Releases: aws/amazon-ssm-agent
Releases · aws/amazon-ssm-agent
Release list
Amazon SSM Agent - Release 3.3.5226.0 - 2026-08-20
- Add bounds check for HeaderLength in AgentMessage Deserialize
- Bump github.com/go-git/go-git/v5 to v5.19.2
- Bump golang.org/x/sync to v0.21.0
- Detect Azure Linux and potential future unregistered Linux platforms
- Fix Windows session command parsing by removing shlex
- Fix shell injection in Windows domainjoin plugin parameters
- Prevent control channel deadlock on ProcessorBufferFull
- Revert migration from aws-sdk-go v1 to aws-sdk-go-v2 change
- Update the logic for loading RegistrationInfo
- Upgrade Go version to 1.25.13
Amazon SSM Agent - Release 3.3.5068.0 - 2026-08-05
- Migrate from aws-sdk-go v1 to aws-sdk-go-v2
- Fix flaky registration/connection channel tests
- Sync AWS SDK fork in extra/ with multicloud vendor changes
- Harden function create file with permissions in a single syscall
- Upgrade Go version to 1.25.12
- Bump golang.org/x/net@v0.55.0 to golang.org/x/net@v0.56.0
- Fix loopback bypass in remote-host port forwarding denylist
Amazon SSM Agent - Release 3.3.4851.0 - 2026-07-13
- Add ECS/EKS credential endpoints and loopback to port-forward denylist
- Canonicalize IP addresses before port-forwarding denylist check
- Pass the ActiveDirectory domain password via stdin using -y /dev/stdin instead of the -w flag
- Fix false StuckAtInProgress timeout for associations with rate >= 2h
- Fix non-interactive session big file transfer issues
- Prevent ssm-user race condition with flock-based serialization
- Send AWS::EC2::Instance as source type when registered with provider EC2
- Validate process name in orphan worker detection
Amazon SSM Agent - Release 3.3.4793.0 - 2026-06-24
- Add multicloud support enabling SSM Agent registration with Azure cloud providers
- Add support for the upcoming public key in the agent code
Amazon SSM Agent - Release 3.3.4624.0 - 2026-06-02
- Bump golang.org/x/crypto from v0.51.0 to v0.52.0
- Bump golang.org/x/net from v0.54.0 to v0.55.0
- Enforce directory boundary in BuildSafePath
- Fix visibility issue with Bottlerocket OS in document output
- Update go-git from v5.17.1 to v5.19.1
Amazon SSM Agent - Release 3.3.4515.0 - 2026-05-21
- Bump golang.org/x/net from v0.48.0 to v0.53.0
- Quit if sysprep failed and log its current state
- Remove attached legacy cloudwatch plugin packages
- Upgrade Go version to 1.25.10
- Use BuildSafePath wherever it is applicable
Amazon SSM Agent - Release 3.3.4364.0 - 2026-05-05
- Add OOM killer protection to systemd service files
- Apply more sanitation to file and registry inventory gatherers
- Bump go-git to v5.17.1
- Deprecate legacy cloudwatch plugin
- Preserve network error details in credential refresher SSM API failures
- Upgrade Go version to 1.25.9
Amazon SSM Agent - Release 3.3.4268.0 - 2026-04-21
- Add SSM Distributor support for Bottlerocket OS
- Implement flush credentials command in ssm-cli
- Log ec2messages access denied as debug instead of error to reduce log noise
- Make credential refresher refresh cache quickly in case of credential flush
- Make Greengrass component registration resilient with retry
Amazon SSM Agent - Release 3.3.4177.0 - 2026-04-06
- Add EnforceWorkspaceRootOwnership configuration to support disable hardening of agent workspace
- Add reboot comment to Windows shutdown command for SSM Agent traceability
- Update privilege access check to verify ownership and permissions of document state files
Amazon SSM Agent - Release 3.3.4121.0 - 2026-03-25
- Add read-only version check prior to install and uninstall in case of occupied package manager locks
- Add ANSI processing for CloudWatch and S3 log
- Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3 to fix CVE-2026-1229