fix: PackedPolicyTooLarge detection in STS tags

Closes #1898.

Due to a bundling, checking for `error instanceof
PackedPolicyTooLargeException` fails. Instead we need to explicitly
check for `error.name`.

.github/workflows/close-stale-issues.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Stale issue job
     steps:
-    - uses: aws-actions/stale-issue-cleanup@v7
+    - uses: aws-actions/stale-issue-cleanup@v6
       with:
         # Setting messages to an empty string will cause the automation to skip
         # that category

.release-please-manifest.json

@@ -1,5 +1,5 @@
 {
   ".release-please-manifest.json": "4.0.2",
   "package.json": "6.0.0",
-  ".": "6.2.3"
+  ".": "6.2.2"
 }

CHANGELOG.md

@@ -2,14 +2,6 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-## [6.2.3](https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.2...v6.2.3) (2026-07-22)
-
-
-### Bug Fixes
-
-* attach git credentials before Tag Major Version push ([#1877](https://github.com/aws-actions/configure-aws-credentials/issues/1877)) ([9ae780b](https://github.com/aws-actions/configure-aws-credentials/commit/9ae780b171afa8c5a3a6a2d154a765b709492482))
-* PackedPolicyTooLarge detection in STS tags ([#1899](https://github.com/aws-actions/configure-aws-credentials/issues/1899)) ([fa8d6a5](https://github.com/aws-actions/configure-aws-credentials/commit/fa8d6a57bbf44b34439fb080bbdadc7c92c285eb))
-
 ## [6.2.2](https://github.com/aws-actions/configure-aws-credentials/compare/v6.2.1...v6.2.2) (2026-07-07)
 
 

CONTRIBUTING.md

@@ -28,12 +28,6 @@ these are incredibly useful:
 - Any modifications you've made relevant to the bug
 - Anything unusual about your environment or deployment
 
-We also ask that you refrain from opening issues via the `gh` CLI or GitHub
-API. These methods bypass our issue templates and therefore don't apply the
-proper labels or workflows that we use. Note that AI agents typically do not
-properly use issue templates. Issues that don't have the proper labels
-applied may be closed without comment.
-
 ## Contributing via Pull Requests
 
 Contributions via pull requests are much appreciated. Before sending us a pull

README.md

@@ -61,7 +61,7 @@ Authenticate to AWS in GitHub Actions (and others)! Works especially well with
        runs-on: ubuntu-latest
        steps:
          - name: Configure AWS Credentials
-           uses: aws-actions/configure-aws-credentials@v6.2.3
+           uses: aws-actions/configure-aws-credentials@v6.1.0
            with:
              role-to-assume: <Role ARN you created in step 2>
              aws-region: <AWS Region you want to use>
@@ -250,7 +250,7 @@ specify the profile name as an environment variable in the job step:
 
 ```yaml
 - name: Configure AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
   with:
     aws-region: us-east-1
     role-to-assume: arn:aws:iam::123456789100:role/my-role
@@ -268,14 +268,14 @@ step environment variables:
 
 ```yaml
 - name: Configure AWS credentials
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
   with:
     aws-region: us-east-1
     role-to-assume: arn:aws:iam::123456789100:role/my-first-role
     aws-profile: firstRoleInChain
 
 - name: assume second role
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
   with:
     aws-region: us-east-2
     role-to-assume: arn:aws:iam::987654321000:role/my-second-role
@@ -311,7 +311,7 @@ this action will always consider the `HTTP_PROXY` environment variable.
 Manually configured proxy:
 
 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.2.3
+uses: aws-actions/configure-aws-credentials@v6.1.0
 with:
   aws-region: us-east-2
   role-to-assume: my-github-actions-role
@@ -458,7 +458,7 @@ line.
 <summary>Inline session policy examples</summary>
 
 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.2.3
+uses: aws-actions/configure-aws-credentials@v6.1.0
 with:
   inline-session-policy: '{"Version":"2012-10-17","Statement":[{"Sid":"Stmt1","Effect":"Allow","Action":"s3:List*","Resource":"*"}]}'
 ```
@@ -466,7 +466,7 @@ with:
 Or we can have a nicely formatted JSON as well:
 
 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.2.3
+uses: aws-actions/configure-aws-credentials@v6.1.0
 with:
   inline-session-policy: >-
     {
@@ -494,7 +494,7 @@ the role.
 <summary>Managed session policy examples</summary>
 
 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.2.3
+uses: aws-actions/configure-aws-credentials@v6.1.0
 with:
   managed-session-policies: arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
 ```
@@ -502,7 +502,7 @@ with:
 And we can pass multiple managed policies likes this:
 
 ```yaml
-uses: aws-actions/configure-aws-credentials@v6.2.3
+uses: aws-actions/configure-aws-credentials@v6.1.0
 with:
   managed-session-policies: |
     arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
@@ -548,7 +548,7 @@ specify the audience through the `audience` input:
 
