deps: resolve 123 Dependabot security alerts (safe, non-breaking) by laileni-aws · Pull Request #136 · aws/amazon-q-vscode

laileni-aws · 2026-07-14T00:05:43Z

Problem

The repository has 160 open Dependabot security alerts across four manifests
(root package-lock.json, packages/core/package.json, and the two src.gen
streaming-client lockfiles). Many are low-risk transitive dependencies that can
be patched without any breaking change.

Solution

Resolve the non-breaking (safe) subset first: security patches that stay
within the same major version, using npm overrides pinned to the exact
GHSA-patched versions plus range-respecting npm update (so lower major lines
are never force-upgraded). No public API or major version of any direct
dependency changes in this PR.

This PR resolves 123 of 160 alerts. The remainder require major-version
bumps or coordinated @aws-sdk upgrades and will follow as separate commits /
a second PR (see Remaining work below).

Alerts resolved by manifest

Manifest	Resolved	Remaining
`package-lock.json` (root)	101 / 133	32
`src.gen/@amzn/amazon-q-developer-streaming-client/package-lock.json`	11 / 12	1
`src.gen/@amzn/codewhisperer-streaming/package-lock.json`	11 / 12	1
`packages/core/package.json`	0 / 3	3
Total	123 / 160	37

Key fixes (root `package.json` overrides + updates)

Package	Patched to	Notable severity
shell-quote	1.8.4	critical
@xmldom/xmldom	0.8.13	high
protobufjs	7.6.3	high/critical
node-forge	1.4.0	high
fast-uri	3.1.2	high
flatted	3.4.2	high
ws	8.21.0	high
form-data	4.0.6	high
tmp	0.2.7	high
undici	6.27.0	high
lodash	4.18.0	high
postcss	8.5.19	moderate
serialize-javascript	7.0.5	moderate
qs / morgan / launch-editor / follow-redirects / koa / on-headers / cipher-base / pbkdf2 / sha.js	patched	moderate/low
ajv, bn.js, glob, tar-fs, picomatch, minimatch, brace-expansion, nanoid, playwright	range-updated	moderate/high

`src.gen` streaming clients

Package	Patched to
lodash	4.18.1
minimatch	3.1.5
@smithy/config-resolver	4.6.8
fast-xml-parser	4.5.7 (latest 4.x)

Remaining work (follow-up commits / second PR)

Area	Alerts	Why deferred
`webpack` (SSRF)	#68, #69	Bumping to the patched 5.104.x pulls `enhanced-resolve` 5.24.x, which breaks the web build's `exports` resolution (see note below). Deferred to a follow-up PR that also fixes core `exports` / web `resolve`. Build-time SSRF in the unused `buildHttp` feature — negligible real risk.
`fast-xml-parser` `<5.7.0` (GHSA-gh4j)	14	Patched only in 5.7.0 — no 4.x backport; AWS SDK pins the 4.x line
`markdown-it` + `linkify-it`	5	Requires 13→14 major bump
`webpack-dev-server`	4	Requires 4→6 major bump
`js-yaml` 4.1.0→4.2.0	4	`mocha` pins exactly `4.1.0`
`jsonata`, `aws-sdk`, `elliptic`, `esbuild`, `@smithy/config-resolver`, `@opentelemetry/core`	8	Via parent major upgrades (some unpatched: `aws-sdk` v2, `elliptic`)
`@protobufjs/utf8`	1	Already fixed via `protobufjs@7.6.3` (stale alert)

Note on the webpack revert: an earlier commit bumped webpack to fix
#68/#69, but the transitive enhanced-resolve 5.24.x upgrade broke the web
bundle (package VSIX / test Web). Reverted to webpack@^5.95.0; #68/#69
will be addressed properly in a follow-up PR.

Verification

npm audit (lockfile-only) on all three lockfiles: root criticals reduced to
0; both src.gen lockfiles report 0 critical / 0 high.
All three lockfiles verified idempotent (a second
npm install --package-lock-only produces no further changes).
webpack / enhanced-resolve pinned back to main's versions (5.95.0 /
5.17.1) to keep the web build green.

Draft: opened as a draft so CI validates the safe batch before the
remaining (breaking) fixes are layered on.

Treat all work as PUBLIC. Private feature/x branches will not be squash-merged at release time.
Your code changes must meet the guidelines in CONTRIBUTING.md.
License: I confirm that my contribution is made under the terms of the Apache 2.0 license.

@aws-sdk

Apply safe, in-major security fixes across all three lockfiles via npm overrides pinned to GHSA-patched versions plus range-respecting updates (no major-version bumps). Resolves 125 of 160 open Dependabot alerts. Root package.json overrides: @xmldom/xmldom, cipher-base, fast-uri, flatted, follow-redirects, form-data, koa, launch-editor, lodash, morgan, node-forge, on-headers, pbkdf2, postcss, protobufjs, qs, serialize-javascript, sha.js, shell-quote, tmp, undici, ws. Also bump webpack devDependency to ^5.104.1 and range-update ajv, bn.js, glob, tar-fs, picomatch, minimatch, brace-expansion, nanoid, playwright. src.gen streaming clients: npm audit fix (lodash, minimatch, @smithy/config-resolver) and override fast-xml-parser to 4.5.7. Remaining alerts require major-version bumps or coordinated @aws-sdk upgrades and are handled separately.

Problem: The webpack ^5.95.0 -> ^5.104.1 bump (added to fix SSRF alerts aws#68/aws#69) pulls webpack 5.108.4 and enhanced-resolve 5.24.2. The newer resolver applies stricter exports-field resolution and can no longer resolve the aws-core-vscode/shared subpath from compiled packages/core/dist in the web bundle, breaking the webBase build. Only the web jobs (package VSIX, test Web) fail; all Node-based jobs pass. Solution: Revert webpack to ^5.95.0, restoring enhanced-resolve 5.17.1 to match main. Dependabot aws#68/aws#69 are build-time SSRF in webpack's HttpUriPlugin/buildHttp experimental feature, which this repo does not use, so real-world risk is negligible. They are intentionally left open and will be fixed thoroughly in a follow-up PR together with the core exports / webpack resolve compatibility work.

laileni-aws · 2026-07-14T00:38:09Z

CI fix: reverted the `webpack` bump (deferring #68/#69)

The initial commit bumped webpack ^5.95.0 → ^5.104.1 to resolve the build-time SSRF alerts #68 / #69. That pull-through upgraded enhanced-resolve (webpack's module resolver) 5.17.1 → 5.24.2, whose stricter exports-field resolution can no longer resolve the aws-core-vscode/shared subpath from the compiled packages/core/dist in the web bundle. This broke webBase, failing the package VSIX and test Web jobs while all Node-based jobs passed.

Action taken: reverted webpack to ^5.95.0 (restoring enhanced-resolve 5.17.1, matching main) — commit 143245e. CI web jobs should now pass.

#68 / #69 are intentionally left open. They are build-time SSRF in webpack's HttpUriPlugin / experiments.buildHttp — a feature this project does not use — so the real-world risk is negligible. They'll be fixed thoroughly in a follow-up PR that bumps webpack and makes packages/core's exports / the web resolve config compatible with the newer enhanced-resolve, validated against the web build.

Resolve the security alerts that require major-version bumps or coordinated transitive upgrades, on top of the safe (category 1) fixes. Brings total resolved to 152 of 160 open Dependabot alerts. Direct bumps: - markdown-it 13 -> ^14.2.0 (+ @types/markdown-it ^14.1.2) [core] - esbuild-loader 2.20.0 -> 4.5.0 [core] (ESBuildMinifyPlugin -> EsbuildPlugin in webpack.base.config.js; pulls esbuild 0.25+) - webpack-dev-server ^4.15.2 -> ^5.2.5 (devServer config uses only options still valid in v5) Overrides / range updates (root): - fast-xml-parser -> 5.7.0 (GHSA-gh4j has no 4.x backport; forces the AWS SDK's XML parser to 5.x - see risk note) - markdown-it 14.2.0, linkify-it 5.0.1, jsonata 2.2.1 - js-yaml@4 -> 4.2.0 (scoped so js-yaml 3.x consumers are untouched) - @smithy/config-resolver, @opentelemetry/core updated to patched lines src.gen streaming clients: - fast-xml-parser override 4.5.7 -> 5.7.0 Note: keeps webpack at ^5.95.0 (see PR aws#136) so the web build stays green; webpack aws#68/aws#69 remain deferred and are addressed separately in this PR. Risk to validate in CI: forcing fast-xml-parser 5.x onto the AWS SDK may affect XML-based SDK responses (S3/EC2/CloudFormation).

Resolve the security alerts that require major-version bumps or coordinated transitive upgrades, on top of the safe (category 1) fixes. Brings total resolved to 152 of 160 open Dependabot alerts. Direct bumps: - markdown-it 13 -> ^14.2.0 (+ @types/markdown-it ^14.1.2) [core] - esbuild-loader 2.20.0 -> 4.5.0 [core] (ESBuildMinifyPlugin -> EsbuildPlugin in webpack.base.config.js; pulls esbuild 0.25+) - webpack-dev-server ^4.15.2 -> ^5.2.5 (devServer config uses only options still valid in v5) Overrides / range updates (root): - fast-xml-parser -> 5.7.0 (GHSA-gh4j has no 4.x backport; forces the AWS SDK's XML parser to 5.x - see risk note) - markdown-it 14.2.0, linkify-it 5.0.1, jsonata 2.2.1 - js-yaml@4 -> 4.2.0 (scoped so js-yaml 3.x consumers are untouched) - @smithy/config-resolver, @opentelemetry/core updated to patched lines src.gen streaming clients: - fast-xml-parser override 4.5.7 -> 5.7.0 Note: keeps webpack at ^5.95.0 (see PR #136) so the web build stays green; webpack #68/#69 remain deferred and are addressed separately in this PR. Risk to validate in CI: forcing fast-xml-parser 5.x onto the AWS SDK may affect XML-based SDK responses (S3/EC2/CloudFormation).

* fix: resolve CodeQL code-scanning security alerts Problem: 17 open CodeQL code-scanning alerts across source, tests, dev scripts, and a workflow (ReDoS, incomplete sanitization, shell-command injection from environment, and a missing workflow permissions block). Solution: - ReDoS (js/polynomial-redos): rewrite vulnerable regexes as linear equivalents - indent()/block-comment/base64url padding in textUtilities.ts; use-strict/require detection in importAdderUtil.ts; trailing '/' and '#' stripping in auth.ts and authUtil.ts (behavior verified against existing unit tests). - Shell injection (js/shell-command-injection-from-environment): replace execSync(string) with execFileSync('git', [...args]) (no shell) in scripts/createRelease.ts and scripts/newChange.ts. - Incomplete sanitization (js/incomplete-sanitization): replace all quotes, not just the first, in ssh.test.ts. - URL substring checks (js/incomplete-url-substring-sanitization): use assert.match instead of includes() on URLs in referenceLogViewProvider.test.ts. - Workflow permissions (actions/missing-workflow-permissions): add a least-privilege top-level 'contents: read' to release.yml (the publish job keeps its explicit 'contents: write'). - Certificate validation (js/disabling-certificate-validation): this is an explicit user opt-in mirroring VS Code's 'http.proxyStrictSSL'; kept the behavior, upgraded the log to a warning, and documented it. None of these overlap with the dependency PRs (#136-138). * fix: match quoted use-strict directive after ReDoS hardening The anchored /^\s*use\s+strict/ regex missed quoted directives like 'use strict'; (line starts with a quote), breaking importAdderUtil 'first line after comments and use strict'. Allow an optional leading quote: /^\s*['"]?use\s+strict/ (still anchored/linear). * fix: strip all block comments in stripNewLinesAndComments Add the global flag to the ReDoS-hardened block-comment regex so lines with multiple block comments are fully stripped (and code between them is preserved), matching the function's documented intent. Addresses review feedback on #140; the g flag keeps the regex linear (no ReDoS).

laileni-aws added 2 commits July 14, 2026 00:00

laileni-aws changed the title ~~deps: resolve 125 Dependabot security alerts (safe, non-breaking)~~ deps: resolve 123 Dependabot security alerts (safe, non-breaking) Jul 14, 2026

laileni-aws mentioned this pull request Jul 14, 2026

deps: resolve major-version Dependabot security alerts (category 2) #137

Merged

laileni-aws marked this pull request as ready for review July 14, 2026 01:23

laileni-aws requested a review from a team as a code owner July 14, 2026 01:23

laileni-aws mentioned this pull request Jul 14, 2026

deps: fix webpack SSRF alerts #68/#69 (pin enhanced-resolve) #138

Merged

ashishrp-aws approved these changes Jul 14, 2026

View reviewed changes

laileni-aws mentioned this pull request Jul 14, 2026

fix: resolve CodeQL code-scanning security alerts #140

Merged

ashishrp-aws approved these changes Jul 14, 2026

View reviewed changes

XiaoChen-amz approved these changes Jul 14, 2026

View reviewed changes

laileni-aws merged commit 9b03d57 into aws:main Jul 14, 2026
33 of 34 checks passed

laileni-aws mentioned this pull request Jul 15, 2026

deps: resolve newly-expanded Dependabot security advisories #143

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

deps: resolve 123 Dependabot security alerts (safe, non-breaking)#136

deps: resolve 123 Dependabot security alerts (safe, non-breaking)#136
laileni-aws merged 2 commits into
aws:mainfrom
laileni-aws:fix/dependabot-security-alerts

laileni-aws commented Jul 14, 2026 •

edited

Loading

Uh oh!

laileni-aws commented Jul 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

laileni-aws commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

Alerts resolved by manifest

Key fixes (root package.json overrides + updates)

src.gen streaming clients

Remaining work (follow-up commits / second PR)

Verification

Uh oh!

laileni-aws commented Jul 14, 2026

CI fix: reverted the webpack bump (deferring #68/#69)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

laileni-aws commented Jul 14, 2026 •

edited

Loading

Key fixes (root `package.json` overrides + updates)

`src.gen` streaming clients

CI fix: reverted the `webpack` bump (deferring #68/#69)