chore: Update dist

chore(deps): bump @aws-sdk/client-sts from 3.1106.0 to 3.1111.0 (#1928 )
Bumps [@aws-sdk/client-sts](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-sts) from 3.1106.0 to 3.1111.0. - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-sts/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1111.0/clients/client-sts) --- updated-dependencies: - dependency-name: "@aws-sdk/client-sts" dependency-version: 3.1111.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-25 04:35:06 +09:00 · 2026-08-18 04:00:07 +00:00 · 2026-08-18 03:59:35 +00:00 · 2026-08-18 03:56:20 +00:00 · 2026-08-18 03:53:20 +00:00 · 2026-08-18 03:51:04 +00:00
17 changed files with 9113 additions and 7901 deletions
@@ -15,7 +15,7 @@ jobs:
    runs-on: ubuntu-latest
    name: Stale issue job
    steps:
-    - uses: aws-actions/stale-issue-cleanup@v6
+    - uses: aws-actions/stale-issue-cleanup@v7
      with:
        # Setting messages to an empty string will cause the automation to skip
        # that category
@@ -55,6 +55,8 @@
          run: |
            git config user.name "GitHub Actions"
            git config user.email "github-aws-sdk-osds-automation@amazon.com"
+            echo "::add-mask::${{ env.OSDS_ACCESS_TOKEN }}"
+            git remote set-url origin https://${{ env.OSDS_ACCESS_TOKEN }}@github.com/aws-actions/configure-aws-credentials.git
            if git rev-parse "v${{ steps.release.outputs.major }}" >/dev/null 2>&1; then
              git tag -d "v${{ steps.release.outputs.major }}"
              git push origin ":v${{ steps.release.outputs.major }}"
@@ -1,5 +1,5 @@
 {
  ".release-please-manifest.json": "4.0.2",
  "package.json": "6.0.0",
-  ".": "6.2.1"
+  ".": "6.2.3"
 }
@@ -2,6 +2,21 @@

 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.

+## [6.2.3](https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.2...v6.2.3) (2026-07-22)
+
+
+### Bug Fixes
+
+* attach git credentials before Tag Major Version push ([#1877](https://github.com/aws-actions/configure-aws-credentials/issues/1877)) ([9ae780b](https://github.com/aws-actions/configure-aws-credentials/commit/9ae780b171afa8c5a3a6a2d154a765b709492482))
+* PackedPolicyTooLarge detection in STS tags ([#1899](https://github.com/aws-actions/configure-aws-credentials/issues/1899)) ([fa8d6a5](https://github.com/aws-actions/configure-aws-credentials/commit/fa8d6a57bbf44b34439fb080bbdadc7c92c285eb))
+
+## [6.2.2](https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.1...v6.2.2) (2026-07-07)
+
+
+### Miscellaneous Chores
+
+* release 6.2.2 ([d01d678](https://github.com/aws-actions/configure-aws-credentials/commit/d01d678e65d6d2bd9d5ca7a95d6f07b00e25f2c2))
+
 ## [6.2.1](https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.0...v6.2.1) (2026-06-26)


@@ -28,6 +28,12 @@ these are incredibly useful:
 - Any modifications you've made relevant to the bug
 - Anything unusual about your environment or deployment

+We also ask that you refrain from opening issues via the `gh` CLI or GitHub
+API. These methods bypass our issue templates and therefore don't apply the
+proper labels or workflows that we use. Note that AI agents typically do not
+properly use issue templates. Issues that don't have the proper labels
+applied may be closed without comment.
+
 ## Contributing via Pull Requests

 Contributions via pull requests are much appreciated. Before sending us a pull
@@ -26,7 +26,7 @@ Authenticate to AWS in GitHub Actions (and others)! Works especially well with
         "Condition": {
           "StringEquals": {
             "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
-             "token.actions.githubusercontent.com:sub": "repo:<GITHUB_ORG>/<GITHUB_REPOSITORY>:ref:refs/heads/<GITHUB_BRANCH>"
+             "token.actions.githubusercontent.com:sub": "repo:<GITHUB_ORG>@<ORG_ID>/<GITHUB_REPOSITORY>@<REPO_ID>:ref:refs/heads/<GITHUB_BRANCH>"
           }
         }
       }
@@ -36,11 +36,16 @@ Authenticate to AWS in GitHub Actions (and others)! Works especially well with

