[Snyk] Security upgrade @aws-sdk/client-s3 from 3.622.0 to 3.894.0

[JJediny]

Snyk has created this PR to fix 3 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue
	XML Entity Expansion SNYK-JS-FASTXMLPARSER-15307668
	Incorrect Regular Expression SNYK-JS-FASTXMLPARSER-15324289
	Buffer Overflow SNYK-JS-FASTXMLPARSER-15353391

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Incorrect Regular Expression

[Copilot]

Pull request overview

Upgrades the AWS S3 client dependency to address Snyk-reported vulnerabilities (notably via updated transitive fast-xml-parser) in this Node.js CLI/service.

Changes:

• Bump @aws-sdk/client-s3 from the previous 3.x range to ^3.894.0 in package.json.
• Regenerate package-lock.json to resolve the upgraded AWS SDK dependency graph (including patched transitive dependencies).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
package.json	Updates the declared @aws-sdk/client-s3 version requirement.
package-lock.json	Updates the resolved dependency tree to @aws-sdk/client-s3@3.894.0 and related transitive packages.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

After bumping @aws-sdk/client-s3 to 3.894.0, the lockfile now contains AWS SDK’s @smithy/node-http-handler v4.x while this project still depends on @smithy/node-http-handler ^3.0.0. Since src/publish/s3.js imports NodeHttpHandler from the top-level dependency, it will resolve to v3.x and be passed into an SDK that expects the v4/v5 Smithy protocol stack, which can cause runtime incompatibilities. Update the direct dependency to a compatible v4.x range (or remove the direct dependency and use a handler implementation that matches the SDK’s Smithy version) and regenerate the lockfile.

Suggested change

	"@smithy/node-http-handler": "^3.0.0",
	"@smithy/node-http-handler": "^4.0.0",