[Aikido] Fix 35 security issues in fast-xml-parser, fast-uri, brace-expansion and 6 more by aikido-autofix[bot] · Pull Request #56 · pixelfusion/aws-scripts

aikido-autofix · 2026-08-27T00:05:15Z

Upgrade dependencies to fix critical XSS via XML entity shadowing, XML entity expansion DoS attacks, stack overflow in XML builder, SSRF bypass via URI parsing inconsistency, and other security vulnerabilities.

⚠️ Breaking changes analysis not available for: aws-cdk-lib, minimatch, ajv

✅ No breaking changes for: fast-xml-parser, fast-uri, brace-expansion, yaml, @smithy/config-resolver, fs-extra

✅ 35 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-25896	🚨 CRITICAL	[fast-xml-parser] A dot (.) in DOCTYPE entity names is treated as a regex wildcard, allowing attackers to shadow built-in XML entities with arbitrary values and bypass entity encoding. This leads to XSS when parsed output is rendered.
CVE-2026-26278	HIGH	[fast-xml-parser] XML entity expansion vulnerability allows attackers to cause denial of service by forcing unlimited entity expansion with minimal input, potentially freezing the application for extended periods.
CVE-2026-27942	HIGH	[fast-xml-parser] XML builder with `preserveOrder:true` causes stack overflow leading to denial of service when processing certain inputs. The application crashes due to improper recursion handling during XML construction.
CVE-2026-33036	HIGH	[fast-xml-parser] Numeric character references and standard XML entities bypass entity expansion limits, allowing attackers to cause XML entity expansion Denial of Service by forcing excessive memory allocation and CPU usage through crafted XML payloads.
CVE-2026-33349	MEDIUM	[fast-xml-parser] XML entity expansion vulnerability where setting maxEntityCount or maxEntitySize to 0 is bypassed due to JavaScript falsy checks, allowing attackers to cause denial of service through memory exhaustion. The vulnerability affects configurations explicitly set to restrict or disable entities.
AIKIDO-2026-878106	HIGH	[fast-uri] URI authority parsing fails to treat backslashes as delimiters, allowing different host interpretations compared to Node's WHATWG URL parser, enabling bypass of host allowlists, SSRF filters, and redirect validation checks. The vulnerability permits attackers to circumvent security controls through crafted URIs containing backslashes.
AIKIDO-2026-10784	HIGH	[fast-uri] A path normalization vulnerability allows attackers to bypass security checks by using percent-encoded slashes and dots that are decoded before dot-segment removal, causing distinct URIs to normalize identically and compare equal.
CVE-2026-6321	HIGH	[fast-uri] A vulnerability in URI normalization allows attackers to bypass path-based access controls by using percent-encoded separators and dot segments that normalize to unintended paths. This enables policy bypass attacks where restricted paths can be accessed through specially crafted encoded URLs.
CVE-2026-6322	HIGH	[fast-uri] Normalize function improperly decodes percent-encoded authority delimiters in the host component, re-emitting them as raw delimiters during serialization. This allows attackers to bypass host allowlist checks and redirect requests to unintended authorities.
AIKIDO-2026-507986	HIGH	[fast-uri] A security bypass vulnerability exists in host canonicalization for Unicode/IDN values due to inconsistent ASCII/Unicode host handling, which could allow attackers to bypass security checks through improper host normalization.
CVE-2026-13676	HIGH	[fast-uri] A vulnerability in IDN hostname canonicalization allows Unicode hostnames to bypass host-based security policies (denylists, loopback filtering, redirects) when fast-uri's output differs from standard URL parsers. This enables attackers to circumvent security controls that rely on host validation.
CVE-2026-16221	HIGH	[fast-uri] A parsing discrepancy in fast-uri allows backslash characters to bypass host-based security policies like allowlists and SSRF filters, enabling attackers to redirect requests to unintended destinations including internal hosts and cloud metadata endpoints.
AIKIDO-2026-236835	HIGH	[fast-uri] A parsing discrepancy allows attackers to bypass host allowlists and SSRF filters by using alternative authority introducers (backslashes, mixed slashes, whitespace) that `fast-uri` treats as paths but Node's URL parser treats as authority, enabling redirection to unintended destinations.
CVE-2026-18446	HIGH	[fast-uri] URI parsing inconsistency allows attackers to bypass host-based security policies by using backslashes instead of forward slashes, causing fast-uri to parse differently than Node's URL parser and potentially enabling SSRF attacks or unintended redirects.
AIKIDO-2026-695913	HIGH	[fast-uri] Unsafe percent-decoding in URL scheme component allows attackers to bypass URL validation and inject malicious hosts or header content through normalization and resolution functions. This enables URL redirection attacks, allowlist bypasses, and header injection in applications processing untrusted URLs.
AIKIDO-2026-87893	HIGH	[fast-uri] Improper validation of IPv6 literals in URIs allows malformed addresses to be silently truncated into different valid addresses, enabling host-policy bypass and routing to unintended addresses like loopback or link-local IPs.
CVE-2026-14257	HIGH	[brace-expansion] Denial of service via memory exhaustion when expand() processes chained brace groups, allowing attackers to crash applications with small inputs by generating progressively longer result strings that exceed memory limits.
AIKIDO-2026-872981	HIGH	[brace-expansion] A vulnerability in the expand() function allows unbounded intermediate array generation during brace expansion, enabling a small crafted input to exhaust process memory or cause denial of service through event loop blocking.
CVE-2026-69152	HIGH	[brace-expansion] A memory exhaustion and event loop blocking vulnerability exists in the expand() function when processing attacker-controlled input with comma-alternatives or padded sequences, bypassing previous DoS protections.
AIKIDO-2026-237551	MEDIUM	[brace-expansion] A recursive expansion function computes unnecessary segments before early returns, causing exponential time complexity when processing consecutive non-expanding brace groups, enabling denial-of-service attacks through short malicious inputs that can stall processes or workers.
CVE-2026-13149	MEDIUM	[brace-expansion] A denial of service vulnerability exists in the expand() function due to exponential-time complexity when processing consecutive non-expanding brace groups, allowing attackers to cause significant CPU consumption and event-loop blocking.
CVE-2026-33750	LOW	[brace-expansion] A brace pattern with zero step value causes an infinite loop, leading to denial of service through process hangs and excessive memory allocation. The vulnerability affects string expansion operations when malicious or malformed patterns are processed.
AIKIDO-2026-10477	LOW	[brace-expansion] A denial-of-service vulnerability allows attackers to craft malicious brace patterns with repeated numeric ranges that cause exponential expansion, consuming excessive CPU and memory until process failure. The fix introduces an optional maximum limit parameter to bound expansion work.
CVE-2026-11417	HIGH	[aws-cdk-lib] OS command injection vulnerability in NodejsFunction local bundling pipeline allows arbitrary command execution if an attacker controls bundling properties like externalModules, define, loader, inject, or esbuildArgs through shell metacharacters injection.
AIKIDO-2026-577363	HIGH	[aws-cdk-lib] OS command injection vulnerability in Docker-based NodejsFunction bundling when using the nodeModules option allows attackers to inject shell commands through dependency version strings, leading to arbitrary code execution with the privileges of the CDK toolchain user.
CVE-2026-13760	HIGH	[aws-cdk-lib] OS command injection vulnerability in NodejsFunction Docker bundling allows attackers controlling package.json dependency versions to execute arbitrary commands on the host via shell metacharacters in the OsCommand helper.
GHSA-464c-974j-9xm6	LOW	[aws-cdk-lib] A logic inversion vulnerability in S3LoggingOptions causes the `encrypted` property to produce opposite behavior, disabling encryption when set to `true` instead of enabling it, potentially leaving CodeBuild logs unencrypted. This is an information disclosure risk affecting logs that may lack encryption at rest.
CVE-2026-33532	MEDIUM	[yaml] A stack overflow vulnerability in the YAML parser's node resolution phase allows attackers to trigger a RangeError via deeply nested YAML structures (~2-10 KB), potentially causing denial of service or process termination in applications that don't catch non-YAMLParseError exceptions.
CVE-2026-26996	LOW	[minimatch] A Regular Expression Denial of Service (ReDoS) vulnerability exists when glob patterns contain many consecutive * wildcards followed by a literal character, causing exponential backtracking with O(4^N) complexity. Applications passing user-controlled strings as patterns to minimatch() are vulnerable to severe performance degradation or hangs.
CVE-2026-27903	LOW	[minimatch] A ReDoS vulnerability in glob pattern matching causes unbounded recursive backtracking with multiple GLOBSTAR segments, enabling attackers to stall the event loop for tens of seconds via crafted patterns in build tools, CI/CD pipelines, or multi-tenant systems.
CVE-2026-27904	LOW	[minimatch] Nested extglobs (`*()` and `+()`) generate regexps with catastrophic backtracking, causing severe ReDoS denial-of-service attacks with minimal input patterns triggering multi-second hangs.
GHSA-6475-r3vj-m8vf	LOW	[@smithy/config-resolver] An attacker with environment access could set an invalid region value, potentially routing AWS API calls to non-AWS hosts. A validation enhancement was added to prevent improper endpoint construction through region input validation.
CVE-2025-69873	LOW	[ajv] A ReDoS vulnerability allows attackers to inject malicious regex patterns via the $data option, causing catastrophic backtracking and CPU exhaustion. A 31-character payload can block execution for ~44 seconds, enabling complete denial of service with minimal effort.
AIKIDO-2026-273849	LOW	[ajv] A prototype pollution vulnerability allows attackers to bypass format validation when the `$data` option is enabled by using inherited property names like `constructor` or `toString` as format values, causing unexpected validation behavior or errors.
AIKIDO-2026-57045	LOW	[fs-extra] A symlink in the destination path allows bypassing self-subdirectory protection, causing copy/move operations to recurse infinitely into the source tree until resource exhaustion or path length limits are exceeded (DoS).