   </details>

-   Note: if you are running in a GitHub environment based workflow, the value
-   for the Sub claim will be different, in the form of
-   `repo:<GITHUB_ORG>/<GITHUB_REPOSITORY>:environment:<ENVIRONMENT_NAME>`.
-   Adjust the trust policy accordingly if you are using environment-based
-   workflows.
+   Note: The value of the `sub` claim may be different depending on the workflow
+   and the environment in which it's running. Workflows in repositories created
+   prior to [15 July 2026][immutable-sub] will omit the `@<ORG_ID>` and
+   `@<REPO_ID>` suffixes unless opted in. Workflows running in GitHub
+   environments will include an`environment:<ENVIRONMENT_NAME>` stanza.  See
+   [Claims and scoping permissions](#claims-and-scoping-permissions) for more
+   information.
+
+   [immutable-sub]:
+   https://github.blog/changelog/2026-04-23-immutable-subject-claims-for-github-actions-oidc-tokens/

 3. Attach permissions to the IAM Role that allow it to access the AWS resources
   you need.
@@ -56,7 +61,7 @@ Authenticate to AWS in GitHub Actions (and others)! Works especially well with
       runs-on: ubuntu-latest
       steps:
         - name: Configure AWS Credentials
-           uses: aws-actions/configure-aws-credentials@v6.1.0
+           uses: aws-actions/configure-aws-credentials@v6.2.3
           with:
             role-to-assume: <Role ARN you created in step 2>
             aws-region: <AWS Region you want to use>
@@ -245,7 +250,7 @@ specify the profile name as an environment variable in the job step:

 ```yaml
 - name: Configure AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-1
    role-to-assume: arn:aws:iam::123456789100:role/my-role
@@ -263,14 +268,14 @@ step environment variables:

 ```yaml
 - name: Configure AWS credentials
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-1
    role-to-assume: arn:aws:iam::123456789100:role/my-first-role
    aws-profile: firstRoleInChain

 - name: assume second role
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-2
    role-to-assume: arn:aws:iam::987654321000:role/my-second-role
@@ -306,7 +311,7 @@ this action will always consider the `HTTP_PROXY` environment variable.
 Manually configured proxy:

 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.1.0
+uses: aws-actions/configure-aws-credentials@v6.2.3
 with:
  aws-region: us-east-2
  role-to-assume: my-github-actions-role
@@ -453,7 +458,7 @@ line.
 <summary>Inline session policy examples</summary>

 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.1.0
+uses: aws-actions/configure-aws-credentials@v6.2.3
 with:
  inline-session-policy: '{"Version":"2012-10-17","Statement":[{"Sid":"Stmt1","Effect":"Allow","Action":"s3:List*","Resource":"*"}]}'
 ```
@@ -461,7 +466,7 @@ with:
 Or we can have a nicely formatted JSON as well:

 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.1.0
+uses: aws-actions/configure-aws-credentials@v6.2.3
 with:
  inline-session-policy: >-
    {
@@ -489,7 +494,7 @@ the role.
 <summary>Managed session policy examples</summary>

 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.1.0
+uses: aws-actions/configure-aws-credentials@v6.2.3
 with:
  managed-session-policies: arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
 ```
@@ -497,7 +502,7 @@ with:
 And we can pass multiple managed policies likes this:

