cx-32 add last login event feed #98

coderabbitai · 2026-01-29T16:11:35Z

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

aws-sdk-go-v2 v1.41.1 release notes github

💡 Result:

github.com/aws/aws-sdk-go-v2 v1.41.1 exists as a Git tag (v1.41.1) and is shown on pkg.go.dev as published Jan 9, 2026. [1]

The repo’s “release notes” for the SDK are maintained in CHANGELOG.md (linked from the module page). [1]

Note: the GitHub Releases page for aws-sdk-go-v2 is primarily date-based (e.g., release-YYYY-MM-DD), not one GitHub Release per semver tag like v1.41.1. [2]

Sources: [1] [2]

🌐 Web query:

google.golang.org/grpc v1.71.0 release notes minimum go version

💡 Result:

google.golang.org/grpc v1.71.0 bumps the minimum supported Go version to Go 1.22.7 (listed under “Dependencies” in the v1.71.0 release notes). [1]

🌐 Web query:

aws-sdk-go-v2 service cloudtrail v1.55.5 release notes

💡 Result:

I couldn’t find any official AWS SDK for Go v2 release notes specifically for github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.55.5 (it doesn’t appear in the top-level aws/aws-sdk-go-v2 GitHub release notes). (github.com)

What I can confirm from AWS’s published v2 release notes is that, on 2025-11-20, the CloudTrail service module was released/updated to v1.55.0 with the feature: “CloudTrail aggregated events to simplify monitoring of data events at scale.” (github.com)

Also note: v1.55.5 does exist as a release number for the deprecated v1 SDK repo (aws/aws-sdk-go), but that’s a different SDK line than aws-sdk-go-v2. (github.com)

Citations:

1: https://github.com/aws/aws-sdk-go-v2/releases?utm_source=openai

2: https://github.com/aws/aws-sdk-go-v2/releases?utm_source=openai

3: https://github.com/aws/aws-sdk-go/releases?utm_source=openai

🌐 Web query:

aws-sdk-go-v2 CHANGELOG.md v1.41 breaking changes

💡 Result:

For the AWS SDK for Go v2, there are no breaking changes called out for “v1.41” in the repo’s published release notes—updates in that range are minor-version bumps (v1.x → v1.(x+1)), which are not where the project ships intentional breaking API changes under SemVer.

In the repo release notes where a module hits v1.41.0 (example: github.com/aws/aws-sdk-go-v2/service/sts: v1.41.0), the change is listed as a Feature addition (STS GetWebIdentityToken support), not a breaking change. [1]

Source

AWS SDK for Go v2 GitHub Releases (shows service/sts: v1.41.0 as a Feature, no breaking-change note) [1]

🌐 Web query:

grpc-go v1.71.0 v1.70.0 breaking changes migration guide

💡 Result:

grpc-go v1.70.0 → v1.71.0: breaking / migration notes

1) Custom balancers that record metrics

Breaking change: balancer.BuildOptions.MetricsRecorder was removed.
Migration: get the recorder from the balancer.ClientConn instead:

Before: use opts.MetricsRecorder

After: use cc.MetricsRecorder() (new method on balancer.ClientConn) [1][2]

2) Types implementing balancer.ClientConn (usually in tests or intercepting/wrapping ClientConn)

Breaking change: implementations must now embed/delegate another balancer.ClientConn implementation (to allow grpc-go to add methods without breaking you).
Migration: change your wrapper/test double to embed the passed-in balancer.ClientConn and forward calls, instead of implementing the interface “from scratch”. Also ensure the embedded delegate is never nil (or you may panic). [1][2][3]

3) balancer/endpointsharding constructor signature changed

Breaking change: constructor now takes the child balancer builder and an options struct.
Migration: update your call sites to pass (childBuilder, esOpts) as required by the new NewBalancer signature. [1][4]

(Related) v1.70.0 behavior change you may hit while upgrading

If you have service configs with an invalid retryPolicy, grpc-go now rejects them (potential breaking change if you previously relied on permissive parsing). Fix the service config to match the gRFC requirements. [5]

Sources: [1] [2] [3] [4] [5]

🌐 Web query:

aws-sdk-go-v2 v1.40 v1.41 compatibility changes

💡 Result:

What changed from aws-sdk-go-v2 v1.40.x → v1.41.x (compatibility-impacting)

1) Default credential chain behavior change (v1.40.0)

v1.40.0 added AWS Login credentials (credentials/logincreds) to the default credential chain. This is the main “compatibility” concern because it can change which credentials get picked up automatically (e.g., if your environment/shared config enables AWS Login, it may now be selected where it previously wasn’t). [1]

2) No documented breaking API change for core module in v1.41.0 / v1.41.1

v1.41.0 (Dec 8, 2025) and v1.41.1 (Jan 9, 2026) exist as new core module versions, but AWS did not call out a core-module breaking change in the high-level release notes (they mostly list service-module updates). [2]

Version timeline (core module)

github.com/aws/aws-sdk-go-v2 v1.40.0 — Nov 19, 2025 [2]

github.com/aws/aws-sdk-go-v2 v1.41.0 — Dec 8, 2025 [2]

github.com/aws/aws-sdk-go-v2 v1.41.1 — Jan 9, 2026 [2]

Sources:
[1] https://github.com/aws/aws-sdk-go-v2/releases (release “2025-11-19.2” highlights github.com/aws/aws-sdk-go-v2: v1.40.0 and the AWS Login creds addition)
[2] https://pkg.go.dev/github.com/aws/aws-sdk-go-v2?tab=versions (version list + dates)

Verify gRPC minimum Go version requirement.

google.golang.org/grpc v1.71.0 requires Go 1.22.7 or later; confirm this aligns with the project's minimum supported Go version. While gRPC v1.71.0 includes breaking changes for custom balancer implementations, they do not affect typical SDK usage. aws-sdk-go-v2 v1.41.1 has no documented breaking changes; note that v1.40.0 added AWS Login credentials to the default credential chain, which may alter credential resolution behavior.

🤖 Prompt for AI Agents

In `@go.mod` around lines 5 - 25, The go.mod pins google.golang.org/grpc v1.71.0 which requires Go 1.22.7+; update the project Go version to at least 1.22.7 (add/update the "go" directive in go.mod and adjust CI/toolchains) or downgrade google.golang.org/grpc to a release compatible with the current minimum Go version, and verify aws-sdk-go-v2 v1.41.1 behavior doesn't change credential resolution in your environment; specifically check entries referencing google.golang.org/grpc and github.com/aws/aws-sdk-go-v2 and ensure CI images, build Dockerfiles, and developer toolchains reflect the chosen Go version.

JavierCarnelli-ConductorOne · 2026-01-29T05:29:56Z

Shouldn't we add a default value for this new config?

if i'm not wrong it takes false as default, but will make it explicit.

-Original file line number
+Diff line change
@@ Expand Up @@
     		UseAssumeRole:           awsc.GetBool(cfg.UseAssumeField.FieldName),
     		SyncSecrets:             awsc.GetBool(cfg.SyncSecrets.FieldName),
     		IamAssumeRoleName:       awsc.GetString(cfg.IamAssumeRoleName.FieldName),
+    		SyncSSOUserLastLogin:    awsc.GetBool(cfg.SyncSSOUserLastLogin.FieldName),
     	}
     	cb, err := connector.New(ctx, config)
@@ Expand Down @@

-Original file line number
+Diff line change
@@ Expand Up / @@ -3,22 +3,24 @@ module github.com/conductorone/baton-aws @@
     go 1.25.2
     require (
-    	github.com/aws/aws-sdk-go-v2 v1.36.3
+    	github.com/aws/aws-sdk-go-v2 v1.41.1
     	github.com/aws/aws-sdk-go-v2/config v1.29.2
     	github.com/aws/aws-sdk-go-v2/credentials v1.17.55
+    	github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.55.5
     	github.com/aws/aws-sdk-go-v2/service/iam v1.35.0
     	github.com/aws/aws-sdk-go-v2/service/identitystore v1.25.4
     	github.com/aws/aws-sdk-go-v2/service/organizations v1.31.0
     	github.com/aws/aws-sdk-go-v2/service/ssoadmin v1.27.5
     	github.com/aws/aws-sdk-go-v2/service/sts v1.33.10
-    	github.com/aws/smithy-go v1.22.2
+    	github.com/aws/smithy-go v1.24.0
     	github.com/conductorone/baton-sdk v0.7.9
     	github.com/ennyjfrick/ruleguard-logfatal v0.0.2
     	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0
     	github.com/quasilyte/go-ruleguard/dsl v0.3.22
     	github.com/spf13/viper v1.19.0
     	github.com/stretchr/testify v1.11.1
     	go.uber.org/zap v1.27.0
+    	google.golang.org/grpc v1.71.0
     	google.golang.org/protobuf v1.36.5
     )
@@ Expand All / @@ -30,8 +32,8 @@ require ( @@
     	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10 // indirect
     	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.25 // indirect
     	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.55 // indirect
-    	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 // indirect
-    	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 // indirect
+    	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 // indirect
+    	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 // indirect
     	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.2 // indirect
     	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.29 // indirect
     	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.2 // indirect
@@ Expand Down Expand Up / @@ -117,7 +119,6 @@ require ( @@
     	golang.org/x/text v0.22.0 // indirect
     	google.golang.org/genproto/googleapis/api v0.0.0-20250218202821-56aae31c358a // indirect
     	google.golang.org/genproto/googleapis/rpc v0.0.0-20250219182151-9fdb1cabc7b2 // indirect
-    	google.golang.org/grpc v1.71.0 // indirect
     	gopkg.in/ini.v1 v1.67.0 // indirect
     	gopkg.in/yaml.v2 v2.4.0 // indirect
     	gopkg.in/yaml.v3 v3.0.1 // indirect
@@ Expand Down @@

