chore: Update dist

Bumps [@aws-sdk/client-sts](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sts) from 3.1111.0 to 3.1116.0.
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sts/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1116.0/clients/client-sts)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-sts"
  dependency-version: 3.1116.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/close-stale-issues.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Stale issue job
     steps:
-    - uses: aws-actions/stale-issue-cleanup@v6
+    - uses: aws-actions/stale-issue-cleanup@v7
       with:
         # Setting messages to an empty string will cause the automation to skip
         # that category

.release-please-manifest.json

@@ -1,5 +1,5 @@
 {
   ".release-please-manifest.json": "4.0.2",
   "package.json": "6.0.0",
-  ".": "6.2.2"
+  ".": "6.2.3"
 }

CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [6.2.3](https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.2...v6.2.3) (2026-07-22)
+
+
+### Bug Fixes
+
+* attach git credentials before Tag Major Version push ([#1877](https://github.com/aws-actions/configure-aws-credentials/issues/1877)) ([9ae780b](https://github.com/aws-actions/configure-aws-credentials/commit/9ae780b171afa8c5a3a6a2d154a765b709492482))
+* PackedPolicyTooLarge detection in STS tags ([#1899](https://github.com/aws-actions/configure-aws-credentials/issues/1899)) ([fa8d6a5](https://github.com/aws-actions/configure-aws-credentials/commit/fa8d6a57bbf44b34439fb080bbdadc7c92c285eb))
+
 ## [6.2.2](https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.1...v6.2.2) (2026-07-07)
 
 

CONTRIBUTING.md

@@ -28,6 +28,12 @@ these are incredibly useful:
 - Any modifications you've made relevant to the bug
 - Anything unusual about your environment or deployment
 
+We also ask that you refrain from opening issues via the `gh` CLI or GitHub
+API. These methods bypass our issue templates and therefore don't apply the
+proper labels or workflows that we use. Note that AI agents typically do not
+properly use issue templates. Issues that don't have the proper labels
+applied may be closed without comment.
+
 ## Contributing via Pull Requests
 
 Contributions via pull requests are much appreciated. Before sending us a pull

README.md

@@ -61,7 +61,7 @@ Authenticate to AWS in GitHub Actions (and others)! Works especially well with
        runs-on: ubuntu-latest
        steps:
          - name: Configure AWS Credentials
-           uses: aws-actions/configure-aws-credentials@v6.1.0
+           uses: aws-actions/configure-aws-credentials@v6.2.3
            with:
              role-to-assume: <Role ARN you created in step 2>
              aws-region: <AWS Region you want to use>
@@ -250,7 +250,7 @@ specify the profile name as an environment variable in the job step:
 
 ```yaml
 - name: Configure AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
   with:
     aws-region: us-east-1
     role-to-assume: arn:aws:iam::123456789100:role/my-role
@@ -268,14 +268,14 @@ step environment variables:
 
 ```yaml
 - name: Configure AWS credentials
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
   with:
     aws-region: us-east-1
     role-to-assume: arn:aws:iam::123456789100:role/my-first-role
     aws-profile: firstRoleInChain
 
 - name: assume second role
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
   with:
     aws-region: us-east-2
     role-to-assume: arn:aws:iam::987654321000:role/my-second-role
@@ -311,7 +311,7 @@ this action will always consider the `HTTP_PROXY` environment variable.
 Manually configured proxy:
 
 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.1.0
+uses: aws-actions/configure-aws-credentials@v6.2.3
 with:
   aws-region: us-east-2
   role-to-assume: my-github-actions-role
@@ -458,7 +458,7 @@ line.
 <summary>Inline session policy examples</summary>
 
 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.1.0
+uses: aws-actions/configure-aws-credentials@v6.2.3
 with:
   inline-session-policy: '{"Version":"2012-10-17","Statement":[{"Sid":"Stmt1","Effect":"Allow","Action":"s3:List*","Resource":"*"}]}'
 ```
@@ -466,7 +466,7 @@ with:
 Or we can have a nicely formatted JSON as well:
 
 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.1.0
+uses: aws-actions/configure-aws-credentials@v6.2.3
 with:
   inline-session-policy: >-
     {
@@ -494,7 +494,7 @@ the role.
 <summary>Managed session policy examples</summary>
 
 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.1.0
+uses: aws-actions/configure-aws-credentials@v6.2.3
 with:
   managed-session-policies: arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
 ```
@@ -502,7 +502,7 @@ with:
 And we can pass multiple managed policies likes this:
 
 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.1.0
+uses: aws-actions/configure-aws-credentials@v6.2.3
 with:
   managed-session-policies: |
     arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
@@ -548,7 +548,7 @@ specify the audience through the `audience` input:
 
 ```yaml
 - name: Configure AWS Credentials for China region audience
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
   with:
     audience: sts.amazonaws.com.cn
     aws-region: cn-northwest-1
@@ -708,7 +708,7 @@ Provider. The audience would still be `sts.amazonaws.com` by default.
 
 ```yaml
 - name: Configure AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
   with:
     aws-region: us-east-2
     role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
@@ -724,13 +724,13 @@ environment variable and use it to assume the role
 
 ```yaml
 - name: Configure AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
   with:
     aws-region: us-east-2
     role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
     role-session-name: MySessionName
 - name: Configure other AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
   with:
     aws-region: us-east-2
     role-to-assume: arn:aws:iam::987654321000:role/my-second-role
@@ -752,7 +752,7 @@ alternatively, the `TagSession` permission can be omitted if you are using the
 
 ```yaml
 - name: Configure AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
   with:
     aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
     aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -773,7 +773,7 @@ like `role-to-assume: my-github-actions-role`.
 ```yaml
 - name: Configure AWS Credentials 1
   id: creds
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
   with:
     aws-region: us-east-2
     role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
@@ -782,7 +782,7 @@ like `role-to-assume: my-github-actions-role`.
   run: |
     aws sts get-caller-identity
 - name: Configure AWS Credentials 2
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
   with:
     aws-region: us-east-2
     aws-access-key-id: ${{ steps.creds.outputs.aws-access-key-id }}
@@ -813,14 +813,14 @@ provided.
 
 ```yaml
 - name: Configure AWS Credentials for Dev
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
   with:
     aws-region: us-east-1
     role-to-assume: arn:aws:iam::111111111111:role/dev-role
     aws-profile: dev
 
 - name: Configure AWS Credentials for Prod
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
   with:
     aws-region: us-west-2
     role-to-assume: arn:aws:iam::222222222222:role/prod-role

THIRD-PARTY

@@ -222,7 +222,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 The following npm package may be included in this product:
 
- - @aws-sdk/client-sts@3.1086.0
+ - @aws-sdk/client-sts@3.1116.0
 
 This package contains the following license:
 
@@ -432,9 +432,9 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/signature-v4-multi-region@3.996.39
+ - @aws-sdk/signature-v4-multi-region@3.996.46
- - @smithy/core@3.29.3
+ - @smithy/core@3.33.3
- - @smithy/types@4.16.1
+ - @smithy/types@4.17.2
 
 These packages each contain the following license:
 
@@ -832,7 +832,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 The following npm package may be included in this product:
 
- - @aws-sdk/core@3.975.1
+ - @aws-sdk/core@3.977.9
 
 This package contains the following license:
 
@@ -1042,16 +1042,16 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/credential-provider-env@3.972.57
+ - @aws-sdk/credential-provider-env@3.972.70
- - @aws-sdk/credential-provider-ini@3.973.1
+ - @aws-sdk/credential-provider-ini@3.973.15
- - @aws-sdk/credential-provider-node@3.972.67
+ - @aws-sdk/credential-provider-node@3.972.81
- - @aws-sdk/token-providers@3.1083.0
+ - @aws-sdk/token-providers@3.1116.0
- - @aws-sdk/types@3.974.0
+ - @aws-sdk/types@3.974.5
- - @aws-sdk/xml-builder@3.972.34
+ - @aws-sdk/xml-builder@3.972.40
- - @smithy/credential-provider-imds@4.4.8
+ - @smithy/credential-provider-imds@4.5.2
- - @smithy/fetch-http-handler@5.6.5
+ - @smithy/fetch-http-handler@5.7.2
- - @smithy/node-http-handler@4.9.5
+ - @smithy/node-http-handler@4.11.3
- - @smithy/signature-v4@5.6.4
+ - @smithy/signature-v4@5.6.12
 