 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.1.0
+uses: aws-actions/configure-aws-credentials@v6.2.3
 with:
  managed-session-policies: |
    arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
@@ -543,7 +548,7 @@ specify the audience through the `audience` input:

 ```yaml
 - name: Configure AWS Credentials for China region audience
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    audience: sts.amazonaws.com.cn
    aws-region: cn-northwest-1
@@ -593,6 +598,29 @@ claims ([1][gh-blog-oidc], [2][sub-claim-custom]).
 > unintended access. Instead, use `StringEquals` or `StringLike` operators to
 > check for specific claim values.

+#### Immutable subject claims
+
+Repositories created on github.com on or after 15 July 2026, and older
+repositories that have opted in, emit an [immutable `sub` claim][immutable-sub].
+This claim appends the permanent numeric ID of the organization and of the
+repository after each name, separated by `@`, so that a recycled org or
+repository name cannot be used to mint tokens matching a stale trust policy.
+For example:
+
+```text
+# Legacy (mutable) sub claim
+repo:octo-org/octo-repo:ref:refs/heads/main
+
+# Immutable sub claim
+repo:octo-org@123456/octo-repo@789012:ref:refs/heads/main
+```
+
+If your trust policy matches the legacy name-only form and your repository emits
+the immutable claim, `AssumeRoleWithWebIdentity` fails with `Not authorized to
+perform sts:AssumeRoleWithWebIdentity`. To fix this, update the `sub` condition
+to the immutable form. You can find your repository's prefix in the Settings,
+or by following the token inspection steps below.
+
 [least-privilege]:
  https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege
 [gh-blog-oidc]:
@@ -605,7 +633,7 @@ claims ([1][gh-blog-oidc], [2][sub-claim-custom]).
 If you aren't sure what claim values your workflow is producing, the
 [`actions-oidc-debugger`](https://github.com/github/actions-oidc-debugger)
 action will print the decoded JWT payload. Run it in a private repository
-only — the token itself is short-lived but the claim values may be sensitive.
+only; the token itself is short-lived but the claim values may be sensitive.

 See the GitHub [security-hardening guide][gh-oidc-hardening] for further
 discussion of trust conditions and threat modeling.
@@ -680,7 +708,7 @@ Provider. The audience would still be `sts.amazonaws.com` by default.

 ```yaml
 - name: Configure AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-2
    role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
@@ -696,13 +724,13 @@ environment variable and use it to assume the role

 ```yaml
 - name: Configure AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-2
    role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
    role-session-name: MySessionName
 - name: Configure other AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-2
    role-to-assume: arn:aws:iam::987654321000:role/my-second-role
@@ -724,7 +752,7 @@ alternatively, the `TagSession` permission can be omitted if you are using the

 ```yaml
 - name: Configure AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -745,7 +773,7 @@ like `role-to-assume: my-github-actions-role`.
 ```yaml
 - name: Configure AWS Credentials 1
  id: creds
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-2
    role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
@@ -754,7 +782,7 @@ like `role-to-assume: my-github-actions-role`.
  run: |
    aws sts get-caller-identity
 - name: Configure AWS Credentials 2
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-2
    aws-access-key-id: ${{ steps.creds.outputs.aws-access-key-id }}
@@ -785,14 +813,14 @@ provided.

 ```yaml
 - name: Configure AWS Credentials for Dev
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-east-1
    role-to-assume: arn:aws:iam::111111111111:role/dev-role
    aws-profile: dev

 - name: Configure AWS Credentials for Prod
-  uses: aws-actions/configure-aws-credentials@v6.1.0
+  uses: aws-actions/configure-aws-credentials@v6.2.3
  with:
    aws-region: us-west-2
    role-to-assume: arn:aws:iam::222222222222:role/prod-role
@@ -3,7 +3,7 @@ https://www.npmjs.com/package/generate-license-file

 The following npm package may be included in this product:

- - @aws/lambda-invoke-store@0.2.4
+ - @aws/lambda-invoke-store@0.3.0

 This package contains the following license:

@@ -184,217 +184,6 @@ Apache License

 -----------

-The following npm packages may be included in this product:
-
- - @aws-crypto/sha256-browser@5.2.0
- - @aws-crypto/supports-web-crypto@5.2.0
-
-These packages each contain the following license:
-
-Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [yyyy] [name of copyright owner]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-
-----------
-
 The following npm package may be included in this product:

 - source-map@0.6.1
@@ -431,220 +220,9 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 -----------

-The following npm packages may be included in this product:
-
- - @aws-crypto/crc32@5.2.0
- - @aws-crypto/util@5.2.0
-
-These packages each contain the following license:
-
-Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "{}"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright {yyyy} {name of copyright owner}
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-
-----------
-
 The following npm package may be included in this product:

- - @aws-sdk/client-sts@3.1075.0
+ - @aws-sdk/client-sts@3.1111.0

 This package contains the following license:

@@ -854,9 +432,9 @@ Apache License

 The following npm packages may be included in this product:

- - @aws-sdk/signature-v4-multi-region@3.996.35
- - @smithy/core@3.26.0
- - @smithy/types@4.15.0
+ - @aws-sdk/signature-v4-multi-region@3.996.45
+ - @smithy/core@3.33.0
+ - @smithy/types@4.17.0

 These packages each contain the following license:

@@ -1254,7 +832,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

 The following npm package may be included in this product:

- - @aws-sdk/core@3.974.23
+ - @aws-sdk/core@3.977.8

 This package contains the following license:

@@ -1462,232 +1040,18 @@ Apache License

 -----------

-The following npm package may be included in this product:
-
- - @aws-crypto/sha256-js@5.2.0
-
-This package contains the following license:
-
-Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "{}"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright {yyyy} {name of copyright owner}
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-
-----------
-
 The following npm packages may be included in this product:

- - @aws-sdk/credential-provider-env@3.972.49
- - @aws-sdk/credential-provider-ini@3.972.56
- - @aws-sdk/credential-provider-node@3.972.58
- - @aws-sdk/token-providers@3.1074.0
- - @aws-sdk/types@3.973.13
- - @aws-sdk/util-locate-window@3.965.8
- - @aws-sdk/xml-builder@3.972.31
- - @smithy/credential-provider-imds@4.4.2
- - @smithy/fetch-http-handler@5.5.2
- - @smithy/is-array-buffer@2.2.0
- - @smithy/node-http-handler@4.8.2
- - @smithy/signature-v4@5.4.6
- - @smithy/util-buffer-from@2.2.0
- - @smithy/util-utf8@2.3.0
+ - @aws-sdk/credential-provider-env@3.972.69
+ - @aws-sdk/credential-provider-ini@3.973.14
+ - @aws-sdk/credential-provider-node@3.972.80
+ - @aws-sdk/token-providers@3.1111.0
+ - @aws-sdk/types@3.974.4
+ - @aws-sdk/xml-builder@3.972.39
+ - @smithy/credential-provider-imds@4.5.0
+ - @smithy/fetch-http-handler@5.7.0
+ - @smithy/node-http-handler@4.11.0
+ - @smithy/signature-v4@5.6.12

 These packages each contain the following license:

@@ -1897,9 +1261,9 @@ Apache License

 The following npm packages may be included in this product:

- - @aws-sdk/credential-provider-process@3.972.49
- - @aws-sdk/credential-provider-sso@3.972.55
- - @aws-sdk/credential-provider-web-identity@3.972.55
+ - @aws-sdk/credential-provider-process@3.972.69
+ - @aws-sdk/credential-provider-sso@3.973.13
+ - @aws-sdk/credential-provider-web-identity@3.972.75

 These packages each contain the following license:

@@ -2109,9 +1473,9 @@ Apache License

 The following npm packages may be included in this product:

- - @aws-sdk/credential-provider-http@3.972.51
- - @aws-sdk/credential-provider-login@3.972.55
- - @aws-sdk/nested-clients@3.997.23
+ - @aws-sdk/credential-provider-http@3.972.71
+ - @aws-sdk/credential-provider-login@3.972.76
+ - @aws-sdk/nested-clients@3.997.43

 These packages each contain the following license:

@@ -2121,7 +1485,7 @@ Apache-2.0

 The following npm package may be included in this product:

- - ip-address@10.2.0
+ - ip-address@10.4.0

 This package contains the following license:

@@ -2376,7 +1740,7 @@ SOFTWARE.

 The following npm package may be included in this product:

- - undici@6.27.0
+ - undici@6.28.0

 This package contains the following license:

