documentation for scope input

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>

.github/workflows/ci.yml

@@ -207,7 +207,7 @@ jobs:
         with:
           registry: public.ecr.aws
 
-  github-container:
+  ghcr:
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -356,3 +356,125 @@ jobs:
             echo "::error::Should have failed"
             exit 1
           fi
+
+  scope-dockerhub:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - windows-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v6
+      -
+        name: Login to Docker Hub
+        uses: ./
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          scope: '@push'
+      -
+        name: Print config.json files
+        shell: bash
+        run: |
+          shopt -s globstar nullglob
+          for file in ~/.docker/**/config.json; do
+            echo "## ${file}"
+            jq '(.auths[]?.auth) |= "REDACTED"' "$file"
+            echo ""
+          done
+
+  scope-dockerhub-repo:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - windows-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v6
+      -
+        name: Login to Docker Hub
+        uses: ./
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          scope: 'docker/buildx-bin@push'
+      -
+        name: Print config.json files
+        shell: bash
+        run: |
+          shopt -s globstar nullglob
+          for file in ~/.docker/**/config.json; do
+            echo "## ${file}"
+            jq '(.auths[]?.auth) |= "REDACTED"' "$file"
+            echo ""
+          done
+
+  scope-ghcr:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - windows-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v6
+      -
+        name: Login to GitHub Container Registry
+        uses: ./
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+          scope: '@push'
+      -
+        name: Print config.json files
+        shell: bash
+        run: |
+          shopt -s globstar nullglob
+          for file in ~/.docker/**/config.json; do
+            echo "## ${file}"
+            jq '(.auths[]?.auth) |= "REDACTED"' "$file"
+            echo ""
+          done
+
+  scope-ghcr-repo:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os:
+          - ubuntu-latest
+          - windows-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v6
+      -
+        name: Login to GitHub Container Registry
+        uses: ./
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+          scope: 'docker/login-action@push'
+      -
+        name: Print config.json files
+        shell: bash
+        run: |
+          shopt -s globstar nullglob
+          for file in ~/.docker/**/config.json; do
+            echo "## ${file}"
+            jq '(.auths[]?.auth) |= "REDACTED"' "$file"
+            echo ""
+          done

README.md

@@ -25,6 +25,7 @@ ___
   * [Quay.io](#quayio)
   * [DigitalOcean](#digitalocean-container-registry)
   * [Authenticate to multiple registries](#authenticate-to-multiple-registries)
+  * [Set scopes for the authentication token](#set-scopes-for-the-authentication-token)
 * [Customizing](#customizing)
   * [inputs](#inputs)
 * [Contributing](#contributing)
@@ -527,8 +528,8 @@ jobs:
 ```
 
 You can also use the `registry-auth` input for raw authentication to
-registries, defined as YAML objects. Each object can contain `registry`,
-`username`, `password` and `ecr` keys similar to current inputs:
+registries, defined as YAML objects. Each object have the same attributes as
+current inputs (except `logout`):
 
 > [!WARNING]
 > We don't recommend using this method, it's better to use the action multiple
@@ -557,6 +558,60 @@ jobs:
               password: ${{ secrets.GITHUB_TOKEN }}
 ```
 
+### Set scopes for the authentication token
+
+The `scope` input allows limiting registry credentials to a specific repository
+or namespace scope when building images with Buildx.
+
+This is useful in GitHub Actions to avoid overriding the Docker Hub
+authentication token embedded in GitHub-hosted runners, which is used for
+pulling images without rate limits. By scoping credentials, you can
+authenticate only where needed (typically for pushing), while keeping
+unauthenticated pulls for base images.
+
+When `scope` is set, credentials are written to the Buildx configuration
+instead of the global Docker configuration. This means:
+* Authentication applies only to the specified scope
+* The default Docker Hub credentials remain available for pulls
+* Credentials are used only by Buildx during the build
+
+> [!IMPORTANT]
+> Credentials written to the Buildx configuration are only accessible by Buildx.
+> They are not available to `docker pull`, `docker push`, or any other Docker
+> CLI commands outside Buildx.
+
+> [!NOTE]
+> This feature requires Buildx version 0.31.0 or later.
+
+```yaml
+name: ci
+
+on:
+  push:
+    branches: main
+
+jobs:
+  login:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Login to Docker Hub (scoped)
+        uses: docker/login-action@v3
+        with:
+          username: ${{ vars.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          scope: 'myorg/myimage@push'
+      -
+        name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          tags: myorg/myimage:latest
+```
+
+In this example, base images are pulled using the embedded GitHub-hosted runner
+credentials, while authenticated access is used only to push `myorg/myimage`.
+
 ## Customizing
 
