Merge branch 'fix/security-scans' into 'develop'

Fix/security scans

See merge request genaiic-reusable-assets/engagement-artifacts/genaiic-idp-accelerator!246

Author: rstrahan

.gitignore

@@ -19,3 +19,4 @@ __pycache__
 rvl_cdip_*
 notebooks/examples/data
 .idea/
+.dsr/

CHANGELOG.md

@@ -5,6 +5,7 @@ SPDX-License-Identifier: MIT-0
 
 ## [Unreleased]
 
+
 ### Added
 
 - **Dynamic Cost Calculation for Metering Data**
@@ -39,6 +40,11 @@ SPDX-License-Identifier: MIT-0
   3. This ensures continued cost optimization by preventing unexpected LLM API calls
 - **Action Required**: Review your current CloudFormation parameter settings before updating and update your configuration accordingly to preserve existing behavior
 
+### Fixed
+- **Fixed B615 "Unsafe Hugging Face Hub download without revision pinning" security finding in Pattern-3 fine-tuning module** - Added revision pinning with to prevent supply chain attacks and ensure reproducible deployments
+- **Fixed CloudWatch Log Group Missing Retention regression**
+- **Security: Cross-Site Scripting (XSS) Vulnerability in FileViewer Component** - Fixed high-risk XSS vulnerability in `src/ui/src/components/document-viewer/FileViewer.jsx` where `innerHTML` was used with user-controlled data
+- **Add permissions boundary support to new Lambda function roles introduced in previous releases**
 
 ## [0.3.11]
 

lib/idp_common_pkg/idp_common/model_finetuning/__init__.py

@@ -1,3 +1,5 @@
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: MIT-0
 """
 Model fine-tuning service package.
 """

lib/idp_common_pkg/idp_common/model_finetuning/create_provisioned_throughput.py

@@ -1,4 +1,6 @@
 #!/usr/bin/env python3
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: MIT-0
 """
 Nova Provisioned Throughput Creation Script
 

lib/idp_common_pkg/idp_common/model_finetuning/inference_example.py

@@ -1,4 +1,6 @@
 #!/usr/bin/env python3
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: MIT-0
 """
 Nova Fine-tuned Model Inference Example Script
 

lib/idp_common_pkg/idp_common/model_finetuning/models.py

@@ -1,3 +1,5 @@
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: MIT-0
 """
 Data models for model fine-tuning service.
 """

lib/idp_common_pkg/idp_common/model_finetuning/prepare_nova_finetuning_data.py

@@ -1,4 +1,6 @@
 #!/usr/bin/env python3
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: MIT-0
 """
 Nova Lite Fine-tuning Dataset Preparation Script
 

lib/idp_common_pkg/tests/unit/agents/analytics/test_tools.py

@@ -1 +1,3 @@
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: MIT-0
 # Unit tests for reporting module

lib/idp_common_pkg/tests/unit/reporting/__init__.py

@@ -1,4 +1,6 @@
 #!/usr/bin/env python3
+# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: MIT-0
 """
 Unit tests for configuration-based pricing functionality in SaveReportingData.
 Tests that pricing is loaded exclusively from configuration dictionary.