[dependabot]

Bumps @aws-sdk/client-s3 from 3.1150.0 to 3.1154.0.

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1154.0

3.1154.0(2026-10-20)

New Features

• client-cloudwatchomni: Updating max value for maxResults in SearchPrincipals API (b0304f53)
• client-rds: Amazon RDS now supports On-Demand Capacity Reservations for DB instances. (4a9c582b)
• client-cloudwatch: Amazon CloudWatch now supports two new anomaly detector settings. AdaptationSpeed (FAST, NORMAL, SLOW) controls how fast the model adapts to baseline changes, and OutlierFilteringStrength (MINIMAL, MODERATE, STRICT) controls how aggressively outliers are filtered. (4ab39261)
• client-dynamodb: Adds support for disassociating a replica from an Amazon DynamoDB multi-Region eventual consistency global table, so you can keep it as a single-Region table with its existing data. Also adds disassociation protection, on by default, to help prevent accidental disassociation. (47fab49d)
• client-bedrock: Amazon Bedrock Guardrails now supports a configurable tier for the contextual grounding policy via a new tier option. Select the Standard tier for grounding that better supports conversations and reasoning, with expanded language coverage. (7b180331)
• client-ecs: ECS Service Gateway makes it easier for developers to deploy ECS services without having to worry about complex ingress networking constructs. (db0d1430)
• client-s3files: S3 Files adds support for the "Misconfigured" file system status. (398f9d10)
• client-cleanrooms: This release allows customers and their partners to easily collaborate with data stored in Databricks, without having to move or share their underlying data among collaborators. (0d7bcd99)
• client-workspaces-instances: Documentation update release for AWS service (9dc12640)
• client-elasticache: LiveMigration enables customers to migrate from self-hosted EC2 Redis and Valkey clusters to ElastiCache Serverless with near-zero downtime. Customers control the migration through three API-driven phases (prepare, start, complete) that handle traffic proxying, data replication, and cutover. (eefeb2a2)
• client-marketplace-catalog: Adds ListEntities filter, sort, and summary support for the ExpressPrivateOfferConfiguration entity type, including filtering by ProductId. (eca81e1f)

---

For list of updated packages, view updated-packages.md in assets-3.1154.0.zip

v3.1153.0

3.1153.0(2026-10-19)

Chores

• core: consume JSON codec from @​smithy/core (#8335) (412d1362)
• update codeowners (#8365) (00c08848)
• codegen: sync for JSON codec and schema server plugin (#8353) (3e350b59)
• scripts: resolve changelog path by resolved location (#8356) (3f50ee08)

New Features

• client-codepipeline: Documentation update release for AWS service (75cdc917)
• client-devops-agent: Documentation update release for AWS service (5ff30e27)
• client-guardduty: Adding a new Expected Bucket Owner optional field for GuardDuty publishing destination APIs (2b62c860)
• client-cloudwatch: This release adds ActionConfiguration to PutMetricAlarm, PutCompositeAlarm and PutLogAlarm. It allows customers to include an alarm's tags in its notifications and alarm state change events (ae734907)
• client-observabilityadmin: Adding support for EKS Container Insights Telemetry Rules (3c63647d)
• client-xray: Adds support for encrypting the Transaction Search spans log group with a customer managed AWS KMS key. Pass the key ARN in the new CloudWatchLogsConfiguration.SpansLogGroupKmsKeyId field of UpdateTraceSegmentDestination. X-Ray applies the key when it creates the log group. (154d49fd)
• client-databrew: Documentation update release for AWS service (67b90539)
• client-bedrock-agent: Adds Retrieval Instructions for Amazon Bedrock Knowledge Bases. Create, get, update, delete, list, and version customer-authored instructions that guide how a knowledge base retrieves and answers, with content review before use. (d16d5176)
• client-emr-containers: Documentation update release for AWS service (4ba3e7bb)
• client-bedrock-agent-runtime: Adds support for applying a Retrieval Instruction, optionally by version, to AgenticRetrieveStream requests for Amazon Bedrock Knowledge Bases, and reports the applied instruction and version on the trace. (a065ceb4)
• client-dynamodb: Enable account endpoint generation for existing CN and GovCloud regions (ca19aa35)
• client-datazone: Adds SDK and CLI support for the Iceberg REST catalog connection types already available in Amazon SageMaker Unified Studio - ICEBERGRESTCATALOG, SNOWFLAKEICEBERGRESTCATALOG, and DATABRICKSICEBERGRESTCATALOG. (58940515)
• client-drs: Documentation update release for AWS service (50b058d1)
• client-amplify: Documentation update release for AWS service (7e7cacf5)
• client-bedrock-agentcore: Adds the Builtin.FailureAnalysis evaluator for batch evaluations. GetBatchEvaluation now returns insightResults that group session failures into insights with root causes and suggested fixes. (e34db602)
• client-codecommit: Documentation update release for AWS service (f6d27955)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1154.0 (2026-10-20)

Note: Version bump only for package @​aws-sdk/client-s3

3.1153.0 (2026-10-19)

Note: Version bump only for package @​aws-sdk/client-s3

3.1152.0 (2026-10-14)

