build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.107.2 to 1.113.1 by dependabot[bot] · Pull Request #319 · wardnet/inforge

dependabot · 2026-09-19T15:37:29Z

Bumps github.com/aws/aws-sdk-go-v2/service/s3 from 1.107.2 to 1.113.1.

Commits

a7eaa10 Release 2026-09-11
c6f53e8 Regenerated Clients
e80f4fa Update endpoints model
55b26d7 Update API model
113bc91 Release 2026-09-10
0b5dc66 Regenerated Clients
625a568 Update endpoints model
9ab2e92 Update API model
f0c4cca Don't notify on draft PR until ready for review (#3549)
b189f38 Release 2026-09-09
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) from 1.107.2 to 1.113.1. - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.107.2...service/s3/v1.113.1) --- updated-dependencies: - dependency-name: github.com/aws/aws-sdk-go-v2/service/s3 dependency-version: 1.113.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-09-19T15:50:33Z

bulwark

❌ scan — 4 govulncheck findings

error output

… truncated to the last 20000 bytes — full log in the run artifact linked below …
/dbbackup.go
[gosec] 2026/09/19 15:48:24 Checking file: /home/runner/work/inforge/inforge/program/dbcluster.go
[gosec] 2026/09/19 15:48:24 Checking file: /home/runner/work/inforge/inforge/program/dbdeploy.go
[gosec] 2026/09/19 15:48:24 Checking file: /home/runner/work/inforge/inforge/program/deploykey.go
[gosec] 2026/09/19 15:48:24 Checking file: /home/runner/work/inforge/inforge/program/encrypted.go
[gosec] 2026/09/19 15:48:24 Checking file: /home/runner/work/inforge/inforge/program/grafana.go
[gosec] 2026/09/19 15:48:24 Checking file: /home/runner/work/inforge/inforge/program/mesh.go
[gosec] 2026/09/19 15:48:24 Checking file: /home/runner/work/inforge/inforge/program/pkigrant.go
[gosec] 2026/09/19 15:48:24 Checking file: /home/runner/work/inforge/inforge/program/program.go
[gosec] 2026/09/19 15:48:24 Checking file: /home/runner/work/inforge/inforge/program/secretresolve.go
[gosec] 2026/09/19 15:48:24 Checking package: r2
[gosec] 2026/09/19 15:48:24 Checking file: /home/runner/work/inforge/inforge/internal/r2/r2.go
[gosec] 2026/09/19 15:48:24 Import directory: /home/runner/work/inforge/inforge/internal/validate
[gosec] 2026/09/19 15:48:25 Checking package: output
[gosec] 2026/09/19 15:48:25 Checking file: /home/runner/work/inforge/inforge/internal/output/report.go
[gosec] 2026/09/19 15:48:25 Checking file: /home/runner/work/inforge/inforge/internal/output/stream.go
[gosec] 2026/09/19 15:48:25 Checking file: /home/runner/work/inforge/inforge/internal/output/translate.go
[gosec] 2026/09/19 15:48:25 Import directory: /home/runner/work/inforge/inforge/internal/app
[gosec] 2026/09/19 15:48:25 Import directory: /home/runner/work/inforge/inforge/internal/cloudinit
[gosec] 2026/09/19 15:48:25 Checking package: cloudinit
[gosec] 2026/09/19 15:48:25 Checking file: /home/runner/work/inforge/inforge/internal/cloudinit/cloudinit.go
[gosec] 2026/09/19 15:48:25 Import directory: /home/runner/work/inforge/inforge/internal/meshpaths
[gosec] 2026/09/19 15:48:25 Checking package: meshpaths
[gosec] 2026/09/19 15:48:25 Checking file: /home/runner/work/inforge/inforge/internal/meshpaths/meshpaths.go
[gosec] 2026/09/19 15:48:25 Import directory: /home/runner/work/inforge/inforge/internal/nginx
[gosec] 2026/09/19 15:48:26 Checking package: app
[gosec] 2026/09/19 15:48:26 Checking file: /home/runner/work/inforge/inforge/internal/app/app.go
[gosec] 2026/09/19 15:48:26 Import directory: /home/runner/work/inforge/inforge/internal/otelcol
[gosec] 2026/09/19 15:48:26 Checking package: otelcol
[gosec] 2026/09/19 15:48:26 Checking file: /home/runner/work/inforge/inforge/internal/otelcol/config.go
[gosec] 2026/09/19 15:48:26 Checking file: /home/runner/work/inforge/inforge/internal/otelcol/install.go
[gosec] 2026/09/19 15:48:26 Checking file: /home/runner/work/inforge/inforge/internal/otelcol/paths.go
[gosec] 2026/09/19 15:48:26 Checking file: /home/runner/work/inforge/inforge/internal/otelcol/shell.go
[gosec] 2026/09/19 15:48:26 Import directory: /home/runner/work/inforge/inforge/internal/pki
