GitHub OIDC Sub Claim Format Change Breaks AWS Deployments for New Repos

·22 views

A developer discovered that GitHub Actions deployments to AWS S3 were silently failing due to a mismatch in the OIDC token's subject claim format. GitHub introduced a new sub claim format in April 2026, embedding numeric owner and repo IDs into the string, replacing the older name-only format used in IAM trust policies. Repositories created after July 15, 2026 receive this new format by default, causing AWS STS to reject role assumption requests when trust policies still reference the old pattern. The change was designed to prevent trust policy hijacking, where an abandoned repo name could be reclaimed by another user to spoof the original subject claim. The fix requires updating the IAM trust policy condition in Terraform to match the new format that includes the numeric GitHub owner and repository IDs.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Four-Stage Incremental Indexing Keeps Financial Research Dashboards Fresh and Citable

A financial research dashboard must make corrected PDFs searchable while keeping earlier citations explainable, which shapes its architecture more than the choice of vector database. The article proposes four observable stages: document intake, chunk preparation, collection upsert, and bounded query, with stable source metadata carried into every result. It recommends designing a retrieval contract first, covering retrieval units, filterable metadata, freshness rules, and citation context. Ingestion and querying should remain separate so that failures can be traced to a specific stage rather than a vague quality problem. Chunk size is treated as an empirical question, to be resolved by testing representative documents and known failure cases such as tables and footnotes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Anthropic Adds Spreadsheets, Whiteboards and Data Tools to Claude

Anthropic announced on November 10, 2026 that Claude is expanding into a broader workspace with spreadsheets, a whiteboard, and a data tool. Claude Sheets and Claude Whiteboards are in beta, while Claude Data, formerly called Dashboards, is available now and can pull from sources such as Snowflake and Salesforce. A meeting note-taker, Claude Meetings, has been announced but has no release date. The company is also broadly releasing interactive connectors that let users edit documents from apps like Confluence and Notion directly inside Claude, with partners including Adobe, Box, and HubSpot. Because the rollout is gradual, many users may not yet have access to these features.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

JSLab adds Prettier formatting for JavaScript and TypeScript scratch code on macOS

JSLab, a JavaScript and TypeScript scratchpad for macOS, now uses Prettier to clean up messy code with a single shortcut, ⌥⇧F, which is also available in the Actions menu and command palette. Formatting is applied as one undo step with minimal edits, so folds, scroll position and cursor placement are preserved. Users can optionally format automatically before each run or on save, both disabled by default. A Formatting settings panel exposes Prettier options such as print width, tab width, semicolons and quote style, using Prettier's standard defaults. If code cannot be parsed, the status bar reports the error and the code is left unchanged, while formatting attempts that run too long are stopped to keep the editor responsive.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Go fintech DNS cutovers need separate checks for zone control, record match, and release approval

The article argues that a successful domain verification proves only that someone could publish a requested DNS record, not that a particular person or service is authorized to redirect a payment-facing hostname. It recommends keeping DNS verification, record reconciliation, and release authorization as distinct gates before any cutover. Using a hypothetical payments.example.com release, the author shows how a verification result, an approver's sign-off, and an operator's record change are three separate actions that should not be treated as interchangeable. The piece also notes that domains and personnel change over time, so verification should have a defined freshness policy rather than lasting indefinitely. Finally, it advises retaining both the desired and previously approved record sets, with the rollback target itself approved before the change.

0 comments Read more at DEV Community