 ### inputs
@@ -568,13 +623,13 @@ The following inputs can be used as `step.with` keys:
 | `registry`      | String | `docker.io` | Server address of Docker registry. If not set then will default to Docker Hub |
 | `username`      | String |             | Username for authenticating to the Docker registry                            |
 | `password`      | String |             | Password or personal access token for authenticating the Docker registry      |
+| `scope`         | String |             | Scope for the authentication token                                            |
 | `ecr`           | String | `auto`      | Specifies whether the given registry is ECR (`auto`, `true` or `false`)       |
 | `logout`        | Bool   | `true`      | Log out from the Docker registry at the end of a job                          |
 | `registry-auth` | YAML   |             | Raw authentication to registries, defined as YAML objects                     |
 
 > [!NOTE]
-> The `registry-auth` input is mutually exclusive with `registry`, `username`,
-> `password` and `ecr` inputs.
+> The `registry-auth` input cannot be used with other inputs except `logout`.
 
 ## Contributing
 

__tests__/docker.test.ts

@@ -50,7 +50,7 @@ test('logout calls exec', async () => {
 
   const registry = 'https://ghcr.io';
 
-  await logout(registry);
+  await logout(registry, '');
 
   expect(execSpy).toHaveBeenCalledTimes(1);
   const callfunc = execSpy.mock.calls[0];

action.yml

@@ -19,6 +19,9 @@ inputs:
   ecr:
     description: 'Specifies whether the given registry is ECR (auto, true or false)'
     required: false
+  scope:
+    description: 'Scope for the authentication token'
+    required: false
   logout:
     description: 'Log out from the Docker registry at the end of a job'
     default: 'true'

src/context.ts

@@ -1,21 +1,90 @@
+import path from 'path';
 import * as core from '@actions/core';
+import * as yaml from 'js-yaml';
+
+import {Buildx} from '@docker/actions-toolkit/lib/buildx/buildx';
+import {Util} from '@docker/actions-toolkit/lib/util';
 
 export interface Inputs {
   registry: string;
   username: string;
   password: string;
+  scope: string;
   ecr: string;
   logout: boolean;
   registryAuth: string;
 }
 
