aws-amplify / aws-amplify/amplify-cli

Update aws-cdk-lib to latest version due to minimatch vulnerability

Open Beginner friendly
#14,631 4 comments 1 reaction 0 assignees View on GitHub
bug p1
Dominant language
TypeScript
Stars
2.9k
Forks
825
Avg merge
11d 23h
Merged PRs (30d)
2

Description

### How did you install the Amplify CLI?

npm

### If applicable, what version of Node.js are you using?

_No response_

### Amplify CLI Version

14.2.5

### What operating system are you using?

Mac

### Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.

No manual changes made

### Describe the bug

Please update aws-cdk-lib to the latest version (2.240.0) in the cli-extensibility-helper package. The aws-cdk-lib package was recently updated due to a vulnerability in minimatch.

### Expected behavior

I should not have any high severity vulnerabilities in my dependency chain.
minimatch <=3.1.3 || 10.0.0 - 10.2.2
Severity: high
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern - https://github.com/advisories/GHSA-3ppc-4f35-3m26
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments - https://github.com/advisories/GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions - https://github.com/advisories/GHSA-23c5-xmqv-rm74
fix available via `npm audit fix`
node_modules/@aws-amplify/amplify-category-custom/node_modules/aws-cdk-lib/node_modules/minimatch
node_modules/@aws-amplify/amplify-cli-core/node_modules/aws-cdk-lib/node_modules/minimatch
node_modules/aws-cdk-lib/node_modules/minimatch
aws-cdk-lib *
Depends on vulnerable versions of minimatch
Depends on vulnerable versions of minimatch
node_modules/@aws-amplify/amplify-category-custom/node_modules/aws-cdk-lib
node_modules/@aws-amplify/amplify-cli-core/node_modules/aws-cdk-lib
node_modules/aws-cdk-lib
@aws-amplify/amplify-category-custom >=3.0.0-ampgenconfig.0
Depends on vulnerable versions of @aws-amplify/amplify-cli-core
Depends on vulnerable versions of aws-cdk-lib
node_modules/@aws-amplify/amplify-category-custom
@aws-amplify/cli-extensibility-helper >=2.5.1-beta.0
Depends on vulnerable versions of @aws-amplify/amplify-category-custom
Depends on vulnerable versions of @aws-amplify/amplify-cli-core
Depends on vulnerable versions of aws-cdk-lib
node_modules/@aws-amplify/cli-extensibility-helper
@aws-amplify/amplify-cli-core 4.0.4-rc.374a34c65a.0 - 4.0.4-replace-lambda-callouts-tests.0 || >=4.0.5-gfix.0
Depends on vulnerable versions of aws-cdk-lib
node_modules/@aws-amplify/amplify-cli-core

### Reproduction steps

Run `npm audit` for a project with "@aws-amplify/cli-extensibility-helper": "^3.0.0" as a dependency

### Project Identifier

_No response_

### Log output

```
# Put your logs below this line

```

### Additional information

_No response_

### Before submitting, please confirm:

- [x] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [x] I have removed any sensitive information from my code snippets and submission.

Contributor guide

Open the contributing guide

Research direction

Start by locating the dependency metadata for the cli-extensibility-helper package and inspect how aws-cdk-lib is resolved in its dependency chain. Update the dependency to version 2.240.0, then run npm audit for a project using the package and confirm that the reported high-severity minimatch vulnerabilities are resolved.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cli, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.