 These packages each contain the following license:
 
@@ -1261,9 +1261,9 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/credential-provider-process@3.972.57
+ - @aws-sdk/credential-provider-process@3.972.70
- - @aws-sdk/credential-provider-sso@3.973.1
+ - @aws-sdk/credential-provider-sso@3.973.14
- - @aws-sdk/credential-provider-web-identity@3.972.63
+ - @aws-sdk/credential-provider-web-identity@3.972.76
 
 These packages each contain the following license:
 
@@ -1473,9 +1473,9 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/credential-provider-http@3.972.59
+ - @aws-sdk/credential-provider-http@3.972.72
- - @aws-sdk/credential-provider-login@3.972.63
+ - @aws-sdk/credential-provider-login@3.972.77
- - @aws-sdk/nested-clients@3.997.31
+ - @aws-sdk/nested-clients@3.997.44
 
 These packages each contain the following license:
 
@@ -1485,7 +1485,7 @@ Apache-2.0
 
 The following npm package may be included in this product:
 
- - ip-address@10.2.0
+ - ip-address@10.4.0
 
 This package contains the following license:
 
@@ -1740,7 +1740,7 @@ SOFTWARE.
 
 The following npm package may be included in this product:
 
- - undici@6.27.0
+ - undici@6.28.0
 
 This package contains the following license:
 