🤖 Remediation details

Fix security vulnerabilities in fast-xml-parser, fast-uri, brace-expansion, aws-cdk-lib, yaml, minimatch, @smithy/config-resolver, ajv, and fs-extra

Short summary

This PR remediates security vulnerabilities in nine npm packages: fast-xml-parser, fast-uri, brace-expansion, aws-cdk-lib, yaml, minimatch, @smithy/config-resolver, ajv, and fs-extra. All fixes are applied via direct dependency version spec bumps in the root package.json, with the resulting transitive resolutions reflected in package-lock.json. No overrides were required.

fast-xml-parser

Previously resolved at 4.4.1 as a transitive dependency of @aws-sdk/core, which was itself pulled in by the direct dependencies @aws-sdk/client-secrets-manager and @aws-sdk/credential-providers. Both direct deps were bumped from ^3.348.0 to ^3.844.0 in package.json, which caused npm to resolve @aws-sdk/client-secrets-manager and @aws-sdk/credential-providers to 3.1117.0. At that version, @aws-sdk/core was updated to 3.977.9, which no longer carries fast-xml-parser as a dependency at all — the package is entirely absent from the lockfile, eliminating the vulnerability.

fast-uri

Previously resolved at 3.0.6 as a transitive dependency of ajv@8.17.1, which was itself nested inside aws-cdk-lib. Bumping aws-cdk-lib from ^2.78.0 to ^2.260.0 in package.json caused npm to resolve aws-cdk-lib to 2.266.0, which no longer carries a nested ajv@8.x instance and therefore no longer pulls in fast-uri. The package is entirely absent from the lockfile at the new resolution, eliminating the vulnerability.

brace-expansion

Present in three lockfile instances, all as a transitive dependency of minimatch. The root instance (1.1.12, via minimatch@3.1.2) and the filelist-nested instance (2.0.2, via minimatch@5.1.6) were resolved to 1.1.18 and 2.1.4 respectively via npm update, which is possible because minimatch@3.x and 5.x declare brace-expansion with caret ranges that allow the patched versions. The aws-cdk-lib-nested instance moved from 1.1.12 to 5.0.9 as a consequence of aws-cdk-lib being bumped to 2.266.0, which bundles a newer minimatch@10.2.5 that in turn resolves brace-expansion@5.0.9.

