fix: upgrade AWS SDK clients to eliminate fast-xml-parser vulnerabilities

Upgrades AWS SDK client packages and adds a resolution to eliminate
vulnerable fast-xml-parser versions (4.4.1, 5.2.5, 5.5.2) from the
dependency tree.

Changes:
- Broadened fast-xml-parser resolution to force all instances to ~5.5.12
- Updated @aws-sdk/core, @aws-sdk/xml-builder and related packages in
  amplify-data-construct and amplify-graphql-api-construct
- Upgraded direct fast-xml-parser dep from 5.5.2 to ~5.5.12 in constructs
- Upgraded AWS SDK clients in test packages to ^3.973.0

After these changes, yarn.lock contains only fast-xml-parser@5.5.12
(safe, >= 5.5.6) with no vulnerable versions remaining.

Author: Simone319

package.json

@@ -475,7 +475,6 @@
     "semver": "^7.5.2",
     "axios": "^1.15.0",
     "braces": "^3.0.3",
-    "**/aws-amplify/**/fast-xml-parser": "~5.5.12",
     "@aws-sdk/core/@aws-sdk/xml-builder": "^3.972.15",
     "cookie": "^0.7.0",
     "@octokit/request-error": "^5.1.1",
@@ -494,7 +493,8 @@
     "handlebars": "^4.7.9",
     "@xmldom/xmldom": "^0.9.9",
     "path-to-regexp": "^0.1.13",
-    "brace-expansion": "^1.1.13"
+    "brace-expansion": "^1.1.13",
+    "**/fast-xml-parser": "~5.5.12"
   },
   "packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
 }

packages/amplify-data-construct/.jsii

@@ -34,33 +34,36 @@
     "@aws-crypto/sha256-js": "^5.2.0",
     "@aws-crypto/supports-web-crypto": "^5.2.0",
     "@aws-crypto/util": "^5.2.0",
-    "@aws-sdk/client-bedrock-runtime": "^3.622.0",
-    "@aws-sdk/client-sso": "3.637.0",
-    "@aws-sdk/client-sso-oidc": "3.637.0",
-    "@aws-sdk/client-sts": "^3.624.0",
-    "@aws-sdk/core": "3.635.0",
-    "@aws-sdk/credential-provider-env": "3.620.1",
-    "@aws-sdk/credential-provider-http": "3.635.0",
-    "@aws-sdk/credential-provider-ini": "3.637.0",
-    "@aws-sdk/credential-provider-login": "3.955.0",
-    "@aws-sdk/credential-provider-node": "3.637.0",
-    "@aws-sdk/credential-provider-process": "3.620.1",
-    "@aws-sdk/credential-provider-sso": "3.637.0",
-    "@aws-sdk/credential-provider-web-identity": "3.621.0",
-    "@aws-sdk/middleware-host-header": "3.620.0",
-    "@aws-sdk/middleware-logger": "3.609.0",
-    "@aws-sdk/middleware-recursion-detection": "3.620.0",
-    "@aws-sdk/middleware-user-agent": "3.637.0",
-    "@aws-sdk/nested-clients": "^3.777.0",
-    "@aws-sdk/region-config-resolver": "3.614.0",
-    "@aws-sdk/token-providers": "3.614.0",
-    "@aws-sdk/types": "^3.734.0",
-    "@aws-sdk/util-endpoints": "3.637.0",
+    "@aws-sdk/client-bedrock-runtime": "^3.973.0",
+    "@aws-sdk/client-sso": "^3.973.0",
+    "@aws-sdk/client-sso-oidc": "^3.973.0",
+    "@aws-sdk/client-sts": "^3.973.0",
+    "@aws-sdk/core": "^3.973.0",
+    "@aws-sdk/credential-provider-env": "^3.972.0",
+    "@aws-sdk/credential-provider-http": "^3.972.0",
+    "@aws-sdk/credential-provider-ini": "^3.972.0",
+    "@aws-sdk/credential-provider-login": "^3.972.0",
+    "@aws-sdk/credential-provider-node": "^3.972.0",
+    "@aws-sdk/credential-provider-process": "^3.972.0",
+    "@aws-sdk/credential-provider-sso": "^3.972.0",
+    "@aws-sdk/credential-provider-web-identity": "^3.972.0",
+    "@aws-sdk/eventstream-handler-node": "^3.972.0",
+    "@aws-sdk/middleware-eventstream": "^3.972.0",
+    "@aws-sdk/middleware-host-header": "^3.972.0",
+    "@aws-sdk/middleware-logger": "^3.972.0",
+    "@aws-sdk/middleware-recursion-detection": "^3.972.0",
+    "@aws-sdk/middleware-user-agent": "^3.972.0",
+    "@aws-sdk/nested-clients": "^3.973.0",
+    "@aws-sdk/region-config-resolver": "^3.972.0",
+    "@aws-sdk/token-providers": "^3.973.0",
+    "@aws-sdk/types": "^3.973.0",
+    "@aws-sdk/util-endpoints": "^3.973.0",
     "@aws-sdk/util-locate-window": "^3.0.0",
-    "@aws-sdk/util-user-agent-browser": "3.609.0",
-    "@aws-sdk/util-user-agent-node": "3.614.0",
-    "@aws-sdk/xml-builder": "3.804.0",
+    "@aws-sdk/util-user-agent-browser": "^3.972.0",
+    "@aws-sdk/util-user-agent-node": "^3.973.0",
+    "@aws-sdk/xml-builder": "^3.972.0",
     "@aws/lambda-invoke-store": "^0.2.2",
+    "@babel/runtime": "^7.18.3",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/core": "^2.0.0",
     "@opentelemetry/resources": "2.0.0",
@@ -117,7 +120,7 @@
     "ci-info": "^3.2.0",
     "crypt": "^0.0.2",
     "fast-xml-builder": "1.1.1",
-    "fast-xml-parser": "5.5.2",
+    "fast-xml-parser": "~5.5.12",
     "fs-extra": "^8.1.0",
     "graceful-fs": "^4.2.0",
     "graphql": "^15.5.0",
@@ -127,6 +130,7 @@
     "immer": "^9.0.12",
     "is-buffer": "~1.1.6",
     "is-ci": "^3.0.1",
+    "json-schema-to-ts": "^3.1.1",
     "jsonfile": "^4.0.0",
     "libphonenumber-js": "1.9.47",
     "lodash": "^4.17.23",
@@ -136,8 +140,10 @@
     "object-hash": "^3.0.0",
     "path-expression-matcher": "1.1.3",
     "pluralize": "8.0.0",
+    "regenerator-runtime": "^0.14.0",
     "semver": "^7.6.3",
     "strnum": "^1.0.5",
+    "ts-algebra": "^2.0.0",
     "ts-dedent": "^2.0.0",
     "tslib": "^2.6.2",
     "universalify": "^0.1.0",
@@ -8593,5 +8599,5 @@
   },
   "types": {},
   "version": "1.17.2",
-  "fingerprint": "CjaXiYUP5ydMk5+Q2+ANminVCU4VrEaFAfud5KNeIwY="
+  "fingerprint": "o956pibqc8+NLxUuoj4k0pEAu9G9uS812Zr0hq2DZa4="
 }

packages/amplify-data-construct/package.json

@@ -208,34 +208,34 @@
     "@aws-crypto/sha256-js": "^5.2.0",
     "@aws-crypto/supports-web-crypto": "^5.2.0",
     "@aws-crypto/util": "^5.2.0",
-    "@aws-sdk/client-bedrock-runtime": "^3.622.0",
-    "@aws-sdk/eventstream-handler-node": "^3.821.0",
-    "@aws-sdk/middleware-eventstream": "^3.821.0",
-    "@aws-sdk/client-sso": "3.637.0",
-    "@aws-sdk/client-sso-oidc": "3.637.0",
-    "@aws-sdk/client-sts": "^3.624.0",
-    "@aws-sdk/core": "3.635.0",
-    "@aws-sdk/credential-provider-env": "3.620.1",
-    "@aws-sdk/credential-provider-http": "3.635.0",
-    "@aws-sdk/credential-provider-ini": "3.637.0",
-    "@aws-sdk/credential-provider-login": "3.955.0",
-    "@aws-sdk/credential-provider-node": "3.637.0",
-    "@aws-sdk/credential-provider-process": "3.620.1",
-    "@aws-sdk/credential-provider-sso": "3.637.0",
-    "@aws-sdk/credential-provider-web-identity": "3.621.0",
-    "@aws-sdk/middleware-host-header": "3.620.0",
-    "@aws-sdk/middleware-logger": "3.609.0",
-    "@aws-sdk/middleware-recursion-detection": "3.620.0",
-    "@aws-sdk/middleware-user-agent": "3.637.0",
-    "@aws-sdk/nested-clients": "^3.777.0",
-    "@aws-sdk/region-config-resolver": "3.614.0",
-    "@aws-sdk/token-providers": "3.614.0",
-    "@aws-sdk/types": "^3.734.0",
-    "@aws-sdk/util-endpoints": "3.637.0",
+    "@aws-sdk/client-bedrock-runtime": "^3.973.0",
+    "@aws-sdk/eventstream-handler-node": "^3.972.0",
+    "@aws-sdk/middleware-eventstream": "^3.972.0",
+    "@aws-sdk/client-sso": "^3.973.0",
+    "@aws-sdk/client-sso-oidc": "^3.973.0",
+    "@aws-sdk/client-sts": "^3.973.0",
+    "@aws-sdk/core": "^3.973.0",
+    "@aws-sdk/credential-provider-env": "^3.972.0",
+    "@aws-sdk/credential-provider-http": "^3.972.0",
+    "@aws-sdk/credential-provider-ini": "^3.972.0",
+    "@aws-sdk/credential-provider-login": "^3.972.0",
+    "@aws-sdk/credential-provider-node": "^3.972.0",
+    "@aws-sdk/credential-provider-process": "^3.972.0",
+    "@aws-sdk/credential-provider-sso": "^3.972.0",
+    "@aws-sdk/credential-provider-web-identity": "^3.972.0",
+    "@aws-sdk/middleware-host-header": "^3.972.0",
+    "@aws-sdk/middleware-logger": "^3.972.0",
+    "@aws-sdk/middleware-recursion-detection": "^3.972.0",
+    "@aws-sdk/middleware-user-agent": "^3.972.0",
+    "@aws-sdk/nested-clients": "^3.973.0",
+    "@aws-sdk/region-config-resolver": "^3.972.0",
+    "@aws-sdk/token-providers": "^3.973.0",
+    "@aws-sdk/types": "^3.973.0",
+    "@aws-sdk/util-endpoints": "^3.973.0",
     "@aws-sdk/util-locate-window": "^3.0.0",
-    "@aws-sdk/util-user-agent-browser": "3.609.0",
-    "@aws-sdk/util-user-agent-node": "3.614.0",
-    "@aws-sdk/xml-builder": "3.804.0",
+    "@aws-sdk/util-user-agent-browser": "^3.972.0",
+    "@aws-sdk/util-user-agent-node": "^3.973.0",
+    "@aws-sdk/xml-builder": "^3.972.0",
     "@aws/lambda-invoke-store": "^0.2.2",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/core": "^2.0.0",
@@ -293,7 +293,7 @@
     "ci-info": "^3.2.0",
     "crypt": "^0.0.2",
     "fast-xml-builder": "1.1.1",
-    "fast-xml-parser": "5.5.2",
+    "fast-xml-parser": "~5.5.12",
     "fs-extra": "^8.1.0",
     "graceful-fs": "^4.2.0",
     "graphql": "^15.5.0",

packages/amplify-e2e-tests/package.json

@@ -30,7 +30,7 @@
     "@aws-sdk/client-amplify": "^3.973.0",
     "@aws-sdk/client-appsync": "^3.973.0",
     "@aws-sdk/client-cloudformation": "^3.973.0",
-    "@aws-sdk/client-codebuild": "3.812.0",
+    "@aws-sdk/client-codebuild": "^3.973.0",
     "@aws-sdk/client-cognito-identity-provider": "^3.973.0",
     "@aws-sdk/client-dynamodb": "^3.973.0",
     "@aws-sdk/client-iam": "^3.973.0",