dist/cleanup/index.js

@@ -1929,7 +1929,11 @@ var require_request = __commonJS({
           } else if (typeof val[i] === "object") {
             throw new InvalidArgumentError(`invalid ${key} header`);
           } else {
-            arr.push(`${val[i]}`);
+            const str = `${val[i]}`;
+            if (!isValidHeaderValue(str)) {
+              throw new InvalidArgumentError(`invalid ${key} header`);
+            }
+            arr.push(str);
           }
         }
         val = arr;
@@ -1941,6 +1945,9 @@ var require_request = __commonJS({
         val = "";
       } else {
         val = `${val}`;
+        if (!isValidHeaderValue(val)) {
+          throw new InvalidArgumentError(`invalid ${key} header`);
+        }
       }
       if (headerName === "host") {
         if (request.host !== null) {
@@ -5671,6 +5678,7 @@ var require_client_h1 = __commonJS({
       RequestContentLengthMismatchError,
       ResponseContentLengthMismatchError,
       RequestAbortedError,
+      InvalidArgumentError,
       HeadersTimeoutError,
       HeadersOverflowError,
       SocketError,
@@ -6397,8 +6405,16 @@ var require_client_h1 = __commonJS({
         }
         body = bodyStream.stream;
         contentLength = bodyStream.length;
-      } else if (util.isBlobLike(body) && request.contentType == null && body.type) {
+      } else if (util.isBlobLike(body) && request.contentType == null) {
-        headers.push("content-type", body.type);
+        const contentType = body.type;
+        if (contentType) {
+          const contentTypeValue = `${contentType}`;
+          if (!util.isValidHeaderValue(contentTypeValue)) {
+            util.errorRequest(client, request, new InvalidArgumentError("invalid content-type header"));
+            return false;
+          }
+          headers.push("content-type", contentTypeValue);
+        }
       }
       if (body && typeof body.read === "function") {
         body.read(0);
@@ -8950,6 +8966,24 @@ var require_retry_handler = __commonJS({
       const current = Date.now();
       return new Date(retryAfter).getTime() - current;
     }
+    function validatePartialResponseContentLength(headers, range, statusCode, retryCount) {
+      const contentLength = headers["content-length"];
+      if (contentLength == null) {
+        return null;
+      }
+      if (!Number.isFinite(range.start) || !Number.isFinite(range.end)) {
+        return null;
+      }
+      const length = Number(contentLength);
+      const expectedLength = range.end - range.start + 1;
+      if (!Number.isFinite(length) || length !== expectedLength) {
+        return new RequestRetryError("Content-Length mismatch", statusCode, {
+          headers,
+          data: { count: retryCount }
+        });
+      }
+      return null;
+    }
     var RetryHandler = class _RetryHandler {
       constructor(opts, handlers) {
         const { retryOptions, ...dispatchOpts } = opts;
@@ -9122,6 +9156,11 @@ var require_retry_handler = __commonJS({
             );
             return false;
           }
+          const contentLengthError = validatePartialResponseContentLength(headers, contentRange, statusCode, this.retryCount);
+          if (contentLengthError != null) {
+            this.abort(contentLengthError);
+            return false;
+          }
           const { start, size, end = size - 1 } = contentRange;
           assert(this.start === start, "content-range mismatch");
           assert(this.end == null || this.end === end, "content-range mismatch");
@@ -9139,6 +9178,11 @@ var require_retry_handler = __commonJS({
                 statusMessage
               );
             }
+            const contentLengthError = validatePartialResponseContentLength(headers, range, statusCode, this.retryCount);
+            if (contentLengthError != null) {
+              this.abort(contentLengthError);
+              return false;
+            }
             const { start, size, end = size - 1 } = range;
             assert(
               start != null && Number.isFinite(start),
@@ -15984,14 +16028,48 @@ var require_util6 = __commonJS({
       for (let i = 0; i < path.length; ++i) {
         const code = path.charCodeAt(i);
         if (code < 32 || // exclude CTLs (0-31)
-        code === 127 || // DEL
+        code > 126 || // exclude DEL and non-ascii
         code === 59) {
           throw new Error("Invalid cookie path");
         }
       }
     }
+    function isLetterOrDigit(code) {
+      return code >= 48 && code <= 57 || // 0-9
+      code >= 65 && code <= 90 || // A-Z
+      code >= 97 && code <= 122;
+    }
     function validateCookieDomain(domain) {
-      if (domain.startsWith("-") || domain.endsWith(".") || domain.endsWith("-")) {
+      if (domain === " ") {
+        return;
+      }
+      if (domain.length > 255) {
+        throw new Error("Invalid cookie domain");
+      }
+      let labelLength = 0;
+      for (let i = 0; i < domain.length; ++i) {
+        const code = domain.charCodeAt(i);
+        if (code === 46) {
+          if (labelLength === 0) {
+            throw new Error("Invalid cookie domain");
+          }
+          if (domain.charCodeAt(i - 1) === 45) {
+            throw new Error("Invalid cookie domain");
+          }
+          labelLength = 0;
+          continue;
+        }
+        if (labelLength === 0 && !isLetterOrDigit(code)) {
+          throw new Error("Invalid cookie domain");
+        }
+        if (!isLetterOrDigit(code) && code !== 45) {
+          throw new Error("Invalid cookie domain");
+        }
+        if (++labelLength > 63) {
+          throw new Error("Invalid cookie domain");
+        }
+      }
+      if (labelLength === 0 || domain.charCodeAt(domain.length - 1) === 45) {
         throw new Error("Invalid cookie domain");
       }
     }
@@ -16074,7 +16152,11 @@ var require_util6 = __commonJS({
           throw new Error("Invalid unparsed");
         }
         const [key, ...value] = part.split("=");
-        out.push(`${key.trim()}=${value.join("=")}`);
+        const trimmedKey = key.trim();
+        const joinedValue = value.join("=");
+        validateCookieName(trimmedKey);
+        validateCookieValue(joinedValue);
+        out.push(`${trimmedKey}=${joinedValue}`);
       }
       return out.join("; ");
     }

package.json

@@ -1,7 +1,7 @@
 {
   "name": "configure-aws-credentials",
   "description": "A GitHub Action to configure AWS credentials",
-  "version": "6.2.2",
+  "version": "6.2.3",
   "scripts": {
     "build": "tsc",
     "lint": "biome check --error-on-warnings ./src ./test && markdownlint -i node_modules -i CHANGELOG.md '**/*.md'",
@@ -17,25 +17,25 @@
     "organization": true
   },
   "devDependencies": {
-    "@aws-sdk/credential-provider-env": "^3.972.57",
+    "@aws-sdk/credential-provider-env": "^3.972.70",
-    "@biomejs/biome": "2.5.3",
+    "@biomejs/biome": "2.5.10",
-    "@smithy/property-provider": "^4.4.8",
+    "@smithy/property-provider": "^4.5.2",
-    "@types/node": "^26.1.1",
+    "@types/node": "^26.2.0",
     "@vitest/coverage-v8": "4.1.10",
     "aws-sdk-client-mock": "^4.1.0",
-    "esbuild": "^0.28.1",
+    "esbuild": "^0.28.2",
     "generate-license-file": "^4.2.1",
     "json-schema": "^0.4.0",
-    "markdownlint-cli": "^0.49.0",
+    "markdownlint-cli": "^0.49.1",
-    "memfs": "^4.64.0",
+    "memfs": "^4.68.1",
     "standard-version": "^9.5.0",
     "typescript": "^7.0.2",
     "vitest": "4.1.10"
   },
   "dependencies": {
     "@actions/core": "^3.0.1",
-    "@aws-sdk/client-sts": "^3.1086.0",
+    "@aws-sdk/client-sts": "^3.1116.0",
-    "@smithy/node-http-handler": "^4.9.5",
+    "@smithy/node-http-handler": "^4.11.3",
     "proxy-agent": "^8.0.2"
   },
   "keywords": [

src/assumeRole.ts

@@ -2,11 +2,7 @@ import assert from 'node:assert';
 import path from 'node:path';
 import * as core from '@actions/core';
 import type { AssumeRoleCommandInput, STSClient, Tag } from '@aws-sdk/client-sts';
-import {
+import { AssumeRoleCommand, AssumeRoleWithWebIdentityCommand } from '@aws-sdk/client-sts';
-  AssumeRoleCommand,
-  AssumeRoleWithWebIdentityCommand,
-  PackedPolicyTooLargeException,
-} from '@aws-sdk/client-sts';
 import type { CredentialsClient } from './CredentialsClient';
 import { errorMessage, isDefined, readFileUtf8, sanitizeGitHubVariables } from './helpers';
 
@@ -65,7 +61,7 @@ async function assumeRoleWithCredentials(params: AssumeRoleCommandInput, client:
     const creds = await client.send(new AssumeRoleCommand({ ...params }));
     return creds;
   } catch (error) {
-    if (error instanceof PackedPolicyTooLargeException) {
+    if ((error as { name?: string })?.name === 'PackedPolicyTooLargeException') {
       core.info('Session tag size is too large; dropping droppable tags and retrying.');
       const droppableKeys = new Set(DROPPABLE_TAG_SOURCES.map((s) => s.key));
       params.Tags = params.Tags?.filter((tag) => !droppableKeys.has(tag.Key ?? ''));

test/index.test.ts

@@ -3,7 +3,6 @@ import {
   AssumeRoleCommand,
   AssumeRoleWithWebIdentityCommand,
   GetCallerIdentityCommand,
-  PackedPolicyTooLargeException,
   STSClient,
 } from '@aws-sdk/client-sts';
 import { mockClient } from 'aws-sdk-client-mock';
@@ -331,10 +330,11 @@ describe('Configure AWS Credentials', {}, () => {
     });
     it('drops droppable tags and retries on PackedPolicyTooLargeException', {}, async () => {
       vi.mocked(core.getInput).mockImplementation(mocks.getInput(mocks.IAM_ASSUMEROLE_INPUTS));
-      mockedSTSClient
+      // Reject with a plain error carrying only the `name`, NOT an instance of the SDK class. This
-        .on(AssumeRoleCommand)
+      // mirrors the bundled action, where the error can be deserialized by a second, non-identical
-        .rejectsOnce(new PackedPolicyTooLargeException({ message: 'too large', $metadata: {} }))
+      // copy of PackedPolicyTooLargeException so `instanceof` fails; the recovery must key off `name`.
-        .resolvesOnce(mocks.outputs.STS_CREDENTIALS);
+      const packedPolicyError = Object.assign(new Error('too large'), { name: 'PackedPolicyTooLargeException' });
+      mockedSTSClient.on(AssumeRoleCommand).rejectsOnce(packedPolicyError).resolvesOnce(mocks.outputs.STS_CREDENTIALS);
       await run();
       expect(core.info).toHaveBeenCalledWith('Session tag size is too large; dropping droppable tags and retrying.');
       const retryInput = mockedSTSClient.commandCalls(AssumeRoleCommand)[1].args[0].input;