[dependabot]

Bumps @aws-sdk/credential-providers from 3.1120.0 to 3.1152.0.

Release notes

Sourced from @​aws-sdk/credential-providers's releases.

v3.1152.0

3.1152.0(2026-10-14)

Documentation Changes

• client-marketplace-metering: Documentation update - added a Get started pointer to the AWS Marketplace AI Metering Agent Skill in the BatchMeterUsage API reference. No API or behavior change. (c97db282)

New Features

• clients: update client endpoints as of 2026-10-14 (91a8a07c)
• client-imagebuilder: This release adds parentInstance to infrastructure configurations, so builds can use an already-running instance from an Amazon EC2 Auto Scaling group. It also adds terminateInstanceOnCompletion, which keeps build and test instances running after image creation ends. (e8a5e26b)
• client-cloudfront: This release adds a new "IpAddressType" field to "VPCOriginEndpointConfig", allowing customers to specify whether their VPC origin accepts IPv4-only or dualstack connections. (6bae6413)
• client-transfer: AWS Transfer Family now lets you store SFTP server host keys in AWS Secrets Manager in your own AWS account. This gives you greater control over your server identity and helps simplify server migrations and failover. (9d0e8866)
• client-dynamodb-streams: Add support for a new iterator type (AT TIMESTAMP) for DynamoDB Streams GetShardIterator API that allows reading from a specific point in time from the stream. (150e6ae3)
• client-ec2: Adds T8i instance sizes to the InstanceType enum. T8i instances are low-cost burstable instances powered by custom sixth generation Intel Xeon 6 processors, available exclusively on AWS, and built on the latest sixth generation AWS Nitro cards (65c6056b)
• client-arc-region-switch: Features - Adds support for an optional payload to invoke the Lambda function with as part of the Custom action Lambda execution block (d21aa72b)
• client-organizations: With dual-stack enabled, all requests now resolve to the endpoint in the partition's primary Region (for example, organizations.us-east-1.api.aws) and are signed for that Region. Previously, requests from other Regions resolved to a nonexistent endpoint. No API changes. (9324745e)
• client-bedrock-agentcore-control: This release supports scoping Amazon Bedrock AgentCore Gateway rate limits by request header or request body field. (30c5bca2)
• client-lambda: AWS Lambda now supports an optional X-Ray trace header for chained invocations in durable executions, enabling child invocations to be linked to the initiating span. (08219be0)
• client-guardduty: Releasing support for Custom Detection Rule Runtime Monitoring (0cb32b8f)
• lib-transfer-manager: publish as a preview package (#8355) (41080929)

---

For list of updated packages, view updated-packages.md in assets-3.1152.0.zip

v3.1151.0

3.1151.0(2026-10-13)

Chores

• lib-transfer-manager: move lib-transfer-manager to preview/ folder (#8351) (5037a006)
• scripts: add preview/ folder to build tooling (#8350) (a922905a)

Documentation Changes

• client-lambda-web: Documentation update to include common use cases. (643507a0)

New Features

• clients: update client endpoints as of 2026-10-13 (d3994582)
• client-lakeformation: Added new LakeFormation APIs and documentation updates for Simple Row-level Security (RLS). (c7a586fc)
• client-agent-registry-control: AWS Agent Registry is improving recently launched custom metadata schema feature to make shared attributes easier to manage. (ed00d0bb)
• client-omics: With Expanded container registry support, you can use container images from registries such as Seqera (Wave), NVIDIA NGC, and Google Artifact Registry with AWS HealthOmics private workflows, without manually migrating images into Amazon ECR or editing your workflow definitions. (db382740)
• client-route-53-domains: Route 53 Domains now supports premium domains. This release adds consent objects to operations on premium domains and a new GetDomainPrices API. Also, the Flags and PublicKey fields were deprecated from the DnssecKey response. (c5cc6f50)
• client-gamelift: Adds support for new instance types in the C8a, C8i, C9g, M8a, M8i, and M9g families for managed EC2 and container fleets (51456772)
• client-appstream: Adds support for administrators to require users to re-authenticate OneDrive and Google Drive storage connectors when a streaming session is reused. (2b6f2af5)
• client-connect: New APIs to support aliases and versions for ContactFlow. (39466baa)
• client-appintegrations: This release adds the Connect JWT authentication type and the AudienceOverride field to AuthConfig, letting A2A server applications authenticate with JWTs issued by Amazon Connect. (3b212b20)

... (truncated)

Changelog

Sourced from @​aws-sdk/credential-providers's changelog.

3.1152.0 (2026-10-14)

Note: Version bump only for package @​aws-sdk/credential-providers

3.1151.0 (2026-10-13)

Note: Version bump only for package @​aws-sdk/credential-providers

3.1150.0 (2026-10-12)

Note: Version bump only for package @​aws-sdk/credential-providers

3.1149.0 (2026-10-09)

Note: Version bump only for package @​aws-sdk/credential-providers

3.1148.0 (2026-10-08)

Note: Version bump only for package @​aws-sdk/credential-providers

3.1147.0 (2026-10-06)

Note: Version bump only for package @​aws-sdk/credential-providers

3.1146.0 (2026-10-02)

... (truncated)

Commits

• 3ce8aa7 Publish v3.1152.0
• d6adfcb Publish v3.1151.0
• 4c9a334 Publish v3.1150.0
• a960c14 Publish v3.1149.0
• 5773a75 chore(codegen): sync for endpoint cache fix and pre-schema error fallback (#8...
• 1bc0425 Publish v3.1148.0
• 663046d Publish v3.1147.0
• 054298b Publish v3.1146.0
• 0199117 Publish v3.1145.0
• ce26281 Publish v3.1144.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: de1d75e8-a29a-40bf-9be5-fa72a75116b7

📥 Commits

Reviewing files that changed from the base of the PR and between e1523e6 and 621fbb6.

⛔ Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing: 1

• package.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.

📝 Walkthrough

The @aws-sdk/credential-providers dependency range in package.json changed from ^3.1120.0 to ^3.1152.0.

Changes: AWS credential provider update

Layer / File(s)	Summary
Update credential provider range package.json	The dependency range for @aws-sdk/credential-providers changed from ^3.1120.0 to ^3.1152.0.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: dahlia

Merge Risk: ⚪ Minimal · up to 621fb

The dependency update preserves the fromEnv() behavior used by storage, so no concrete merge blocker is identified.

Security architecture risk: 🔵 Low · up to 621fb

The inspected credential-selection and rejection behavior is unchanged, and no privilege expansion was established. End-to-end storage authorization and deployed permissions remain unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The affected path supplies application-environment credentials to the configured S3 storage target. A configured bucket does not establish the credentials' maximum IAM authority. Permitted resources, tenant reach and actual authorization outcomes remain unresolved because deployed policy and network-operation evidence are missing.

Trust Boundaries and Controls

• observed — The inspected provider continues to read process environment credentials when invoked and rejects absent or empty access-key or secret-key values. No request-controlled credential source appears in this factory. Whether an attacker can modify deployment environment values was not established.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the dependency and the exact version update described in the changeset.
Description check		The description directly explains the dependency update and includes relevant release notes and changelog details.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}