Skip to content

Commit bddb2c8

Browse files
svidgensvidgen
authored
fix: dep updates (#3441)
- fast-xml-parser ^5.5.2 -> ^5.5.7 (CVE-2026-26278, entity bypass, DoS, stack overflow) - Added minimatch ^3.1.5 resolution (ReDoS across nx, api-extractor, etc.) - Added lodash-es ^4.17.23 resolution (prototype pollution) Addresses alerts: #295, #294, #302, #307-310, #236, #273-275, #282-285, #290, #292 Note: ajv ^8.18.0 resolution attempted but reverted - breaks commitlint strict mode schema validation in commit-msg hook. <!-- Please make sure to read the Pull Request Guidelines: https://github.com/aws-amplify/amplify-cli/blob/master/CONTRIBUTING.md#pull-requests --> #### Description of changes <!-- Thank you for your Pull Request! Please provide a description above and review the requirements below. --> ##### CDK / CloudFormation Parameters Changed <!-- Please list any changes to the CDK/CFN params, with a link to references https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html e.g. * Conditionally added support for `Code` based AppSync Functions: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-appsync-functionconfiguration.html#cfn-appsync-functionconfiguration-code * Conditionally added support for `Code` based AppSync Resolvers: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-appsync-resolver.html#cfn-appsync-resolver-code --> #### Issue #, if available <!-- Also, please reference any associated PRs for documentation updates. --> #### Description of how you validated changes #### Checklist <!-- Remove items that do not apply. For completed items, change [ ] to [x]. --> - [ ] PR description included - [ ] `yarn test` passes - [ ] E2E test run linked - [ ] Tests are [changed or added](https://github.com/aws-amplify/amplify-cli/blob/master/CONTRIBUTING.md#tests) - [ ] Relevant documentation is changed or added (and PR referenced) - [ ] New AWS SDK calls or CloudFormation actions have been added to relevant test and service IAM policies - [ ] Any CDK or CloudFormation parameter changes are called out explicitly By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
1 parent c756f3f commit bddb2c8

40 files changed

Lines changed: 2798 additions & 2102 deletions

File tree

‎.agent-docs/DEPENDABOT.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,3 +102,8 @@ yarn e2e-monitor {batchId}
102102
- Group related updates together when possible
103103
- Document breaking changes in commit messages
104104
- Check for peer dependency conflicts after updates
105+
- Git commit hooks (husky pre-commit) run `yarn extract-dependency-licenses` which updates `dependency_licenses.txt`. Because the hook runs after staging, the updated file may not be included in the commit. **Always check `git status` after committing** for unstaged changes to `dependency_licenses.txt` and amend the commit if needed:
106+
```bash
107+
git add dependency_licenses.txt
108+
git commit --amend --no-edit
109+
```