@@ -1929,7 +1929,11 @@ var require_request = __commonJS({
          } else if (typeof val[i] === "object") {
            throw new InvalidArgumentError(`invalid ${key} header`);
          } else {
-            arr.push(`${val[i]}`);
+            const str = `${val[i]}`;
+            if (!isValidHeaderValue(str)) {
+              throw new InvalidArgumentError(`invalid ${key} header`);
+            }
+            arr.push(str);
          }
        }
        val = arr;
@@ -1941,6 +1945,9 @@ var require_request = __commonJS({
        val = "";
      } else {
        val = `${val}`;
+        if (!isValidHeaderValue(val)) {
+          throw new InvalidArgumentError(`invalid ${key} header`);
+        }
      }
      if (headerName === "host") {
        if (request.host !== null) {
@@ -5671,6 +5678,7 @@ var require_client_h1 = __commonJS({
      RequestContentLengthMismatchError,
      ResponseContentLengthMismatchError,
      RequestAbortedError,
+      InvalidArgumentError,
      HeadersTimeoutError,
      HeadersOverflowError,
      SocketError,
@@ -6397,8 +6405,16 @@ var require_client_h1 = __commonJS({
        }
        body = bodyStream.stream;
        contentLength = bodyStream.length;
-      } else if (util.isBlobLike(body) && request.contentType == null && body.type) {
-        headers.push("content-type", body.type);
+      } else if (util.isBlobLike(body) && request.contentType == null) {
+        const contentType = body.type;
+        if (contentType) {
+          const contentTypeValue = `${contentType}`;
+          if (!util.isValidHeaderValue(contentTypeValue)) {
+            util.errorRequest(client, request, new InvalidArgumentError("invalid content-type header"));
+            return false;
+          }
+          headers.push("content-type", contentTypeValue);
+        }
      }
      if (body && typeof body.read === "function") {
        body.read(0);
@@ -8950,6 +8966,24 @@ var require_retry_handler = __commonJS({
      const current = Date.now();
      return new Date(retryAfter).getTime() - current;
    }
+    function validatePartialResponseContentLength(headers, range, statusCode, retryCount) {
+      const contentLength = headers["content-length"];
+      if (contentLength == null) {
+        return null;
+      }
+      if (!Number.isFinite(range.start) || !Number.isFinite(range.end)) {
+        return null;
+      }
+      const length = Number(contentLength);
+      const expectedLength = range.end - range.start + 1;
+      if (!Number.isFinite(length) || length !== expectedLength) {
+        return new RequestRetryError("Content-Length mismatch", statusCode, {
+          headers,
+          data: { count: retryCount }
+        });
+      }
+      return null;
+    }
    var RetryHandler = class _RetryHandler {
      constructor(opts, handlers) {
        const { retryOptions, ...dispatchOpts } = opts;
@@ -9122,6 +9156,11 @@ var require_retry_handler = __commonJS({
            );
            return false;
          }
+          const contentLengthError = validatePartialResponseContentLength(headers, contentRange, statusCode, this.retryCount);
+          if (contentLengthError != null) {
+            this.abort(contentLengthError);
+            return false;
+          }
          const { start, size, end = size - 1 } = contentRange;
          assert(this.start === start, "content-range mismatch");
          assert(this.end == null || this.end === end, "content-range mismatch");
@@ -9139,6 +9178,11 @@ var require_retry_handler = __commonJS({
                statusMessage
              );
            }
+            const contentLengthError = validatePartialResponseContentLength(headers, range, statusCode, this.retryCount);
+            if (contentLengthError != null) {
+              this.abort(contentLengthError);
+              return false;
+            }
            const { start, size, end = size - 1 } = range;
            assert(
              start != null && Number.isFinite(start),
@@ -15984,14 +16028,48 @@ var require_util6 = __commonJS({
      for (let i = 0; i < path.length; ++i) {
        const code = path.charCodeAt(i);
        if (code < 32 || // exclude CTLs (0-31)
-        code === 127 || // DEL
+        code > 126 || // exclude DEL and non-ascii
        code === 59) {
          throw new Error("Invalid cookie path");
        }
      }
    }
+    function isLetterOrDigit(code) {
+      return code >= 48 && code <= 57 || // 0-9
+      code >= 65 && code <= 90 || // A-Z
+      code >= 97 && code <= 122;
+    }
    function validateCookieDomain(domain) {
-      if (domain.startsWith("-") || domain.endsWith(".") || domain.endsWith("-")) {
+      if (domain === " ") {
+        return;
+      }
+      if (domain.length > 255) {
+        throw new Error("Invalid cookie domain");
+      }
+      let labelLength = 0;
+      for (let i = 0; i < domain.length; ++i) {
+        const code = domain.charCodeAt(i);
+        if (code === 46) {
+          if (labelLength === 0) {
+            throw new Error("Invalid cookie domain");
+          }
+          if (domain.charCodeAt(i - 1) === 45) {
+            throw new Error("Invalid cookie domain");
+          }
+          labelLength = 0;
+          continue;
+        }
+        if (labelLength === 0 && !isLetterOrDigit(code)) {
+          throw new Error("Invalid cookie domain");
+        }
+        if (!isLetterOrDigit(code) && code !== 45) {
+          throw new Error("Invalid cookie domain");
+        }
+        if (++labelLength > 63) {
+          throw new Error("Invalid cookie domain");
+        }
+      }
+      if (labelLength === 0 || domain.charCodeAt(domain.length - 1) === 45) {
        throw new Error("Invalid cookie domain");
      }
    }
@@ -16074,7 +16152,11 @@ var require_util6 = __commonJS({
          throw new Error("Invalid unparsed");
        }
        const [key, ...value] = part.split("=");
-        out.push(`${key.trim()}=${value.join("=")}`);
+        const trimmedKey = key.trim();
+        const joinedValue = value.join("=");
+        validateCookieName(trimmedKey);
+        validateCookieValue(joinedValue);
+        out.push(`${trimmedKey}=${joinedValue}`);
      }
      return out.join("; ");
    }
@@ -1,7 +1,7 @@
 {
  "name": "configure-aws-credentials",
  "description": "A GitHub Action to configure AWS credentials",
-  "version": "6.2.1",
+  "version": "6.2.3",
  "scripts": {
    "build": "tsc",
    "lint": "biome check --error-on-warnings ./src ./test && markdownlint -i node_modules -i CHANGELOG.md '**/*.md'",
@@ -17,25 +17,25 @@
    "organization": true
  },
  "devDependencies": {
-    "@aws-sdk/credential-provider-env": "^3.972.49",
-    "@biomejs/biome": "2.5.0",
-    "@smithy/property-provider": "^4.4.2",
-    "@types/node": "^26.0.0",
-    "@vitest/coverage-v8": "4.1.9",
+    "@aws-sdk/credential-provider-env": "^3.972.69",
+    "@biomejs/biome": "2.5.8",
+    "@smithy/property-provider": "^4.5.0",
+    "@types/node": "^26.2.0",
+    "@vitest/coverage-v8": "4.1.10",
    "aws-sdk-client-mock": "^4.1.0",
-    "esbuild": "^0.28.1",
+    "esbuild": "^0.28.2",
    "generate-license-file": "^4.2.1",
    "json-schema": "^0.4.0",
-    "markdownlint-cli": "^0.49.0",
-    "memfs": "^4.57.8",
+    "markdownlint-cli": "^0.49.1",
+    "memfs": "^4.68.1",
    "standard-version": "^9.5.0",
-    "typescript": "^6.0.3",
-    "vitest": "4.1.9"
+    "typescript": "^7.0.2",
+    "vitest": "4.1.10"
  },
  "dependencies": {
    "@actions/core": "^3.0.1",
-    "@aws-sdk/client-sts": "^3.1075.0",
-    "@smithy/node-http-handler": "^4.8.2",
+    "@aws-sdk/client-sts": "^3.1111.0",
+    "@smithy/node-http-handler": "^4.11.0",
    "proxy-agent": "^8.0.2"
  },
  "keywords": [
@@ -10,10 +10,6 @@ if (!process.env.AWS_EXECUTION_ENV) {
  process.env.AWS_EXECUTION_ENV = 'GitHubActions';
 }