aws-cdk-lib

A direct dependency declared as ^2.78.0, resolved at 2.204.0. The declared spec was bumped to ^2.260.0 in package.json to satisfy the patched version floor of 2.260.0, causing npm to resolve it to 2.266.0. This was necessary both to fix aws-cdk-lib itself and to pull in patched versions of its bundled/nested transitives (yaml, minimatch, fs-extra, brace-expansion).

yaml

Resolved at 1.10.2 as a bundled transitive inside aws-cdk-lib. Bumping aws-cdk-lib to ^2.260.0 (resolved 2.266.0) was required because aws-cdk-lib@2.245.0 is the first release that pins yaml to 1.10.3; the patched version 1.10.3 is now reflected in the lockfile under node_modules/aws-cdk-lib/node_modules/yaml.

minimatch

Present in three lockfile instances. The aws-cdk-lib-nested instance moved from 3.1.2 to 10.2.5 as a direct consequence of the aws-cdk-lib bump to 2.266.0, which bundles a much newer minimatch. The root instance (shared by eslint, @eslint/eslintrc, glob, jake, and others) moved from 3.1.2 to 3.1.5 via npm update, which is within the ^3.1.2 range those parents declare. The filelist-nested instance moved from 5.1.6 to 5.1.9 via the same npm update pass.

@smithy/config-resolver

Previously resolved at 4.1.4 as a transitive dependency of @aws-sdk/client-secrets-manager and related @aws-sdk packages. Bumping @aws-sdk/client-secrets-manager and @aws-sdk/credential-providers to ^3.844.0 caused npm to resolve those packages to 3.1117.0. At that version the @aws-sdk ecosystem no longer includes @smithy/config-resolver as a separate lockfile entry — the package is entirely absent from the resolved tree, eliminating the vulnerability.

ajv

Present in two lockfile instances. The aws-cdk-lib-nested ajv@8.17.1 instance was eliminated entirely when aws-cdk-lib was bumped to 2.266.0 (that version no longer nests ajv@8.x). The root ajv@6.12.6 instance (pulled in by eslint@8.57.1 and @eslint/eslintrc@2.1.4) was resolved to 6.15.0 via npm update; this is within the ^6.12.4 range those parents declare, so no parent bump was needed.

fs-extra

Resolved at 11.3.0 as a bundled transitive inside aws-cdk-lib. Bumping aws-cdk-lib to ^2.260.0 (resolved 2.266.0) was sufficient because aws-cdk-lib@2.266.0 declares fs-extra as ^11.3.6, and the patched version 11.3.6 is now reflected in the lockfile under node_modules/aws-cdk-lib/node_modules/fs-extra.

Version changes

Package	From	To	Why updated
`aws-cdk-lib` (package.json spec)	`^2.78.0`	`^2.260.0`	Direct CVE fix; also required to pull patched transitives
`aws-cdk-lib` (lockfile resolved)	`2.204.0`	`2.266.0`	Direct CVE fix; spec bump resolved to latest compatible
`@aws-sdk/client-secrets-manager` (package.json spec)	`^3.348.0`	`^3.844.0`	Parent bump required to pull patched `fast-xml-parser` / `@smithy/config-resolver`
`@aws-sdk/client-secrets-manager` (lockfile resolved)	`3.840.0`	`3.1117.0`	Parent bump resolved to latest compatible
`@aws-sdk/credential-providers` (package.json spec)	`^3.348.0`	`^3.844.0`	Aligned with `client-secrets-manager` (same version group); parent of `@aws-sdk/core`
`@aws-sdk/credential-providers` (lockfile resolved)	`3.840.0`	`3.1117.0`	Parent bump resolved to latest compatible
`@aws-sdk/core`	`3.840.0`	`3.977.9`	Transitive after parent bump (`@aws-sdk/client-secrets-manager`); new version drops `fast-xml-parser`
`fast-xml-parser`	`4.4.1`	(removed)	Vulnerable package eliminated; no longer in dep tree at new `@aws-sdk/core`
`fast-uri`	`3.0.6`	(removed)	Vulnerable package eliminated; no longer in dep tree at new `aws-cdk-lib`
`@smithy/config-resolver`	`4.1.4`	(removed)	Vulnerable package eliminated; no longer in dep tree at new `@aws-sdk` versions
`yaml` (in `aws-cdk-lib`)	`1.10.2`	`1.10.3`	Transitive after parent bump (`aws-cdk-lib`)
`minimatch` (in `aws-cdk-lib`)	`3.1.2`	`10.2.5`	Transitive after parent bump (`aws-cdk-lib`)
`minimatch` (root)	`3.1.2`	`3.1.5`	Lockfile refresh via `npm update`; within declared `^3.1.2` range
`minimatch` (in `filelist`)	`5.1.6`	`5.1.9`	Lockfile refresh via `npm update`; within declared `^5.0.1` range
`brace-expansion` (in `aws-cdk-lib`)	`1.1.12`	`5.0.9`	Transitive after parent bump (`aws-cdk-lib` → `minimatch@10.2.5`)
`brace-expansion` (root)	`1.1.12`	`1.1.18`	Lockfile refresh via `npm update`; within `minimatch@3.x` declared `^1.1.7` range
`brace-expansion` (in `filelist`)	`2.0.2`	`2.1.4`	Lockfile refresh via `npm update`; within `minimatch@5.x` declared `^2.0.1` range
`fs-extra` (in `aws-cdk-lib`)	`11.3.0`	`11.3.6`	Transitive after parent bump (`aws-cdk-lib`)
`ajv` (in `aws-cdk-lib`)	`8.17.1`	(removed)	Eliminated; `aws-cdk-lib@2.266.0` no longer nests `ajv@8.x`
`ajv` (root)	`6.12.6`	`6.15.0`	Lockfile refresh via `npm update`; within `eslint` declared `^6.12.4` range
`@aws-sdk/client-cognito-identity`	`3.840.0`	(updated transitively)	Transitive after `@aws-sdk` parent bump
`@aws-sdk/client-sso`	`3.840.0`	(updated transitively)	Transitive after `@aws-sdk` parent bump
`@aws-sdk/nested-clients`	`3.840.0`	(updated transitively)	Transitive after `@aws-sdk` parent bump
`@smithy/util-defaults-mode-node`	`4.0.21`	(updated transitively)	Transitive after `@aws-sdk` parent bump

github-actions · 2026-08-27T00:05:28Z

Package lock diff

 2.4.1 -> 2.6.1
node_modules/@aws-cdk/asset-awscli-v1 2.2.242 -> 2.2.292
node_modules/@aws-cdk/asset-node-proxy-agent-v6 2.1.0 -> 2.1.2
node_modules/@aws-cdk/cloud-assembly-schema 45.2.0 -> 54.20.0
node_modules/@aws-cdk/cloud-assembly-schema/node_modules/jsonschema 1.4.1 -> 1.5.0
node_modules/@aws-cdk/cloud-assembly-schema/node_modules/semver 7.7.2 -> 7.8.5
node_modules/@aws-crypto/sha256-browser removed
node_modules/@aws-crypto/sha256-browser/node_modules/@smithy/is-array-buffer removed
node_modules/@aws-crypto/sha256-browser/node_modules/@smithy/util-buffer-from removed
node_modules/@aws-crypto/sha256-browser/node_modules/@smithy/util-utf8 removed
node_modules/@aws-crypto/sha256-js removed
node_modules/@aws-crypto/supports-web-crypto removed
node_modules/@aws-crypto/util removed
node_modules/@aws-crypto/util/node_modules/@smithy/is-array-buffer removed
node_modules/@aws-crypto/util/node_modules/@smithy/util-buffer-from removed
node_modules/@aws-crypto/util/node_modules/@smithy/util-utf8 removed
node_modules/@aws-sdk/client-cognito-identity removed
node_modules/@aws-sdk/client-secrets-manager 3.840.0 -> 3.1117.0
node_modules/@aws-sdk/client-sso removed
node_modules/@aws-sdk/core 3.840.0 -> 3.977.9
node_modules/@aws-sdk/credential-provider-cognito-identity 3.840.0 -> 3.972.69
node_modules/@aws-sdk/credential-provider-env 3.840.0 -> 3.972.70
node_modules/@aws-sdk/credential-provider-http 3.840.0 -> 3.972.72
node_modules/@aws-sdk/credential-provider-ini 3.840.0 -> 3.973.15
node_modules/@aws-sdk/credential-provider-node 3.840.0 -> 3.972.81
node_modules/@aws-sdk/credential-provider-process 3.840.0 -> 3.972.70
node_modules/@aws-sdk/credential-provider-sso 3.840.0 -> 3.973.14
node_modules/@aws-sdk/credential-provider-web-identity 3.840.0 -> 3.972.76
node_modules/@aws-sdk/credential-providers 3.840.0 -> 3.1117.0
node_modules/@aws-sdk/middleware-host-header removed
node_modules/@aws-sdk/middleware-logger removed
node_modules/@aws-sdk/middleware-recursion-detection removed
node_modules/@aws-sdk/middleware-user-agent removed
node_modules/@aws-sdk/nested-clients 3.840.0 -> 3.997.44
node_modules/@aws-sdk/region-config-resolver removed
node_modules/@aws-sdk/token-providers 3.840.0 -> 3.1116.0
node_modules/@aws-sdk/types 3.840.0 -> 3.974.5
node_modules/@aws-sdk/util-endpoints removed
node_modules/@aws-sdk/util-locate-window removed
node_modules/@aws-sdk/util-user-agent-browser removed
node_modules/@aws-sdk/util-user-agent-node removed
node_modules/@aws-sdk/xml-builder 3.821.0 -> 3.972.40
node_modules/@smithy/abort-controller removed
node_modules/@smithy/config-resolver removed
node_modules/@smithy/core 3.6.0 -> 3.33.3
node_modules/@smithy/credential-provider-imds 4.0.6 -> 4.5.2
node_modules/@smithy/fetch-http-handler 5.0.4 -> 5.7.2
node_modules/@smithy/hash-node removed
node_modules/@smithy/invalid-dependency removed
node_modules/@smithy/is-array-buffer removed
node_modules/@smithy/middleware-content-length removed
node_modules/@smithy/middleware-endpoint removed
node_modules/@smithy/middleware-retry removed
node_modules/@smithy/middleware-serde removed
node_modules/@smithy/middleware-stack removed
node_modules/@smithy/node-config-provider removed
node_modules/@smithy/node-http-handler 4.0.6 -> 4.11.3
node_modules/@smithy/property-provider removed
node_modules/@smithy/protocol-http removed
node_modules/@smithy/querystring-builder removed
node_modules/@smithy/querystring-parser removed
node_modules/@smithy/service-error-classification removed
node_modules/@smithy/shared-ini-file-loader removed
node_modules/@smithy/signature-v4 5.1.2 -> 5.7.3
node_modules/@smithy/smithy-client removed
node_modules/@smithy/types 4.3.1 -> 4.17.2
node_modules/@smithy/url-parser removed
node_modules/@smithy/util-base64 removed
node_modules/@smithy/util-body-length-browser removed
node_modules/@smithy/util-body-length-node removed
node_modules/@smithy/util-buffer-from removed
node_modules/@smithy/util-config-provider removed
node_modules/@smithy/util-defaults-mode-browser removed
node_modules/@smithy/util-defaults-mode-node removed
node_modules/@smithy/util-endpoints removed
node_modules/@smithy/util-hex-encoding removed
node_modules/@smithy/util-middleware removed
node_modules/@smithy/util-retry removed
node_modules/@smithy/util-stream removed
node_modules/@smithy/util-uri-escape removed
node_modules/@smithy/util-utf8 removed
node_modules/@types/uuid removed
node_modules/ajv 6.12.6 -> 6.15.0
node_modules/aws-cdk-lib 2.204.0 -> 2.266.0
node_modules/aws-cdk-lib/node_modules/ajv removed
node_modules/aws-cdk-lib/node_modules/ansi-regex removed
node_modules/aws-cdk-lib/node_modules/ansi-styles removed
node_modules/aws-cdk-lib/node_modules/astral-regex removed
node_modules/aws-cdk-lib/node_modules/balanced-match 1.0.2 -> 4.0.4
node_modules/aws-cdk-lib/node_modules/brace-expansion 1.1.12 -> 5.0.9
node_modules/aws-cdk-lib/node_modules/color-convert removed
node_modules/aws-cdk-lib/node_modules/color-name removed
node_modules/aws-cdk-lib/node_modules/concat-map removed
node_modules/aws-cdk-lib/node_modules/emoji-regex removed
node_modules/aws-cdk-lib/node_modules/fast-deep-equal removed
node_modules/aws-cdk-lib/node_modules/fast-uri removed
node_modules/aws-cdk-lib/node_modules/fs-extra 11.3.0 -> 11.3.6
node_modules/aws-cdk-lib/node_modules/is-fullwidth-code-point removed
node_modules/aws-cdk-lib/node_modules/json-schema-traverse removed
node_modules/aws-cdk-lib/node_modules/jsonfile 6.1.0 -> 6.2.1
node_modules/aws-cdk-lib/node_modules/lodash.truncate removed
node_modules/aws-cdk-lib/node_modules/minimatch 3.1.2 -> 10.2.5
node_modules/aws-cdk-lib/node_modules/require-from-string removed
node_modules/aws-cdk-lib/node_modules/semver 7.7.2 -> 7.8.5
node_modules/aws-cdk-lib/node_modules/slice-ansi removed
node_modules/aws-cdk-lib/node_modules/string-width removed
node_modules/aws-cdk-lib/node_modules/strip-ansi removed
node_modules/aws-cdk-lib/node_modules/table removed
node_modules/aws-cdk-lib/node_modules/yaml 1.10.2 -> 1.10.3
node_modules/bowser 2.11.0 -> 2.14.1
node_modules/brace-expansion 1.1.12 -> 1.1.18
node_modules/constructs 10.4.2 -> 10.8.1
node_modules/fast-xml-parser removed
node_modules/filelist/node_modules/brace-expansion 2.0.2 -> 2.1.4
node_modules/filelist/node_modules/minimatch 5.1.6 -> 5.1.9
node_modules/minimatch 3.1.2 -> 3.1.5
node_modules/strnum removed
node_modules/uuid removed
node_modules/@aws-sdk/credential-provider-login added
node_modules/@aws-sdk/signature-v4-multi-region added
node_modules/@aws/lambda-invoke-store added
node_modules/aws-cdk-lib/node_modules/@aws-cdk/cloud-assembly-api added
node_modules/aws-cdk-lib/node_modules/@aws/cloudformation-validate added

