Skip to content

[Refactor][Build] Remove the end-of-support aws-sdk-go v1 from backend/go.mod #9196

Closed

Description

@DoDiODev

What and why to refactor

backend/go.mod still requires github.com/aws/aws-sdk-go (v1). AWS ended
support for the v1 SDK on
2025-07-31:
no more bug fixes, no more security fixes. v1.55.8 is the last release and
deprecates every package, which is how it surfaced in #9192 (lint red with
11× SA1019).

Keeping an unsupported SDK in the dependency tree means:

  • any future CVE in it will not be fixed upstream by AWS,
  • every Dependabot gomod run that touches it re-triggers the deprecation
    warnings, which currently have to be suppressed by a lint exclusion,
  • security scanners will increasingly flag it.

Describe the solution you'd like

  1. Migrate the only consumer, backend/plugins/kiro, to aws-sdk-go-v2
    (separate issue: [Refactor][Kiro] Migrate the kiro plugin from aws-sdk-go v1 to aws-sdk-go-v2 #9195).
  2. Remove github.com/aws/aws-sdk-go from backend/go.mod / go.sum
    (go mod tidy).
  3. Remove the temporary staticcheck exclusion for SA1019 /
    plugins/kiro/ from backend/.golangci.yaml (added in fix(ci): make Dependabot gomod PRs tested and lint-clean #9197).
  4. Optional guard: add a depguard rule (or a simple grep in CI) that rejects
    new imports of github.com/aws/aws-sdk-go/, so v1 does not come back
    through another plugin.

@warren830 — since kiro is currently the sole user of the AWS SDK in
DevLake, looping you in here as well. If you plan further AWS-based plugins,
starting them on v2 would avoid repeating this.

Related issues

Additional context

q_dev, the previous AWS-based plugin, was removed in #9079, so after the
kiro migration no code in the repository depends on v1 anymore.

Activity

  1. DoDiODev commented on Oct 29, 2026

    @DoDiODev
    ContributorAuthor

    FYI: this looks resolved by #9233 (merged 2026-10-22). After that change, backend/go.mod / go.sum no longer reference github.com/aws/aws-sdk-go (v1), not even as an indirect dependency. The kiro plugin now uses aws-sdk-go-v2 only (config, credentials, service/s3, service/identitystore), and q_dev was already removed in #9079.

    Feel free to close this if you agree.

  2. klesh commented on Oct 29, 2026

    @klesh
    Contributor

    Thanks for gathering the information.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions