Skip to content

Commit 56f9ae8

Browse files
authored
fix: remove unused aws-lambda package to eliminate aws-sdk v2 dependency (github-aws-runners#5088)
## Summary The `aws-lambda` npm package ([npmjs.com/package/aws-lambda](https://www.npmjs.com/package/aws-lambda)) is a CLI deploy tool last published in November 2021. It is listed as a production dependency in `webhook` and `aws-powertools-util`, but **is not used anywhere at runtime**. Every `import` from `'aws-lambda'` in the codebase (e.g. `import { Context, SQSEvent } from 'aws-lambda'`) resolves to `@types/aws-lambda` — TypeScript type definitions that are erased at compile time. `@types/aws-lambda` is already correctly declared as a `devDependency` in all packages that use it. ### Why this matters The `aws-lambda` package transitively depends on `aws-sdk@^2.814.0` (v2), which reached end-of-support on September 8, 2025. Advisory [GHSA-j965-2qgj-vjmq](GHSA-j965-2qgj-vjmq) flags all of aws-sdk v2 with no patch available — the only remediation is migrating to v3. This causes the **Dependency vulnerability scan** to fail on any PR that modifies the lockfile enough to trigger a dependency graph rebuild. ### What this PR does - Removes `aws-lambda` from `dependencies` in `lambdas/functions/webhook/package.json` and `lambdas/libs/aws-powertools-util/package.json` - Regenerates `yarn.lock`, eliminating `aws-sdk` v2 and its transitive dependency tree from the lockfile ### What this PR does NOT do - Does not change any source code — no runtime behavior changes - Does not remove `@types/aws-lambda` (the TypeScript types) — those remain as devDependencies ## Test plan - [x] All 352 tests pass (`yarn test` across all 7 projects) - [x] Dependency vulnerability scan should now pass (no more aws-sdk v2 in the dependency graph)
1 parent c00d4c2 commit 56f9ae8

3 files changed

Lines changed: 8 additions & 293 deletions

File tree

lambdas/functions/webhook/package.json

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,7 @@
3434
"@middy/core": "^6.4.5",
3535
"@octokit/rest": "22.0.1",
3636
"@octokit/types": "^16.0.0",
37-
"@octokit/webhooks": "^14.2.0",
38-
"aws-lambda": "^1.0.7"
37+
"@octokit/webhooks": "^14.2.0"
3938
},
4039
"nx": {
4140
"includedScripts": [

lambdas/libs/aws-powertools-util/package.json

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,7 @@
2222
"dependencies": {
2323
"@aws-lambda-powertools/logger": "^2.31.0",
2424
"@aws-lambda-powertools/metrics": "^2.31.0",
25-
"@aws-lambda-powertools/tracer": "^2.31.0",
26-
"aws-lambda": "^1.0.7"
25+
"@aws-lambda-powertools/tracer": "^2.31.0"
2726
},
2827
"nx": {
2928
"includedScripts": [

0 commit comments

Comments
 (0)