packages/amplify-graphql-api-construct-tests/package.json

@@ -25,15 +25,15 @@
     "@aws-amplify/auth-construct": "1.8.0",
     "@aws-amplify/core": "^2.1.0",
     "@aws-amplify/graphql-api-construct": "1.21.2",
-    "@aws-sdk/client-appsync": "3.624.0",
-    "@aws-sdk/client-cloudformation": "3.624.0",
-    "@aws-sdk/client-cloudwatch-logs": "3.624.0",
-    "@aws-sdk/client-cognito-identity-provider": "3.624.0",
-    "@aws-sdk/client-dynamodb": "3.624.0",
-    "@aws-sdk/client-lambda": "3.624.0",
-    "@aws-sdk/client-rds": "3.624.0",
-    "@aws-sdk/client-ssm": "3.624.0",
-    "@aws-sdk/client-sts": "3.624.0",
+    "@aws-sdk/client-appsync": "^3.973.0",
+    "@aws-sdk/client-cloudformation": "^3.973.0",
+    "@aws-sdk/client-cloudwatch-logs": "^3.973.0",
+    "@aws-sdk/client-cognito-identity-provider": "^3.973.0",
+    "@aws-sdk/client-dynamodb": "^3.973.0",
+    "@aws-sdk/client-lambda": "^3.973.0",
+    "@aws-sdk/client-rds": "^3.973.0",
+    "@aws-sdk/client-ssm": "^3.973.0",
+    "@aws-sdk/client-sts": "^3.973.0",
     "@faker-js/faker": "^8.2.0",
     "amplify-category-api-e2e-core": "5.0.11",
     "aws-amplify": "^4.2.8",

packages/amplify-graphql-api-construct/.jsii

@@ -34,33 +34,36 @@
     "@aws-crypto/sha256-js": "^5.2.0",
     "@aws-crypto/supports-web-crypto": "^5.2.0",
     "@aws-crypto/util": "^5.2.0",
-    "@aws-sdk/client-bedrock-runtime": "^3.622.0",
-    "@aws-sdk/client-sso": "3.637.0",
-    "@aws-sdk/client-sso-oidc": "3.637.0",
-    "@aws-sdk/client-sts": "^3.624.0",
-    "@aws-sdk/core": "3.635.0",
-    "@aws-sdk/credential-provider-env": "3.620.1",
-    "@aws-sdk/credential-provider-http": "3.635.0",
-    "@aws-sdk/credential-provider-ini": "3.637.0",
-    "@aws-sdk/credential-provider-login": "3.955.0",
-    "@aws-sdk/credential-provider-node": "3.637.0",
-    "@aws-sdk/credential-provider-process": "3.620.1",
-    "@aws-sdk/credential-provider-sso": "3.637.0",
-    "@aws-sdk/credential-provider-web-identity": "3.621.0",
-    "@aws-sdk/middleware-host-header": "3.620.0",
-    "@aws-sdk/middleware-logger": "3.609.0",
-    "@aws-sdk/middleware-recursion-detection": "3.620.0",
-    "@aws-sdk/middleware-user-agent": "3.637.0",
-    "@aws-sdk/nested-clients": "^3.777.0",
-    "@aws-sdk/region-config-resolver": "3.614.0",
-    "@aws-sdk/token-providers": "3.614.0",
-    "@aws-sdk/types": "^3.734.0",
-    "@aws-sdk/util-endpoints": "3.734.0",
+    "@aws-sdk/client-bedrock-runtime": "^3.973.0",
+    "@aws-sdk/client-sso": "^3.973.0",
+    "@aws-sdk/client-sso-oidc": "^3.973.0",
+    "@aws-sdk/client-sts": "^3.973.0",
+    "@aws-sdk/core": "^3.973.0",
+    "@aws-sdk/credential-provider-env": "^3.972.0",
+    "@aws-sdk/credential-provider-http": "^3.972.0",
+    "@aws-sdk/credential-provider-ini": "^3.972.0",
+    "@aws-sdk/credential-provider-login": "^3.972.0",
+    "@aws-sdk/credential-provider-node": "^3.972.0",
+    "@aws-sdk/credential-provider-process": "^3.972.0",
+    "@aws-sdk/credential-provider-sso": "^3.972.0",
+    "@aws-sdk/credential-provider-web-identity": "^3.972.0",
+    "@aws-sdk/eventstream-handler-node": "^3.972.0",
+    "@aws-sdk/middleware-eventstream": "^3.972.0",
+    "@aws-sdk/middleware-host-header": "^3.972.0",
+    "@aws-sdk/middleware-logger": "^3.972.0",
+    "@aws-sdk/middleware-recursion-detection": "^3.972.0",
+    "@aws-sdk/middleware-user-agent": "^3.972.0",
+    "@aws-sdk/nested-clients": "^3.973.0",
+    "@aws-sdk/region-config-resolver": "^3.972.0",
+    "@aws-sdk/token-providers": "^3.973.0",
+    "@aws-sdk/types": "^3.973.0",
+    "@aws-sdk/util-endpoints": "^3.973.0",
     "@aws-sdk/util-locate-window": "^3.0.0",
-    "@aws-sdk/util-user-agent-browser": "3.609.0",
-    "@aws-sdk/util-user-agent-node": "3.614.0",
-    "@aws-sdk/xml-builder": "3.804.0",
+    "@aws-sdk/util-user-agent-browser": "^3.972.0",
+    "@aws-sdk/util-user-agent-node": "^3.973.0",
+    "@aws-sdk/xml-builder": "^3.972.0",
     "@aws/lambda-invoke-store": "^0.2.2",
+    "@babel/runtime": "^7.18.3",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/core": "^2.0.0",
     "@opentelemetry/resources": "2.0.0",
@@ -117,7 +120,7 @@
     "ci-info": "^3.2.0",
     "crypt": "^0.0.2",
     "fast-xml-builder": "1.1.1",
-    "fast-xml-parser": "5.5.2",
+    "fast-xml-parser": "~5.5.12",
     "fs-extra": "^8.1.0",
     "graceful-fs": "^4.2.0",
     "graphql": "^15.5.0",
@@ -127,6 +130,7 @@
     "immer": "^9.0.12",
     "is-buffer": "~1.1.6",
     "is-ci": "^3.0.1",
+    "json-schema-to-ts": "^3.1.1",
     "jsonfile": "^4.0.0",
     "libphonenumber-js": "1.9.47",
     "lodash": "^4.17.23",
@@ -136,8 +140,10 @@
     "object-hash": "^3.0.0",
     "path-expression-matcher": "1.1.3",
     "pluralize": "8.0.0",
+    "regenerator-runtime": "^0.14.0",
     "semver": "^7.6.3",
     "strnum": "^1.0.5",
+    "ts-algebra": "^2.0.0",
     "ts-dedent": "^2.0.0",
     "tslib": "^2.6.2",
     "universalify": "^0.1.0",
@@ -14034,5 +14040,5 @@
     }
   },
   "version": "1.21.2",
-  "fingerprint": "Fj0ZrujYgXvanPVPYhWdXIeKmPAK5V6P1qhDk/iHRQ0="
+  "fingerprint": "uhL72uTHa424IaBCwBnTI5FPExcLXDhBkBHpXqL1m4A="
 }

packages/amplify-graphql-api-construct/package.json

@@ -208,34 +208,34 @@
     "@aws-crypto/sha256-js": "^5.2.0",
     "@aws-crypto/supports-web-crypto": "^5.2.0",
     "@aws-crypto/util": "^5.2.0",
-    "@aws-sdk/client-bedrock-runtime": "^3.622.0",
-    "@aws-sdk/eventstream-handler-node": "^3.821.0",
-    "@aws-sdk/middleware-eventstream": "^3.821.0",
-    "@aws-sdk/client-sso": "3.637.0",
-    "@aws-sdk/client-sso-oidc": "3.637.0",
-    "@aws-sdk/client-sts": "^3.624.0",
-    "@aws-sdk/core": "3.635.0",
-    "@aws-sdk/credential-provider-env": "3.620.1",
-    "@aws-sdk/credential-provider-http": "3.635.0",
-    "@aws-sdk/credential-provider-ini": "3.637.0",
-    "@aws-sdk/credential-provider-login": "3.955.0",
-    "@aws-sdk/credential-provider-node": "3.637.0",
-    "@aws-sdk/credential-provider-process": "3.620.1",
-    "@aws-sdk/credential-provider-sso": "3.637.0",
-    "@aws-sdk/credential-provider-web-identity": "3.621.0",
-    "@aws-sdk/middleware-host-header": "3.620.0",
-    "@aws-sdk/middleware-logger": "3.609.0",
-    "@aws-sdk/middleware-recursion-detection": "3.620.0",
-    "@aws-sdk/middleware-user-agent": "3.637.0",
-    "@aws-sdk/nested-clients": "^3.777.0",
-    "@aws-sdk/region-config-resolver": "3.614.0",
-    "@aws-sdk/token-providers": "3.614.0",
-    "@aws-sdk/types": "^3.734.0",
-    "@aws-sdk/util-endpoints": "3.734.0",
+    "@aws-sdk/client-bedrock-runtime": "^3.973.0",
+    "@aws-sdk/eventstream-handler-node": "^3.972.0",
+    "@aws-sdk/middleware-eventstream": "^3.972.0",
+    "@aws-sdk/client-sso": "^3.973.0",
+    "@aws-sdk/client-sso-oidc": "^3.973.0",
+    "@aws-sdk/client-sts": "^3.973.0",
+    "@aws-sdk/core": "^3.973.0",
+    "@aws-sdk/credential-provider-env": "^3.972.0",
+    "@aws-sdk/credential-provider-http": "^3.972.0",
+    "@aws-sdk/credential-provider-ini": "^3.972.0",
+    "@aws-sdk/credential-provider-login": "^3.972.0",
+    "@aws-sdk/credential-provider-node": "^3.972.0",
+    "@aws-sdk/credential-provider-process": "^3.972.0",
+    "@aws-sdk/credential-provider-sso": "^3.972.0",
+    "@aws-sdk/credential-provider-web-identity": "^3.972.0",
+    "@aws-sdk/middleware-host-header": "^3.972.0",
+    "@aws-sdk/middleware-logger": "^3.972.0",
+    "@aws-sdk/middleware-recursion-detection": "^3.972.0",
+    "@aws-sdk/middleware-user-agent": "^3.972.0",
+    "@aws-sdk/nested-clients": "^3.973.0",
+    "@aws-sdk/region-config-resolver": "^3.972.0",
+    "@aws-sdk/token-providers": "^3.973.0",
+    "@aws-sdk/types": "^3.973.0",
+    "@aws-sdk/util-endpoints": "^3.973.0",
     "@aws-sdk/util-locate-window": "^3.0.0",
-    "@aws-sdk/util-user-agent-browser": "3.609.0",
-    "@aws-sdk/util-user-agent-node": "3.614.0",
-    "@aws-sdk/xml-builder": "3.804.0",
+    "@aws-sdk/util-user-agent-browser": "^3.972.0",
+    "@aws-sdk/util-user-agent-node": "^3.973.0",
+    "@aws-sdk/xml-builder": "^3.972.0",
     "@aws/lambda-invoke-store": "^0.2.2",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/core": "^2.0.0",
@@ -293,7 +293,7 @@
     "ci-info": "^3.2.0",
     "crypt": "^0.0.2",
     "fast-xml-builder": "1.1.1",
-    "fast-xml-parser": "5.5.2",
+    "fast-xml-parser": "~5.5.12",
     "fs-extra": "^8.1.0",
     "graceful-fs": "^4.2.0",
     "graphql": "^15.5.0",