+export interface Auth {
+  registry: string;
+  username: string;
+  password: string;
+  scope: string;
+  ecr: string;
+  configDir: string;
+}
+
 export function getInputs(): Inputs {
   return {
     registry: core.getInput('registry'),
     username: core.getInput('username'),
     password: core.getInput('password'),
+    scope: core.getInput('scope'),
     ecr: core.getInput('ecr'),
     logout: core.getBooleanInput('logout'),
     registryAuth: core.getInput('registry-auth')
   };
 }
+
+export function getAuthList(inputs: Inputs): Array<Auth> {
+  if (inputs.registryAuth && (inputs.registry || inputs.username || inputs.password || inputs.scope || inputs.ecr)) {
+    throw new Error('Cannot use registry-auth with other inputs');
+  }
+  let auths: Array<Auth> = [];
+  if (!inputs.registryAuth) {
+    auths.push({
+      registry: inputs.registry || 'docker.io',
+      username: inputs.username,
+      password: inputs.password,
+      scope: inputs.scope,
+      ecr: inputs.ecr || 'auto',
+      configDir: scopeToConfigDir(inputs.registry, inputs.scope)
+    });
+  } else {
+    auths = (yaml.load(inputs.registryAuth) as Array<Auth>).map(auth => {
+      core.setSecret(auth.password); // redacted in workflow logs
+      return {
+        registry: auth.registry || 'docker.io',
+        username: auth.username,
+        password: auth.password,
+        scope: auth.scope,
+        ecr: auth.ecr || 'auto',
+        configDir: scopeToConfigDir(auth.registry || 'docker.io', auth.scope)
+      };
+    });
+  }
+  if (auths.length == 0) {
+    throw new Error('No registry to login');
+  }
+  return auths;
+}
+
+export function scopeToConfigDir(registry: string, scope?: string): string {
+  if (scopeDisabled() || !scope || scope === '') {
+    return '';
+  }
+  let configDir = path.join(Buildx.configDir, 'config', registry === 'docker.io' ? 'registry-1.docker.io' : registry);
+  if (scope.startsWith('@')) {
+    configDir += scope;
+  } else {
+    configDir = path.join(configDir, scope);
+  }
+  return configDir;
+}
+
+function scopeDisabled(): boolean {
+  if (process.env.DOCKER_LOGIN_SCOPE_DISABLED) {
+    return Util.parseBool(process.env.DOCKER_LOGIN_SCOPE_DISABLED);
+  }
+  return false;
+}

src/docker.ts

@@ -1,19 +1,31 @@
-import * as aws from './aws';
 import * as core from '@actions/core';
 
+import * as aws from './aws';
+import * as context from './context';
+
 import {Docker} from '@docker/actions-toolkit/lib/docker/docker';
 
-export async function login(registry: string, username: string, password: string, ecr: string): Promise<void> {
-  if (/true/i.test(ecr) || (ecr == 'auto' && aws.isECR(registry))) {
-    await loginECR(registry, username, password);
+export async function login(auth: context.Auth): Promise<void> {
+  if (/true/i.test(auth.ecr) || (auth.ecr == 'auto' && aws.isECR(auth.registry))) {
+    await loginECR(auth.registry, auth.username, auth.password, auth.scope);
   } else {
-    await loginStandard(registry, username, password);
+    await loginStandard(auth.registry, auth.username, auth.password, auth.scope);
   }
 }
 
-export async function logout(registry: string): Promise<void> {
+export async function logout(registry: string, configDir: string): Promise<void> {
+  let envs: {[key: string]: string} | undefined;
+  if (configDir !== '') {
+    envs = Object.assign({}, process.env, {
+      DOCKER_CONFIG: configDir
+    }) as {
+      [key: string]: string;
+    };
+    core.info(`Alternative config dir: ${configDir}`);
+  }
   await Docker.getExecOutput(['logout', registry], {
-    ignoreReturnCode: true
+    ignoreReturnCode: true,
+    env: envs
   }).then(res => {
     if (res.stderr.length > 0 && res.exitCode != 0) {
       core.warning(res.stderr.trim());
@@ -21,7 +33,7 @@ export async function logout(registry: string): Promise<void> {
   });
 }
 
-export async function loginStandard(registry: string, username: string, password: string): Promise<void> {
+export async function loginStandard(registry: string, username: string, password: string, scope?: string): Promise<void> {
   if (!username && !password) {
     throw new Error('Username and password required');
   }
@@ -31,38 +43,39 @@ export async function loginStandard(registry: string, username: string, password
   if (!password) {
     throw new Error('Password required');
   }
+  await loginExec(registry, username, password, scope);
+}
 
-  const loginArgs: Array<string> = ['login', '--password-stdin'];
-  loginArgs.push('--username', username);
-  loginArgs.push(registry);
+export async function loginECR(registry: string, username: string, password: string, scope?: string): Promise<void> {
+  core.info(`Retrieving registries data through AWS SDK...`);
+  const regDatas = await aws.getRegistriesData(registry, username, password);
+  for (const regData of regDatas) {
+    await loginExec(regData.registry, regData.username, regData.password, scope);
+  }
+}
 
