Conversation
- fast-xml-parser ^5.5.2 -> ^5.5.7 (CVE-2026-26278, entity bypass, DoS, stack overflow) - Added minimatch ^3.1.5 resolution (ReDoS across nx, api-extractor, etc.) - Added lodash-es ^4.17.23 resolution (prototype pollution) Addresses alerts: #295, #294, #302, #307-310, #236, #273-275, #282-285, #290, #292 Note: ajv ^8.18.0 resolution attempted but reverted - breaks commitlint strict mode schema validation in commit-msg hook. Build: 27 packages pass Tests: 25 packages pass
svidgen
force-pushed
the
wirejs/dbots-2026-03-19
branch
2 times, most recently
from
6f89ece to
dc21c6e
Compare
…ty expansion limit Upgrade @aws-sdk/* client packages in e2e/test packages to ^3.973.0. This pulls in @aws-sdk/core@3.973.23 which delegates XML parsing to @aws-sdk/xml-builder@3.972.15, properly configuring maxTotalExpansions: Infinity for AWS service responses. Also add @aws-sdk/xml-builder resolution override to ensure the fixed version is used globally, since the construct packages hoist an older version that lacks the parseXML export. This resolves 'Entity expansion limit exceeded' errors caused by fast-xml-parser 5.5.7's new default limit of 1000 entity expansions.
svidgen
force-pushed
the
wirejs/dbots-2026-03-19
branch
from
dc21c6e to
08b0a46
Compare
Resolve conflicts in test package.json files: keep upgraded AWS SDK versions (^3.973.0) from our branch, take main's internal package version bumps.
- Merge 7 commits from main including E2E stability fixes and Node 22 compat - Bump axios ^1.13.5 -> ^1.15.0 (SSRF + header injection CVEs) - Bump basic-ftp ^5.2.0 -> ^5.2.2 (CRLF injection CVEs) - Bump lodash ^4.17.23 -> ^4.18.1 (code injection + prototype pollution) - Bump lodash-es ^4.17.23 -> ^4.18.1 (code injection + prototype pollution) - Add handlebars ^4.7.9 resolution (JS injection + DoS CVEs) - Add @xmldom/xmldom ^0.9.9 resolution (XML injection CVE) - Add path-to-regexp ^0.1.13 resolution (ReDoS CVE) - Add brace-expansion ^1.1.13 resolution (DoS CVE)
…ilures - Remove source-map-support/register import from all 31 CDK backend app.ts templates — CDK init template no longer includes this dep, and Node 22 has built-in source map support - Bump fast-xml-parser resolution ^5.5.7 -> ~5.5.12 to fix entity expansion limit exceeded errors (default changed to Infinity in 5.5.10) and address CVE-2026-33036 - Update e2e testing docs: 100% pass rate required, no exceptions
…on limit The unscoped resolution forced fast-xml-parser 5.5.x onto the AWS SDK which expects 4.4.1. Version 5.x introduced entity expansion limits (default 1000) that break CloudFormation XML parsing for large stacks. Keep the scoped **/aws-amplify/** resolution for construct packages while letting the AWS SDK resolve its own compatible version.
Member
Author
|
One failure on e2e tests is cleanup. Acceptable failure. Waiting on PR checks. https://tiny.amazon.com/m3y5ad8n/IsenLink |
Simone319
approved these changes
Apr 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses alerts: #295, #294, #302, #307-310, #236, #273-275, #282-285, #290, #292
Note: ajv ^8.18.0 resolution attempted but reverted - breaks commitlint strict mode schema validation in commit-msg hook.
Description of changes
CDK / CloudFormation Parameters Changed
Issue #, if available
Description of how you validated changes
Checklist
yarn testpassesBy submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.