fix: resolve fast-xml-parser HIGH/CRITICAL vulnerabilities - #3477
Merged
Conversation
…ties Upgrades AWS SDK client packages and adds a resolution to eliminate vulnerable fast-xml-parser versions (4.4.1, 5.2.5, 5.5.2) from the dependency tree. Changes: - Broadened fast-xml-parser resolution to force all instances to ~5.5.12 - Updated @aws-sdk/core, @aws-sdk/xml-builder and related packages in amplify-data-construct and amplify-graphql-api-construct - Upgraded direct fast-xml-parser dep from 5.5.2 to ~5.5.12 in constructs - Upgraded AWS SDK clients in test packages to ^3.973.0 After these changes, yarn.lock contains only fast-xml-parser@5.5.12 (safe, >= 5.5.6) with no vulnerable versions remaining.
Remove stale lockfile entries for @aws-sdk packages in the 3.775.x and 3.810.x version families that declared fast-xml-parser 4.4.1. These came from aws-appsync@4.1.10 (via @aws-sdk/client-s3@^3.25.0 resolved to 3.779.0) and @aws-cdk/toolkit-lib@1.16.0 (via @aws-sdk/client-*@^3 resolved to 3.810.0). After removal, yarn install re-resolved these ranges to the latest compatible versions which use @aws-sdk/core >= 3.974.8 (no fast-xml-parser dependency). Remaining: @aws-sdk/core@3.622.0 from @aws-amplify/ai-constructs@1.6.1 still declares fast-xml-parser 4.4.1, but the resolution forces it to 5.5.12. This will be addressed separately.
svidgen
approved these changes
May 11, 2026
|
Got this warning as well. It would be nice if that fix is merged ASAP |
Main yarn.lock: - fast-xml-parser ~5.5.12 → ~5.7.2 (resolves to 5.7.3) - fast-xml-builder 1.1.4 → 1.2.0 - axios 1.15.0 → 1.16.1 - @xmldom/xmldom 0.9.9 → 0.9.10 - basic-ftp 5.2.2 → 6.0.1 - picomatch 2.3.1/4.0.3 → 2.3.2/4.0.4 - flatted 3.3.3 → 3.4.2 - fast-uri 3.0.6 → 3.1.2 - tmp 0.2.5 → 0.2.7 - @aws-amplify/ai-constructs 1.6.1 → 1.6.2 scripts/yarn.lock: - axios 1.12.0 → 1.16.1 - minimatch 9.0.5 → 10.2.5 - fast-xml-parser 4.4.1 → 5.8.0 jsonServer/yarn.lock: - minimatch 3.1.2 → 3.1.5 jsonServer/src-server/yarn.lock: - lodash 4.17.21 → 4.18.1
…s and update license disclaimer
…onstruct completeness
…y advisories - @aws-sdk/xml-builder ^3.972.0 -> ^3.972.31 in both constructs (root resolution @aws-sdk/core/@aws-sdk/xml-builder -> ^3.972.31). 3.972.31 is the first release containing aws-sdk-js-v3#7863, which replaces fast-xml-parser with an internal XML parser. - @opentelemetry/core pinned to >=2.8.0 via root resolutions (GHSA-8988-4f7v-96qf); resolves to 2.8.0. - uuid pinned to ^11.1.1 via root resolutions + both constructs (GHSA-w5hq-g745-h8pq); resolves to 11.1.1, the patched legacy-11 release. Avoids uuid 14.x which is ESM-first.
…m constructs Bumps @aws-sdk client packages (client-bedrock-runtime, client-sso, client-sso-oidc, client-sts, token-providers) to ^3.1074.0 and pins @aws-sdk/core to ^3.974.23 (the 3.1074 release line). Adds a root resolution forcing all @aws-sdk/core to 3.974.23, which depends on @aws-sdk/xml-builder@^3.972.31 — the version that removed fast-xml-parser. This collapses the previously stale core/xml-builder 3.972.15/22/26 resolutions (which still pulled fast-xml-parser) onto the fast-xml-parser-free 3.972.31. Removes the now-orphaned fast-xml-parser dependency chain (fast-xml-parser, fast-xml-builder, @nodable/entities, path-expression-matcher, strnum, xml-naming) from both constructs' dependencies + bundledDependencies and the root nohoist config, since xml-builder@3.972.31 no longer pulls them. The **/fast-xml-parser and **/fast-xml-builder safety resolutions are retained to keep legacy @aws-sdk v3 consumers (client-s3@3.6.1, client-sts@3.186.0) on the patched fast-xml-parser@5.7.3.
…error/null guards) Two Gen2-cdk e2e suites (generation, conversation) were failing for reasons unrelated to product code. This change fixes the test fixtures and adds fail-fast hygiene guards. Test-side only; no product behavior changes. Model ids The fixtures invoked anthropic.claude-3-haiku-20240307-v1:0, a legacy Bedrock model that has been auto-revoked in the e2e account; invoking it returned ResourceNotFoundException, AppSync resolved null, and the tests crashed on a null-deref. - generation: the @generation transformer's AppSync->Bedrock IAM role grants bedrock:InvokeModel only on the foundation-model ARN, so a cross-region inference profile fails with AccessDenied. The generation fixture is switched to the active on-demand foundation model mistral.mistral-large-2407-v1:0, which the e2e account can invoke under the existing IAM and which satisfies the basic text/scalar assertions. - conversation: routes via @aws-amplify/ai-constructs, which handles inference-profile IAM, so the conversation fixture uses the active inference profile us.anthropic.claude-haiku-4-5-20251001-v1:0. Fail-fast guards generation.test.ts: assert the GraphQL response has no errors and that the generated recipe is not null before dereferencing, so a Bedrock/GraphQL error is printed instead of a TypeError. conversation.test.ts: replace the ineffective toBeDefined() check on the stream part with not.toBeNull(), guard the .length read when the part is null, and add a max-iteration / overall-timeout guard inside the subscription for-await loop so a non-streaming assistant fails fast with a descriptive message instead of cascading into the jest timeout. --- Prompt: Split the mixed e2e/CI branch into a clean draft PR off main containing only the generation/conversation e2e test fixes: switch the dead legacy claude-3-haiku model id to a working model (generation -> mistral plain on-demand FM, conversation -> working inference profile) and add the error/null fail-fast guards. tsc the construct-tests package and commit (no --no-verify). (cherry picked from commit d3e8617)
…ol-use/structured output) (cherry picked from commit 3a02ac7)
…` assertions for haiku-4-5 The conversation happy-path e2e asserted every streamed ConversationMessageStreamPart had a non-null `p` and aggregated `p` into a non-empty string. That premise is wrong: `p` is optional stream padding, not response text. The ai-constructs Bedrock converse adapter only sets `p` when the underlying Bedrock contentBlockDelta carries a string padding field, and never sets it on control frames (contentBlockStop, the final stopReason chunk). claude-haiku-4-5 emits no `p` padding at all, so the subscription delivers `p: null` on every part, failing `expect(streamPart.p).not.toBeNull()` on the first frame and cascading the other cases into timeouts. Verified directly against us.anthropic.claude-haiku-4-5-20251001-v1:0 via Bedrock ConverseStream: the model returns the full pirate response (stopReason end_turn) with text delivered through contentBlockDelta/contentBlockText and no `p` padding on any frame. The assistant text is mapped correctly, so this is a test-assertion issue, not a resolver bug. Drop the contradictory not-null assertion, keep the `p` length check when padding is present, and assert the aggregate streamed contentBlockText is non-empty so the test still meaningfully verifies a real streaming response was received. --- Prompt: Gen2 PR #3500 conversation e2e shard failed at conversation.test.ts:136 expect(streamPart.p).not.toBeNull() with model us.anthropic.claude-haiku-4-5. Determine whether haiku-4-5 returns the pirate text interleaved with null-p control frames (assertion is wrong, fix it properly) or whether no assistant text arrives (real resolver bug, report it, do not loosen the test). Gather evidence from the CI log and the stream-part type/resolver, then fix or report. Commit to the branch with a conventional message, no --no-verify, follow CODING_GUIDELINES.md, and push. (cherry picked from commit 84331e7)
…ile for conversation haiku-4-5 ai-constructs v1.6.2 only grants correct Bedrock IAM for global.-prefixed model ids; switch pirateChat @conversation aiModel from us. to global. profile.
…S3/IAM operations Cherry-picked from 7a697364c (excluding stray .roko notepad file). Adds ConfiguredRetryStrategy + isNetworkError guards to cleanup-e2e-resources.ts and TimeoutError/ETIMEDOUT/ECONNRESET handling to retries.ts.
…-only buildspec for iteration
…ckInput (ai-constructs sends SDK ToolUseBlock.type)
… in a separate PR)
3 tasks
…eardown for log_config
…core event-stream dynamic import); keep cap-3
…modules for log_config tests
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR addresses fast-xml-parser security vulnerabilities and a set of related dependency/bundling hygiene fixes, plus stabilizes the conversation and generation e2e tests that gate this change.
1. Security / dependency resolutions (root
package.json)Added / updated
resolutionsto force safe versions tree-wide:**/fast-xml-parser: ~5.7.2,**/fast-xml-builder: >=1.1.7(replaces the previous narrow**/aws-amplify/**/fast-xml-parser: ~5.5.12resolution)@aws-sdk/core: ^3.974.23(replaces the previous@aws-sdk/core/@aws-sdk/xml-builderpin; eliminates stalexml-buildercarriers that pulled infast-xml-parser)@opentelemetry/core: >=2.8.0uuid: ^11.1.1(pinned to 11.x — NOT>=, which would resolve to ESM-only 14.x)axios: ^1.16.1,tmp: ^0.2.6,basic-ftp: >=5.3.1,@xmldom/xmldom: >=0.9.10,fast-uri: >=3.1.2,flatted: >=3.4.2,@aws-amplify/plugin-types: 1.12.12. AWS SDK upgrades in construct packages
amplify-graphql-api-constructandamplify-data-construct:@aws-sdk/*client packages (client-bedrock-runtime,client-sso,client-sso-oidc,client-sts,token-providers) bumped to^3.1074.0; supporting middleware/util/credential-provider packages bumped to the^3.972/3.973release line;@aws-sdk/core: ^3.974.23.@aws-amplify/ai-constructs: ^1.6.1 → ^1.6.2;uuid: ^9.0.1 → ^11.1.1.fast-xml-parser,fast-xml-builder,path-expression-matcher, andstrnumfromdependencies,bundledDependencies, and the rootnohoistlist (no longer pulled in after the SDK upgrade).@aws-sdk/middleware-sdk-s3,@aws-sdk/middleware-websocket,@aws-sdk/signature-v4-multi-region,@aws-sdk/util-arn-parser, and@aws-sdk/util-format-urltodependencies+bundledDependencies(and rootnohoist) so the published bundle stays complete with the upgraded SDK.dependency_licenses.txt, both.jsiifiles, andyarn.lock.3. AWS SDK upgrades in test / tooling packages
amplify-graphql-api-construct-tests,amplify-e2e-tests,amplify-graphql-model-transformer,amplify-graphql-schema-generator, andgraphql-transformers-e2e-tests:@aws-sdk/client-*(and@aws-sdk/types) bumped to^3.973.0.scripts/package.json:axios → ^1.16.1plus addedresolutions(fast-xml-parser >=5.5.6,minimatch >=9.0.6,axios >=1.16.1);scripts/yarn.lockregenerated.graphql-transformers-e2e-testsjsonServer fixtures: addedresolutions(minimatch 3.1.5) andlodash >=4.17.23; regenerated both jsonServeryarn.lockfiles.4. Conversation e2e test fix
type: StringtoAmplifyAIToolUseBlockInputin three places: the conversation test schema fixture (schema-conversation.graphql), the transformer test schema fixture (conversation-schema-types.graphql), and the generatedAPI.ts. Root cause: a newer bundled@aws-sdk/client-bedrock-runtime(via@aws-amplify/ai-constructs) added atypefield toToolUseBlock; the handler spreads the whole SDK object into the GraphQL mutation, so AppSync rejected the unknown field. The schema addition is backward-compatible (optional).aiModeltoglobal.anthropic.claude-haiku-4-5-20251001-v1:0.errors[]stream parts immediately; switched the response-text assertion from accumulatedp(now optional stream padding) to accumulatedcontentBlockText.5. Generation e2e test fix
aiModeltoamazon.nova-lite-v1:0and added fail-fast guards (assert no GraphQLerrors, assert recipe is non-null).6. Lint fix
amplify-e2e-core/src/init/initProjectHelper.ts: wrapped an over-widthconsole.logto satisfy prettier.Testing