 ```yaml
 - name: Configure AWS Credentials for China region audience
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
   with:
     audience: sts.amazonaws.com.cn
     aws-region: cn-northwest-1
@@ -708,7 +708,7 @@ Provider. The audience would still be `sts.amazonaws.com` by default.
 
 ```yaml
 - name: Configure AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
   with:
     aws-region: us-east-2
     role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
@@ -724,13 +724,13 @@ environment variable and use it to assume the role
 
 ```yaml
 - name: Configure AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
   with:
     aws-region: us-east-2
     role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
     role-session-name: MySessionName
 - name: Configure other AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
   with:
     aws-region: us-east-2
     role-to-assume: arn:aws:iam::987654321000:role/my-second-role
@@ -752,7 +752,7 @@ alternatively, the `TagSession` permission can be omitted if you are using the
 
 ```yaml
 - name: Configure AWS Credentials
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
   with:
     aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
     aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -773,7 +773,7 @@ like `role-to-assume: my-github-actions-role`.
 ```yaml
 - name: Configure AWS Credentials 1
   id: creds
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
   with:
     aws-region: us-east-2
     role-to-assume: arn:aws:iam::123456789100:role/my-github-actions-role
@@ -782,7 +782,7 @@ like `role-to-assume: my-github-actions-role`.
   run: |
     aws sts get-caller-identity
 - name: Configure AWS Credentials 2
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
   with:
     aws-region: us-east-2
     aws-access-key-id: ${{ steps.creds.outputs.aws-access-key-id }}
@@ -813,14 +813,14 @@ provided.
 
 ```yaml
 - name: Configure AWS Credentials for Dev
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
   with:
     aws-region: us-east-1
     role-to-assume: arn:aws:iam::111111111111:role/dev-role
     aws-profile: dev
 
 - name: Configure AWS Credentials for Prod
-  uses: aws-actions/configure-aws-credentials@v6.2.3
+  uses: aws-actions/configure-aws-credentials@v6.1.0
   with:
     aws-region: us-west-2
     role-to-assume: arn:aws:iam::222222222222:role/prod-role

THIRD-PARTY

@@ -222,7 +222,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 The following npm package may be included in this product:
 
- - @aws-sdk/client-sts@3.1111.0
+ - @aws-sdk/client-sts@3.1091.0
 
 This package contains the following license:
 
@@ -432,9 +432,9 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/signature-v4-multi-region@3.996.45
- - @smithy/core@3.33.0
- - @smithy/types@4.17.0
+ - @aws-sdk/signature-v4-multi-region@3.996.41
+ - @smithy/core@3.29.6
+ - @smithy/types@4.16.1
 
 These packages each contain the following license:
 
@@ -832,7 +832,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 The following npm package may be included in this product:
 
- - @aws-sdk/core@3.977.8
+ - @aws-sdk/core@3.975.3
 
 This package contains the following license:
 
@@ -1042,16 +1042,16 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/credential-provider-env@3.972.69
- - @aws-sdk/credential-provider-ini@3.973.14
- - @aws-sdk/credential-provider-node@3.972.80
- - @aws-sdk/token-providers@3.1111.0
- - @aws-sdk/types@3.974.4
- - @aws-sdk/xml-builder@3.972.39
- - @smithy/credential-provider-imds@4.5.0
- - @smithy/fetch-http-handler@5.7.0
- - @smithy/node-http-handler@4.11.0
- - @smithy/signature-v4@5.6.12
+ - @aws-sdk/credential-provider-env@3.972.59
+ - @aws-sdk/credential-provider-ini@3.973.4
+ - @aws-sdk/credential-provider-node@3.972.70
+ - @aws-sdk/token-providers@3.1088.0
+ - @aws-sdk/types@3.974.2
+ - @aws-sdk/xml-builder@3.972.36
+ - @smithy/credential-provider-imds@4.4.11
+ - @smithy/fetch-http-handler@5.6.8
+ - @smithy/node-http-handler@4.9.8
+ - @smithy/signature-v4@5.6.7
 
 These packages each contain the following license:
 
@@ -1261,9 +1261,9 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/credential-provider-process@3.972.69
- - @aws-sdk/credential-provider-sso@3.973.13
- - @aws-sdk/credential-provider-web-identity@3.972.75
+ - @aws-sdk/credential-provider-process@3.972.59
+ - @aws-sdk/credential-provider-sso@3.973.3
+ - @aws-sdk/credential-provider-web-identity@3.972.65
 
 These packages each contain the following license:
 
@@ -1473,9 +1473,9 @@ Apache License
 
 The following npm packages may be included in this product:
 
- - @aws-sdk/credential-provider-http@3.972.71
- - @aws-sdk/credential-provider-login@3.972.76
- - @aws-sdk/nested-clients@3.997.43
+ - @aws-sdk/credential-provider-http@3.972.61
+ - @aws-sdk/credential-provider-login@3.972.66
+ - @aws-sdk/nested-clients@3.997.33
 
 These packages each contain the following license:
 
@@ -1485,7 +1485,7 @@ Apache-2.0
 
 The following npm package may be included in this product:
 
- - ip-address@10.4.0
+ - ip-address@10.2.0
 
 This package contains the following license:
 
@@ -1740,7 +1740,7 @@ SOFTWARE.
 
 The following npm package may be included in this product:
 
- - undici@6.28.0
+ - undici@6.27.0
 
 This package contains the following license:
 

dist/cleanup/index.js

@@ -1929,11 +1929,7 @@ var require_request = __commonJS({
           } else if (typeof val[i] === "object") {
             throw new InvalidArgumentError(`invalid ${key} header`);
           } else {
-            const str = `${val[i]}`;
-            if (!isValidHeaderValue(str)) {
-              throw new InvalidArgumentError(`invalid ${key} header`);
-            }
-            arr.push(str);
+            arr.push(`${val[i]}`);
           }
         }
         val = arr;
@@ -1945,9 +1941,6 @@ var require_request = __commonJS({
         val = "";
       } else {
         val = `${val}`;
-        if (!isValidHeaderValue(val)) {
-          throw new InvalidArgumentError(`invalid ${key} header`);
-        }
       }
       if (headerName === "host") {
         if (request.host !== null) {
@@ -5678,7 +5671,6 @@ var require_client_h1 = __commonJS({
       RequestContentLengthMismatchError,
       ResponseContentLengthMismatchError,
       RequestAbortedError,
-      InvalidArgumentError,
       HeadersTimeoutError,
       HeadersOverflowError,
       SocketError,
@@ -6405,16 +6397,8 @@ var require_client_h1 = __commonJS({
         }
         body = bodyStream.stream;
         contentLength = bodyStream.length;
-      } else if (util.isBlobLike(body) && request.contentType == null) {
-        const contentType = body.type;
-        if (contentType) {
-          const contentTypeValue = `${contentType}`;
-          if (!util.isValidHeaderValue(contentTypeValue)) {
-            util.errorRequest(client, request, new InvalidArgumentError("invalid content-type header"));
-            return false;
-          }
-          headers.push("content-type", contentTypeValue);
-        }
+      } else if (util.isBlobLike(body) && request.contentType == null && body.type) {
+        headers.push("content-type", body.type);
       }
       if (body && typeof body.read === "function") {
         body.read(0);
@@ -8966,24 +8950,6 @@ var require_retry_handler = __commonJS({
       const current = Date.now();
       return new Date(retryAfter).getTime() - current;
     }
-    function validatePartialResponseContentLength(headers, range, statusCode, retryCount) {
-      const contentLength = headers["content-length"];
-      if (contentLength == null) {
-        return null;
-      }
-      if (!Number.isFinite(range.start) || !Number.isFinite(range.end)) {
-        return null;
-      }
-      const length = Number(contentLength);
-      const expectedLength = range.end - range.start + 1;
-      if (!Number.isFinite(length) || length !== expectedLength) {
-        return new RequestRetryError("Content-Length mismatch", statusCode, {
-          headers,
-          data: { count: retryCount }
-        });
-      }
-      return null;
-    }
     var RetryHandler = class _RetryHandler {
       constructor(opts, handlers) {
         const { retryOptions, ...dispatchOpts } = opts;
@@ -9156,11 +9122,6 @@ var require_retry_handler = __commonJS({
             );
             return false;
           }
-          const contentLengthError = validatePartialResponseContentLength(headers, contentRange, statusCode, this.retryCount);
-          if (contentLengthError != null) {
-            this.abort(contentLengthError);
-            return false;
-          }
           const { start, size, end = size - 1 } = contentRange;
           assert(this.start === start, "content-range mismatch");
           assert(this.end == null || this.end === end, "content-range mismatch");
@@ -9178,11 +9139,6 @@ var require_retry_handler = __commonJS({
                 statusMessage
               );
             }
-            const contentLengthError = validatePartialResponseContentLength(headers, range, statusCode, this.retryCount);
-            if (contentLengthError != null) {
-              this.abort(contentLengthError);
-              return false;
-            }
             const { start, size, end = size - 1 } = range;
             assert(
               start != null && Number.isFinite(start),
@@ -16028,48 +15984,14 @@ var require_util6 = __commonJS({
       for (let i = 0; i < path.length; ++i) {
         const code = path.charCodeAt(i);
         if (code < 32 || // exclude CTLs (0-31)
-        code > 126 || // exclude DEL and non-ascii
+        code === 127 || // DEL
         code === 59) {
           throw new Error("Invalid cookie path");
         }
       }
     }
-    function isLetterOrDigit(code) {
-      return code >= 48 && code <= 57 || // 0-9
-      code >= 65 && code <= 90 || // A-Z
-      code >= 97 && code <= 122;
-    }
     function validateCookieDomain(domain) {
-      if (domain === " ") {
-        return;
-      }
-      if (domain.length > 255) {
-        throw new Error("Invalid cookie domain");
-      }
-      let labelLength = 0;
-      for (let i = 0; i < domain.length; ++i) {
-        const code = domain.charCodeAt(i);
-        if (code === 46) {
-          if (labelLength === 0) {
-            throw new Error("Invalid cookie domain");
-          }
-          if (domain.charCodeAt(i - 1) === 45) {
-            throw new Error("Invalid cookie domain");
-          }
-          labelLength = 0;
-          continue;
-        }
-        if (labelLength === 0 && !isLetterOrDigit(code)) {
-          throw new Error("Invalid cookie domain");
-        }
-        if (!isLetterOrDigit(code) && code !== 45) {
-          throw new Error("Invalid cookie domain");
-        }
-        if (++labelLength > 63) {
-          throw new Error("Invalid cookie domain");
-        }
-      }
-      if (labelLength === 0 || domain.charCodeAt(domain.length - 1) === 45) {
+      if (domain.startsWith("-") || domain.endsWith(".") || domain.endsWith("-")) {
         throw new Error("Invalid cookie domain");
       }
     }
@@ -16152,11 +16074,7 @@ var require_util6 = __commonJS({
           throw new Error("Invalid unparsed");
         }
         const [key, ...value] = part.split("=");
-        const trimmedKey = key.trim();
-        const joinedValue = value.join("=");
-        validateCookieName(trimmedKey);
-        validateCookieValue(joinedValue);
-        out.push(`${trimmedKey}=${joinedValue}`);
+        out.push(`${key.trim()}=${value.join("=")}`);
       }
       return out.join("; ");
     }

package.json

@@ -1,7 +1,7 @@
 {
   "name": "configure-aws-credentials",
   "description": "A GitHub Action to configure AWS credentials",
-  "version": "6.2.3",
+  "version": "6.2.2",
   "scripts": {
     "build": "tsc",
     "lint": "biome check --error-on-warnings ./src ./test && markdownlint -i node_modules -i CHANGELOG.md '**/*.md'",
@@ -17,25 +17,25 @@
     "organization": true
   },
   "devDependencies": {
-    "@aws-sdk/credential-provider-env": "^3.972.69",
-    "@biomejs/biome": "2.5.8",
-    "@smithy/property-provider": "^4.5.0",
-    "@types/node": "^26.2.0",
+    "@aws-sdk/credential-provider-env": "^3.972.59",
+    "@biomejs/biome": "2.5.4",
+    "@smithy/property-provider": "^4.4.11",
+    "@types/node": "^26.1.1",
     "@vitest/coverage-v8": "4.1.10",
     "aws-sdk-client-mock": "^4.1.0",
-    "esbuild": "^0.28.2",
+    "esbuild": "^0.28.1",
     "generate-license-file": "^4.2.1",
     "json-schema": "^0.4.0",
     "markdownlint-cli": "^0.49.1",
-    "memfs": "^4.68.1",
+    "memfs": "^4.64.0",
     "standard-version": "^9.5.0",
     "typescript": "^7.0.2",
     "vitest": "4.1.10"
   },
   "dependencies": {
     "@actions/core": "^3.0.1",
-    "@aws-sdk/client-sts": "^3.1111.0",
-    "@smithy/node-http-handler": "^4.11.0",
+    "@aws-sdk/client-sts": "^3.1091.0",
+    "@smithy/node-http-handler": "^4.9.8",
     "proxy-agent": "^8.0.2"
   },
   "keywords": [