Note: Version bump only for package @​aws-sdk/client-s3

3.1151.0 (2026-10-13)

Note: Version bump only for package @​aws-sdk/client-s3

Commits

• f6ff312 Publish v3.1154.0
• 3508584 Publish v3.1153.0
• 3e350b5 chore(codegen): sync for JSON codec and schema server plugin (#8353)
• 3ce8aa7 Publish v3.1152.0
• d6adfcb Publish v3.1151.0
• See full diff in compare view

[dependabot]

Labels

The following labels could not be found: destinations, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
npm/@aws-sdk/checksums	3.1001.4	🟢 6.3	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 5 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST ⚠️ 0 no SAST tool detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts 🟢 9 binaries present in source code Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing 🟢 10 project is fuzzed
npm/@aws-sdk/client-s3	3.1154.0	🟢 6.3	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 5 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST ⚠️ 0 no SAST tool detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts 🟢 9 binaries present in source code Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing 🟢 10 project is fuzzed
npm/@aws-sdk/core	3.978.4	🟢 6.3	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 5 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST ⚠️ 0 no SAST tool detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts 🟢 9 binaries present in source code Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing 🟢 10 project is fuzzed
npm/@aws-sdk/credential-provider-env	3.972.75	🟢 6.3	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 5 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST ⚠️ 0 no SAST tool detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts 🟢 9 binaries present in source code Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing 🟢 10 project is fuzzed
npm/@aws-sdk/credential-provider-http	3.972.77	🟢 6.3	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 5 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST ⚠️ 0 no SAST tool detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts 🟢 9 binaries present in source code Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing 🟢 10 project is fuzzed
npm/@aws-sdk/credential-provider-ini	3.973.20	🟢 6.3	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 5 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST ⚠️ 0 no SAST tool detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts 🟢 9 binaries present in source code Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing 🟢 10 project is fuzzed
npm/@aws-sdk/credential-provider-login	3.972.82	🟢 6.3	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 5 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST ⚠️ 0 no SAST tool detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts 🟢 9 binaries present in source code Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing 🟢 10 project is fuzzed
npm/@aws-sdk/credential-provider-node	3.972.87	🟢 6.3	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 5 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST ⚠️ 0 no SAST tool detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts 🟢 9 binaries present in source code Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing 🟢 10 project is fuzzed
npm/@aws-sdk/credential-provider-process	3.972.75	🟢 6.3	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 5 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST ⚠️ 0 no SAST tool detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts 🟢 9 binaries present in source code Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing 🟢 10 project is fuzzed
npm/@aws-sdk/credential-provider-sso	3.973.19	🟢 6.3	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 5 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST ⚠️ 0 no SAST tool detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts 🟢 9 binaries present in source code Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing 🟢 10 project is fuzzed
npm/@aws-sdk/credential-provider-web-identity	3.972.81	🟢 6.3	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 5 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST ⚠️ 0 no SAST tool detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts 🟢 9 binaries present in source code Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing 🟢 10 project is fuzzed
npm/@aws-sdk/middleware-sdk-s3	3.972.80	🟢 6.3	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 5 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST ⚠️ 0 no SAST tool detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts 🟢 9 binaries present in source code Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing 🟢 10 project is fuzzed
npm/@aws-sdk/nested-clients	3.997.49	🟢 6.3	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 5 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST ⚠️ 0 no SAST tool detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts 🟢 9 binaries present in source code Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing 🟢 10 project is fuzzed
npm/@aws-sdk/token-providers	3.1153.0	🟢 6.3	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 5 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST ⚠️ 0 no SAST tool detected Packaging 🟢 10 packaging workflow detected Binary-Artifacts 🟢 9 binaries present in source code Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing 🟢 10 project is fuzzed
npm/@smithy/core	3.36.1	Unknown	Unknown

Scanned Files

• packages/destinations/package-lock.json

[mishrasanjeev]

Reviewed exact head 9264f29. Only the destinations development lock changes: 15 development records, zero runtime records; S3 client 3.1150 to 3.1154, Smithy core 3.35.2 to 3.36.1 and related AWS dependencies. No source, manifest, version, override, scanner policy or auth context change. Upstream changelogs and endpoint/signature contracts reviewed. Fresh exact-candidate Node26.12.1 Docker validation passed 15 package, 8 loopback SSE/HTTP, 9 S3-shaped HTTP and 16 policy checks without failures/skips; all 40 npm audits, builds/typecheck and secret/vendor gates passed. Old 3.1150 client passed the same nine S3 controls. Actual dynamically loaded SDK requests used loopback only with networknone and ephemeral synthetic credentials; independent SigV4 HMAC/CRC32 verification and signature/body tamper negative controls, ordinary batching/final flush, configured retry/error surfacing and SSE upload passed. No live cloud/IAM/credential-provider compatibility, durable requeue after terminal failure, arbitrary oversized-batch draining, production/provider/merchant/financial coverage or package publication is claimed. All 47 current-head checks succeeded with two expected skips; all six workflows succeeded, with no open PR CodeQL alerts.