Skip to content

Commit 23d0396

Browse files
Simone319Simone319
committed
fix: bump @aws-sdk/xml-builder, @opentelemetry/core, uuid for security advisories
- @aws-sdk/xml-builder ^3.972.0 -> ^3.972.31 in both constructs (root resolution @aws-sdk/core/@aws-sdk/xml-builder -> ^3.972.31). 3.972.31 is the first release containing aws-sdk-js-v3#7863, which replaces fast-xml-parser with an internal XML parser. - @opentelemetry/core pinned to >=2.8.0 via root resolutions (GHSA-8988-4f7v-96qf); resolves to 2.8.0. - uuid pinned to ^11.1.1 via root resolutions + both constructs (GHSA-w5hq-g745-h8pq); resolves to 11.1.1, the patched legacy-11 release. Avoids uuid 14.x which is ESM-first.
1 parent fc78049 commit 23d0396

7 files changed

Lines changed: 54 additions & 107 deletions

File tree

‎dependency_licenses.txt‎

Lines changed: 0 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -33279,58 +33279,6 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
3327933279

3328033280
-----
3328133281

33282-
The following software may be included in this product: uuid. A copy of the source code may be downloaded from https://github.com/uuidjs/uuid.git. This software contains the following license and notice below:
33283-
33284-
The MIT License (MIT)
33285-
33286-
Copyright (c) 2010-2020 Robert Kieffer and other contributors
33287-
33288-
Permission is hereby granted, free of charge, to any person obtaining a copy
33289-
of this software and associated documentation files (the "Software"), to deal
33290-
in the Software without restriction, including without limitation the rights
33291-
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
33292-
copies of the Software, and to permit persons to whom the Software is
33293-
furnished to do so, subject to the following conditions:
33294-
33295-
The above copyright notice and this permission notice shall be included in all
33296-
copies or substantial portions of the Software.
33297-
33298-
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
33299-
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
33300-
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
33301-
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
33302-
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
33303-
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
33304-
SOFTWARE.
33305-
33306-
-----
33307-
33308-
The following software may be included in this product: uuid. A copy of the source code may be downloaded from https://github.com/kelektiv/node-uuid.git. This software contains the following license and notice below:
33309-
33310-
The MIT License (MIT)
33311-
33312-
Copyright (c) 2010-2016 Robert Kieffer and other contributors
33313-
33314-
Permission is hereby granted, free of charge, to any person obtaining a copy
33315-
of this software and associated documentation files (the "Software"), to deal
33316-
in the Software without restriction, including without limitation the rights
33317-
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
33318-
copies of the Software, and to permit persons to whom the Software is
33319-
furnished to do so, subject to the following conditions:
33320-
33321-
The above copyright notice and this permission notice shall be included in all
33322-
copies or substantial portions of the Software.
33323-
33324-
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
33325-
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
33326-
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
33327-
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
33328-
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
33329-
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
33330-
SOFTWARE.
33331-
33332-
-----
33333-
3333433282
The following software may be included in this product: v8-compile-cache, v8-compile-cache-lib. A copy of the source code may be downloaded from https://github.com/zertosh/v8-compile-cache.git (v8-compile-cache), https://github.com/cspotcode/v8-compile-cache-lib.git (v8-compile-cache-lib). This software contains the following license and notice below:
3333533283

3333633284
The MIT License (MIT)

‎package.json‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -489,7 +489,7 @@
489489
"semver": "^7.5.2",
490490
"axios": "^1.16.1",
491491
"braces": "^3.0.3",
492-
"@aws-sdk/core/@aws-sdk/xml-builder": "^3.972.22",
492+
"@aws-sdk/core/@aws-sdk/xml-builder": "^3.972.31",
493493
"cookie": "^0.7.0",
494494
"@octokit/request-error": "^5.1.1",
495495
"@octokit/request": "^8.4.1",
@@ -511,7 +511,9 @@
511511
"fast-uri": ">=3.1.2",
512512
"flatted": ">=3.4.2",
513513
"**/fast-xml-parser": "~5.7.2",
514-
"**/fast-xml-builder": ">=1.1.7"
514+
"**/fast-xml-builder": ">=1.1.7",
515+
"@opentelemetry/core": ">=2.8.0",
516+
"uuid": "^11.1.1"
515517
},
516518
"packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
517519
}

‎packages/amplify-data-construct/.jsii‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -52,18 +52,24 @@
5252
"@aws-sdk/middleware-host-header": "^3.972.0",
5353
"@aws-sdk/middleware-logger": "^3.972.0",
5454
"@aws-sdk/middleware-recursion-detection": "^3.972.0",
55+
"@aws-sdk/middleware-sdk-s3": "^3.972.37",
5556
"@aws-sdk/middleware-user-agent": "^3.972.0",
57+
"@aws-sdk/middleware-websocket": "^3.972.16",
5658
"@aws-sdk/nested-clients": "^3.973.0",
5759
"@aws-sdk/region-config-resolver": "^3.972.0",
60+
"@aws-sdk/signature-v4-multi-region": "^3.996.25",
5861
"@aws-sdk/token-providers": "^3.973.0",
5962
"@aws-sdk/types": "^3.973.0",
63+
"@aws-sdk/util-arn-parser": "^3.972.3",
6064
"@aws-sdk/util-endpoints": "^3.973.0",
65+
"@aws-sdk/util-format-url": "^3.972.10",
6166
"@aws-sdk/util-locate-window": "^3.0.0",
6267
"@aws-sdk/util-user-agent-browser": "^3.972.0",
6368
"@aws-sdk/util-user-agent-node": "^3.973.0",
64-
"@aws-sdk/xml-builder": "^3.972.0",
69+
"@aws-sdk/xml-builder": "^3.972.31",
6570
"@aws/lambda-invoke-store": "^0.2.2",
6671
"@babel/runtime": "^7.18.3",
72+
"@nodable/entities": "^2.1.0",
6773
"@opentelemetry/api": "^1.9.0",
6874
"@opentelemetry/core": "^2.0.0",
6975
"@opentelemetry/resources": "2.0.0",
@@ -147,7 +153,8 @@
147153
"ts-dedent": "^2.0.0",
148154
"tslib": "^2.6.2",
149155
"universalify": "^0.1.0",
150-
"uuid": "^9.0.1",
156+
"uuid": "^11.1.1",
157+
"xml-naming": "^0.1.0",
151158
"zod": "^3.22.2"
152159
},
153160
"dependencies": {
@@ -8599,5 +8606,5 @@
85998606
},
86008607
"types": {},
86018608
"version": "1.17.3",
8602-
"fingerprint": "iuzz4IUbOgNmqpOvRjeUAFrasiVbfNFtgl4wkq3gH1c="
8609+
"fingerprint": "nfltHpQ6XgO+xOf6i/vn2aOW2tQ1Fc+YAjbBHKo+lJY="
86038610
}

‎packages/amplify-data-construct/package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -247,7 +247,7 @@
247247
"@aws-sdk/util-locate-window": "^3.0.0",
248248
"@aws-sdk/util-user-agent-browser": "^3.972.0",
249249
"@aws-sdk/util-user-agent-node": "^3.973.0",
250-
"@aws-sdk/xml-builder": "^3.972.0",
250+
"@aws-sdk/xml-builder": "^3.972.31",
251251
"@aws/lambda-invoke-store": "^0.2.2",
252252
"@nodable/entities": "^2.1.0",
253253
"@opentelemetry/api": "^1.9.0",
@@ -333,7 +333,7 @@
333333
"ts-dedent": "^2.0.0",
334334
"tslib": "^2.6.2",
335335
"universalify": "^0.1.0",
336-
"uuid": "^9.0.1",
336+
"uuid": "^11.1.1",
337337
"xml-naming": "^0.1.0",
338338
"zod": "^3.22.2"
339339
},

‎packages/amplify-graphql-api-construct/.jsii‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -52,18 +52,24 @@
5252
"@aws-sdk/middleware-host-header": "^3.972.0",
5353
"@aws-sdk/middleware-logger": "^3.972.0",
5454
"@aws-sdk/middleware-recursion-detection": "^3.972.0",
55+
"@aws-sdk/middleware-sdk-s3": "^3.972.37",
5556
"@aws-sdk/middleware-user-agent": "^3.972.0",
57+
"@aws-sdk/middleware-websocket": "^3.972.16",
5658
"@aws-sdk/nested-clients": "^3.973.0",
5759
"@aws-sdk/region-config-resolver": "^3.972.0",
60+
"@aws-sdk/signature-v4-multi-region": "^3.996.25",
5861
"@aws-sdk/token-providers": "^3.973.0",
5962
"@aws-sdk/types": "^3.973.0",
63+
"@aws-sdk/util-arn-parser": "^3.972.3",
6064
"@aws-sdk/util-endpoints": "^3.973.0",
65+
"@aws-sdk/util-format-url": "^3.972.10",
6166
"@aws-sdk/util-locate-window": "^3.0.0",
6267
"@aws-sdk/util-user-agent-browser": "^3.972.0",
6368
"@aws-sdk/util-user-agent-node": "^3.973.0",
64-
"@aws-sdk/xml-builder": "^3.972.0",
69+
"@aws-sdk/xml-builder": "^3.972.31",
6570
"@aws/lambda-invoke-store": "^0.2.2",
6671
"@babel/runtime": "^7.18.3",
72+
"@nodable/entities": "^2.1.0",
6773
"@opentelemetry/api": "^1.9.0",
6874
"@opentelemetry/core": "^2.0.0",
6975
"@opentelemetry/resources": "2.0.0",
@@ -147,7 +153,8 @@
147153
"ts-dedent": "^2.0.0",
148154
"tslib": "^2.6.2",
149155
"universalify": "^0.1.0",
150-
"uuid": "^9.0.1",
156+
"uuid": "^11.1.1",
157+
"xml-naming": "^0.1.0",
151158
"zod": "^3.22.2"
152159
},
153160
"dependencies": {
@@ -14040,5 +14047,5 @@
1404014047
}
1404114048
},
1404214049
"version": "1.21.3",
14043-
"fingerprint": "5ICEXpXtFhTUczsbC1WtvPQX7k0LPVFLNyTSoRKFfMU="
14050+
"fingerprint": "Q4qtMfQyBEgWKxMziAPpRXpFgVz/6eOc8rikvc1Td4o="
1404414051
}

‎packages/amplify-graphql-api-construct/package.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -247,7 +247,7 @@
247247
"@aws-sdk/util-locate-window": "^3.0.0",
248248
"@aws-sdk/util-user-agent-browser": "^3.972.0",
249249
"@aws-sdk/util-user-agent-node": "^3.973.0",
250-
"@aws-sdk/xml-builder": "^3.972.0",
250+
"@aws-sdk/xml-builder": "^3.972.31",
251251
"@aws/lambda-invoke-store": "^0.2.2",
252252
"@nodable/entities": "^2.1.0",
253253
"@opentelemetry/api": "^1.9.0",
@@ -333,7 +333,7 @@
333333
"ts-dedent": "^2.0.0",
334334
"tslib": "^2.6.2",
335335
"universalify": "^0.1.0",
336-
"uuid": "^9.0.1",
336+
"uuid": "^11.1.1",
337337
"xml-naming": "^0.1.0",
338338
"zod": "^3.22.2"
339339
},

‎yarn.lock‎

Lines changed: 26 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -6332,16 +6332,6 @@
63326332
dependencies:
63336333
tslib "^1.8.0"
63346334

