aws-amplify / aws-amplify/amplify-cli

@aws-amplify/cli-extensibility-helper moderate severity vulnerability with aws-cdk-lib dependency

Open
#14,167 2 comments 0 reactions 0 assignees View on GitHub
feature-request
Dominant language
TypeScript
Stars
2.9k
Forks
825
Avg merge
11d 23h
Merged PRs (30d)
2

Description

### Is this feature request related to a new or existing Amplify category?

_No response_

### Is this related to another service?

_No response_

### Describe the feature you'd like to request

`@aws-amplify/cli-extensibility-helper` has a dependency on `aws-cdk-lib` `~2.177.0` which has moderate and low severity vulnerabilities that would be worth updating at some point:

https://github.com/advisories/GHSA-qq4x-c6h6-rfxh
https://github.com/advisories/GHSA-5pq3-h73f-66hr
https://github.com/advisories/GHSA-qc59-cxj2-c2w4

### Describe the solution you'd like

The `aws-cdk-lib` dependency in `@aws-amplify/cli-extensibility-helper` should be updated to at least `2.189.1` to address both vulnerabilities.

### Describe alternatives you've considered

The only work around is to use forced resolutions for the versions since the semver doesn't allow minor version updates (`~2.177.0`).

### Additional context

_No response_

### Is this something that you'd be interested in working on?

- [ ] 👋 I may be able to implement this feature request

### Would this feature include a breaking change?

- [ ] ⚠️ This feature might incur a breaking change

Contributor guide

Open the contributing guide

Research direction

Locate the package manifest for @aws-amplify/cli-extensibility-helper and inspect its aws-cdk-lib dependency declaration, including any associated lockfile. Update the allowed version to at least 2.189.1, then verify the dependency resolves to that version and addresses the three linked advisories.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cli, security
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.