Request to update or deprecate aws-sdk-go library to fix CVE-2020-8911

What did you do?

AWS inspector scans, flag the CVE-2020-8911, due to the presence of vulnerable aws-sdk-go library.

The module import being flagged, is over here: https://github.com/prometheus/prometheus/blob/main/go.mod#L113

What did you expect to see?

The aws-sdk-go module was not expected to be imported, as it is known to have vulnerabilies.

What did you see instead? Under which circumstances?

The aws-sdk-go module, continues to be imported. Although teams can file exceptions and ignore, raising this, to see if there's a way to deprecate the library, or migrate the APIs to the aws-sdk-v2 apis.

System information

RHEL 10.1 with otel-collector at https://github.com/open-telemetry/opentelemetry-collector-contrib/releases/tag/v0.150.0

Prometheus version

github.com/prometheus/[email protected]

Prometheus configuration file

https://github.com/prometheus/prometheus/blob/main/go.mod#L113

Alertmanager version

Alertmanager configuration file

Logs