- actions/checkout v4 -> v6
- actions/setup-go v4 -> v5
- go-version ^1.20 -> ^1.25
- Replace abandoned marvinpinto/action-automatic-releases with
softprops/action-gh-release v2
Node.js 20 actions are deprecated and will be forced to Node 24
starting June 2, 2026, and removed September 16, 2026.
The pmapperCommand in runAllChecksCommand was missing the
PmapperDataBasePath parameter, causing --pmapper-data-basepath to be
ignored for the pmapper module when running all-checks. (Fixes#105)
The instances module had a race condition where role analysis ran before
the receiver goroutine finished collecting all MappedInstances. This
caused IsAdminRole and CanPrivEscToAdmin columns to appear empty in
all-checks despite pmapper data being available. Fixed by signaling
the receiver to stop and waiting for it to drain before running role
analysis.
Version bumped to 2.0.4.
The EC2 user data InstancesModule in runAllChecksCommand was not receiving
the PmapperDataBasePath parameter, causing the --pmapper-data-basepath flag
to be ignored when running all-checks.
Fix: Add PmapperDataBasePath: PmapperDataBasePath to the ec2UserData struct
initialization in runAllChecksCommand.
awsservicemap v1.1.0 switched to URL-based service slugs, breaking all
commands that used the old identifiers. Affected slugs and their fixes:
secretsmanager -> secrets-manager (resource-trusts, inventory)
ssm -> systems-manager (inventory)
elb -> elasticloadbalancing (endpoints, inventory, network-ports)
es -> opensearch-service (endpoints, inventory, resource-trusts)
mq -> amazon-mq (endpoints, inventory)
stepfunctions -> step-functions (inventory)
sagemaker -> sagemaker-ai (env-vars)
clouddirectory -> directoryservice (directory-services)
kinesis -> streams (inventory)
lightsail -> amazonlightsail.com (endpoints, env-vars, network-ports)
Each mismatch caused IsServiceInRegion to return false for all regions,
silently skipping enumeration of that service entirely.
awsservicemap v1.1.0 changed to a URL-based service identification format.
The secrets module was passing old-style slugs ("secretsmanager", "ssm") to
IsServiceInRegion, which never matched the new URL-derived slugs
("secrets-manager", "systems-manager"). This caused 0 tasks to be queued
and no secrets to be returned despite secrets existing in the account.
Joseph Barcia