Bump software.amazon.msk:aws-msk-iam-auth from 2.3.7 to 2.3.8

[dependabot]

Bumps software.amazon.msk:aws-msk-iam-auth from 2.3.7 to 2.3.8.

Release notes

Sourced from software.amazon.msk:aws-msk-iam-auth's releases.

2.3.8

What's changed in 2.3.8

• Fix signing-region resolution for cluster names containing an AWS region id: the region is now anchored to the endpoint DNS suffix instead of matched as an unanchored substring (#245)
• Upgrade the AWS SDK BOM from 2.44.12 to 2.51.2
• Update jackson-databind to 2.22.1, resolving CVE-2026-54512, CVE-2026-54513, CVE-2026-54514 and CVE-2026-54515
• Switch the synchronous HTTP client from apache-client to apache5-client, replacing Apache HttpClient 4.x with 5.x and removing commons-logging from the dependency tree
• Constrain httpclient5 to 5.6.4, resolving CVE-2026-64607 and CVE-2026-71290
• Exclude the unused netty-nio-client asynchronous HTTP client, which this library never instantiates, reducing the uber jar from roughly 14.4 MB to 10.2 MB and removing all 36 CVEs reported against Netty 4.1.133.Final across its ten modules
• Update slf4j-api to 1.7.36
• Raise the kafka-clients compile floor from 2.8.1 to 3.9.2
• Upgrade the OWASP dependency-check plugin from 7.1.0.1 to 13.0.0. Releases 9.0.0 and later use the NVD API in place of the retired NVD data feeds, which the previous version could no longer reach

Maven Central

<dependency>
    <groupId>software.amazon.msk</groupId>
    <artifactId>aws-msk-iam-auth</artifactId>
    <version>2.3.8</version>
</dependency>

The attached aws-msk-iam-auth-2.3.8-all.jar is the self-contained uber jar for use on the Kafka client classpath.

Commits

• a9850ea chore: Prepare release 2.3.8 (#250)
• e471175 Merge pull request #249 from aws/fix/kafka-clients-compile-floor
• 10b73f4 Merge pull request #247 from aws/fix/anchored-region-resolution
• b190015 Merge pull request #244 from aws/fix/dependency-currency-2.3.8
• db6eda1 docs: Document only the NVD_API_KEY environment variable for the scan key
• 89dc120 fix: Publish the httpclient5 floor in the POM and exclude apache-client
• 462873b fix: Anchor signing-region resolution to the endpoint DNS suffix
• 6a84660 fix: Raise the kafka-clients compile floor to 3.9.2
• 4a9cb31 chore: Tighten build script comments
• 673cf0e fix: Restore the OWASP dependency-check scanner
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)