6335-
"@aws-sdk/xml-builder@^3.972.0", "@aws-sdk/xml-builder@^3.972.22":
6336-
version "3.972.22"
6337-
resolved "https://registry.yarnpkg.com/@aws-sdk/xml-builder/-/xml-builder-3.972.22.tgz#1e44ca9fd9c3fdc3d9af9540ced024f34cfc60b2"
6338-
integrity sha512-PMYKKtJd70IsSG0yHrdAbxBr+ZWBKLvzFZfD3/urxgf6hXVMzuU5M+3MJ5G67RpOmLBu1fAUN65SbWuKUCOlAA==
6339-
dependencies:
6340-
"@nodable/entities" "2.1.0"
6341-
"@smithy/types" "^4.14.1"
6342-
fast-xml-parser "5.7.2"
6343-
tslib "^2.6.2"
6344-
63456335
"@aws-sdk/xml-builder@^3.972.11", "@aws-sdk/xml-builder@^3.972.15":
63466336
version "3.972.15"
63476337
resolved "https://registry.yarnpkg.com/@aws-sdk/xml-builder/-/xml-builder-3.972.15.tgz#7cbc823f8eb11fa8c02d81a744892e41b1762619"
@@ -6351,6 +6341,16 @@
63516341
fast-xml-parser "5.5.8"
63526342
tslib "^2.6.2"
63536343

6344+
"@aws-sdk/xml-builder@^3.972.22":
6345+
version "3.972.22"
6346+
resolved "https://registry.yarnpkg.com/@aws-sdk/xml-builder/-/xml-builder-3.972.22.tgz#1e44ca9fd9c3fdc3d9af9540ced024f34cfc60b2"
6347+
integrity sha512-PMYKKtJd70IsSG0yHrdAbxBr+ZWBKLvzFZfD3/urxgf6hXVMzuU5M+3MJ5G67RpOmLBu1fAUN65SbWuKUCOlAA==
6348+
dependencies:
6349+
"@nodable/entities" "2.1.0"
6350+
"@smithy/types" "^4.14.1"
6351+
fast-xml-parser "5.7.2"
6352+
tslib "^2.6.2"
6353+
63546354
"@aws-sdk/xml-builder@^3.972.26":
63556355
version "3.972.26"
63566356
resolved "https://registry.yarnpkg.com/@aws-sdk/xml-builder/-/xml-builder-3.972.26.tgz#949366fe7c195f676f0ab9e002dd95b70942410c"
@@ -6360,6 +6360,14 @@
63606360
fast-xml-parser "5.7.3"
63616361
tslib "^2.6.2"
63626362

6363+
"@aws-sdk/xml-builder@^3.972.31":
6364+
version "3.972.31"
6365+
resolved "https://registry.yarnpkg.com/@aws-sdk/xml-builder/-/xml-builder-3.972.31.tgz#8cbfa41fbc6bab6ef279d2088b85e916956a3fb2"
6366+
integrity sha512-SzE4Pgyl+hDF+BuyuzxUSpwnuUu9lJuO1YGgteG89/4Qv0+2IQiVQqdbPV32IozLvXWQChPQcdkk/sKvb1QHiQ==
6367+
dependencies:
6368+
"@smithy/types" "^4.14.3"
6369+
tslib "^2.6.2"
6370+
63636371
"@aws/lambda-invoke-store@^0.2.2":
63646372
version "0.2.2"
63656373
resolved "https://registry.yarnpkg.com/@aws/lambda-invoke-store/-/lambda-invoke-store-0.2.2.tgz#b00f7d6aedfe832ef6c84488f3a422cce6a47efa"
@@ -8712,10 +8720,10 @@
87128720
resolved "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.0.tgz#d03eba68273dc0f7509e2a3d5cba21eae10379fe"
87138721
integrity sha512-3giAOQvZiH5F9bMlMiv8+GSPMeqg0dbaeo58/0SlA9sxSqZhnUtxzX9/2FzyhS9sWQf5S0GJE0AKBrFqjpeYcg==
87148722