-// Bound how long a single STS call may hang. 60s per attempt keeps the total
-// failure time predictable.
-const STS_TIMEOUT_MS = 60_000;
-
 export interface CredentialsClientProps {
  region?: string;
  proxyServer?: string;
@@ -47,14 +43,6 @@ export class CredentialsClient {
      this.requestHandler = new NodeHttpHandler({
        httpsAgent: handler,
        httpAgent: handler,
-        connectionTimeout: STS_TIMEOUT_MS,
-        requestTimeout: STS_TIMEOUT_MS,
-      });
-    } else {
-      // No proxy
-      this.requestHandler = new NodeHttpHandler({
-        connectionTimeout: STS_TIMEOUT_MS,
-        requestTimeout: STS_TIMEOUT_MS,
      });
    }
    if (props.stsEndpoint) {
@@ -2,11 +2,7 @@ import assert from 'node:assert';
 import path from 'node:path';
 import * as core from '@actions/core';
 import type { AssumeRoleCommandInput, STSClient, Tag } from '@aws-sdk/client-sts';
-import {
-  AssumeRoleCommand,
-  AssumeRoleWithWebIdentityCommand,
-  PackedPolicyTooLargeException,
-} from '@aws-sdk/client-sts';
+import { AssumeRoleCommand, AssumeRoleWithWebIdentityCommand } from '@aws-sdk/client-sts';
 import type { CredentialsClient } from './CredentialsClient';
 import { errorMessage, isDefined, readFileUtf8, sanitizeGitHubVariables } from './helpers';

