Conversation
Merge latest release to main
- fast-xml-parser ^5.5.2 -> ^5.5.7 (CVE-2026-26278, entity bypass, DoS, stack overflow) - Added minimatch ^3.1.5 resolution (ReDoS across nx, api-extractor, etc.) - Added lodash-es ^4.17.23 resolution (prototype pollution) Addresses alerts: #295, #294, #302, #307-310, #236, #273-275, #282-285, #290, #292 Note: ajv ^8.18.0 resolution attempted but reverted - breaks commitlint strict mode schema validation in commit-msg hook. <!-- Please make sure to read the Pull Request Guidelines: https://github.com/aws-amplify/amplify-cli/blob/master/CONTRIBUTING.md#pull-requests --> #### Description of changes <!-- Thank you for your Pull Request! Please provide a description above and review the requirements below. --> ##### CDK / CloudFormation Parameters Changed <!-- Please list any changes to the CDK/CFN params, with a link to references https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html e.g. * Conditionally added support for `Code` based AppSync Functions: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-appsync-functionconfiguration.html#cfn-appsync-functionconfiguration-code * Conditionally added support for `Code` based AppSync Resolvers: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-appsync-resolver.html#cfn-appsync-resolver-code --> #### Issue #, if available <!-- Also, please reference any associated PRs for documentation updates. --> #### Description of how you validated changes #### Checklist <!-- Remove items that do not apply. For completed items, change [ ] to [x]. --> - [ ] PR description included - [ ] `yarn test` passes - [ ] E2E test run linked - [ ] Tests are [changed or added](https://github.com/aws-amplify/amplify-cli/blob/master/CONTRIBUTING.md#tests) - [ ] Relevant documentation is changed or added (and PR referenced) - [ ] New AWS SDK calls or CloudFormation actions have been added to relevant test and service IAM policies - [ ] Any CDK or CloudFormation parameter changes are called out explicitly By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
#3473) ## Description Fixes aws-amplify/amplify-backend#3158 ### Problem `npm ci` fails with "Missing from lock file" errors after `npm install` when using `@aws-amplify/backend`. The root cause is that `bundledDependencies` in `@aws-amplify/data-construct` and `@aws-amplify/graphql-api-construct` is missing transitive dependencies of bundled packages. These missing deps get hoisted during `npm install` but aren't captured in `package-lock.json`, causing `npm ci` to fail. ### Changes **Added 6 missing transitive deps** to `bundledDependencies`, `dependencies`, and `nohoist` in both construct packages: | Package | Required by | |---|---| | `@aws-sdk/eventstream-handler-node` | `@aws-sdk/client-bedrock-runtime@^3.622.0` | | `@aws-sdk/middleware-eventstream` | `@aws-sdk/client-bedrock-runtime@^3.622.0` | | `json-schema-to-ts` | `@aws-amplify/ai-constructs` | | `ts-algebra` | `json-schema-to-ts` | | `@babel/runtime` | `json-schema-to-ts` | | `regenerator-runtime` | `@babel/runtime` | **Removed `json-schema-to-ts` exclusion** from `verify-construct-dependencies.ts` since it now needs to be bundled. **Added regression test** to `verify_amplify_backend_compatability`: checks that every dependency of every bundled package is itself listed in `bundledDependencies`. This catches the exact class of bug from aws-amplify/amplify-backend#3158. ### Testing **Red/green verified** — regression test reproduces the original issue on unfixed code and passes with the fix: - ❌ **Red** ([diff vs main](main...red/npm-ci-regression-test)) — main + regression test only, no fix → `verify_amplify_backend_compatability` fails ([CodeBuild](https://us-east-1.console.aws.amazon.com/codesuite/codebuild/594813022831/projects/amplify-category-api-pr-workflow/batch/amplify-category-api-pr-workflow:2b4825e4-c32c-492d-8575-10c8811480b5?region=us-east-1)): ``` ERROR: Missing bundled transitive dependencies: @aws-amplify/data-construct: @aws-amplify/ai-constructs requires json-schema-to-ts (not bundled) @aws-amplify/data-construct: @aws-sdk/client-bedrock-runtime requires @aws-sdk/eventstream-handler-node (not bundled) @aws-amplify/data-construct: @aws-sdk/client-bedrock-runtime requires @aws-sdk/middleware-eventstream (not bundled) @aws-amplify/graphql-api-construct: @aws-amplify/ai-constructs requires json-schema-to-ts (not bundled) @aws-amplify/graphql-api-construct: @aws-sdk/client-bedrock-runtime requires @aws-sdk/eventstream-handler-node (not bundled) @aws-amplify/graphql-api-construct: @aws-sdk/client-bedrock-runtime requires @aws-sdk/middleware-eventstream (not bundled) ``` - ✅ **Green** ([this PR](https://github.com/aws-amplify/amplify-category-api/pull/3473/files)) — fix + regression test → all 11 PR checks pass ([CodeBuild](https://us-east-1.console.aws.amazon.com/codesuite/codebuild/594813022831/projects/amplify-category-api-pr-workflow/batch/amplify-category-api-pr-workflow:b51e221f-235c-4f42-8e2d-8e38a9aab9f1?region=us-east-1)) - ✅ **E2E tests**: ([CodeBuild](https://tiny.amazon.com/1dvh9bk5w/IsenLink)) (cleanup failing as expected still; all tests passing)
adrianjoshua-strutt
approved these changes
May 4, 2026
svidgen
approved these changes
May 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of changes
CDK / CloudFormation Parameters Changed
Issue #, if available
Description of how you validated changes
Checklist
yarn testpassesBy submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.