You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[Refactor][Build] Remove the end-of-support aws-sdk-go v1 from backend/go.mod #9196
backend/go.mod still requires github.com/aws/aws-sdk-go (v1). AWS ended
support for the v1 SDK on 2025-07-31:
no more bug fixes, no more security fixes. v1.55.8 is the last release and
deprecates every package, which is how it surfaced in #9192 (lint red with
11× SA1019).
Keeping an unsupported SDK in the dependency tree means:
any future CVE in it will not be fixed upstream by AWS,
every Dependabot gomod run that touches it re-triggers the deprecation
warnings, which currently have to be suppressed by a lint exclusion,
Optional guard: add a depguard rule (or a simple grep in CI) that rejects
new imports of github.com/aws/aws-sdk-go/, so v1 does not come back
through another plugin.
@warren830 — since kiro is currently the sole user of the AWS SDK in
DevLake, looping you in here as well. If you plan further AWS-based plugins,
starting them on v2 would avoid repeating this.
FYI: this looks resolved by #9233 (merged 2026-10-22). After that change, backend/go.mod / go.sum no longer reference github.com/aws/aws-sdk-go (v1), not even as an indirect dependency. The kiro plugin now uses aws-sdk-go-v2 only (config, credentials, service/s3, service/identitystore), and q_dev was already removed in #9079.
Activity
DoDiODev commentedon Oct 29, 2026
FYI: this looks resolved by #9233 (merged 2026-10-22). After that change,
backend/go.mod/go.sumno longer referencegithub.com/aws/aws-sdk-go(v1), not even as an indirect dependency. Thekiroplugin now usesaws-sdk-go-v2only (config,credentials,service/s3,service/identitystore), andq_devwas already removed in #9079.Feel free to close this if you agree.
klesh commentedon Oct 29, 2026
Thanks for gathering the information.