chore(deps): update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.97.3 [security]

[dwertent]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
github.com/aws/aws-sdk-go-v2/service/s3	indirect	patch	v1.97.1 → v1.97.3

---

Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder

GHSA-xmrv-pmrh-hhx2

More information

Details

CVSSv3.1 Rating: [Medium]
CVSSv3.1 Score: [5.9]
CVSSv3.1 Vector String: [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H]

Summary and Impact

An issue exists in the the EventStream header decoder in AWS SDK for Go v2 in versions predating 2026-03-23. An actor can send a malformed EventStream response frame containing a crafted header value type byte outside the valid range, which can cause the host process to terminate.

Impacted versions: < 2026-03-23

Patches

This issue has been addressed in versions 2026-03-23 and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds

Not Applicable

References

If you have any questions or comments about this advisory, we ask that you contact [AWS/Amazon] Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

Severity

• CVSS Score: 5.9 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/aws/aws-sdk-go-v2/security/advisories/GHSA-xmrv-pmrh-hhx2
• https://github.com/aws/aws-sdk-go-v2
• https://github.com/aws/aws-sdk-go-v2/releases/tag/release-2026-03-23

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

aws/aws-sdk-go-v2 (github.com/aws/aws-sdk-go-v2/service/s3)

v1.97.3

General Highlights

• Dependency Update: Updated to the latest SDK module versions

Module Highlights

• github.com/aws/aws-sdk-go-v2: v1.41.5
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/accessanalyzer: v1.45.12
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/account: v1.30.5
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/acm: v1.37.23
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/acmpca: v1.46.12
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/aiops: v1.6.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/amp: v1.42.9
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/amplify: v1.38.14
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/amplifybackend: v1.32.20
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/amplifyuibuilder: v1.28.20
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/apigateway: v1.39.1
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/apigatewaymanagementapi: v1.29.14
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/apigatewayv2: v1.34.1
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/appconfig: v1.43.13
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/appconfigdata: v1.23.22
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/appfabric: v1.16.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/appflow: v1.51.12
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/appintegrations: v1.37.7
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/applicationautoscaling: v1.41.14
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/applicationcostprofiler: v1.27.12
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/applicationdiscoveryservice: v1.35.13
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/applicationinsights: v1.34.20
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/applicationsignals: v1.19.1
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/appmesh: v1.35.12
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/apprunner: v1.39.14
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/appstream: v1.54.4
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/appsync: v1.53.5
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/arcregionswitch: v1.6.3
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/arczonalshift: v1.22.23
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/artifact: v1.15.5
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/athena: v1.57.4
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/auditmanager: v1.46.12
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/autoscaling: v1.64.4
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/autoscalingplans: v1.30.14
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/b2bi: v1.0.0-preview.100
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/backup: v1.54.11
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/backupgateway: v1.26.3
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/backupsearch: v1.6.23
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/batch: v1.63.2
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/bcmdashboards: v1.1.4
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/bcmdataexports: v1.14.0
  • Feature: With this release we are providing an option to accounts to have their export delivered to an S3 bucket that is not owned by the account.
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/bcmpricingcalculator: v1.10.9
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/bcmrecommendedactions: v1.1.5
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/bedrock: v1.57.1
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/bedrockagent: v1.52.7
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/bedrockagentcore: v1.15.2
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/bedrockagentcorecontrol: v1.25.1
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/bedrockagentruntime: v1.51.8
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/bedrockdataautomation: v1.13.5
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/bedrockdataautomationruntime: v1.10.4
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/bedrockruntime: v1.50.4
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/billing: v1.10.4
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/billingconductor: v1.28.5
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/braket: v1.39.8
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/budgets: v1.43.4
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/chatbot: v1.14.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/chime: v1.41.12
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/chimesdkidentity: v1.27.20
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/chimesdkmediapipelines: v1.26.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/chimesdkmeetings: v1.33.15
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/chimesdkmessaging: v1.32.17
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/chimesdkvoice: v1.28.13
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/cleanrooms: v1.42.4
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/cleanroomsml: v1.22.5
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/cloud9: v1.33.20
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/cloudcontrol: v1.29.13
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/clouddirectory: v1.30.12
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/cloudformation: v1.71.9
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/cloudfront: v1.60.4
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/cloudfrontkeyvaluestore: v1.12.24
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/cloudhsm: v1.29.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/cloudhsmv2: v1.34.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/cloudsearch: v1.32.12
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/cloudsearchdomain: v1.28.20
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/cloudtrail: v1.55.9
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/cloudtraildata: v1.17.13
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/cloudwatch: v1.55.3
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/cloudwatchevents: v1.32.23
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs: v1.65.0
  • Feature: This release adds parameter support to saved queries in CloudWatch Logs Insights. Define reusable query templates with named placeholders, invoke them using start query. Available in Console, CLI and SDK
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/codeartifact: v1.38.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/codebuild: v1.68.13
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/codecatalyst: v1.21.12
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/codecommit: v1.33.12
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/codeconnections: v1.10.20
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/codedeploy: v1.35.13
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/codeguruprofiler: v1.29.20
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/codegurureviewer: v1.34.20
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/codegurusecurity: v1.16.24
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/codepipeline: v1.46.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/codestarconnections: v1.35.13
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/codestarnotifications: v1.31.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/cognitoidentity: v1.33.22
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/cognitoidentityprovider: v1.59.3
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/cognitosync: v1.29.12
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/comprehend: v1.40.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/comprehendmedical: v1.31.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/computeoptimizer: v1.49.8
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/computeoptimizerautomation: v1.0.8
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/configservice: v1.62.1
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/connect: v1.166.1
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/connectcampaigns: v1.20.20
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/connectcampaignsv2: v1.11.4
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/connectcases: v1.39.1
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/connectcontactlens: v1.33.13
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/connecthealth: v1.0.3
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/connectparticipant: v1.36.7
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/controlcatalog: v1.14.9
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/controltower: v1.28.9
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/costandusagereportservice: v1.34.13
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/costexplorer: v1.63.6
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/costoptimizationhub: v1.22.8
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/customerprofiles: v1.57.2
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/databasemigrationservice: v1.61.10
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/databrew: v1.39.14
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/dataexchange: v1.40.14
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/datapipeline: v1.30.20
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/datasync: v1.58.2
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/datazone: v1.54.2
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/dax: v1.29.16
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/deadline: v1.26.2
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/detective: v1.38.13
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/devicefarm: v1.38.8
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/devopsguru: v1.40.12
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/directconnect: v1.38.15
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/directoryservice: v1.38.16
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/directoryservicedata: v1.7.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/dlm: v1.35.16
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/docdb: v1.48.13
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/docdbelastic: v1.20.13
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/drs: v1.36.13
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/dsql: v1.12.8
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/dynamodb: v1.57.1
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/dynamodbstreams: v1.32.14
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/ebs: v1.33.14
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/ec2: v1.296.1
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/ec2instanceconnect: v1.32.20
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/ecr: v1.56.2
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/ecrpublic: v1.38.13
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/ecs: v1.74.1
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/efs: v1.41.14
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/eks: v1.81.2
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/eksauth: v1.12.13
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/elasticache: v1.51.13
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/elasticbeanstalk: v1.34.2
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/elasticloadbalancing: v1.33.23
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2: v1.54.10
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/elasticsearchservice: v1.39.2
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/elementalinference: v1.0.3
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/emr: v1.59.0
  • Feature: Add StepExecutionRoleArn to RunJobFlow API
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/emrcontainers: v1.40.17
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/emrserverless: v1.39.6
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/entityresolution: v1.26.5
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/eventbridge: v1.45.23
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/evs: v1.6.4
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/finspace: v1.33.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/finspacedata: v1.33.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/firehose: v1.42.13
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/fis: v1.37.20
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/fms: v1.44.22
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/forecast: v1.41.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/forecastquery: v1.29.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/frauddetector: v1.41.12
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/freetier: v1.13.14
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/fsx: v1.65.7
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/gamelift: v1.51.3
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/gameliftstreams: v1.11.1
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/geomaps: v1.9.4
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/geoplaces: v1.8.5
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/georoutes: v1.7.14
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/glacier: v1.32.6
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/globalaccelerator: v1.35.15
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/glue: v1.139.1
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/grafana: v1.33.4
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/greengrass: v1.32.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/greengrassv2: v1.42.12
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/groundstation: v1.40.4
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/guardduty: v1.74.2
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/health: v1.37.4
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/healthlake: v1.36.13
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/iam: v1.53.7
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/identitystore: v1.36.5
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/imagebuilder: v1.51.4
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/inspector: v1.30.20
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/inspector2: v1.47.4
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/inspectorscan: v1.13.5
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/internetmonitor: v1.26.14
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/invoicing: v1.9.8
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/iot: v1.72.5
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/iotdataplane: v1.32.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/iotdeviceadvisor: v1.36.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/iotevents: v1.33.13
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/ioteventsdata: v1.30.12
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/iotfleetwise: v1.31.20
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/iotjobsdataplane: v1.30.13
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/iotmanagedintegrations: v1.8.4
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/iotsecuretunneling: v1.33.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/iotsitewise: v1.52.19
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/iotthingsgraph: v1.30.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/iottwinmaker: v1.29.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/iotwireless: v1.54.9
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/ivs: v1.48.14
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/ivschat: v1.21.20
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/ivsrealtime: v1.33.1
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/kafka: v1.49.2
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/kafkaconnect: v1.30.4
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/kendra: v1.60.21
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/kendraranking: v1.15.25
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/keyspaces: v1.25.4
  • Bug Fix: Fix a bug where a recorded clock skew could persist on the client even if the client and server clock ended up realigning.
• github.com/aws/aws-sdk-go-v2/service/keyspacesstreams: v1.6.3
  • Bug Fix: Fix a bug where a recorded clock s

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[dwertent]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 8 additional dependencies were updated

Details:

Package	Change
github.com/aws/aws-sdk-go-v2	v1.41.4 -> v1.41.5
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	v1.7.7 -> v1.7.8
github.com/aws/aws-sdk-go-v2/internal/configsources	v1.4.20 -> v1.4.21
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2	v2.7.20 -> v2.7.21
github.com/aws/aws-sdk-go-v2/internal/v4a	v1.4.21 -> v1.4.22
github.com/aws/aws-sdk-go-v2/service/internal/checksum	v1.9.12 -> v1.9.13
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url	v1.13.20 -> v1.13.21
github.com/aws/aws-sdk-go-v2/service/internal/s3shared	v1.19.20 -> v1.19.21

File name: nodebuilder/tests/tastora/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 8 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.25.9 -> 1.25.11
github.com/aws/aws-sdk-go-v2	v1.41.4 -> v1.41.5
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	v1.7.7 -> v1.7.8
github.com/aws/aws-sdk-go-v2/internal/configsources	v1.4.20 -> v1.4.21
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2	v2.7.20 -> v2.7.21
github.com/aws/aws-sdk-go-v2/internal/v4a	v1.4.21 -> v1.4.22
github.com/aws/aws-sdk-go-v2/service/internal/checksum	v1.9.12 -> v1.9.13
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url	v1.13.20 -> v1.13.21
github.com/aws/aws-sdk-go-v2/service/internal/s3shared	v1.19.20 -> v1.19.21

[Copilot]

Pull request overview

This PR updates the AWS SDK for Go v2 S3 module (and associated transitive AWS SDK modules) to a newer patch release to address a reported DoS/panic issue in the SDK’s EventStream decoding path.

Changes:

• Bumps github.com/aws/aws-sdk-go-v2/service/s3 from v1.97.1 to v1.97.3 (plus related AWS SDK module versions, including aws/protocol/eventstream to v1.7.8).
• Updates root go.mod/go.sum to reflect the new indirect dependency versions.
• Updates the nodebuilder/tests/tastora module’s go.mod/go.sum accordingly (including a change to the go directive).

Reviewed changes

Copilot reviewed 2 out of 4 changed files in this pull request and generated 1 comment.

File	Description
go.mod	Updates indirect AWS SDK v2 dependency versions, including S3 and EventStream.
go.sum	Adds new sums for updated AWS SDK v2 module versions.
nodebuilder/tests/tastora/go.mod	Updates AWS SDK v2 indirect versions and modifies the module go directive.
nodebuilder/tests/tastora/go.sum	Adds new sums for updated AWS SDK v2 module versions in the tastora test module.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[dwertent]

Closing: opened during a CVE-remediation test session on 2026-06-15; not needed (superseded by consolidated grouped/direct-only/severity-filtered config). Sorry for the noise.