[gosec] 2026/09/19 15:48:27 Checking package: pki
[gosec] 2026/09/19 15:48:27 Checking file: /home/runner/work/inforge/inforge/internal/pki/leaf.go
[gosec] 2026/09/19 15:48:27 Checking file: /home/runner/work/inforge/inforge/internal/pki/store.go
[gosec] 2026/09/19 15:48:27 Checking file: /home/runner/work/inforge/inforge/internal/pki/x509.go
[gosec] 2026/09/19 15:48:27 Import directory: /home/runner/work/inforge/inforge/internal/registry
[gosec] 2026/09/19 15:48:27 Checking package: validate
[gosec] 2026/09/19 15:48:27 Checking file: /home/runner/work/inforge/inforge/internal/validate/cidr.go
[gosec] 2026/09/19 15:48:27 Checking file: /home/runner/work/inforge/inforge/internal/validate/observability.go
[gosec] 2026/09/19 15:48:27 Checking file: /home/runner/work/inforge/inforge/internal/validate/security.go
[gosec] 2026/09/19 15:48:27 Checking file: /home/runner/work/inforge/inforge/internal/validate/source.go
[gosec] 2026/09/19 15:48:27 Checking file: /home/runner/work/inforge/inforge/internal/validate/validate.go
[gosec] 2026/09/19 15:48:27 Checking package: nginx
[gosec] 2026/09/19 15:48:27 Checking file: /home/runner/work/inforge/inforge/internal/nginx/config.go
[gosec] 2026/09/19 15:48:27 Checking file: /home/runner/work/inforge/inforge/internal/nginx/install.go
[gosec] 2026/09/19 15:48:27 Checking file: /home/runner/work/inforge/inforge/internal/nginx/paths.go
[gosec] 2026/09/19 15:48:27 Import directory: /home/runner/work/inforge/inforge/internal/tags
[gosec] 2026/09/19 15:48:27 Import directory: /home/runner/work/inforge/inforge/cmd/inforge
[gosec] 2026/09/19 15:48:27 Checking package: tags
[gosec] 2026/09/19 15:48:27 Checking file: /home/runner/work/inforge/inforge/internal/tags/tags.go
[gosec] 2026/09/19 15:48:27 Import directory: /home/runner/work/inforge/inforge/internal/backupstore
[gosec] 2026/09/19 15:48:28 Checking package: backupstore
[gosec] 2026/09/19 15:48:28 Checking file: /home/runner/work/inforge/inforge/internal/backupstore/store.go
[gosec] 2026/09/19 15:48:28 Checking package: cloudflare
[gosec] 2026/09/19 15:48:28 Checking file: /home/runner/work/inforge/inforge/providers/cloudflare/dns.go
[gosec] 2026/09/19 15:48:29 Checking package: registry
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/internal/registry/registry.go
[gosec] 2026/09/19 15:48:29 Checking package: main
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/arch.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/config.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/db.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/deploy.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/ephemeral.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/ephemeral_down.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/ephemeral_reap.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/ephemeral_up.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/main.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/matrix.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/meshbaseline.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/pki.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/plugins.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/preview.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/release.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/releases.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/report.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/secret.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/service.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/servicecmds.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/serviceinspect.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/sshpush.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/stack.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/statelock.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/update.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/validate.go
[gosec] 2026/09/19 15:48:29 Checking file: /home/runner/work/inforge/inforge/cmd/inforge/version.go
Results:


