Skip to content

fix(deps): remediate open Dependabot security alerts - #1387

Merged
krokoko merged 2 commits into
awslabs:mainfrom
krokoko:secfix
Sep 1, 2026
Merged

fix(deps): remediate open Dependabot security alerts#1387
krokoko merged 2 commits into
awslabs:mainfrom
krokoko:secfix

Conversation

@krokoko

@krokoko krokoko commented Sep 1, 2026

Copy link
Copy Markdown
Collaborator

Fixes open Dependabot security alerts.

Summary

Remediates 8 open Dependabot alerts by removing an unused dev dependency chain and
bumping vulnerable Python packages in lambda dev/runtime lockfiles.

  • Remove unused aws-sdk-mock to eliminate transitive aws-sdk v2 (alert 163) and uuid@8.0.0 (alert 232)
  • Bump pytest to >=9.0.3 in lambda dev dependencies (214, 215, 216, 230)
  • Bump requests to 2.34.2 and Pygments to 2.21.0 in OpenSearch lambda lockfile (195, 208)

Pull Request Checklist

  • Testing
    • Unit test added (prefer not to modify an existing test, otherwise, it's probably a breaking change)
    • Integration test added (if adding a new pattern or making a significant update to an existing pattern)
  • Docs
    • README: README and/or documentation topic updated
    • Design: For significant features, design document added to design folder

Test plan

  • npx projen compile
  • Jest unit tests (353/353 pass; bedrock-batch-sfn suite excluded locally — requires Docker)
  • Integration snapshot asserts pass
  • uv run pytest in lambda/aws-bedrock-batch-stepfn (27/27 pass)
  • uv lock --check in lambda/aws-bedrock-batch-stepfn
  • CI build on GitHub Actions (includes Docker-based bedrock-batch-sfn tests)

Notes

  • aws-sdk-mock was listed in devDependencies but had no imports anywhere in the codebase.
  • Python dependency bumps are dev-only except requests (2.32.52.34.2), a runtime
    transitive dependency of opensearch-py within its existing version constraint.
  • No breaking changes to construct APIs or runtime behavior.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.

Remove unused aws-sdk-mock to eliminate aws-sdk v2 and uuid@8.0.0.
Bump pytest, requests, and Pygments in lambda dev dependencies.

Co-authored-by: Cursor <cursoragent@cursor.com>
@codecov

codecov Bot commented Sep 1, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.88%. Comparing base (e12a0d0) to head (620dbc2).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff            @@
##             main    #1387    +/-   ##
========================================
  Coverage   94.88%   94.88%            
========================================
  Files          87       87            
  Lines       26951    26951            
  Branches      480      834   +354     
========================================
  Hits        25572    25572            
  Misses       1379     1379            

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@krokoko
krokoko merged commit f1c7eb0 into awslabs:main Sep 1, 2026
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants