chore(main): release 6.2.4 (#1942)

Co-authored-by: Tom Keller <1083460+kellertk@users.noreply.github.com>

.release-please-manifest.json

@@ -1,5 +1,5 @@
 {
   ".release-please-manifest.json": "4.0.2",
   "package.json": "6.0.0",
-  ".": "6.2.3"
+  ".": "6.2.4"
 }

CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [6.2.4](https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.3...v6.2.4) (2026-08-31)
+
+
+### Bug Fixes
+
+* account-ids handling, mask proxy as secret in logs ([#1943](https://github.com/aws-actions/configure-aws-credentials/issues/1943)) ([aa65264](https://github.com/aws-actions/configure-aws-credentials/commit/aa6526434b08748f8776b29964e3f1f5d90e7b63))
+* skip backoff sleep after the final retryAndBackoff attempt ([#1937](https://github.com/aws-actions/configure-aws-credentials/issues/1937)) ([3852440](https://github.com/aws-actions/configure-aws-credentials/commit/3852440c21363386b7b790605685d08a7c1a4876))
+
 ## [6.2.3](https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.2...v6.2.3) (2026-07-22)
 
 

dist/index.js

@@ -44679,7 +44679,7 @@ var require_dist_cjs15 = __commonJS({
       throw lastProviderError;
     };
     var multipleCredentialSourceWarningEmitted = false;
-    var defaultProvider = (init = {}) => memoizeChain([
+    var defaultProvider2 = (init = {}) => memoizeChain([
       async () => {
         const profile = init.profile ?? process.env[ENV_PROFILE2];
         if (profile) {
@@ -44746,7 +44746,7 @@ var require_dist_cjs15 = __commonJS({
     var credentialsTreatedAsExpired = (credentials) => credentials?.expiration !== void 0 && credentials.expiration.getTime() - Date.now() < 3e5;
     exports2.credentialsTreatedAsExpired = credentialsTreatedAsExpired;
     exports2.credentialsWillNeedRefresh = credentialsWillNeedRefresh;
-    exports2.defaultProvider = defaultProvider;
+    exports2.defaultProvider = defaultProvider2;
   }
 });
 
