fix(aws): clear install-path dependency CVEs in aws/cdk and aws/cli-installer - #359
Open
kylehounslow wants to merge 1 commit into
Open
fix(aws): clear install-path dependency CVEs in aws/cdk and aws/cli-installer#359kylehounslow wants to merge 1 commit into
kylehounslow wants to merge 1 commit into
Conversation
…nstaller aws/cdk: - aws-cdk-lib ^2.180.0 -> ^2.260.0 (clears CVE-2026-13760; fast-uri CVE-2026-6321/6322 fixed in cdk 2.252.0) - aws-cdk CLI ^2.180.0 -> ^2.1132.0 (cloud-assembly schema v54 compat; synth fails otherwise) - overrides.fast-xml-parser ^5.7.0 (clears CVE-2026-41650 on the @aws-sdk chain) aws/cli-installer: - @aws-sdk/credential-provider-node -> 3.972.30 (lock); newer @aws-sdk/xml-builder drops fast-xml-parser, clearing CVE-2026-41650 Closes opensearch-project#293 opensearch-project#214 opensearch-project#215 Refs opensearch-project#357 Signed-off-by: Kyle Hounslow <kylhouns@amazon.com>
kylehounslow
requested review from
anirudha,
goyamegh,
joshuali925,
ps48 and
vamsimanohar
as code owners
July 27, 2026 20:34
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Clears the open Mend security alerts on the two user-facing AWS install manifests (
aws/cdk,aws/cli-installer). These manifests are not watched by Dependabot, so the alerts sat open. This is the code users run to install the stack, so it is the highest-blast-radius path in the triage tracked by #357.Consolidated into one PR because both manifests share the same
fast-xml-parserroot and the changes verify together. No major-version bumps.Changes
aws/cdk:aws-cdk-lib^2.180.0->^2.260.0. Clears CVE-2026-13760 (direct) and thefast-uriadvisories CVE-2026-6321/6322 (patched in cdk 2.252.0).aws-cdkCLI^2.180.0->^2.1132.0. 2.260.0 emits cloud-assembly schema v54; the old CLI floor only reads v53, socdk synthfails on a schema mismatch without this. Still a 2.x bump.overrides.fast-xml-parser: ^5.7.0(resolves 5.10.1). Clears CVE-2026-41650 on the@aws-sdkchain.aws/cli-installer:@aws-sdk/credential-provider-node-> 3.972.30 (lockfile only). The newer@aws-sdk/xml-builderin that tree dropsfast-xml-parserentirely, which clears CVE-2026-41650 at the source. Nofast-xml-parseroverride is added here because a fresh re-lock resolves none, so an override would match nothing.Supersedes bot PRs #335, #339, and #289, which each carry a subset of this fix.
Residual cdk advisories (not fixable via npm overrides)
The
brace-expansionandfast-uriadvisories that remain on the cdk tree arebundledDependenciesshipped inside theaws-cdk-libtarball (via minimatch/ajv). npmoverridescannot rewrite bundled deps, so no override clears them. Even 2.262.1 bundles the flagged versions. Mend's own table on #293 marks theseFixed in: N/Afor the same reason. They clear when aws-cdk-lib bundles patched versions upstream.Validation
aws/cdk:npm install,npm run build,npm run synthall pass.synthtemplate shape is identical to main (ObsInfra 19 resources, ObservabilityStack 29; zero added, removed, or retyped resources). The only drift is CDK-internal: provider-framework helper Lambdas movenodejs22.x->nodejs24.xand the CDKMetadata blob changes. All user resources are byte-identical after asset-hash normalization.aws/cli-installer:npm install,npm test(134/134 pass),npm run e2e:listgreen,npm auditreports 0 vulnerabilities.e2e gap:
npm run e2eprovisions billable live AWS infra (OpenSearch domains, EC2, OSIS) and was not run unattended. This change is a lockfile adoption on the installer plus a non-breaking cdk minor, covered by the unit suite and a clean audit. Requesting QA on the managed public e2e path before merge.Closes #293 #214 #215
Refs #357