github-actions: bump aws-actions/configure-aws-credentials from 4 to 6

[dependabot]

Bumps aws-actions/configure-aws-credentials from 4 to 6.

Release notes

Sourced from aws-actions/configure-aws-credentials's releases.

v6.0.0

6.0.0 (2026-02-04)

⚠ BREAKING CHANGES

• Update action to use node24 Note this requires GitHub action runner version v2.327.1 or later (#1632) (a7a2c11)

Features

• add support to define transitive tag keys (#1316) (232435c) (930ebd9)

Bug Fixes

• properly output aws-account-id and authenticated-arn when using role-chaining (#1633) (7ceaf96)

v5.1.1

5.1.1 (2025-11-24)

Miscellaneous Chores

• release 5.1.1 (56d6a58)
• various dependency updates

v5.1.0

5.1.0 (2025-10-06)

Features

• Add global timeout support (#1487) (1584b8b)
• add no-proxy support (#1482) (dde9b22)
• Improve debug logging in retry logic (#1485) (97ef425)

Bug Fixes

• properly expose getProxyForUrl (introduced in #1482) (#1486) (cea4298)

v5.0.0

5.0.0 (2025-09-03)

⚠ BREAKING CHANGES

• Cleanup input handling. Changes invalid boolean input behavior (see #1445)

Features

... (truncated)

Changelog

Sourced from aws-actions/configure-aws-credentials's changelog.

6.2.1 (2026-06-26)

Bug Fixes

• enforce allowed-account-ids on all auth paths (#1847) (4d281fb)

6.2.0 (2026-06-01)

Features

• add additional session tags by default (#1775) (e0ba768)
• add more retry logic and better logging (#1764) (540d0c1)
• add regex validation to role-session-name (#1765) (e354499)
• Allow custom session tags to be passed when assuming a role (#1759) (61f50f6)
• expose run id in STS client user-agent (#1774) (29d1be3)
• support custom STS endpoints (#1762) (8d52d05)

Bug Fixes

• skip credential check on output-env-credentials: false (#1778) (58e7c47)
• assumeRole failing from session tag size too large (#1808) (d6f5dc3)

6.1.3 (2026-05-28)

Bug Fixes

• fix: allow kubelet token symlink in #1805

6.1.2 (2026-05-26)

Bug Fixes

• additional filesystem checks (#1799) (c39f282)

6.1.1 (2026-05-05)

Miscellaneous Chores

• various dependency updates

6.1.0 (2026-04-06)

Features

• add skip cleanup option (#1716) (11b1c58), closes #1545
• Support usage of AWS Profiles (#1696) (a7f0c82)

Commits

• e6de054 chore(main): release 6.2.3 (#1878)
• ab3b2ba chore: Update dist
• fa8d6a5 fix: PackedPolicyTooLarge detection in STS tags (#1899)
• 42e118a chore(deps-dev): bump markdownlint-cli from 0.49.0 to 0.49.1 (#1896)
• d86ddfc chore: Update dist
• 874aaac chore(deps): bump @​aws-sdk/client-sts from 3.1086.0 to 3.1091.0 (#1892)
• d4341b6 chore: Update dist
• fe51823 chore(deps-dev): bump @​aws-sdk/credential-provider-env (#1894)
• a8be382 chore(deps-dev): bump @​biomejs/biome from 2.5.3 to 2.5.4 (#1893)
• e000376 chore: Update dist
• Additional commits viewable in compare view

[bgentry]

@dependabot rebase

[bgentry]

🤖 Codex review: Blocked by a known-vulnerable runtime artifact.

Upgrade

• aws-actions/configure-aws-credentials: v4 → v6
• Reviewed head: 54ec140f8e09ddce9b8bb44ca4c840f49285b7c6
• Current v6 target: release 6.2.3 commit e6de054238d6b7531b4efff3b6587d9aade6a06c

Security review

• The exact v4/v6 tags, source, generated bundles, dependency graph, OIDC/STS behavior, workflow permissions, and credential exposure were inspected. v6 removes nine older Undici advisories from the v4 bundle and adds useful credential validation.
• The current v6 bundle still contains undici@6.27.0, including code affected by three medium advisories published August 3 and fixed in 6.28.0: GHSA-m8rv-5g2x-5cg5, GHSA-v3r7-h72x-cjcm, and GHSA-8xcm-r25x-g524.
• River's precise OIDC path does not appear to reach those APIs, but this action handles cloud credentials and the known-vulnerable runtime remains present. Upstream has merged the 6.28.0 update, but the reviewed v6 tag has not yet moved to a release containing it.

Compatibility verification

• The Dependabot workflow reaches Node 24 startup and OIDC token acquisition, then AWS rejects AssumeRoleWithWebIdentity for the bot identity. It does not validate successful role assumption, ECR operations, or cleanup.

Residual risk / blocker

• Wait for a v6 release containing undici >=6.28.0, then re-resolve the mutable tag and review the new bundle/security delta. Do not approve or merge this target.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.