[Snyk] Security upgrade software.amazon.awssdk:sts from 2.10.56 to 2.48.4

[chrislin22]

Snyk has created this PR to fix 2 vulnerabilities in the maven dependencies of this project.

Snyk changed the following file(s):

• pulsar-io/aws/pom.xml

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score	Upgrade
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-IONETTY-18170202	710	software.amazon.awssdk:sts: 2.10.56 -> 2.48.4 No Path Found Proof of Concept
	Allocation of Resources Without Limits or Throttling SNYK-JAVA-IONETTY-18170204	710	software.amazon.awssdk:sts: 2.10.56 -> 2.48.4 No Path Found Proof of Concept

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling

[chrislin22]

This is a minor version upgrade that spans a significant number of releases for the AWS SDK for Java v2. According to the official AWS SDK versioning policy, minor version updates are considered medium risk and may contain backward-incompatible changes. [7]

Potential Risks:

• Core Runtime Changes: The SDK has undergone internal refactoring in areas like authentication and endpoint resolution, which could introduce subtle behavioral changes. [1]
• Minimum Java Version: The minimum required Java version may have been increased across this version range. Verification of your project's Java runtime against the SDK's requirements is necessary.
• Dependency Updates: Core dependencies, such as the Jackson JSON processor, have been upgraded, which could lead to transitive dependency conflicts. [4]

While no specific, high-impact breaking API changes for the STS client were identified in the release notes, the large version gap and the SDK's versioning policy warrant a medium risk assessment. [7]

Recommendation:
Thoroughly test the application's authentication and STS-related functionality after the upgrade. Verify that your Java runtime version is still supported and check for any new transitive dependency conflicts.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.