From 7f15e8635ed424db91bd4eec3670c8eb8084a2cd Mon Sep 17 00:00:00 2001
From: Laxman Reddy Aileni <laileni@amazon.com>
Date: Mon, 20 Jul 2026 21:39:51 +0000
Subject: [PATCH] deps: bump adm-zip to 0.6.0 to patch high-severity advisory
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Problem:
adm-zip ^0.5.10 (in packages/core) has an open high-severity Dependabot
advisory (alerts #249, #250). The root build scripts (scripts/lspArtifact.ts)
import adm-zip but only relied on it being hoisted from packages/core.

Solution:
- Bump adm-zip to ^0.6.0 in packages/core.
- Declare adm-zip ^0.6.0 (+ @types/adm-zip) in the root package.json, since
  the root build scripts import it directly — this keeps it resolvable at the
  root regardless of workspace hoisting (fixes "Cannot find module 'adm-zip'"
  during packaging).
- Regenerate the lockfile.

Other open alerts (uuid, @opentelemetry/core, @smithy/config-resolver —
multiple coexisting versions; aws-sdk, elliptic — no patch) are deferred for
scoped human review.
---
 package-lock.json          | 10 +++++++---
 package.json               |  2 ++
 packages/core/package.json |  2 +-
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 183e340f4..eb20eefaf 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -25,6 +25,7 @@
                 "@aws-toolkits/telemetry": "^1.0.341",
                 "@playwright/browser-chromium": "^1.43.1",
                 "@stylistic/eslint-plugin": "^2.11.0",
+                "@types/adm-zip": "^0.4.34",
                 "@types/he": "^1.2.3",
                 "@types/jaro-winkler": "^0.2.4",
                 "@types/vscode": "^1.68.0",
@@ -36,6 +37,7 @@
                 "@vscode/test-electron": "^2.3.8",
                 "@vscode/test-web": "^0.0.65",
                 "@vscode/vsce": "^2.19.0",
+                "adm-zip": "^0.6.0",
                 "eslint": "^8.56.0",
                 "eslint-config-prettier": "^9.1.0",
                 "eslint-plugin-aws-toolkits": "file:plugins/eslint-plugin-aws-toolkits",
@@ -26424,10 +26426,12 @@
             }
         },
         "node_modules/adm-zip": {
-            "version": "0.5.10",
+            "version": "0.6.0",
+            "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.6.0.tgz",
+            "integrity": "sha512-XleryMhbuksdKtofnWZ9Sk+4CUTbms4Mb/EU32SZwToAyZ5RgVos/ki8n+yr0LWHOGKuakbXTuuYNHLQjhddgg==",
             "license": "MIT",
             "engines": {
-                "node": ">=6.0"
+                "node": ">=14.0"
             }
         },
         "node_modules/agent-base": {
@@ -38887,7 +38891,7 @@
                 "@svgdotjs/svg.js": "^3.0.16",
                 "@vscode/debugprotocol": "^1.57.0",
                 "@zip.js/zip.js": "^2.7.41",
-                "adm-zip": "^0.5.10",
+                "adm-zip": "^0.6.0",
                 "amazon-states-language-service": "^1.16.1",
                 "async-lock": "^1.4.0",
                 "aws-sdk": "^2.1692.0",
diff --git a/package.json b/package.json
index 99d907e29..5b687dd9f 100644
--- a/package.json
+++ b/package.json
@@ -45,6 +45,7 @@
         "@aws-toolkits/telemetry": "^1.0.341",
         "@playwright/browser-chromium": "^1.43.1",
         "@stylistic/eslint-plugin": "^2.11.0",
+        "@types/adm-zip": "^0.4.34",
         "@types/he": "^1.2.3",
         "@types/jaro-winkler": "^0.2.4",
         "@types/vscode": "^1.68.0",
@@ -56,6 +57,7 @@
         "@vscode/test-electron": "^2.3.8",
         "@vscode/test-web": "^0.0.65",
         "@vscode/vsce": "^2.19.0",
+        "adm-zip": "^0.6.0",
         "eslint": "^8.56.0",
         "eslint-config-prettier": "^9.1.0",
         "eslint-plugin-aws-toolkits": "file:plugins/eslint-plugin-aws-toolkits",
diff --git a/packages/core/package.json b/packages/core/package.json
index 7b95bdac0..76efb3189 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -636,7 +636,7 @@
         "@svgdotjs/svg.js": "^3.0.16",
         "@vscode/debugprotocol": "^1.57.0",
         "@zip.js/zip.js": "^2.7.41",
-        "adm-zip": "^0.5.10",
+        "adm-zip": "^0.6.0",
         "amazon-states-language-service": "^1.16.1",
         "async-lock": "^1.4.0",
         "aws-sdk": "^2.1692.0",