@@ -44766,7 +44766,7 @@ var require_dist_cjs16 = __commonJS({
     var { TypeRegistry: TypeRegistry2, getSchemaSerdePlugin: getSchemaSerdePlugin2 } = (init_schema(), __toCommonJS(schema_exports));
     var { resolveAwsSdkSigV4Config: resolveAwsSdkSigV4Config2, resolveAwsSdkSigV4AConfig: resolveAwsSdkSigV4AConfig2, AwsSdkSigV4Signer: AwsSdkSigV4Signer2, AwsSdkSigV4ASigner: AwsSdkSigV4ASigner2, NODE_SIGV4A_CONFIG_OPTIONS: NODE_SIGV4A_CONFIG_OPTIONS2, NODE_AUTH_SCHEME_PREFERENCE_OPTIONS: NODE_AUTH_SCHEME_PREFERENCE_OPTIONS2 } = (init_httpAuthSchemes2(), __toCommonJS(httpAuthSchemes_exports));
     var { SignatureV4MultiRegion: SignatureV4MultiRegion3 } = require_dist_cjs3();
-    var { defaultProvider } = require_dist_cjs15();
+    var { defaultProvider: defaultProvider2 } = require_dist_cjs15();
     var { toUtf8: toUtf83, fromUtf8: fromUtf83, toBase64: toBase643, fromBase64: fromBase642, calculateBodyLength: calculateBodyLength2 } = (init_serde(), __toCommonJS(serde_exports));
     var { streamCollector: streamCollector7, NodeHttpHandler: NodeHttpHandler2 } = require_dist_cjs6();
     var { AwsQueryProtocol: AwsQueryProtocol2 } = (init_protocols2(), __toCommonJS(protocols_exports2));
@@ -45882,12 +45882,12 @@ var require_dist_cjs16 = __commonJS({
         defaultsMode,
         authSchemePreference: config?.authSchemePreference ?? loadConfig2(NODE_AUTH_SCHEME_PREFERENCE_OPTIONS2, loaderConfig),
         bodyLengthChecker: config?.bodyLengthChecker ?? calculateBodyLength2,
-        credentialDefaultProvider: config?.credentialDefaultProvider ?? defaultProvider,
+        credentialDefaultProvider: config?.credentialDefaultProvider ?? defaultProvider2,
         defaultUserAgentProvider: config?.defaultUserAgentProvider ?? createDefaultUserAgentProvider2({ serviceId: clientSharedValues.serviceId, clientVersion: packageInfo.version }),
         httpAuthSchemes: config?.httpAuthSchemes ?? [
           {
             schemeId: "aws.auth#sigv4",
-            identityProvider: (ipc) => ipc.getIdentityProvider("aws.auth#sigv4") || (async (idProps) => await defaultProvider(idProps?.__config || {})()),
+            identityProvider: (ipc) => ipc.getIdentityProvider("aws.auth#sigv4") || (async (idProps) => await defaultProvider2(idProps?.__config || {})()),
             signer: new AwsSdkSigV4Signer2()
           },
           {
@@ -74785,13 +74785,12 @@ function exportAccountId(identity, maskAccountId) {
   return accountId;
 }
 function validateAccountId(expectedAccountIds, account) {
-  if (!expectedAccountIds || expectedAccountIds.length === 0 || expectedAccountIds[0] === "") {
+  const allowedAccountIds = expectedAccountIds?.filter((id) => id !== "") ?? [];
+  if (allowedAccountIds.length === 0) {
     return;
   }
-  if (!account || !expectedAccountIds.includes(account)) {
+  if (!account || !allowedAccountIds.includes(account)) {
-    throw new Error(
+    throw new Error("The account ID of the provided credentials does not match any of the allowed account IDs");
-      `The account ID of the provided credentials (${account ?? "unknown"}) does not match any of the expected account IDs: ${expectedAccountIds.join(", ")}`
-    );
   }
 }
 function toCredentialIdentity(creds) {
@@ -74804,6 +74803,24 @@ function toCredentialIdentity(creds) {
     ...creds.SessionToken && { sessionToken: creds.SessionToken }
   };
 }
+function maskProxyCredentials(proxyServer) {
+  setSecret(proxyServer);
+  let url;
+  try {
+    url = new URL(proxyServer);
+  } catch (_) {
+    return;
+  }
+  for (const part of [url.username, url.password]) {
+    if (!part) continue;
+    setSecret(part);
+    try {
+      const decoded = decodeURIComponent(part);
+      if (decoded !== part) setSecret(decoded);
+    } catch (_) {
+    }
+  }
+}
 function sanitizeGitHubVariables(name) {
   const nameWithoutSpecialCharacters = name.replace(/[^\p{L}\p{Z}\p{N}_.:/=+\-@]/gu, SANITIZATION_CHARACTER);
   const nameTruncated = nameWithoutSpecialCharacters.slice(0, MAX_TAG_VALUE_LENGTH);
@@ -74859,18 +74876,6 @@ function errorMessage(error3) {
 function isDefined(i5) {
   return i5 !== void 0 && i5 !== null;
 }
-async function areCredentialsValid(credentialsClient) {
-  const client = credentialsClient.stsClient;
-  try {
-    const identity = await client.send(new import_client_sts.GetCallerIdentityCommand({}));
-    if (identity.Account) {
-      return true;
-    }
-    return false;
-  } catch (_) {
-    return false;
-  }
-}
 function getBooleanInput(name, options) {
   const trueValue = ["true", "True", "TRUE"];
   const falseValue = ["false", "False", "FALSE"];
@@ -75185,6 +75190,7 @@ async function assumeRole(params) {
 
 // src/CredentialsClient.ts
 var import_client_sts3 = __toESM(require_dist_cjs16());
+var import_credential_provider_node = __toESM(require_dist_cjs15());
 var import_node_http_handler5 = __toESM(require_dist_cjs6());
 
