aws-amplify / aws-amplify/amplify-cli
Update aws-cdk-lib to latest version due to minimatch vulnerability
- Dominant language
- TypeScript
- Stars
- 2.9k
- Forks
- 825
- Avg merge
- 11d 23h
- Merged PRs (30d)
- 2
Description
### How did you install the Amplify CLI?
npm
### If applicable, what version of Node.js are you using?
_No response_
### Amplify CLI Version
14.2.5
### What operating system are you using?
Mac
### Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.
No manual changes made
### Describe the bug
Please update aws-cdk-lib to the latest version (2.240.0) in the cli-extensibility-helper package. The aws-cdk-lib package was recently updated due to a vulnerability in minimatch.
### Expected behavior
I should not have any high severity vulnerabilities in my dependency chain.
minimatch <=3.1.3 || 10.0.0 - 10.2.2
Severity: high
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
fix available via `npm audit fix`
node_modules/@aws-amplify/amplify-category-custom/node_modules/aws-cdk-lib/node_modules/minimatch
node_modules/@aws-amplify/amplify-cli-core/node_modules/aws-cdk-lib/node_modules/minimatch
node_modules/aws-cdk-lib/node_modules/minimatch
aws-cdk-lib *
Depends on vulnerable versions of minimatch
Depends on vulnerable versions of minimatch
node_modules/@aws-amplify/amplify-category-custom/node_modules/aws-cdk-lib
node_modules/@aws-amplify/amplify-cli-core/node_modules/aws-cdk-lib
node_modules/aws-cdk-lib
@aws-amplify/amplify-category-custom >=3.0.0-ampgenconfig.0
Depends on vulnerable versions of @aws-amplify/amplify-cli-core
Depends on vulnerable versions of aws-cdk-lib
node_modules/@aws-amplify/amplify-category-custom
@aws-amplify/cli-extensibility-helper >=2.5.1-beta.0
Depends on vulnerable versions of @aws-amplify/amplify-category-custom
Depends on vulnerable versions of @aws-amplify/amplify-cli-core
Depends on vulnerable versions of aws-cdk-lib
node_modules/@aws-amplify/cli-extensibility-helper
@aws-amplify/amplify-cli-core 4.0.4-rc.374a34c65a.0 - 4.0.4-replace-lambda-callouts-tests.0 || >=4.0.5-gfix.0
Depends on vulnerable versions of aws-cdk-lib
node_modules/@aws-amplify/amplify-cli-core
### Reproduction steps
Run `npm audit` for a project with "@aws-amplify/cli-extensibility-helper": "^3.0.0" as a dependency
### Project Identifier
_No response_
### Log output
```
# Put your logs below this line
```
### Additional information
_No response_
### Before submitting, please confirm:
- [x] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [x] I have removed any sensitive information from my code snippets and submission.
Contributor guide
Research direction
Start by locating the dependency metadata for the cli-extensibility-helper package and inspect how aws-cdk-lib is resolved in its dependency chain. Update the dependency to version 2.240.0, then run npm audit for a project using the package and confirm that the reported high-severity minimatch vulnerabilities are resolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100