From 1c4237dd063292113b405c3b234c26d4a555db42 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 11 Aug 2026 09:28:00 +0000 Subject: [PATCH] build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.43.3 to 1.43.4 Bumps [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) from 1.43.3 to 1.43.4. - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](https://github.com/aws/aws-sdk-go-v2/compare/v1.43.3...v1.43.4) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2 dependency-version: 1.43.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- go.mod | 2 +- go.sum | 4 +-- .../aws-sdk-go-v2/aws/go_module_metadata.go | 2 +- .../aws/transport/http/client.go | 27 ++++++++++++++++++- vendor/modules.txt | 2 +- 5 files changed, 31 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index d003053e..3c7adace 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.26 require ( github.com/KimMachineGun/automemlimit v0.7.5 - github.com/aws/aws-sdk-go-v2 v1.43.3 + github.com/aws/aws-sdk-go-v2 v1.43.4 github.com/aws/aws-sdk-go-v2/config v1.32.34 github.com/aws/aws-sdk-go-v2/credentials v1.19.33 github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.22.38 diff --git a/go.sum b/go.sum index ac0dc834..913a7efc 100644 --- a/go.sum +++ b/go.sum @@ -51,8 +51,8 @@ github.com/andybalholm/brotli v1.1.1 h1:PR2pgnyFznKEugtsUo0xLdDop5SKXd5Qf5ysW+7X github.com/andybalholm/brotli v1.1.1/go.mod h1:05ib4cKhjx3OQYUY22hTVd34Bc8upXjOLL2rKwwZBoA= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= -github.com/aws/aws-sdk-go-v2 v1.43.3 h1:XJIcfv8uDs2ukdQsoAC8/Ebu1ejxwzlayl2ZsiFns2A= -github.com/aws/aws-sdk-go-v2 v1.43.3/go.mod h1:70vwSy16txshwG+g55WkpgPKDIByzHI8ccBsOteo3bQ= +github.com/aws/aws-sdk-go-v2 v1.43.4 h1:b9FTvbRwy+JCsfp2Wp6wV/KbOx3Aj7nkoFb2cRX0IhE= +github.com/aws/aws-sdk-go-v2 v1.43.4/go.mod h1:70vwSy16txshwG+g55WkpgPKDIByzHI8ccBsOteo3bQ= github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.16 h1:aiuaKlDweRC5qExJondpWjOgyzMHpofpwspGXUtwn4c= github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.16/go.mod h1:nG/LOlmox9BDe9HvQnXWzgcK8uKbgBMZ/Hp5pVt/21I= github.com/aws/aws-sdk-go-v2/config v1.32.34 h1:o+YAizrX562nEZXaB38uYTK8RvIsvW0uuRP+e5e0Pfk= diff --git a/vendor/github.com/aws/aws-sdk-go-v2/aws/go_module_metadata.go b/vendor/github.com/aws/aws-sdk-go-v2/aws/go_module_metadata.go index 5b940e38..93b3d00e 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/aws/go_module_metadata.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/aws/go_module_metadata.go @@ -3,4 +3,4 @@ package aws // goModuleVersion is the tagged release for this module -const goModuleVersion = "1.43.3" +const goModuleVersion = "1.43.4" diff --git a/vendor/github.com/aws/aws-sdk-go-v2/aws/transport/http/client.go b/vendor/github.com/aws/aws-sdk-go-v2/aws/transport/http/client.go index 49cc3120..94094ec2 100644 --- a/vendor/github.com/aws/aws-sdk-go-v2/aws/transport/http/client.go +++ b/vendor/github.com/aws/aws-sdk-go-v2/aws/transport/http/client.go @@ -2,6 +2,7 @@ package http import ( "context" + "crypto/fips140" "crypto/tls" "net" "net/http" @@ -27,6 +28,19 @@ var ( // Default to TLS 1.2 for all HTTPS requests. DefaultHTTPTransportTLSMinVersion uint16 = tls.VersionTLS12 + + // DefaultHTTPTransportTLSCurvePreferencesFIPS is the elliptic curve preference + // list applied to the default transport when the FIPS 140-3 module is active. + // + // Go's default preferences lead with X25519, which crypto/ecdh rejects under + // GODEBUG=fips140=only, failing every TLS handshake the SDK attempts. Only the + // NIST curves are FIPS-approved, so restricting to them keeps the default + // client usable in FIPS deployments. + DefaultHTTPTransportTLSCurvePreferencesFIPS = []tls.CurveID{ + tls.CurveP256, + tls.CurveP384, + tls.CurveP521, + } ) // Timeouts for net.Dialer's network connection. @@ -178,6 +192,16 @@ func defaultDialer() *net.Dialer { } } +// defaultTLSCurvePreferences returns the curve preferences for the default +// transport. Outside FIPS mode it returns nil so Go's own defaults apply, +// preserving X25519 and the post-quantum X25519MLKEM768 hybrid. +func defaultTLSCurvePreferences(fipsEnabled bool) []tls.CurveID { + if !fipsEnabled { + return nil + } + return DefaultHTTPTransportTLSCurvePreferencesFIPS +} + func defaultHTTPTransport() *http.Transport { dialer := defaultDialer() @@ -192,7 +216,8 @@ func defaultHTTPTransport() *http.Transport { ExpectContinueTimeout: DefaultHTTPTransportExpectContinueTimeout, ForceAttemptHTTP2: true, TLSClientConfig: &tls.Config{ - MinVersion: DefaultHTTPTransportTLSMinVersion, + MinVersion: DefaultHTTPTransportTLSMinVersion, + CurvePreferences: defaultTLSCurvePreferences(fips140.Enabled()), }, } diff --git a/vendor/modules.txt b/vendor/modules.txt index 7fffc053..13618ea1 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -15,7 +15,7 @@ github.com/STARRY-S/zip ## explicit; go 1.13 github.com/andybalholm/brotli github.com/andybalholm/brotli/matchfinder -# github.com/aws/aws-sdk-go-v2 v1.43.3 +# github.com/aws/aws-sdk-go-v2 v1.43.4 ## explicit; go 1.24 github.com/aws/aws-sdk-go-v2/aws github.com/aws/aws-sdk-go-v2/aws/arn