8715-
"@opentelemetry/core@2.0.0", "@opentelemetry/core@^2.0.0":
8716-
version "2.0.0"
8717-
resolved "https://registry.npmjs.org/@opentelemetry/core/-/core-2.0.0.tgz#37e9f0e9ddec4479b267aca6f32d88757c941b3a"
8718-
integrity sha512-SLX36allrcnVaPYG3R78F/UZZsBsvbc7lMCLx37LyH5MJ1KAAZ2E3mW9OAD3zGz0G8q/BtoS5VUrjzDydhD6LQ==
8723+
"@opentelemetry/core@2.0.0", "@opentelemetry/core@>=2.8.0", "@opentelemetry/core@^2.0.0":
8724+
version "2.8.0"
8725+
resolved "https://registry.yarnpkg.com/@opentelemetry/core/-/core-2.8.0.tgz#f6e86de3688bdb54a6ca8f4935363a5b588ae91c"
8726+
integrity sha512-hd1Lfh8p545nNz+jq1Ejfz+Mn1hyLuxYn1YzTfFNrxr8urEWMNQLPf1Th8kjOH+HxwawCrtgBp8JpBUR4ZSgww==
87198727
dependencies:
87208728
"@opentelemetry/semantic-conventions" "^1.29.0"
87218729

@@ -21072,35 +21080,10 @@ utils-merge@1.0.1:
2107221080
resolved "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz#9f95710f50a267947b2ccc124741c1028427e713"
2107321081
integrity sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==
2107421082

21075-
uuid@3.3.2:
21076-
version "3.3.2"
21077-
resolved "https://registry.npmjs.org/uuid/-/uuid-3.3.2.tgz#1b4af4955eb3077c501c23872fc6513811587131"
21078-
integrity sha512-yXJmeNaw3DnnKAOKJE51sL/ZaYfWJRl1pK9dr19YFCu0ObS231AB1/LbqTKRAQ5kw8A90rA6fr4riOUpTZvQZA==
21079-
21080-
uuid@3.x, uuid@^3.0.0, uuid@^3.2.1, uuid@^3.3.2:
21081-
version "3.4.0"
21082-
resolved "https://registry.npmjs.org/uuid/-/uuid-3.4.0.tgz#b23e4358afa8a202fe7a100af1f5f883f02007ee"
21083-
integrity sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==
21084-
21085-
uuid@8.0.0:
21086-
version "8.0.0"
21087-
resolved "https://registry.npmjs.org/uuid/-/uuid-8.0.0.tgz#bc6ccf91b5ff0ac07bbcdbf1c7c4e150db4dbb6c"
21088-
integrity sha512-jOXGuXZAWdsTH7eZLtyXMqUb9EcWMGZNbL9YcGBJl4MH4nrxHmZJhEHvyLFrkxo+28uLb/NYRcStH48fnD0Vzw==
21089-
21090-
uuid@^11.1.0:
21091-
version "11.1.0"
21092-
resolved "https://registry.npmjs.org/uuid/-/uuid-11.1.0.tgz#9549028be1753bb934fc96e2bca09bb4105ae912"
21093-
integrity sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A==
21094-
21095-
uuid@^8.0.0, uuid@^8.3.2:
21096-
version "8.3.2"
21097-
resolved "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz#80d5b5ced271bb9af6c445f21a1a04c606cefbe2"
21098-
integrity sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==
21099-
21100-
uuid@^9.0.1:
21101-
version "9.0.1"
21102-
resolved "https://registry.yarnpkg.com/uuid/-/uuid-9.0.1.tgz#e188d4c8853cc722220392c424cd637f32293f30"
21103-
integrity sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==
21083+
uuid@3.3.2, uuid@3.x, uuid@8.0.0, uuid@^11.1.0, uuid@^11.1.1, uuid@^3.0.0, uuid@^3.2.1, uuid@^3.3.2, uuid@^8.0.0, uuid@^8.3.2, uuid@^9.0.1:
21084+
version "11.1.1"
21085+
resolved "https://registry.yarnpkg.com/uuid/-/uuid-11.1.1.tgz#f6d81d2e1c65d00762e5e29b16c5d2d995e208ad"
21086+
integrity sha512-vIYxrBCC/N/K+Js3qSN88go7kIfNPssr/hHCesKCQNAjmgvYS2oqr69kIufEG+O4+PfezOH4EbIeHCfFov8ZgQ==
2110421087

2110521088
v8-compile-cache-lib@^3.0.1:
2110621089
version "3.0.1"

0 commit comments

Comments
 (0)