Description

#3327 added package extensions in .yarnrc.yml for @aws-sdk to satisfy peer dependencies transitively required by @aws-sdk/client-s3.

With newer versions of the AWS SDK (updated in #5098), these extensions are no longer necessary because the credential packages used by @aws-sdk/client-s3 no longer declare peer dependencies on @aws-sdk/client-sts and @aws-sdk/client-sso-oidc.

Furthermore, these extensions are keeping around an old vulnerable version of fast-xml-parser which prevents https://github.com/smartcontractkit/external-adapters-js/security/dependabot/421 from being fixed.

Changes

yq -i '
  del(.packageExtensions."@aws-sdk/credential-provider-ini@*") |
  del(.packageExtensions."@aws-sdk/credential-provider-web-identity@*") |
  del(.packageExtensions."@aws-sdk/token-providers@*")
' .yarnrc.yml

yarn

1. Remove the 3 @aws-sdk package extensions from .yarnrc.yml.
2. Run yarn.

Steps to Test

git checkout 23ceaae1d1~1
yq -i '
  del(.packageExtensions."@aws-sdk/credential-provider-ini@*") |
  del(.packageExtensions."@aws-sdk/credential-provider-web-identity@*") |
  del(.packageExtensions."@aws-sdk/token-providers@*")
' .yarnrc.yml
yarn
# Notice that this fails:
yarn bundle packages/sources/s3-csv-reader -o packages/sources/s3-csv-reader/bundle

# Error: Module not found: Error: @aws-sdk/credential-provider-ini tried to access @aws-sdk/client-sts (a peer dependency) but it isn't provided by its ancestors; this makes the require call ambiguous and unsound.
# ... etc.

grep fast-xml-parser yarn.lock   # includes vulnerable version 4.4.1

# Try the same at 23ceaae1d1 and notice that it passes.
git reset --hard HEAD
git checkout 23ceaae1d1
yq -i '
  del(.packageExtensions."@aws-sdk/credential-provider-ini@*") |
  del(.packageExtensions."@aws-sdk/credential-provider-web-identity@*") |
  del(.packageExtensions."@aws-sdk/token-providers@*")
' .yarnrc.yml
yarn
yarn bundle packages/sources/s3-csv-reader -o packages/sources/s3-csv-reader/bundle
grep fast-xml-parser yarn.lock   # expect only 5.7.3

Quality Assurance

• If a new adapter was made, or an existing one was modified so that its environment variables have changed, update the relevant infra-k8s configuration file.
• If a new adapter was made, or an existing one was modified so that its environment variables have changed, update the relevant adapter-secrets configuration file.
• If a new adapter was made, or a new endpoint was added, update the test-payload.json file with relevant requests.
• The branch naming follows git flow (feature/x, chore/x, release/x, hotfix/x, fix/x) or is created from Jira.
• This is related to a maximum of one Jira story or GitHub issue.
• Types are safe (avoid TypeScript/TSLint features like any and disable, instead use more specific types).
• All code changes have 100% unit and integration test coverage. If testing is not applicable or too difficult to justify doing, the reasoning should be documented explicitly in the PR.