‎.agent-docs/E2E_TESTING.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,10 @@ git checkout <your-branch>
9898
git stash pop
9999
```
100100

101+
## Success Criteria
102+
103+
A passing e2e run means **100% of tests pass with zero failures**. There is no "close enough" — if any test fails, the run has failed and the failures must be investigated and fixed. Do not dismiss failures as pre-existing or infrastructure-related without verifying on main and fixing them.
104+
101105
## Common Failure Patterns
102106

103107
| Pattern | Symptoms | Action |

‎dependency_licenses.txt‎

Lines changed: 22 additions & 22 deletions
Large diffs are not rendered by default.

‎package.json‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -450,7 +450,7 @@
450450
"**/jake/async": "^2.6.4",
451451
"**/nth-check": "^2.0.1",
452452
"aws-cdk-lib": "2.224.0",
453-
"lodash": "^4.17.23",
453+
"lodash": "^4.18.1",
454454
"node-fetch": "^2.6.7",
455455
"cross-fetch": "^2.2.6",
456456
"trim-newlines": "^3.0.1",
@@ -461,10 +461,10 @@
461461
"ejs": "^3.1.7",
462462
"json5": "^2.2.3",
463463
"semver": "^7.5.2",
464-
"axios": "^1.13.5",
464+
"axios": "^1.15.0",
465465
"braces": "^3.0.3",
466-
"**/aws-amplify/**/fast-xml-parser": "^5.5.2",
467-
"fast-xml-parser": "^5.5.2",
466+
"**/aws-amplify/**/fast-xml-parser": "~5.5.12",
467+
"@aws-sdk/core/@aws-sdk/xml-builder": "^3.972.15",
468468
"cookie": "^0.7.0",
469469
"@octokit/request-error": "^5.1.1",
470470
"@octokit/request": "^8.4.1",
@@ -476,7 +476,13 @@
476476
"js-yaml": "^4.1.1",
477477
"diff": "^8.0.3",
478478
"tmp": "^0.2.5",
479-
"basic-ftp": "^5.2.0"
479+
"basic-ftp": "^5.2.2",
480+
"lodash-es": "^4.18.1",
481+
"minimatch": "^3.1.5",
482+
"handlebars": "^4.7.9",
483+
"@xmldom/xmldom": "^0.9.9",
484+
"path-to-regexp": "^0.1.13",
485+
"brace-expansion": "^1.1.13"
480486
},
481487
"packageManager": "yarn@1.22.22+sha512.a6b2f7906b721bba3d67d4aff083df04dad64c399707841b7acf00f6b133b7ac24255f2652fa22ae3534329dc6180534e98d17432037ff6fd140556e2bb3137e"
482488
}

‎packages/amplify-data-construct/.jsii‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -9,24 +9,24 @@
99
"@aws-amplify/ai-constructs": "^1.6.1",
1010
"@aws-amplify/backend-output-schemas": "^1.0.0",
1111
"@aws-amplify/backend-output-storage": "^1.0.0",
12-
"@aws-amplify/graphql-auth-transformer": "4.2.5",
13-
"@aws-amplify/graphql-conversation-transformer": "1.1.13",
14-
"@aws-amplify/graphql-default-value-transformer": "3.1.15",
12+
"@aws-amplify/graphql-auth-transformer": "4.2.7",
13+
"@aws-amplify/graphql-conversation-transformer": "1.1.14",
14+
"@aws-amplify/graphql-default-value-transformer": "3.1.16",
1515
"@aws-amplify/graphql-directives": "2.8.0",
16-
"@aws-amplify/graphql-function-transformer": "3.1.17",
17-
"@aws-amplify/graphql-generation-transformer": "1.2.5",
18-
"@aws-amplify/graphql-http-transformer": "3.0.20",
19-
"@aws-amplify/graphql-index-transformer": "3.1.0",
20-
"@aws-amplify/graphql-maps-to-transformer": "4.0.20",
21-
"@aws-amplify/graphql-model-transformer": "3.4.0",
22-
"@aws-amplify/graphql-predictions-transformer": "3.0.20",
23-
"@aws-amplify/graphql-relational-transformer": "3.1.12",
24-