-  core.info(`Logging into ${registry}...`);
-  await Docker.getExecOutput(loginArgs, {
+async function loginExec(registry: string, username: string, password: string, scope?: string): Promise<void> {
+  let envs: {[key: string]: string} | undefined;
+  const configDir = context.scopeToConfigDir(registry, scope);
+  if (configDir !== '') {
+    envs = Object.assign({}, process.env, {
+      DOCKER_CONFIG: configDir
+    }) as {
+      [key: string]: string;
+    };
+    core.info(`Logging into ${registry} (scope ${scope})...`);
+  } else {
+    core.info(`Logging into ${registry}...`);
+  }
+  await Docker.getExecOutput(['login', '--password-stdin', '--username', username, registry], {
     ignoreReturnCode: true,
     silent: true,
-    input: Buffer.from(password)
+    input: Buffer.from(password),
+    env: envs
   }).then(res => {
     if (res.stderr.length > 0 && res.exitCode != 0) {
       throw new Error(res.stderr.trim());
     }
-    core.info(`Login Succeeded!`);
+    core.info('Login Succeeded!');
   });
 }
-
-export async function loginECR(registry: string, username: string, password: string): Promise<void> {
-  core.info(`Retrieving registries data through AWS SDK...`);
-  const regDatas = await aws.getRegistriesData(registry, username, password);
-  for (const regData of regDatas) {
-    core.info(`Logging into ${regData.registry}...`);
-    await Docker.getExecOutput(['login', '--password-stdin', '--username', regData.username, regData.registry], {
-      ignoreReturnCode: true,
-      silent: true,
-      input: Buffer.from(regData.password)
-    }).then(res => {
-      if (res.stderr.length > 0 && res.exitCode != 0) {
-        throw new Error(res.stderr.trim());
-      }
-      core.info('Login Succeeded!');
-    });
-  }
-}

src/main.ts

@@ -1,4 +1,3 @@
-import * as yaml from 'js-yaml';
 import * as core from '@actions/core';
 import * as actionsToolkit from '@docker/actions-toolkit';
 
@@ -6,48 +5,21 @@ import * as context from './context';
 import * as docker from './docker';
 import * as stateHelper from './state-helper';
 
-interface Auth {
-  registry: string;
-  username: string;
-  password: string;
-  ecr: string;
-}
-
 export async function main(): Promise<void> {
   const inputs: context.Inputs = context.getInputs();
   stateHelper.setLogout(inputs.logout);
 
-  if (inputs.registryAuth && (inputs.registry || inputs.username || inputs.password || inputs.ecr)) {
-    throw new Error('Cannot use registry-auth with other inputs');
-  }
+  const auths = context.getAuthList(inputs);
+  stateHelper.setRegistries(Array.from(new Map(auths.map(auth => [`${auth.registry}|${auth.configDir}`, {registry: auth.registry, configDir: auth.configDir} as stateHelper.RegistryState])).values()));
 
-  if (!inputs.registryAuth) {
-    stateHelper.setRegistries([inputs.registry || 'docker.io']);
-    await docker.login(inputs.registry || 'docker.io', inputs.username, inputs.password, inputs.ecr || 'auto');
+  if (auths.length === 1) {
+    await docker.login(auths[0]);
     return;
   }
 
-  const auths = yaml.load(inputs.registryAuth) as Auth[];
-  if (auths.length == 0) {
-    throw new Error('No registry to login');
-  }
-
-  const registries: string[] = [];
   for (const auth of auths) {
-    if (!auth.registry) {
-      registries.push('docker.io');
-    } else {
-      registries.push(auth.registry);
-    }
-    if (auth.password) {
-      core.setSecret(auth.password);
-    }
-  }
-  stateHelper.setRegistries(registries.filter((value, index, self) => self.indexOf(value) === index));
-
-  for (const auth of auths) {
-    await core.group(`Login to ${auth.registry || 'docker.io'}`, async () => {
-      await docker.login(auth.registry || 'docker.io', auth.username, auth.password, auth.ecr || 'auto');
+    await core.group(`Login to ${auth.registry}`, async () => {
+      await docker.login(auth);
     });
   }
 }
@@ -56,8 +28,10 @@ async function post(): Promise<void> {
   if (!stateHelper.logout) {
     return;
   }
-  for (const registry of stateHelper.registries.split(',')) {
-    await docker.logout(registry);
+  for (const registryState of stateHelper.registries) {
+    await core.group(`Logout from ${registryState.registry}`, async () => {
+      await docker.logout(registryState.registry, registryState.configDir);
+    });
   }
 }
 

src/state-helper.ts

@@ -1,10 +1,15 @@
 import * as core from '@actions/core';
 
-export const registries = process.env['STATE_registries'] || '';
+export const registries = process.env['STATE_registries'] ? (JSON.parse(process.env['STATE_registries']) as Array<RegistryState>) : [];
 export const logout = /true/i.test(process.env['STATE_logout'] || '');
 
-export function setRegistries(registries: string[]) {
-  core.saveState('registries', registries.join(','));
+export interface RegistryState {
+  registry: string;
+  configDir: string;
+}
+
+export function setRegistries(registries: Array<RegistryState>) {
+  core.saveState('registries', JSON.stringify(registries));
 }
 
 export function setLogout(logout: boolean) {

yarn.lock

@@ -2672,16 +2672,15 @@ __metadata:
   linkType: hard
 
 "@smithy/config-resolver@npm:^4.2.2":
-  version: 4.4.5
-  resolution: "@smithy/config-resolver@npm:4.4.5"
+  version: 4.2.2
+  resolution: "@smithy/config-resolver@npm:4.2.2"
   dependencies:
-    "@smithy/node-config-provider": "npm:^4.3.7"
-    "@smithy/types": "npm:^4.11.0"
-    "@smithy/util-config-provider": "npm:^4.2.0"
-    "@smithy/util-endpoints": "npm:^3.2.7"
-    "@smithy/util-middleware": "npm:^4.2.7"
+    "@smithy/node-config-provider": "npm:^4.2.2"
+    "@smithy/types": "npm:^4.5.0"
+    "@smithy/util-config-provider": "npm:^4.1.0"
+    "@smithy/util-middleware": "npm:^4.1.1"
     tslib: "npm:^2.6.2"
-  checksum: 10/b86f3299f86cd93c84a15ccc7e223b032d3ce8c97d13d3a777515ed9874bb1ec116988204caace744cac014fdfda315682e43644142f44c7ada0bf426b7bfa8b
+  checksum: 10/8b489420646c61c4ac57e2754ad6e4012de27aa6d0bca18d69f1916085908d58d8ba4d8d963e24ba55c9a797996b95cedff18e3fa2674136c6eb14044f942da0
   languageName: node
   linkType: hard
 
@@ -2848,18 +2847,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@smithy/node-config-provider@npm:^4.3.7":
-  version: 4.3.7
-  resolution: "@smithy/node-config-provider@npm:4.3.7"
-  dependencies:
-    "@smithy/property-provider": "npm:^4.2.7"
-    "@smithy/shared-ini-file-loader": "npm:^4.4.2"
-    "@smithy/types": "npm:^4.11.0"
-    tslib: "npm:^2.6.2"
-  checksum: 10/eecd04b69623fba976f12129bf2c4f8a4d4b6462b7e852894a1863754a1e900249564215d5cde664ed54d11b061ebcaa86357c43bd2286fe2780208f287cf9c6
-  languageName: node
-  linkType: hard
-
 "@smithy/node-http-handler@npm:^4.2.1":
   version: 4.2.1
   resolution: "@smithy/node-http-handler@npm:4.2.1"
@@ -2883,16 +2870,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@smithy/property-provider@npm:^4.2.7":
-  version: 4.2.7
-  resolution: "@smithy/property-provider@npm:4.2.7"
-  dependencies:
-    "@smithy/types": "npm:^4.11.0"
-    tslib: "npm:^2.6.2"
-  checksum: 10/8193bffe7ef04e280a5239020f7414f1f842b7487a5608961a0d230de10a4a7c090a12fff4269aac614d3ff179d3d97e6fe9a0d4476063e45c01dc6aeeb81a47
-  languageName: node
-  linkType: hard
-
 "@smithy/protocol-http@npm:^5.2.1":
   version: 5.2.1
   resolution: "@smithy/protocol-http@npm:5.2.1"
@@ -2943,16 +2920,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@smithy/shared-ini-file-loader@npm:^4.4.2":
-  version: 4.4.2
-  resolution: "@smithy/shared-ini-file-loader@npm:4.4.2"
-  dependencies:
-    "@smithy/types": "npm:^4.11.0"
-    tslib: "npm:^2.6.2"
-  checksum: 10/fd0a4c967fb9bf2f2c96bf41c54579eed80cbd75eb81351669ba7759d6c5f2139a31e535133fb985e499b7dd2c1a007e39a5fde057a1930101d3423b8252e33c
-  languageName: node
-  linkType: hard
-
 "@smithy/signature-v4@npm:^5.2.1":
   version: 5.2.1
   resolution: "@smithy/signature-v4@npm:5.2.1"
@@ -2993,15 +2960,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@smithy/types@npm:^4.11.0":
-  version: 4.11.0
-  resolution: "@smithy/types@npm:4.11.0"
-  dependencies:
-    tslib: "npm:^2.6.2"
-  checksum: 10/253484df3d0625137c745774af854c3175b0f7d56e826a03348fcb94aa2b60dd164380515920ed539b7e0b070f994d3ab20a0a95ad9fe385233921f5a48193de
-  languageName: node
-  linkType: hard
-
 "@smithy/types@npm:^4.5.0":
   version: 4.5.0
   resolution: "@smithy/types@npm:4.5.0"
@@ -3080,15 +3038,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@smithy/util-config-provider@npm:^4.2.0":
-  version: 4.2.0
-  resolution: "@smithy/util-config-provider@npm:4.2.0"
-  dependencies:
-    tslib: "npm:^2.6.2"
-  checksum: 10/d65f36401c7a085660cf201a1b317d271e390258b619179fff88248c2db64fc35e6c62fe055f1e55be8935b06eb600379824dabf634fb26d528f54fe60c9d77b
-  languageName: node
-  linkType: hard
-
 "@smithy/util-defaults-mode-browser@npm:^4.1.2":
   version: 4.1.2
   resolution: "@smithy/util-defaults-mode-browser@npm:4.1.2"
@@ -3128,17 +3077,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@smithy/util-endpoints@npm:^3.2.7":
-  version: 3.2.7
-  resolution: "@smithy/util-endpoints@npm:3.2.7"
-  dependencies:
-    "@smithy/node-config-provider": "npm:^4.3.7"
-    "@smithy/types": "npm:^4.11.0"
-    tslib: "npm:^2.6.2"
-  checksum: 10/a5954b8091ca60e60e8b5665e937fec5caf1c90f1f380957424906a3adb92fc7f7fd4c565e19cc138a55b95a1a6fb9f82b78eb4499687c168704f24db739c2e0
-  languageName: node
-  linkType: hard
-
 "@smithy/util-hex-encoding@npm:^4.1.0":
   version: 4.1.0
   resolution: "@smithy/util-hex-encoding@npm:4.1.0"
@@ -3158,16 +3096,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@smithy/util-middleware@npm:^4.2.7":
-  version: 4.2.7
-  resolution: "@smithy/util-middleware@npm:4.2.7"
-  dependencies:
-    "@smithy/types": "npm:^4.11.0"
-    tslib: "npm:^2.6.2"
-  checksum: 10/ffe3c2def97376a85e59cb7c1c516060e243bcf3e971538ced046f5b5e9771ef146637d430e9c87ae38ee1ac11f02a218f70fafd6d5099d7ff9595738e27c3c1
-  languageName: node
-  linkType: hard
-
 "@smithy/util-retry@npm:^4.1.1":
   version: 4.1.1
   resolution: "@smithy/util-retry@npm:4.1.1"