@@ -65,7 +61,7 @@ async function assumeRoleWithCredentials(params: AssumeRoleCommandInput, client:
    const creds = await client.send(new AssumeRoleCommand({ ...params }));
    return creds;
  } catch (error) {
-    if (error instanceof PackedPolicyTooLargeException) {
+    if ((error as { name?: string })?.name === 'PackedPolicyTooLargeException') {
      core.info('Session tag size is too large; dropping droppable tags and retrying.');
      const droppableKeys = new Set(DROPPABLE_TAG_SOURCES.map((s) => s.key));
      params.Tags = params.Tags?.filter((tag) => !droppableKeys.has(tag.Key ?? ''));
@@ -281,22 +281,6 @@ export function isDefined<T>(i: T | undefined | null): i is T {
 }
 /* c8 ignore stop */

-// Reads the `exp` claim (Unix seconds) from a JWT and reports whether the token is already expired or will expire
-// within `skewSeconds`. This is to decide whether to re-mint the OIDC token before an AssumeRole attempt. On any parse
-// failure we return false so a malformed token can't start a re-mint loop.
-export function jwtExpiresWithin(token: string, skewSeconds: number): boolean {
-  try {
-    const payload = token.split('.')[1];
-    if (!payload) return false;
-    const decoded = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
-    if (typeof decoded.exp !== 'number') return false;
-    const nowSeconds = Date.now() / 1000;
-    return decoded.exp <= nowSeconds + skewSeconds;
-  } catch (_) {
-    return false;
-  }
-}
-
 export async function areCredentialsValid(credentialsClient: CredentialsClient) {
  const client = credentialsClient.stsClient;
  try {
@@ -9,7 +9,6 @@ import {
  exportCredentials,
  exportRegion,
  getBooleanInput,
-  jwtExpiresWithin,
  retryAndBackoff,
  toCredentialIdentity,
  translateEnvVariables,
@@ -20,7 +19,6 @@ import {
 import { writeProfileFiles } from './profileManager';

