fix(deps): drop vulnerable fast-xml-parser from reconciliation lambda#9765
Open
eliotlim wants to merge 1 commit into
Open
fix(deps): drop vulnerable fast-xml-parser from reconciliation lambda#9765eliotlim wants to merge 1 commit into
eliotlim wants to merge 1 commit into
Conversation
The service's standalone pnpm-lock.yaml pinned @aws-sdk/core@3.576.0, which depends directly on fast-xml-parser@4.2.5 — flagged critical by Dependabot (GHSA-m7jm-9gc2-mpf2, entity-encoding bypass via regex injection in DOCTYPE entity names; patched in 4.5.4). Regenerating the standalone lockfile within the existing caret ranges resolves the aws-sdk clients to 3.1087.0 — the same versions the main app already runs — where fast-xml-parser is no longer a dependency, so the vulnerable package is removed from the tree entirely. package.json specifiers are unchanged, so the root workspace lockfile stays in sync. The Lambda only uses SSMClient/GetParameterCommand, stable across all of aws-sdk v3, so the resolution bump carries no runtime risk. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
|
lgtm - lets redploy the lambda to issue the patch |
kevin9foong
approved these changes
Jul 16, 2026
|
Tick the box to add this pull request to the merge queue (same as
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Critical Dependabot alert #828 (
GHSA-m7jm-9gc2-mpf2— fast-xml-parser entity-encoding bypass via regex injection in DOCTYPE entity names, patched in 4.5.4) againstservices/form-payment-reconciliation/pnpm-lock.yaml.That standalone lockfile pinned
@aws-sdk/core@3.576.0, which depends directly on the vulnerablefast-xml-parser@4.2.5. (The alert was explicitly deferred in #9764.)Solution
Regenerate the service's standalone lockfile within its existing caret ranges (
@aws-sdk/client-secrets-manager ^3.529.1,@aws-sdk/client-ssm ^3.525.0). This resolves both clients to3.1087.0— the same versions the main app already runs — where@aws-sdk/coreno longer depends onfast-xml-parserat all, so the vulnerable package (and itsstrnumdep) is removed from the tree entirely.package.jsonspecifiers are unchanged, so the root workspace lockfile stays in sync (rootpnpm install --frozen-lockfileremains green).Breaking Changes
Tests
pnpm install -p --frozen-lockfile --ignore-workspace(standalone deploy path) — passes.pnpm install --frozen-lockfile(root workspace) — passes;package.jsonuntouched so no desync.git diffconfirmsfast-xml-parser@4.2.5+strnum@1.0.5removed, no other vulnerable transitives introduced.Runtime risk
None. The Lambda (
index.js) uses onlySSMClient/GetParameterCommand, which are stable across all of aws-sdk v3.Not addressed
decompress(critical, alert #1006) remains open by request — no upstream patch exists (latest4.2.1is the vulnerable version), and it's a dev-only transitive of the Serverless CLI deploy tooling with no untrusted-archive path.🤖 Generated with Claude Code