"@aws-amplify/graphql-searchable-transformer": "3.1.0",
25-
"@aws-amplify/graphql-sql-transformer": "0.4.20",
26-
"@aws-amplify/graphql-transformer": "2.4.0",
27-
"@aws-amplify/graphql-transformer-core": "3.5.0",
16+
"@aws-amplify/graphql-function-transformer": "3.1.18",
17+
"@aws-amplify/graphql-generation-transformer": "1.2.6",
18+
"@aws-amplify/graphql-http-transformer": "3.0.21",
19+
"@aws-amplify/graphql-index-transformer": "3.1.1",
20+
"@aws-amplify/graphql-maps-to-transformer": "4.0.22",
21+
"@aws-amplify/graphql-model-transformer": "3.4.1",
22+
"@aws-amplify/graphql-predictions-transformer": "3.0.21",
23+
"@aws-amplify/graphql-relational-transformer": "3.1.13",
24+
"@aws-amplify/graphql-searchable-transformer": "3.1.2",
25+
"@aws-amplify/graphql-sql-transformer": "0.4.21",
26+
"@aws-amplify/graphql-transformer": "2.4.2",
27+
"@aws-amplify/graphql-transformer-core": "3.5.1",
2828
"@aws-amplify/graphql-transformer-interfaces": "4.3.0",
29-
"@aws-amplify/graphql-validate-transformer": "1.1.5",
29+
"@aws-amplify/graphql-validate-transformer": "1.1.6",
3030
"@aws-amplify/platform-core": "^1.0.0",
3131
"@aws-amplify/plugin-types": "^1.0.0",
3232
"@aws-crypto/crc32": "5.2.0",
@@ -145,7 +145,7 @@
145145
"zod": "^3.22.2"
146146
},
147147
"dependencies": {
148-
"@aws-amplify/graphql-api-construct": "1.21.0",
148+
"@aws-amplify/graphql-api-construct": "1.21.2",
149149
"aws-cdk-lib": "^2.224.0",
150150
"constructs": "^10.3.0"
151151
},
@@ -8592,6 +8592,6 @@
85928592
}
85938593
},
85948594
"types": {},
8595-
"version": "1.17.0",
8596-
"fingerprint": "XQTfFtyRagbevfbYjx5v7BCyCW/jP4XSnhmmppM9OCE="
8595+
"version": "1.17.2",
8596+
"fingerprint": "CjaXiYUP5ydMk5+Q2+ANminVCU4VrEaFAfud5KNeIwY="
85978597
}

‎packages/amplify-e2e-core/package.json‎

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -22,21 +22,22 @@
2222
"clean": "rimraf ./lib"
2323
},
2424
"dependencies": {
25-
"@aws-sdk/client-amplifybackend": "3.828.0",
26-
"@aws-sdk/client-appsync": "3.827.0",
27-
"@aws-sdk/client-cloudformation": "3.828.0",
28-
"@aws-sdk/client-cognito-identity-provider": "3.826.0",
29-
"@aws-sdk/client-ec2": "3.624.0",
30-
"@aws-sdk/client-iam": "3.828.0",
31-
"@aws-sdk/client-kms": "3.624.0",
32-
"@aws-sdk/client-lambda": "3.828.0",
33-
"@aws-sdk/client-rds": "3.624.0",
34-
"@aws-sdk/client-rds-data": "3.624.0",
35-
"@aws-sdk/client-secrets-manager": "3.624.0",
36-
"@aws-sdk/client-ssm": "3.624.0",
37-
"@aws-sdk/client-sts": "3.624.0",
38-
"@aws-sdk/credential-providers": "3.624.0",
39-
"@aws-sdk/lib-dynamodb": "3.826.0",
25+
"@aws-sdk/client-amplifybackend": "^3.973.0",
26+
"@aws-sdk/client-appsync": "^3.973.0",
27+
"@aws-sdk/client-cloudformation": "^3.973.0",
28+
"@aws-sdk/client-cognito-identity-provider": "^3.973.0",
29+
"@aws-sdk/client-ec2": "^3.973.0",
30+
"@aws-sdk/client-iam": "^3.973.0",
31+
"@aws-sdk/client-kms": "^3.973.0",
32+
"@aws-sdk/client-lambda": "^3.973.0",
33+
"@aws-sdk/client-rds": "^3.973.0",
34+
"@aws-sdk/client-rds-data": "^3.973.0",
35+
"@aws-sdk/client-s3": "^3.973.0",
36+
"@aws-sdk/client-secrets-manager": "^3.973.0",
37+
"@aws-sdk/client-ssm": "^3.973.0",
38+
"@aws-sdk/client-sts": "^3.973.0",
39+
"@aws-sdk/credential-providers": "^3.973.0",
40+
"@aws-sdk/lib-dynamodb": "^3.973.0",
4041
"amplify-headless-interface": "^1.17.7",
4142
"axios": "^1.13.5",
4243
"chalk": "^4.1.1",

‎packages/amplify-e2e-tests/package.json‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "amplify-category-api-e2e-tests",
3-
"version": "4.1.13",
3+
"version": "4.1.12",
44
"description": "E2e test suite",
55
"repository": {
66
"type": "git",
@@ -27,20 +27,20 @@
2727
"@aws-amplify/amplify-app": "^5.0.35",
2828
"@aws-amplify/graphql-schema-generator": "0.11.14",
2929
"@aws-amplify/graphql-transformer-core": "3.5.1",
30-
"@aws-sdk/client-amplify": "^3.812.0",
31-
"@aws-sdk/client-appsync": "^3.812.0",
32-
"@aws-sdk/client-cloudformation": "^3.812.0",
33-
"@aws-sdk/client-codebuild": "^3.812.0",
34-
"@aws-sdk/client-cognito-identity-provider": "^3.812.0",
35-
"@aws-sdk/client-dynamodb": "^3.812.0",
36-
"@aws-sdk/client-iam": "^3.812.0",
37-
"@aws-sdk/client-organizations": "^3.812.0",
38-
"@aws-sdk/client-rds": "^3.812.0",
39-
"@aws-sdk/client-s3": "^3.812.0",
40-
"@aws-sdk/client-ssm": "^3.812.0",
41-
"@aws-sdk/client-sts": "^3.812.0",
42-
"@aws-sdk/credential-provider-node": "^3.812.0",
43-
"@aws-sdk/credential-providers": "3.828.0",
30+
"@aws-sdk/client-amplify": "^3.973.0",
31+
"@aws-sdk/client-appsync": "^3.973.0",
32+
"@aws-sdk/client-cloudformation": "^3.973.0",
33+
"@aws-sdk/client-codebuild": "3.812.0",
34+
"@aws-sdk/client-cognito-identity-provider": "^3.973.0",
35+
"@aws-sdk/client-dynamodb": "^3.973.0",
36+
"@aws-sdk/client-iam": "^3.973.0",
37+
"@aws-sdk/client-organizations": "^3.973.0",
38+
"@aws-sdk/client-rds": "^3.973.0",
39+
"@aws-sdk/client-s3": "^3.973.0",
40+
"@aws-sdk/client-ssm": "^3.973.0",
41+
"@aws-sdk/client-sts": "^3.973.0",
42+
"@aws-sdk/credential-provider-node": "^3.972.0",
43+
"@aws-sdk/credential-providers": "^3.973.0",
4444
"@smithy/util-retry": "^4.1.2",
4545
"amplify-category-api-e2e-core": "5.0.11",
4646
"aws-amplify": "^4.2.8",

‎packages/amplify-graphql-api-construct-tests/src/__tests__/backends/add-resources/app.ts‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
#!/usr/bin/env node
22

3-
import 'source-map-support/register';
43
import * as cdk from 'aws-cdk-lib';
54
import * as appsync from 'aws-cdk-lib/aws-appsync';
65
// @ts-ignore

‎packages/amplify-graphql-api-construct-tests/src/__tests__/backends/admin-role/app.ts‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
#!/usr/bin/env node
2-
import 'source-map-support/register';
32
import { App, Stack, Duration, RemovalPolicy, CfnOutput } from 'aws-cdk-lib';
43
import { Role, PolicyDocument, PolicyStatement, ServicePrincipal, Effect } from 'aws-cdk-lib/aws-iam';
54
import { UserPool, UserPoolClient } from 'aws-cdk-lib/aws-cognito';

‎packages/amplify-graphql-api-construct-tests/src/__tests__/backends/all-auth-modes/app.ts‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
#!/usr/bin/env node
2-
import 'source-map-support/register';
32
import { App, Stack, Duration } from 'aws-cdk-lib';
43
import { Role, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
54
import { UserPool, CfnIdentityPool } from 'aws-cdk-lib/aws-cognito';

0 commit comments

Comments
 (0)