 // node_modules/proxy-agent/dist/index.js
@@ -76395,6 +76401,7 @@ var CredentialsClient = class {
     }
     if (props.proxyServer) {
       info("Configuring proxy handler for STS client");
+      maskProxyCredentials(props.proxyServer);
       const proxyOptions = {
         httpProxy: props.proxyServer,
         httpsProxy: props.proxyServer
@@ -76460,10 +76467,13 @@ var CredentialsClient = class {
     }
   }
   async loadCredentials() {
-    const config = {};
+    return (0, import_credential_provider_node.defaultProvider)({
-    if (this.requestHandler !== void 0) config.requestHandler = this.requestHandler;
+      clientConfig: {
-    const client = new import_client_sts3.STSClient(config);
+        ...this.region !== void 0 && { region: this.region },
-    return client.config.credentials();
+        ...this.stsEndpoint !== void 0 && { endpoint: this.stsEndpoint },
+        ...this.requestHandler !== void 0 && { requestHandler: this.requestHandler }
+      }
+    })();
   }
 };
 
@@ -76507,8 +76517,14 @@ function parseIni2(iniData) {
 function stringifyIni(data2) {
   const sections = [];
   for (const [sectionName, sectionData] of Object.entries(data2)) {
+    if (/[\r\n]/.test(sectionName)) {
+      throw new Error("INI section names must not contain newline characters");
+    }
     const lines = [`[${sectionName}]`];
     for (const [key, value] of Object.entries(sectionData)) {
+      if (/[\r\n]/.test(key) || /[\r\n]/.test(value)) {
+        throw new Error("INI keys and values must not contain newline characters");
+      }
       lines.push(`${key} = ${value}`);
     }
     sections.push(lines.join("\n"));
@@ -76689,8 +76705,15 @@ async function run() {
     let sourceAccountId;
     let webIdentityToken;
     if (useExistingCredentials) {
-      const validCredentials = await areCredentialsValid(credentialsClient);
+      const identity = await (async () => {
-      if (validCredentials) {
+        try {
+          return await getCallerIdentity(credentialsClient.stsClient);
+        } catch {
+          return null;
+        }
+      })();
+      if (identity) {
+        validateAccountId(expectedAccountIds, identity.Account);
         notice("Pre-existing credentials are valid. No need to generate new ones.");
         if (timeoutId) clearTimeout(timeoutId);
         return;

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "configure-aws-credentials",
-  "version": "6.2.3",
+  "version": "6.2.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "configure-aws-credentials",
-      "version": "6.2.3",
+      "version": "6.2.4",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^3.0.1",
@@ -5179,9 +5179,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.2.0",
+      "version": "4.3.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.2.tgz",
-      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+      "integrity": "sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==",
       "dev": true,
       "funding": [
         {
@@ -5919,9 +5919,9 @@
       }
     },
     "node_modules/markdownlint-cli/node_modules/js-yaml": {
-      "version": "5.2.1",
+      "version": "5.2.3",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.1.tgz",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.3.tgz",
-      "integrity": "sha512-zfLtNfQqxVqq3uaTqSkh4x4hZw3KHobGUA0fJUj4wawW8bsQLTVqpHdXSIzidh7o+4lEW36tANuAGdaFx6Zgnw==",
+      "integrity": "sha512-n+mUVyUX5bVv7G/G2zyIHOhdxfuU1dY2NOFzTQUWiMUbFss8b57NFlgCCaggU78wSw5KVS9cllzeLyzyR+n5nw==",
       "dev": true,
       "funding": [
         {

package.json

@@ -1,7 +1,7 @@
 {
   "name": "configure-aws-credentials",
   "description": "A GitHub Action to configure AWS credentials",
-  "version": "6.2.3",
+  "version": "6.2.4",
   "scripts": {
     "build": "tsc",
     "lint": "biome check --error-on-warnings ./src ./test && markdownlint -i node_modules -i CHANGELOG.md '**/*.md'",