Summary:
  Gosec  : dev
  Files  : 138
  Lines  : 30994
  Nosec  : 45
  Issues : 0

go: downloading golang.org/x/vuln v1.7.0
go: downloading golang.org/x/telemetry v0.0.0-20260811182544-a038080d80e5
go: downloading golang.org/x/mod v0.39.0
go: downloading golang.org/x/tools v0.49.0
=== Symbol Results ===

Vulnerability #1: GO-2026-6443
    Server panic via missing authority or Host headers in google.golang.org/grpc
  More info: https://pkg.go.dev/vuln/GO-2026-6443
  Module: google.golang.org/grpc
    Found in: google.golang.org/grpc@v1.82.1
    Fixed in: google.golang.org/grpc@v1.82.2
    Example traces found:
      #1: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.http2Server.HandleStreams

Vulnerability #2: GO-2026-6355
    Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-6355
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.55.0
    Fixed in: golang.org/x/crypto@v0.56.0
    Example traces found:
      #1: cmd/inforge/stack.go:217:31: inforge.ephemeralWorkspace calls auto.NewLocalWorkspace, which eventually calls ssh.NewClientConn

Vulnerability #3: GO-2026-6354
    Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh
  More info: https://pkg.go.dev/vuln/GO-2026-6354
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.55.0
    Fixed in: golang.org/x/crypto@v0.56.0
    Example traces found:
      #1: cmd/inforge/stack.go:217:31: inforge.ephemeralWorkspace calls auto.NewLocalWorkspace, which eventually calls ssh.NewClientConn

Vulnerability #4: GO-2026-6348
    Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in
    google.golang.org/grpc
  More info: https://pkg.go.dev/vuln/GO-2026-6348
  Module: google.golang.org/grpc
    Found in: google.golang.org/grpc@v1.82.1
    Fixed in: google.golang.org/grpc@v1.83.1
    Example traces found:
      #1: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls mem.BufferSlice.MaterializeToBuffer
      #2: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls mem.IsBelowBufferPoolingThreshold
      #3: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls mem.NewBuffer
      #4: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls mem.ReadAll
      #5: internal/secretstore/age.go:70:20: secretstore.Encrypt calls armor.armoredWriter.Close, which eventually calls mem.writer.Write
      #6: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.ClientStream.Close
      #7: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.ClientStream.Header
      #8: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.ClientStream.Read
      #9: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.ClientStream.RecvCompress
      #10: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.ClientStream.TrailersOnly
      #11: internal/registry/registry.go:268:17: registry.registry.DNS calls sync.Once.Do, which eventually calls transport.NewHTTP2Client
      #12: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.NewServerTransport
      #13: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.ServerStream.Read
      #14: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.Stream.ReadMessageHeader
      #15: cmd/inforge/preview.go:100:28: inforge.runPreview calls auto.Stack.Preview, which eventually calls transport.http2Client.Close
      #16: cmd/inforge/preview.go:100:28: inforge.runPreview calls auto.Stack.Preview, which eventually calls transport.http2Client.GracefulClose
      #17: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.http2Client.NewStream
      #18: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.http2Server.Close
      #19: providers/hetzner/compute.go:250:33: hetzner.HetznerCompute.Create calls hcloud.NewServer, which eventually calls transport.http2Server.HandleStreams

Your code is affected by 4 vulnerabilities from 2 modules.
This scan also found 0 vulnerabilities in packages you import and 2
vulnerabilities in modules you require, but your code doesn't appear to call
these vulnerabilities.
Use '-show verbose' for more details.
creating virtual environment...
installing semgrep from spec 'semgrep==1.173.0'...
done! ✨ 🌟 ✨
  installed package semgrep 1.173.0, installed using Python 3.12.3
  These apps are now available
    - pysemgrep
    - semgrep
                  
                  
┌────────────────┐
│ Debugging Info │
└────────────────┘
                  
  SCAN ENVIRONMENT
  versions    - semgrep 1.173.0 on python 3.12.3                                       
  environment - running in environment github-actions, triggering event is pull_request
Fixing git state for github action pull request
Not on head ref: bb93ad64b7024c8e76fa30f004d848beaedb98ba; checking that out now.
            
