCIsInVwZGF0ZWRJblZlciI6IjM5LjI2NC4wIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY2llcyIsImltcGFjdC9uby1jaGFuZ2Vsb2ctcmVxdWlyZWQiXX0=-->
Co-authored-by: pulumi-renovate[bot] <189166143+pulumi-renovate[bot]@users.noreply.github.com>
![pulumi-renovate[bot]](https://avatars.githubusercontent.com/u/21992475?v=4&size=40){kind=avatar}
0 commit comments