Skip to content

build(deps): bump github.com/aws/smithy-go from 1.27.3 to 1.27.6 - #266

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/aws/smithy-go-1.27.6
Open

build(deps): bump github.com/aws/smithy-go from 1.27.3 to 1.27.6#266
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/aws/smithy-go-1.27.6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 8, 2026

Copy link
Copy Markdown
Contributor

Bumps github.com/aws/smithy-go from 1.27.3 to 1.27.6.

Changelog

Sourced from github.com/aws/smithy-go's changelog.

Release (2026-08-07)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.27.7
    • Bug Fix: Don't serialize unset JSON documents as nil in structure members.
    • Bug Fix: Fix a deserialization panic around collection members in recursive shape configs.

Release (2026-07-31)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.27.6
    • Bug Fix: Fix failure to deserialize any @httpPayload struct with a non-string member.
    • Bug Fix: Fix failure to serialize any @httpPayload struct with a nested struct.

Release (2026-07-27)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.27.5
    • Bug Fix: Fix a performance issue in awsQuery with large response payloads.

Release (2026-07-16)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go/aws-http-auth: v1.2.1
    • Bug Fix: Use r.URL.Host when r.Host is unset.
  • github.com/aws/smithy-go/aws-http-auth-schemes: v1.0.0
    • Release: Module github.com/aws/smithy-go/aws-http-auth-schemes adds generic smithy-go client support for AWS Sigv4 and Sigv4a.

Release (2026-06-26)

General Highlights

  • Dependency Update: Updated to the latest SDK module versions

Module Highlights

  • github.com/aws/smithy-go: v1.27.3
    • Bug Fix: Fix bug in JSON doc encoder and endpoint host label format validation

Release (2026-06-05)

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/aws/smithy-go](https://github.com/aws/smithy-go) from 1.27.3 to 1.27.6.
- [Release notes](https://github.com/aws/smithy-go/releases)
- [Changelog](https://github.com/aws/smithy-go/blob/main/CHANGELOG.md)
- [Commits](aws/smithy-go@v1.27.3...v1.27.6)

---
updated-dependencies:
- dependency-name: github.com/aws/smithy-go
  dependency-version: 1.27.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 8, 2026
@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown

bulwark

  • scan — 1 govulncheck findings
error output
… truncated to the last 20000 bytes — full log in the run artifact linked below …
n.go
[gosec] 2026/08/08 15:46:47 Import directory: /home/runner/work/inforge/inforge/internal/postgres
[gosec] 2026/08/08 15:46:47 Checking package: grafanaalert
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/grafanaalert/builtin.go
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/grafanaalert/crowdsec.go
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/grafanaalert/grafanaalert.go
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/grafanaalert/service.go
[gosec] 2026/08/08 15:46:47 Import directory: /home/runner/work/inforge/inforge/internal/regions
[gosec] 2026/08/08 15:46:47 Checking package: postgres
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/postgres/config.go
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/postgres/install.go
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/postgres/paths.go
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/postgres/role.go
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/postgres/shell.go
[gosec] 2026/08/08 15:46:47 Import directory: /home/runner/work/inforge/inforge/internal/remote
[gosec] 2026/08/08 15:46:47 Checking package: regions
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/regions/regions.go
[gosec] 2026/08/08 15:46:47 Import directory: /home/runner/work/inforge/inforge/internal/agent
[gosec] 2026/08/08 15:46:47 Checking package: nginx
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/nginx/config.go
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/nginx/install.go
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/nginx/paths.go
[gosec] 2026/08/08 15:46:47 Import directory: /home/runner/work/inforge/inforge/internal/aptlock
[gosec] 2026/08/08 15:46:47 Checking package: aptlock
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/aptlock/aptlock.go
[gosec] 2026/08/08 15:46:47 Import directory: /home/runner/work/inforge/inforge/internal/grafana
[gosec] 2026/08/08 15:46:47 Checking package: grafana
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/grafana/grafana.go
[gosec] 2026/08/08 15:46:47 Import directory: /home/runner/work/inforge/inforge/internal/grant
[gosec] 2026/08/08 15:46:47 Checking package: agent
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/agent/decrypt.go
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/agent/descriptor.go
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/agent/env.go
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/agent/exec.go
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/agent/meshdescriptor.go
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/agent/passwd.go
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/agent/project.go
[gosec] 2026/08/08 15:46:47 Checking file: /home/runner/work/inforge/inforge/internal/agent/run.go
[gosec] 2026/08/08 15:46:48 Import directory: /home/runner/work/inforge/inforge/internal/meshnginx
[gosec] 2026/08/08 15:46:48 Checking package: meshnginx
[gosec] 2026/08/08 15:46:48 Checking file: /home/runner/work/inforge/inforge/internal/meshnginx/egress.go
[gosec] 2026/08/08 15:46:48 Checking file: /home/runner/work/inforge/inforge/internal/meshnginx/ingress.go
[gosec] 2026/08/08 15:46:48 Checking file: /home/runner/work/inforge/inforge/internal/meshnginx/install.go
[gosec] 2026/08/08 15:46:48 Checking file: /home/runner/work/inforge/inforge/internal/meshnginx/render.go
[gosec] 2026/08/08 15:46:48 Checking package: remote
[gosec] 2026/08/08 15:46:48 Checking file: /home/runner/work/inforge/inforge/internal/remote/remote.go
[gosec] 2026/08/08 15:46:48 Import directory: /home/runner/work/inforge/inforge/internal/registry
[gosec] 2026/08/08 15:46:48 Import directory: /home/runner/work/inforge/inforge/internal/yamldoc
[gosec] 2026/08/08 15:46:48 Checking package: yamldoc
[gosec] 2026/08/08 15:46:48 Checking file: /home/runner/work/inforge/inforge/internal/yamldoc/dsl.go
[gosec] 2026/08/08 15:46:48 Checking file: /home/runner/work/inforge/inforge/internal/yamldoc/env.go
[gosec] 2026/08/08 15:46:48 Checking file: /home/runner/work/inforge/inforge/internal/yamldoc/yamldoc.go
[gosec] 2026/08/08 15:46:48 Import directory: /home/runner/work/inforge/inforge/program
[gosec] 2026/08/08 15:46:49 Checking package: grant
[gosec] 2026/08/08 15:46:49 Checking file: /home/runner/work/inforge/inforge/internal/grant/database.go
[gosec] 2026/08/08 15:46:49 Checking file: /home/runner/work/inforge/inforge/internal/grant/grant.go
[gosec] 2026/08/08 15:46:49 Checking file: /home/runner/work/inforge/inforge/internal/grant/pki.go
[gosec] 2026/08/08 15:46:49 Import directory: /home/runner/work/inforge/inforge/internal/backupstore
[gosec] 2026/08/08 15:46:50 Checking package: backupstore
[gosec] 2026/08/08 15:46:50 Checking file: /home/runner/work/inforge/inforge/internal/backupstore/store.go
[gosec] 2026/08/08 15:46:50 Import directory: /home/runner/work/inforge/inforge/internal/meshcert
[gosec] 2026/08/08 15:46:50 Checking package: meshcert
[gosec] 2026/08/08 15:46:50 Checking file: /home/runner/work/inforge/inforge/internal/meshcert/meshcert.go
[gosec] 2026/08/08 15:46:50 Import directory: /home/runner/work/inforge/inforge/internal/grafanadash
[gosec] 2026/08/08 15:46:50 Checking package: grafanadash
[gosec] 2026/08/08 15:46:50 Checking file: /home/runner/work/inforge/inforge/internal/grafanadash/crowdsec.go
[gosec] 2026/08/08 15:46:50 Checking file: /home/runner/work/inforge/inforge/internal/grafanadash/custom.go
[gosec] 2026/08/08 15:46:50 Checking file: /home/runner/work/inforge/inforge/internal/grafanadash/database.go
[gosec] 2026/08/08 15:46:50 Checking file: /home/runner/work/inforge/inforge/internal/grafanadash/grafanadash.go
[gosec] 2026/08/08 15:46:50 Checking file: /home/runner/work/inforge/inforge/internal/grafanadash/infrastructure.go
[gosec] 2026/08/08 15:46:50 Checking file: /home/runner/work/inforge/inforge/internal/grafanadash/service.go
[gosec] 2026/08/08 15:46:50 Import directory: /home/runner/work/inforge/inforge/internal/meshplan
[gosec] 2026/08/08 15:46:50 Checking package: registry
[gosec] 2026/08/08 15:46:50 Checking file: /home/runner/work/inforge/inforge/internal/registry/registry.go
[gosec] 2026/08/08 15:46:51 Import directory: /home/runner/work/inforge/inforge/internal/otelcol
[gosec] 2026/08/08 15:46:51 Checking package: cloudflare
[gosec] 2026/08/08 15:46:51 Checking package: meshplan
[gosec] 2026/08/08 15:46:51 Checking file: /home/runner/work/inforge/inforge/internal/meshplan/deploy.go
[gosec] 2026/08/08 15:46:51 Checking file: /home/runner/work/inforge/inforge/providers/cloudflare/dns.go
[gosec] 2026/08/08 15:46:51 Checking package: otelcol
[gosec] 2026/08/08 15:46:51 Checking file: /home/runner/work/inforge/inforge/internal/otelcol/config.go
[gosec] 2026/08/08 15:46:51 Checking file: /home/runner/work/inforge/inforge/internal/meshplan/meshplan.go
[gosec] 2026/08/08 15:46:51 Import directory: /home/runner/work/inforge/inforge/internal/r2
[gosec] 2026/08/08 15:46:51 Checking file: /home/runner/work/inforge/inforge/internal/otelcol/install.go
[gosec] 2026/08/08 15:46:51 Checking file: /home/runner/work/inforge/inforge/internal/otelcol/paths.go
[gosec] 2026/08/08 15:46:51 Checking file: /home/runner/work/inforge/inforge/internal/otelcol/shell.go
[gosec] 2026/08/08 15:46:51 Import directory: /home/runner/work/inforge/inforge/internal/release
[gosec] 2026/08/08 15:46:51 Import directory: /home/runner/work/inforge/inforge/internal/types
[gosec] 2026/08/08 15:46:51 Checking package: r2
[gosec] 2026/08/08 15:46:51 Checking file: /home/runner/work/inforge/inforge/internal/r2/r2.go
[gosec] 2026/08/08 15:46:51 Import directory: /home/runner/work/inforge/inforge/internal/app
[gosec] 2026/08/08 15:46:51 Checking package: release
[gosec] 2026/08/08 15:46:51 Checking file: /home/runner/work/inforge/inforge/internal/release/manifest.go
[gosec] 2026/08/08 15:46:51 Checking file: /home/runner/work/inforge/inforge/internal/release/store.go
[gosec] 2026/08/08 15:46:52 Checking package: app
[gosec] 2026/08/08 15:46:52 Checking file: /home/runner/work/inforge/inforge/internal/app/app.go
[gosec] 2026/08/08 15:46:52 Checking package: types
[gosec] 2026/08/08 15:46:52 Checking file: /home/runner/work/inforge/inforge/internal/types/types.go
[gosec] 2026/08/08 15:46:53 Checking package: program
[gosec] 2026/08/08 15:46:53 Checking file: /home/runner/work/inforge/inforge/program/adr0042.go
[gosec] 2026/08/08 15:46:53 Checking file: /home/runner/work/inforge/inforge/program/dbbackup.go
[gosec] 2026/08/08 15:46:53 Checking file: /home/runner/work/inforge/inforge/program/dbcluster.go
[gosec] 2026/08/08 15:46:53 Checking file: /home/runner/work/inforge/inforge/program/dbdeploy.go
[gosec] 2026/08/08 15:46:53 Checking file: /home/runner/work/inforge/inforge/program/deploykey.go
[gosec] 2026/08/08 15:46:53 Checking file: /home/runner/work/inforge/inforge/program/encrypted.go
[gosec] 2026/08/08 15:46:53 Checking file: /home/runner/work/inforge/inforge/program/grafana.go
[gosec] 2026/08/08 15:46:53 Checking file: /home/runner/work/inforge/inforge/program/mesh.go
[gosec] 2026/08/08 15:46:53 Checking file: /home/runner/work/inforge/inforge/program/pkigrant.go
[gosec] 2026/08/08 15:46:53 Checking file: /home/runner/work/inforge/inforge/program/program.go
[gosec] 2026/08/08 15:46:53 Checking file: /home/runner/work/inforge/inforge/program/secretresolve.go
Results:


Summary:
  Gosec  : dev
  Files  : 138
  Lines  : 30326
  Nosec  : 44
  Issues : 0

go: downloading golang.org/x/vuln v1.6.0
go: downloading golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959
go: downloading golang.org/x/tools v0.48.0
=== Symbol Results ===

Vulnerability #1: GO-2026-6061
    Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2
    transport server implementation in google.golang.org/grpc
  More info: https://pkg.go.dev/vuln/GO-2026-6061
  Module: google.golang.org/grpc
    Found in: google.golang.org/grpc@v1.81.1
    Fixed in: google.golang.org/grpc@v1.82.1
    Example traces found:
      #1: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.ClientStream.Close
      #2: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.ClientStream.Header
      #3: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.ClientStream.Read
      #4: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.ClientStream.RecvCompress
      #5: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.ClientStream.TrailersOnly
      #6: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.ClientStream.Write
      #7: internal/registry/registry.go:268:17: registry.registry.DNS calls sync.Once.Do, which eventually calls transport.NewHTTP2Client
      #8: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.NewServerTransport
      #9: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.ServerStream.Read
      #10: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.Stream.ReadMessageHeader
      #11: cmd/inforge/preview.go:100:28: inforge.runPreview calls auto.Stack.Preview, which eventually calls transport.http2Client.Close
      #12: cmd/inforge/preview.go:100:28: inforge.runPreview calls auto.Stack.Preview, which eventually calls transport.http2Client.GracefulClose
      #13: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.http2Client.NewStream
      #14: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.http2Server.Drain
      #15: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.http2Server.HandleStreams

Your code is affected by 1 vulnerability from 1 module.
This scan also found 0 vulnerabilities in packages you import and 2
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.
creating virtual environment...
installing semgrep from spec 'semgrep==1.168.0'...
done! ✨ 🌟 ✨
  installed package semgrep 1.168.0, installed using Python 3.12.3
  These apps are now available
    - pysemgrep
    - semgrep
                  
                  
┌────────────────┐
│ Debugging Info │
└────────────────┘
                  
  SCAN ENVIRONMENT
  versions    - semgrep 1.168.0 on python 3.12.3                                       
  environment - running in environment github-actions, triggering event is pull_request
Fixing git state for github action pull request
Not on head ref: 5f1d38c69bc85781facab832d9e5a48effc2dcbc; checking that out now.
            
  CONNECTION
Using b468aacc5ef4b274d0dbebda68e975773126db3e as the merge-base of b468aacc5ef4b274d0dbebda68e975773126db3e and 5f1d38c69bc85781facab832d9e5a48effc2dcbc
  Initializing scan (deployment=wardnet, scan_id=207394564)  
  Enabled products: Code, Supply Chain                               
        
  ENGINE
Semgrep Pro Engine will be installed in /opt/pipx/venvs/semgrep/lib/python3.12/site-packages/semgrep/bin/semgrep-core-proprietary
Downloading... ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 314.7/314.7 MB 218.5 MB/s 0:00:00
Successfully installed Semgrep Pro Engine (version 1.168.0)!

  Using git merge base detected from environment for diff scans: b468aacc5ef4b274d0dbebda68e975773126db3e
               
               
┌─────────────┐
│ Scan Status │
└─────────────┘
  Scanning 2 files tracked by git with 2944 Code rules, 1372 Supply Chain rules:
            
            
  CODE RULES
  Scanning 2 files with 47 <multilang> rules.
                    
  SUPPLY CHAIN RULES
                                                                                                                        
  Dependency Sources   Resolution Method   Ecosystem   Dependencies   Rules                                             
 ───────────────────────────────────────────────────────────────────────────                                            
  go.mod               Lockfile            Gomod       143             1372                                             
  website/yarn.lock    Skipped             Unknown     -                  -                                             
                                                                                                                        
                                                                                                                        
  Analysis       Rules                                                                                                  
 ──────────────────────                                                                                                 
  Basic            955                                                                                                  
  Reachability     397                                                                                                  
  Malicious         20                                                                                                  
                                                                                                                        
  Current version has 1 finding.

Creating git worktree from 'b468aacc5ef4b274d0dbebda68e975773126db3e' to scan baseline.
  Will report findings introduced by these commits (may be incomplete for shallow checkouts):
    * 5f1d38c build(deps): bump github.com/aws/smithy-go from 1.27.3 to 1.27.6

               
               
┌─────────────┐
│ Scan Status │
└─────────────┘
  Scanning 1 file tracked by git with 0 Code rules, 1 Supply Chain rule:
            
            
  CODE RULES
  Nothing to scan.
                    
  SUPPLY CHAIN RULES
                                                                                                                        
  Dependency Sources   Resolution Method   Ecosystem   Dependencies   Rules                                             
 ───────────────────────────────────────────────────────────────────────────                                            
  go.mod               Lockfile            Gomod       143                1                                             
                                                                                                                        
                                                                                                                        
  Analysis       Rules                                                                                                  
 ──────────────────────                                                                                                 
  Reachability       1                                                                                                  
                                                                                                                        
  Uploading scan results  
  Finalizing scan                         
                
┌──────────────┐
│ Scan Summary │
└──────────────┘
✅ CI scan completed successfully.
 • Findings: 0 (0 blocking)
 • Rules run: 111576
 • Targets scanned: 2
 • Parsed lines: ~100.0%
 • Scan skipped: 
   ◦ Matching --exclude patterns: 88
   ◦ Files matching .semgrepignore patterns: 121
 • Scan was limited to files changed since baseline commit.
 • For a detailed list of skipped files and lines, run semgrep with the --verbose flag
CI scan completed successfully.
  View results in Semgrep Cloud Platform:
    https://semgrep.dev/orgs/wardnet/findings?repo=wardnet/inforge&ref=refs/pull/266/merge
    https://semgrep.dev/orgs/wardnet/supply-chain/vulnerabilities?repo=wardnet/inforge&ref=refs/pull/266/merge
  No blocking findings so exiting with code 0

A new version of Semgrep is available. See https://semgrep.dev/docs/upgrading
[PASS] gosec
[FAIL] govulncheck
[PASS] semgrep
Error: 1 check(s) failed
bulwark: 1 check(s) failed
  • coverage — go: 66.3% (baseline 66.3%)

📦 Full bulwark output — complete scan and coverage logs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants