refactor: Upgrade @aws-sdk/s3-request-presigner from 3.787.0 to 3.815.0 #284
Conversation
Snyk has created this PR to upgrade @aws-sdk/s3-request-presigner from 3.787.0 to 3.815.0. See this package in npm: @aws-sdk/s3-request-presigner See this project in Snyk: https://app.snyk.io/org/acinader/project/3364151b-9c9a-4458-9afd-809dc5309438?utm_source=github&utm_medium=referral&page=upgrade-pr
|
I will reformat the title to use the proper commit message syntax. |
parse-github-assistant
bot
changed the title
|
🚀 Thanks for opening this pull request! |
📝 WalkthroughWalkthroughThe dependency "@aws-sdk/s3-request-presigner" in the package.json file was updated from version 3.787.0 to 3.815.0. No other files or dependencies were modified. Changes
Possibly related PRs
📜 Recent review detailsConfiguration used: CodeRabbit UI ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms (6)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
🎉 Snyk checks have passed. No issues have been found so far.✅ security/snyk check is complete. No issues have been found. (View Details) |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #284 +/- ##
=======================================
Coverage 97.19% 97.19%
=======================================
Files 2 2
Lines 214 214
=======================================
Hits 208 208
Misses 6 6 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
package.json (1)
23-23: Ensure AWS SDK version compatibility across packages.The
@aws-sdk/client-s3dependency is pinned at3.824.0while@aws-sdk/s3-request-presigneris updated to3.815.0. Mixing minor versions can introduce subtle API mismatches—consider aligning both to the same minor version (e.g.,3.824.0) or verifying compatibility between these releases.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (1)
package.json(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (6)
- GitHub Check: Parse Server 7, Node.js 20
- GitHub Check: Parse Server 8, Node.js 20
- GitHub Check: Parse Server 8, Node.js 18
- GitHub Check: Parse Server 7, Node.js 22
- GitHub Check: Parse Server 8, Node.js 22
- GitHub Check: Parse Server 7, Node.js 18
| "dependencies": { | ||
| "@aws-sdk/client-s3": "3.824.0", | ||
| "@aws-sdk/s3-request-presigner": "3.787.0" | ||
| "@aws-sdk/s3-request-presigner": "3.815.0" |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Validate the security update and run dependency audit.
After bumping the presigner package, reinstall dependencies and run an audit to confirm the Snyk-reported vulnerability is resolved and no new issues have been introduced.
🏁 Script executed:
#!/bin/bash
npm ci
npm auditLength of output: 9815
Remaining vulnerabilities detected after audit
The npm audit report shows 15 unresolved issues (including 2 critical and 4 high) related to transitive dependencies of @aws-sdk/s3-request-presigner bump:
• Critical:
– crypto-js (PBKDF2 weakness)
• High:
– cross-spawn (ReDoS)
– path-to-regexp (ReDoS)
– ws (DoS via headers)
– others
Action items:
- Run
npm audit fixto address non-breaking issues. - For fixes marked “--force” (breaking changes), evaluate upgrading/removing the following top-level dependencies:
• parse & parse-server (crypto-js, ws, tough-cookie)
• express (path-to-regexp)
• @babel/runtime & helpers (named group RegExp issue) - After upgrades, rerun
npm ci && npm auditto confirm zero vulnerabilities.
Please prioritize resolving or safely mitigating the remaining findings before merging.
🤖 Prompt for AI Agents
In package.json at line 23, after updating the @aws-sdk/s3-request-presigner
dependency, run npm ci and npm audit to identify remaining vulnerabilities. Then
run npm audit fix to automatically resolve non-breaking issues. For
vulnerabilities requiring breaking changes, evaluate upgrading or removing
top-level dependencies such as parse, parse-server, express, and @babel/runtime
as indicated. After making these changes, reinstall dependencies and rerun npm
audit to ensure all vulnerabilities are resolved before merging.
Snyk has created this PR to upgrade @aws-sdk/s3-request-presigner from 3.787.0 to 3.815.0.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 13 versions ahead of your current version.
The recommended version was released 22 days ago.
Release notes
Package name: @aws-sdk/s3-request-presigner
-
3.815.0 - 2025-05-21
- client-application-auto-scaling: Doc only update that addresses a customer reported issue. (1076a5e6)
- clients: update client endpoints as of 2025-05-21 (153ceba3)
- client-bedrock-agent-runtime: Amazon Bedrock introduces asynchronous flows (in preview), which let you run flows for longer durations and yield control so that your application can perform other tasks and you don't have to actively monitor the flow's progress. (9128be8e)
- client-cloudwatch: Adds support for setting up Contributor Insight rules on logs transformed via Logs Transformation feature. (0eed8726)
- client-ec2: Release of Dualstack and Ipv6-only EC2 Public DNS hostnames (b9f691a5)
- client-partnercentral-selling: Modified validation to allow expectedCustomerSpend array with zero elements in Partner Opportunity operations. (ed51782d)
- middleware-flexible-checksums: increase hook timeout to 60s for middleware-md5-fallback.e2e (#7095) (c57206a4)
-
3.812.0 - 2025-05-16
- client-ecs: This is an Amazon ECs documentation only release to support the change of the container exit "reason" field from 255 characters to 1024 characters. (88cb2cfc)
- clients: update client endpoints as of 2025-05-16 (9a8d9b5d)
- client-bedrock-data-automation: Add support for VIDEO modality to BlueprintType enum. (5657cb1e)
- client-codepipeline: CodePipeline now supports new API ListDeployActionExecutionTargets that lists the deployment target details for deploy action executions. (eb51d8f6)
- client-emr: Added APIs for managing Application UIs: Access Persistent (serverless) UIs via CreatePersistentAppUI DescribePersistentAppUI & GetPersistentAppUIPresignedURL, and Cluster-based UIs through GetOnClusterAppUIPresignedURL. Supports Yarn, Spark History, and TEZ interfaces. (f1f82e19)
- client-neptune: This release adds Global Cluster Switchover capability which enables you to change your global cluster's primary AWS Region, the region that serves writes, while preserving the replication between all regions in the global cluster. (ab547b08)
- client-glue: Changes include (1) Excel as S3 Source type and XML and Tableau's Hyper as S3 Sink types, (2) targeted number of partitions parameter in S3 sinks and (3) new compression types in CSV/JSON and Parquet S3 sinks. (a5f2aef9)
- client-service-quotas: This release introduces CreateSupportCase operation to SDK. (611d06e0)
- client-bedrock-data-automation-runtime: Add AssetProcessingConfiguration for video segment to InputConfiguration (bbf9999d)
- core/protocols: read error code case-insensitively (#7085) (c13a2a07)
- codegen: unblock CI status check (#7086) (e6fe205c)
-
3.810.0 - 2025-05-14
- build: allow turbo dev config (#7079) (ba210280)
- codegen: update for default endpoint ruleset (#7077) (b51a0f6d)
- client-cloudwatch-logs: This release adds a new API "ListLogGroups" and an improvement in API "DescribeLogGroups" (9d801db0)
- client-cognito-identity-provider: Add exceptions to WebAuthn operations. (d56b4892)
- client-mediaconvert: This update enables cropping for video overlays and adds a new STL to Teletext upconversion toggle to preserve styling. (e87d8b48)
- client-firehose: This release adds catalogARN support for s3 tables multi-catalog catalogARNs. (7f8490a8)
-
3.808.0 - 2025-05-12
- core: return httpBearerAuth in authSchemePreference if token is set in env (#7067) (320bc3a2)
- clients: update smithy versions to get loader config types (#7072) (d6920e8c)
- clients: update client endpoints as of 2025-05-12 (a476498d)
- client-ec2: EC2 - Adding support for AvailabilityZoneId (c7ea9041)
- client-mediatailor: Documenting that EnabledLoggingStrategies is always present in responses of PlaybackConfiguration read operations. (bf0301e7)
- client-iam: Updating the endpoint list for the Identity and access management (IAM) service (854b130d)
- client-medialive: Add support to the AV1 rate control mode (f8e9f567)
- client-deadline: AWS Deadline Cloud service-managed fleets now support configuration scripts. Configuration scripts make it easy to install additional software, like plugins and packages, onto a worker. (11819667)
- client-s3-control: Updates to support S3 Express zonal endpoints for directory buckets in AWS CLI (db31822a)
- client-sagemaker: No API changes from previous release. This release migrated the model to Smithy keeping all features unchanged. (e06ca015)
- client-supplychain: Launch new AWS Supply Chain public APIs for DataIntegrationEvent, DataIntegrationFlowExecution and DatasetNamespace. Also add more capabilities to existing public APIs to support direct dataset event publish, data deduplication in DataIntegrationFlow, partition specification of custom datasets. (d647fdf4)
-
3.806.0 - 2025-05-08
- deps: pass signing name to env credential provider (#7064) (801cece8)
- clients: populate logger in loaderConfig (#7061) (48bdda33)
- client-guardduty: Updated description of a data structure. (c9ce9447)
- client-cloudfront: Doc-only update for CloudFront. These changes include customer-reported issues. (5a23f2f5)
- clients: update client endpoints as of 2025-05-08 (ece09fe8)
- client-sso-admin: Update PutPermissionBoundaryToPermissionSet API's managedPolicyArn pattern to allow valid ARN only. Update ApplicationName to allow white spaces. (bc0de81a)
- client-ec2: Launching the feature to support ENA queues offering flexibility to support multiple queues per Enhanced Network Interface (ENI) (b9b5b6ce)
- client-glue: This new release supports customizable RefreshInterval for all Saas ZETL integrations from 15 minutes to 6 days. (d6e00491)
- client-codepipeline: Add support for Secrets Manager and Plaintext environment variable types in Commands action (753bf4e0)
- codegen: allow overwriting protocol priority order (#7066) (dc4edaa0)
- client-s3: integration for config 'authSchemePreference' (#7063) (49c6f99d)
-
3.804.0 - 2025-05-06
-
3.803.0 - 2025-05-05
-
3.802.0 - 2025-05-02
-
3.800.0 - 2025-04-30
-
3.799.0 - 2025-04-29
-
3.798.0 - 2025-04-28
-
3.797.0 - 2025-04-25
-
3.796.0 - 2025-04-24
-
3.787.0 - 2025-04-10
from @aws-sdk/s3-request-presigner GitHub release notes3.815.0(2025-05-21)
Documentation Changes
New Features
Tests
For list of updated packages, view updated-packages.md in assets-3.815.0.zip
3.812.0(2025-05-16)
Documentation Changes
New Features
Bug Fixes
Tests
For list of updated packages, view updated-packages.md in assets-3.812.0.zip
3.810.0(2025-05-14)
Chores
New Features
For list of updated packages, view updated-packages.md in assets-3.810.0.zip
3.808.0(2025-05-12)
Chores
New Features
For list of updated packages, view updated-packages.md in assets-3.808.0.zip
3.806.0(2025-05-08)
Chores
Documentation Changes
New Features
Bug Fixes
Tests
For list of updated packages, view updated-packages.md in assets-3.806.0.zip
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information:
Summary by CodeRabbit