-Original file line number
+Diff line change
@@ Expand Up @@
     github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
     github.com/aws/aws-lambda-go v1.47.0 h1:0H8s0vumYx/YKs4sE7YM0ktwL2eWse+kfopsRI1sXVI=
     github.com/aws/aws-lambda-go v1.47.0/go.mod h1:dpMpZgvWx5vuQJfBt0zqBha60q7Dd7RfgJv23DymV8A=
-    github.com/aws/aws-sdk-go-v2 v1.36.3 h1:mJoei2CxPutQVxaATCzDUjcZEjVRdpsiiXi2o38yqWM=
-    github.com/aws/aws-sdk-go-v2 v1.36.3/go.mod h1:LLXuLpgzEbD766Z5ECcRmi8AzSwfZItDtmABVkRLGzg=
+    github.com/aws/aws-sdk-go-v2 v1.41.1 h1:ABlyEARCDLN034NhxlRUSZr4l71mh+T5KAeGh6cerhU=
+    github.com/aws/aws-sdk-go-v2 v1.41.1/go.mod h1:MayyLB8y+buD9hZqkCW3kX1AKq07Y5pXxtgB+rRFhz0=
     github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10 h1:zAybnyUQXIZ5mok5Jqwlf58/TFE7uvd3IAsa1aF9cXs=
     github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10/go.mod h1:qqvMj6gHLR/EXWZw4ZbqlPbQUyenf4h82UQUlKc+l14=
     github.com/aws/aws-sdk-go-v2/config v1.29.2 h1:JuIxOEPcSKpMB0J+khMjznG9LIhIBdmqNiEcPclnwqc=
@@ Expand All @@
     github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.25/go.mod h1:OiC8+OiqrURb1wrwmr/UbOVLFSWEGxjinj5C299VQdo=
     github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.55 h1:yfz56qEKO2MqTV0m81KtZS7swlP335FMrmoC1GBgU5k=
     github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.55/go.mod h1:O/fEJxrOLSCbhA8jL1xHwo8gzbN/iNcT+y7aq7c6KHE=
-    github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 h1:ZK5jHhnrioRkUNOc+hOgQKlUL5JeC3S6JgLxtQ+Rm0Q=
-    github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34/go.mod h1:p4VfIceZokChbA9FzMbRGz5OV+lekcVtHlPKEO0gSZY=
-    github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 h1:SZwFm17ZUNNg5Np0ioo/gq8Mn6u9w19Mri8DnJ15Jf0=
-    github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34/go.mod h1:dFZsC0BLo346mvKQLWmoJxT+Sjp+qcVR1tRVHQGOH9Q=
+    github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17 h1:xOLELNKGp2vsiteLsvLPwxC+mYmO6OZ8PYgiuPJzF8U=
+    github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.17/go.mod h1:5M5CI3D12dNOtH3/mk6minaRwI2/37ifCURZISxA/IQ=
+    github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17 h1:WWLqlh79iO48yLkj1v3ISRNiv+3KdQoZ6JWyfcsyQik=
+    github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.17/go.mod h1:EhG22vHRrvF8oXSTYStZhJc1aUgKtnJe+aOiFEV90cM=
     github.com/aws/aws-sdk-go-v2/internal/ini v1.8.2 h1:Pg9URiobXy85kgFev3og2CuOZ8JZUBENF+dcgWBaYNk=
     github.com/aws/aws-sdk-go-v2/internal/ini v1.8.2/go.mod h1:FbtygfRFze9usAadmnGJNc8KsP346kEe+y2/oyhGAGc=
     github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.29 h1:g9OUETuxA8i/Www5Cby0R3WSTe7ppFTZXHVLNskNS4w=
     github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.29/go.mod h1:CQk+koLR1QeY1+vm7lqNfFii07DEderKq6T3F1L2pyc=
+    github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.55.5 h1:sSgqtZi6Kp4Pc1V4turyaux7xUXxC1JwbEF6MzTQ9oE=
+    github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.55.5/go.mod h1:zweZsRPub5YhgUjoMGOeRWuXOOORt6YFiA51hpmNB4c=
     github.com/aws/aws-sdk-go-v2/service/iam v1.35.0 h1:xIjTizH74aMNQBjp9D5cvjRZmOYtnrpjOGU3xkVqrjk=
     github.com/aws/aws-sdk-go-v2/service/iam v1.35.0/go.mod h1:IdHqqRLKgxYR4IY7Omd7SuV4SJzJ8seF+U5PW+mvtP4=
     github.com/aws/aws-sdk-go-v2/service/identitystore v1.25.4 h1:icyZwij1BqzyW5yZGcfHIftrPogK9LgiWt08B1IYyWQ=
@@ Expand All @@
     github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.11/go.mod h1:JDJtD+b8HNVv71axz8+S5492KM8wTzHRFpMKQbPlYxw=
     github.com/aws/aws-sdk-go-v2/service/sts v1.33.10 h1:g9d+TOsu3ac7SgmY2dUf1qMgu/uJVTlQ4VCbH6hRxSw=
     github.com/aws/aws-sdk-go-v2/service/sts v1.33.10/go.mod h1:WZfNmntu92HO44MVZAubQaz3qCuIdeOdog2sADfU6hU=
-    github.com/aws/smithy-go v1.22.2 h1:6D9hW43xKFrRx/tXXfAlIZc4JI+yQe6snnWcQyxSyLQ=
-    github.com/aws/smithy-go v1.22.2/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
+    github.com/aws/smithy-go v1.24.0 h1:LpilSUItNPFr1eY85RYgTIg5eIEPtvFbskaFcmmIUnk=
+    github.com/aws/smithy-go v1.24.0/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
     github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
     github.com/benbjohnson/clock v1.3.5 h1:VvXlSJBzZpA/zum6Sj74hxwYI2DIxRWuNIoXAzHZz5o=
     github.com/benbjohnson/clock v1.3.5/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
@@ Expand Down @@

