github-actions: bump aws-actions/configure-aws-credentials from 4 to 5

[dependabot]

Bumps aws-actions/configure-aws-credentials from 4 to 5.

Release notes

Sourced from aws-actions/configure-aws-credentials's releases.

v5.0.0

5.0.0 (2025-09-03)

⚠ BREAKING CHANGES

• Cleanup input handling. Changes invalid boolean input behavior (see #1445)

Features

• add skip OIDC option (#1458) (8c45f6b)
• Cleanup input handling. Changes invalid boolean input behavior (see #1445) (74b3e27)
• support account id allowlist (#1456) (c4be498)

v4.3.1

4.3.1 (2025-08-04)

Bug Fixes

• update readme to 4.3.1 (#1424) (be2e7ad)

v4.3.0

4.3.0 (2025-08-04)

NOTE: This release tag originally pointed to 59b441846ad109fa4a1549b73ef4e149c4bfb53b, but a critical bug was discovered shortly after publishing. We updated this tag to d0834ad3a60a024346910e522a81b0002bd37fea to prevent anyone using the 4.3.0 tag from encountering the bug, and we published 4.3.1 to allow workflows to auto update correctly.

Features

• dependency update and feature cleanup (#1414) (59489ba), closes #1062 #1191
• Optional environment variable output (c3b3ce6)

Bug Fixes

• docs: readme samples versioning (5b3c895)
• the wrong example region for China partition in README (37fe9a7)
• properly set proxy environment variable (cbea708)

Miscellaneous Chores

• release 4.3.0 (3f7c218)

v4.2.1

4.2.1 (2025-05-14)

Bug Fixes

... (truncated)

Changelog

Sourced from aws-actions/configure-aws-credentials's changelog.

6.1.1 (2026-05-05)

Miscellaneous Chores

• various dependency updates

6.1.0 (2026-04-06)

Features

• add skip cleanup option (#1716) (11b1c58), closes #1545
• Support usage of AWS Profiles (#1696) (a7f0c82)

Commits

• 61815dc chore(main): release 5.1.1 (#1564)
• 56d6a58 chore: release 5.1.1
• 4a54c24 chore(deps-dev): bump glob from 10.4.5 to 10.5.0 (#1563)
• b2793c9 chore(deps-dev): bump @​types/node from 24.10.0 to 24.10.1 (#1559)
• 8c230bf chore: Update dist
• f7a5b07 chore(deps): bump @​aws-sdk/client-sts from 3.928.0 to 3.933.0 (#1558)
• 730fc04 chore(deps-dev): bump @​biomejs/biome from 2.3.4 to 2.3.6 (#1555)
• bc0dd36 chore(deps-dev): bump memfs from 4.50.0 to 4.51.0 (#1556)
• f2964c7 chore: Update dist
• cf46495 chore(deps): bump @​aws-sdk/client-sts from 3.922.0 to 3.928.0 (#1548)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[bgentry]

🤖 Codex review: Approved after dependency security and compatibility review.

Upgrade

• aws-actions/configure-aws-credentials: v4 → v5
• Reviewed head: c361dc7dd831d397adccce2d6c492750fa675fde
• Resolved v5 identity at review time:
  61815dcd50bd041e203e49132bacad1fd04d2708

Security review

• Compared the exact upstream trees and generated bundles. The current v4
  tag resolves to 7474bc4690e29a8392af63c5b98e7449536d5c3a; v5 resolves through tag
  object cabfdba3510de1431bac9dba27511d97497fc100 to the signed, immutable
  v5.1.1 commit above.
• Reviewed 26 added, 99 changed, and 15 removed lockfile entries plus sensitive
  proxy/PAC artifacts. Registry SHA-512 values match; there are no new install
  hooks, non-registry sources, integrity rewrites, native bindings, or
  platform-gated runtime packages.
• River's OIDC path retains the same permissions, token/STS flow, credential
  masking/export, and cleanup. New strict boolean parsing, account allowlisting,
  timeout, and broader proxy/PAC support are optional and inactive with River's
  inputs. No unconditional secret read, telemetry, filesystem write, or process
  spawning was introduced.
• This is a routine major update, not a confirmed security update. It removes
  older Smithy/UUID advisory surfaces; advisory-flagged additions are reachable
  only through caller-supplied PAC/FTP or SOCKS proxy configuration, which
  River does not use.

Compatibility verification

• The affected jobs execute v5, acquire OIDC credentials, and reach AWS STS;
  STS rejects Dependabot's identity before any build. The same role-policy
  failure occurs across the queue while those jobs still use v4, identifying
  this as the bot credential context rather than a v5 regression.
• River supplies no changed/strict boolean or proxy inputs. The exact head was
  checked out in isolation; its non-workflow tree is byte-identical to the
  fully validated PR #677 tree, so unaffected install, lint, test, production
  build, and Storybook results were reused.
• All Go, JavaScript, lint, release, and public image checks are green. The
  private image success path remains unavailable to bot-authored CI.

Residual risk

• Moderate-low: @v5 is a mutable major tag and must be re-resolved before
  merge. The large generated bundle adds QuickJS/PAC proxy code and retains
  advisory findings that are inactive in River's no-proxy configuration. The
  authenticated AWS success path could not be completed in Dependabot's
  restricted context.