 const DEFAULT_ROLE_DURATION = 3600; // One hour (seconds)
-const TOKEN_REFRESH_SKEW_SECONDS = 30;
 const ROLE_SESSION_NAME = 'GitHubActions';
 const REGION_REGEX = /^[a-z0-9-]+$/g;
 const ROLE_SESSION_NAME_REGEX = /^[\w+=,.@-]*$/;
@@ -248,10 +246,6 @@ export async function run() {
      let roleCredentials: AssumeRoleCommandOutput;
      do {
        roleCredentials = await withRetry(async () => {
-          if (useGitHubOIDCProvider() && jwtExpiresWithin(webIdentityToken, TOKEN_REFRESH_SKEW_SECONDS)) {
-            core.info('OIDC token has expired or is about to; requesting a fresh one before AssumeRole.');
-            webIdentityToken = await core.getIDToken(audience);
-          }
          return assumeRole({
            credentialsClient,
            sourceAccountId,
@@ -51,33 +51,6 @@ describe('Configure AWS Credentials helpers', {}, () => {
    expect(core.info).toHaveBeenCalledWith(expect.stringContaining('Retry: attempt 1 of 3 failed'));
    helpers.reset();
  });
-  describe('jwtExpiresWithin', {}, () => {
-    // Builds a JWT-shaped string (header.payload.signature) with the given payload. Only the payload
-    // segment is read by the helper; the signature is irrelevant since we never verify it.
-    const makeJwt = (payload: object) => {
-      const encode = (obj: object) => Buffer.from(JSON.stringify(obj)).toString('base64url');
-      return `${encode({ alg: 'RS256' })}.${encode(payload)}.signature`;
-    };
-    it('returns true when the token is already expired', {}, () => {
-      const exp = Math.floor(Date.now() / 1000) - 60;
-      expect(helpers.jwtExpiresWithin(makeJwt({ exp }), 30)).toBe(true);
-    });
-    it('returns true when the token expires within the skew window', {}, () => {
-      const exp = Math.floor(Date.now() / 1000) + 10;
-      expect(helpers.jwtExpiresWithin(makeJwt({ exp }), 30)).toBe(true);
-    });
-    it('returns false when the token is comfortably valid', {}, () => {
-      const exp = Math.floor(Date.now() / 1000) + 900;
-      expect(helpers.jwtExpiresWithin(makeJwt({ exp }), 30)).toBe(false);
-    });
-    it('returns false for a token with no exp claim', {}, () => {
-      expect(helpers.jwtExpiresWithin(makeJwt({ sub: 'foo' }), 30)).toBe(false);
-    });
-    it('returns false for a malformed token', {}, () => {
-      expect(helpers.jwtExpiresWithin('not-a-jwt', 30)).toBe(false);
-      expect(helpers.jwtExpiresWithin('', 30)).toBe(false);
-    });
-  });
  it('can output creds when told to', {}, () => {
    vi.spyOn(core, 'setOutput').mockImplementation(() => {});
    vi.spyOn(core, 'setSecret').mockImplementation(() => {});
@@ -3,7 +3,6 @@ import {
  AssumeRoleCommand,
  AssumeRoleWithWebIdentityCommand,
  GetCallerIdentityCommand,
-  PackedPolicyTooLargeException,
  STSClient,
 } from '@aws-sdk/client-sts';
 import { mockClient } from 'aws-sdk-client-mock';
@@ -89,28 +88,6 @@ describe('Configure AWS Credentials', {}, () => {
      expect(core.exportVariable).toHaveBeenCalledTimes(5);
      expect(core.setFailed).not.toHaveBeenCalled();
    });
-    it('re-mints the OIDC token when it has expired during retries', {}, async () => {
-      // Helper to build a JWT with a given exp (Unix seconds). Only the payload is read by the action.
-      const makeJwt = (exp: number) => {
-        const encode = (obj: object) => Buffer.from(JSON.stringify(obj)).toString('base64url');
-        return `${encode({ alg: 'RS256' })}.${encode({ exp })}.sig`;
-      };
-      const expiredToken = makeJwt(Math.floor(Date.now() / 1000) - 60);
-      const freshToken = makeJwt(Math.floor(Date.now() / 1000) + 900);
-      // First call returns an already-expired token; the refresh inside the retry loop returns a fresh one.
-      vi.mocked(core.getIDToken).mockResolvedValueOnce(expiredToken).mockResolvedValueOnce(freshToken);
-      mockedSTSClient.on(AssumeRoleWithWebIdentityCommand).resolvesOnce(mocks.outputs.STS_CREDENTIALS);
-      await run();
-      // Token fetched once up front, then re-minted because the first was expired.
-      expect(core.getIDToken).toHaveBeenCalledTimes(2);
-      expect(core.info).toHaveBeenCalledWith(
-        'OIDC token has expired or is about to; requesting a fresh one before AssumeRole.',
-      );
-      // The fresh token is the one actually sent to STS.
-      const call = mockedSTSClient.commandCalls(AssumeRoleWithWebIdentityCommand)[0];
-      expect(call.args[0].input.WebIdentityToken).toBe(freshToken);
-      expect(core.setFailed).not.toHaveBeenCalled();
-    });
  });

  describe('IAM User Authentication', {}, () => {
@@ -353,10 +330,11 @@ describe('Configure AWS Credentials', {}, () => {
    });
    it('drops droppable tags and retries on PackedPolicyTooLargeException', {}, async () => {
      vi.mocked(core.getInput).mockImplementation(mocks.getInput(mocks.IAM_ASSUMEROLE_INPUTS));
-      mockedSTSClient
-        .on(AssumeRoleCommand)
-        .rejectsOnce(new PackedPolicyTooLargeException({ message: 'too large', $metadata: {} }))
-        .resolvesOnce(mocks.outputs.STS_CREDENTIALS);
+      // Reject with a plain error carrying only the `name`, NOT an instance of the SDK class. This
+      // mirrors the bundled action, where the error can be deserialized by a second, non-identical
+      // copy of PackedPolicyTooLargeException so `instanceof` fails; the recovery must key off `name`.
+      const packedPolicyError = Object.assign(new Error('too large'), { name: 'PackedPolicyTooLargeException' });
+      mockedSTSClient.on(AssumeRoleCommand).rejectsOnce(packedPolicyError).resolvesOnce(mocks.outputs.STS_CREDENTIALS);
      await run();
      expect(core.info).toHaveBeenCalledWith('Session tag size is too large; dropping droppable tags and retrying.');
      const retryInput = mockedSTSClient.commandCalls(AssumeRoleCommand)[1].args[0].input;