-Original file line number
+Diff line change
@@ Expand Up / @@ -98,6 +98,12 @@ var ( @@
     		field.WithDescription("Role name for the IAM role to assume when using the AWS connector"),
     		field.WithDefaultValue("OrganizationAccountAccessRole"),
     	)
+    	SyncSSOUserLastLogin = field.BoolField(
+    		"sync-sso-user-last-login",
+    		field.WithDisplayName("Sync SSO User Last Login"),
+    		field.WithDescription("Enable fetching last login time for SSO users from CloudTrail (requires cloudtrail:LookupEvents permission)"),
+    		field.WithDefaultValue(false),
+    	)
     )
     func ValidateExternalId(input string) error {
@@ Expand Down Expand Up / @@ -146,6 +152,7 @@ var Config = field.NewConfiguration( @@
     		UseAssumeField,
     		SyncSecrets,
     		IamAssumeRoleName,
+    		SyncSSOUserLastLogin,
     	},
     	field.WithConstraints(
     		field.FieldsDependentOn(
@@ Expand Down @@

-Original file line number
+Diff line change
@@ Expand Up / @@ -13,6 +13,7 @@ import ( @@
     	awsConfig "github.com/aws/aws-sdk-go-v2/config"
     	"github.com/aws/aws-sdk-go-v2/credentials"
     	"github.com/aws/aws-sdk-go-v2/credentials/stscreds"
+    	"github.com/aws/aws-sdk-go-v2/service/cloudtrail"
     	"github.com/aws/aws-sdk-go-v2/service/iam"
     	awsIdentityStore "github.com/aws/aws-sdk-go-v2/service/identitystore"
     	awsOrgs "github.com/aws/aws-sdk-go-v2/service/organizations"
@@ Expand Down Expand Up / @@ -47,6 +48,7 @@ type Config struct { @@
     	SCIMEnabled             bool
     	SyncSecrets             bool
     	IamAssumeRoleName       string
+    	SyncSSOUserLastLogin    bool
     }
     type AWS struct {
@@ Expand Down Expand Up / @@ -81,8 +83,10 @@ type AWS struct { @@
     	identityStoreClient client.IdentityStoreClient
     	identityInstance    *awsSsoAdminTypes.InstanceMetadata
     	awsClientFactory    *AWSClientFactory
+    	cloudTrailClient    *cloudtrail.Client
-    	syncSecrets bool
+    	syncSecrets          bool
+    	syncSSOUserLastLogin bool
     }
     func (o *AWS) getIAMClient(ctx context.Context) (*iam.Client, error) {
@@ Expand Down Expand Up @@
     		_callingConfig:          map[string]awsSdk.Config{},
     		_callingConfigError:     map[string]error{},
     		syncSecrets:             config.SyncSecrets,
+    		syncSSOUserLastLogin:    config.SyncSSOUserLastLogin,
     	}
     	rv.awsClientFactory = NewAWSClientFactory(config, rv, httpClient)
@@ Expand Down Expand Up @@
     }
     func (c *AWS) SetupClients(ctx context.Context) error {
+    	l := ctxzap.Extract(ctx)
     	globalCallingConfig, err := c.getCallingConfig(ctx, c.globalRegion)
     	if err != nil {
     		return err
@@ Expand All / @@ -342,6 +348,12 @@ func (c *AWS) SetupClients(ctx context.Context) error { @@
     		c.identityStoreClient = awsIdentityStore.NewFromConfig(ssoCallingConfig)
     		c.ssoAdminClient = awsSsoAdmin.NewFromConfig(ssoCallingConfig)
+    		// Only create CloudTrail client if SSO user last login sync is enabled
+    		if c.syncSSOUserLastLogin {
+    			l.Debug("syncSSOUserLastLogin enabled. creating cloudTrailClient")
+    			c.cloudTrailClient = cloudtrail.NewFromConfig(ssoCallingConfig)
+    		}
     		identityInstance, err := c.getIdentityInstance(ctx, c.ssoAdminClient)
     		if err != nil {
     			return err
@@ Expand Down Expand Up @@
     	return rs
     }
+    func (c *AWS) EventFeeds(ctx context.Context) []connectorbuilder.EventFeed {
+    	l := ctxzap.Extract(ctx)
+    	if !c.syncSSOUserLastLogin || c.cloudTrailClient == nil {
+    		return nil
+    	}
+    	l.Debug("syncSSOUserLastLogin enabled. adding ssoLoginEventFeed")
+    	return []connectorbuilder.EventFeed{
+    		newSSOLoginEventFeed(c.cloudTrailClient, c.ssoRegion),
+    	}
+    }
     func (c *AWS) getIdentityInstance(ctx context.Context, ssoClient *awsSsoAdmin.Client) (*awsSsoAdminTypes.InstanceMetadata, error) {
     	c._identityInstancesCacheMtx.Lock()
     	defer c._identityInstancesCacheMtx.Unlock()
@@ Expand Down @@

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

cx-32 add last login event feed #98

Uh oh!

Diff view

Diff view

There are no files selected for viewing

coderabbitai bot Jan 29, 2026

Uh oh!

Uh oh!

JavierCarnelli-ConductorOne Jan 29, 2026

Uh oh!

agustin-conductor Jan 29, 2026

Uh oh!

Uh oh!

Uh oh!

cx-32 add last login event feed #98

Uh oh!

cx-32 add last login event feed #98

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

coderabbitai bot Jan 29, 2026

Choose a reason for hiding this comment

grpc-go v1.70.0 → v1.71.0: breaking / migration notes

1) Custom balancers that record metrics

2) Types implementing balancer.ClientConn (usually in tests or intercepting/wrapping ClientConn)

3) balancer/endpointsharding constructor signature changed

(Related) v1.70.0 behavior change you may hit while upgrading

What changed from aws-sdk-go-v2 v1.40.x → v1.41.x (compatibility-impacting)

1) Default credential chain behavior change (v1.40.0)

2) No documented breaking API change for core module in v1.41.0 / v1.41.1

Version timeline (core module)

Uh oh!

Uh oh!

JavierCarnelli-ConductorOne Jan 29, 2026

Choose a reason for hiding this comment

Uh oh!

agustin-conductor Jan 29, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

2) Types implementing `balancer.ClientConn` (usually in tests or intercepting/wrapping ClientConn)

3) `balancer/endpointsharding` constructor signature changed

What changed from `aws-sdk-go-v2` v1.40.x → v1.41.x (compatibility-impacting)