  CONNECTION
Using b429a6cc71e5ac1730e904afc3d71d378b494c4d as the merge-base of b429a6cc71e5ac1730e904afc3d71d378b494c4d and bb93ad64b7024c8e76fa30f004d848beaedb98ba
  Initializing scan (deployment=wardnet, scan_id=230563564)  
  Enabled products: Code, Supply Chain                               
        
  ENGINE
Semgrep Pro Engine will be installed in /opt/pipx/venvs/semgrep/lib/python3.12/site-packages/semgrep/bin/semgrep-core-proprietary
Downloading... ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 316.6/316.6 MB 456.4 MB/s 0:00:00
Successfully installed Semgrep Pro Engine (version 1.173.0)!

  Using git merge base detected from environment for diff scans: b429a6cc71e5ac1730e904afc3d71d378b494c4d
               
               
┌─────────────┐
│ Scan Status │
└─────────────┘
  Scanning 2 files tracked by git with 2944 Code rules, 1461 Supply Chain rules:
            
            
  CODE RULES
  Scanning 2 files with 47 <multilang> rules.
                    
  SUPPLY CHAIN RULES
                                                                                                                        
  Dependency Sources   Resolution Method   Ecosystem   Dependencies   Rules                                             
 ───────────────────────────────────────────────────────────────────────────                                            
  go.mod               Lockfile            Gomod       146             1461                                             
  website/yarn.lock    Skipped             Unknown     -                  -                                             
                                                                                                                        
                                                                                                                        
  Analysis       Rules                                                                                                  
 ──────────────────────                                                                                                 
  Basic            997                                                                                                  
  Reachability     442                                                                                                  
  Malicious         22                                                                                                  
                                                                                                                        
  Current version has 2 findings.

Creating git worktree from 'b429a6cc71e5ac1730e904afc3d71d378b494c4d' to scan baseline.
  Will report findings introduced by these commits (may be incomplete for shallow checkouts):
    * bb93ad6 build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3

               
               
┌─────────────┐
│ Scan Status │
└─────────────┘
  Scanning 1 file tracked by git with 2 Supply Chain rules:
            
            
  CODE RULES
  No code rules to run.
                    
  SUPPLY CHAIN RULES
                                                                                                                        
  Dependency Sources   Resolution Method   Ecosystem   Dependencies   Rules                                             
 ───────────────────────────────────────────────────────────────────────────                                            
  go.mod               Lockfile            Gomod       146                2                                             
                                                                                                                        
                                                                                                                        
  Analysis       Rules                                                                                                  
 ──────────────────────                                                                                                 
  Reachability       2                                                                                                  
                                                                                                                        
  Uploading scan results  
  Finalizing scan                         
                
┌──────────────┐
│ Scan Summary │
└──────────────┘
✅ CI scan completed successfully.
 • Findings: 0 (0 blocking)
 • Rules run: 115327
 • Targets scanned: 2
 • Parsed lines: ~100.0%
 • Scan skipped: 
   ◦ Matching --exclude patterns: 89
   ◦ Files matching .semgrepignore patterns: 124
 • Scan was limited to files changed since baseline commit.
 • For a detailed list of skipped files and lines, run semgrep with the --verbose flag
CI scan completed successfully.
  View results in Semgrep Cloud Platform:
    https://semgrep.dev/orgs/wardnet/findings?repo=wardnet/inforge&ref=refs/pull/319/merge
    https://semgrep.dev/orgs/wardnet/supply-chain/vulnerabilities?repo=wardnet/inforge&ref=refs/pull/319/merge
  No blocking findings so exiting with code 0

A new version of Semgrep is available. See https://semgrep.dev/docs/upgrading
[PASS] gosec
[FAIL] govulncheck
[PASS] semgrep
Error: 1 check(s) failed
bulwark: 1 check(s) failed

✅ coverage — go: 67.3% (baseline 67.3%)

📦 Full bulwark output — complete scan and coverage logs.

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Sep 19, 2026

dependabot Bot mentioned this pull request Sep 19, 2026

build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.107.2 to 1.111.0 #305

Closed

Navigation Menu

build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.107.2 to 1.113.1 - #319

build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.107.2 to 1.113.1#319
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/s3-1.113.1

dependabot Bot commented on behalf of github Sep 19, 2026

Uh oh!

github-actions Bot commented Sep 19, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 19, 2026

Uh oh!

github-actions Bot commented Sep 19, 2026

bulwark

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants