Bump aws-cdk-lib and reconcile root audit allowlist - #71
Merged
Conversation
The bundled minimatch subtree inside aws-cdk-lib carried a brace-expansion copy that npm overrides structurally cannot reach. Bumping to the current latest release moves it from 5.0.7 to 5.0.8, clearing one of the two allowlisted high advisories; the remaining one is fixed only in 5.0.9 and stays allowlisted with a justification refreshed to current truth and an upstream revisit note. The vestigial react-router allowlist entry and its stale comment are removed now that the fix is resolved and the frontend gate from the previous change is in place. Synthesized templates were proven logically identical across all stacks before and after the bump, with only metadata version strings differing; alpha package pins are untouched.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
aws-cdk-lib 2.262.1 → 2.264.0 (registry latest, exact-pinned). The bundled minimatch subtree - unreachable by npm overrides - moves brace-expansion 5.0.7 → 5.0.8, clearing GHSA-mh99-v99m-4gvg. The remaining advisory (GHSA-1gw5-rvv9-x895, Dependabot #92) is fixed only in 5.0.9, which no published aws-cdk-lib bundles yet: it stays allowlisted with a justification refreshed to current truth and a revisit date. The vestigial react-router allowlist entry is removed (7.18.2 resolved; frontend gate from the previous PR now covers that tree).
Testing
Synthesized templates proven logically identical across all 9 stacks before and after the bump (only CDK metadata version strings differ); zero IAM or resource deltas. Backend jest 6,330 passed, lint, tsc, synth all exit 0. Alpha package pins untouched, zero peer errors. Root audit-ci gate exits 0 with rgw5 the only vulnerable-allowlisted warning and no stale entries;
npm auditintentionally still exits 1 on the allowlisted rgw5.Notes
Dependabot #92 remains open by design until upstream bundles brace-expansion ≥5.0.9 - the justification file carries the revisit note. No runtime or infrastructure delta.