aikido-autofix · 2026-09-04T00:33:24Z

Closed by Aikido: a new AutoFix has been created → #57

fix(security): update dependencies

e5c1a45

aikido-autofix Bot mentioned this pull request Aug 27, 2026

[Aikido] Fix 33 security issues in fast-xml-parser, fast-uri, brace-expansion and 6 more #55

Closed

aikido-autofix Bot closed this Sep 4, 2026

aikido-autofix Bot deleted the fix/aikido-security-update-packages-98482257-853z branch September 4, 2026 00:33

Navigation Menu

[Aikido] Fix 35 security issues in fast-xml-parser, fast-uri, brace-expansion and 6 more - #56

[Aikido] Fix 35 security issues in fast-xml-parser, fast-uri, brace-expansion and 6 more#56
aikido-autofix[bot] wants to merge 1 commit into
masterfrom
fix/aikido-security-update-packages-98482257-853z

aikido-autofix Bot commented Aug 27, 2026

Uh oh!

github-actions Bot commented Aug 27, 2026

Uh oh!

aikido-autofix Bot commented Sep 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

Conversation

aikido-autofix Bot commented Aug 27, 2026

Short summary

fast-xml-parser

fast-uri

brace-expansion

aws-cdk-lib

yaml

minimatch

@smithy/config-resolver

ajv

fs-extra

Version changes

Uh oh!

github-actions Bot commented Aug 27, 2026

Package lock diff

Uh oh!

aikido-autofix Bot commented Sep 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants