fix(java): drop hkdf offset method - #2222
Merged
Merged
Conversation
rishav-karanjit
marked this pull request as ready for review
April 15, 2026 23:05
ShubhamChaturvedi7
approved these changes
Apr 15, 2026
rishav-karanjit
pushed a commit
that referenced
this pull request
Apr 16, 2026
## [4.0.0](v3.9.1...v4.0.0) (2026-04-16) ### ⚠ BREAKING CHANGES * **.net:** Bump MPL V2 (#2145) ### feat * **.net:** Bump MPL V2 ([#2145](#2145)) ([87c534b](87c534b)) ### Fixes -- Java * **java:** drop hkdf offset method ([#2222](#2222)) ([7aad5fb](7aad5fb)) ### Maintenance -- Java * **java:** Attempt to reduce flaky CI ([#2220](#2220)) ([987aec6](987aec6)) * **java:** attempt to reduce flaky CI failures ([#2203](#2203)) ([b4d88f1](b4d88f1)) * **java:** merge from main ([53d6ba3](53d6ba3)) * **java:** shut down local DDB in test ([#2176](#2176)) ([fa1e151](fa1e151)) ### Maintenance -- Rust * **rust:** release v1.2.4 ([#2184](#2184)) ([6823d31](6823d31)) ### Miscellaneous * **.net:** add ddb local to .net release ([#2075](#2075)) ([db55bdf](db55bdf)) * **.net:** comment out testvectors from release ([#2076](#2076)) ([fdaa9e3](fdaa9e3)) * **.net:** fix release commands to include all json tv files ([#2072](#2072)) ([10f809d](10f809d)) * **.net:** pin mpl to latest ([#2065](#2065)) ([f6b64a6](f6b64a6)) * **.net:** reference submoduled mpl ([#2080](#2080)) ([be3f58f](be3f58f)) * add code coverage check ([#2171](#2171)) ([c2ae8e7](c2ae8e7)) * add DDBEC examples ([#2064](#2064)) ([9b7c284](9b7c284)) * add integration test and unit test ([#2139](#2139)) ([3cb8a96](3cb8a96)) * add migration examples ([#2057](#2057)) ([18dbc50](18dbc50)) * add more interop tests ([#2131](#2131)) ([c06bc3a](c06bc3a)) * add multi order test ([#2170](#2170)) ([d09cd16](d09cd16)) * add test for DDBEC with sdk v2 ([#2126](#2126)) ([e3ac7cd](e3ac7cd)) * add user agent string ([#2172](#2172)) ([88c597c](88c597c)) * bump GitHub Actions to latest versions ([#2144](#2144)) ([92615d4](92615d4)) * **ci:** add workflow_dispatch and remove run on PR for daily CI ([#2218](#2218)) ([d6fd0fb](d6fd0fb)) * **ci:** daily ci for branches ([#2208](#2208)) ([fcc4b97](fcc4b97)) * **ci:** remove branch default to main ([#2219](#2219)) ([1a3d1f0](1a3d1f0)) * **CI:** run clippy ([#2181](#2181)) ([6b54985](6b54985)) * **ci:** run test on Java 21 and windows OS ([#2159](#2159)) ([6e702d8](6e702d8)) * **ci:** use snapshot builds ([#2083](#2083)) ([0124ca6](0124ca6)) * copy DDBEC with SDK v2 code as-is from internal ([#2047](#2047)) ([dc439b4](dc439b4)) * delete ddbec which uses AWS SDK Java v1 ([#2193](#2193)) ([bb74687](bb74687)) * **deps:** bump actions/checkout v5->v6 and setup-docker-macos-action v1.0.2->v1.1.0 ([#2130](#2130)) ([337c776](337c776)) * **deps:** update aws-lc-sys requirement from 0.38 to 0.39 in /DynamoDbEncryption/runtimes/rust ([#2149](#2149)) ([b76bcb7](b76bcb7)) * fix CI (almost) and make AWS SDK v1 compileOnly ([#2049](#2049)) ([e509a56](e509a56)) * merge from main ([e9f8259](e9f8259)) * merge from main 2nd try ([eb17468](eb17468)) * merge from main and fix ubuntu failing ([#2192](#2192)) ([3317b4d](3317b4d)) * move put cache after signature verification ([#2223](#2223)) ([49b8b67](49b8b67)) * refactor non-prod CI to only run Go targets ([#2134](#2134)) ([0d2622c](0d2622c)) * release aws-db-esdk v1.2.3 ([#2122](#2122)) ([888aaba](888aaba)) * Rename `Directkmsmaterialsprovider` to `Directkmsmaterialprovider` ([#2150](#2150)) ([4126efa](4126efa)) * rename and format ([#2118](#2118)) ([091b7b4](091b7b4)) * run java test on ubuntu ([#2167](#2167)) ([cffa72c](cffa72c)) * update internal legacy override with adapter pattern ([#2054](#2054)) ([abbac83](abbac83)) * update readme and remove comments in CI ([#2158](#2158)) ([7e1c863](7e1c863))
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue #, if available:
Description of changes:
The offset in HKDF was never used. The bug is completely inert in practice — all in-tree callers use the 2-parameter deriveKey() overload which passes offset=0, making the incorrect initialization equivalent to the correct one. Same fix as DDBEC with SDK V1. See
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.