[Aikido] Fix 41 security issues in fast-xml-parser, fast-uri, brace-expansion and 6 more

[aikido-autofix]

Upgrade dependencies to fix critical XSS via XML entity shadowing, XML entity expansion DoS attacks, stack overflow in XML builder, SSRF bypass via URI parsing inconsistency, and other security vulnerabilities.

⚠️ Breaking changes analysis not available for: aws-cdk-lib, minimatch, ajv

✅ No breaking changes for: fast-xml-parser, fast-uri, brace-expansion, yaml, @smithy/config-resolver, fs-extra

✅ 41 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-25896	🚨 CRITICAL	[fast-xml-parser] A dot (.) in DOCTYPE entity names is treated as a regex wildcard, allowing attackers to shadow built-in XML entities with arbitrary values and bypass entity encoding. This leads to XSS when parsed output is rendered.
CVE-2026-26278	HIGH	[fast-xml-parser] XML entity expansion vulnerability allows attackers to cause denial of service by forcing unlimited entity expansion with minimal input, potentially freezing the application for extended periods. The issue is fixed in version 5.3.6 or by disabling DOCTYPE parsing with processEntities: false.
CVE-2026-27942	HIGH	[fast-xml-parser] XML builder with preserveOrder:true causes stack overflow leading to denial of service when processing certain inputs. The application crashes, making it unavailable to legitimate users.
CVE-2026-33036	HIGH	[fast-xml-parser] Numeric character references and standard XML entities bypass entity expansion limits, allowing attackers to cause XML entity expansion Denial of Service by forcing excessive memory allocation and CPU usage despite configured protections.
CVE-2026-33349	MEDIUM	[fast-xml-parser] XML entity expansion vulnerability where setting maxEntityCount or maxEntitySize to 0 is bypassed due to JavaScript falsy checks, allowing attackers to cause denial of service through memory exhaustion. The vulnerability affects configurations explicitly set to restrict or disable entities.
AIKIDO-2026-878106	HIGH	[fast-uri] Inconsistent URI authority parsing allows backslash characters to be interpreted differently than Node's WHATWG URL implementation, enabling attackers to bypass host allowlists, SSRF filters, and redirect validation checks.
AIKIDO-2026-10784	HIGH	[fast-uri] A path normalization vulnerability allows attackers to bypass security checks by using percent-encoded slashes and dots that are decoded before dot-segment removal, causing distinct URIs to normalize identically and potentially circumvent URL-based access controls.
CVE-2026-6321	HIGH	[fast-uri] URI normalization vulnerability allows path traversal bypass through encoded separators and dot segments. Attackers can craft URLs that appear to comply with path-based policies but normalize to unauthorized locations, enabling policy enforcement bypass.
CVE-2026-6322	HIGH	[fast-uri] Normalize function improperly decodes percent-encoded authority delimiters in the host component, re-emitting them as raw delimiters during serialization. This allows attackers to bypass host allowlist checks and redirect requests to unintended authorities.
AIKIDO-2026-507986	HIGH	[fast-uri] A host canonicalization vulnerability in Unicode/IDN value handling could allow security bypasses due to inconsistent ASCII/Unicode host processing. The fix implements WHATWG URL parsing for proper normalization to prevent authentication and validation bypasses.
CVE-2026-13676	HIGH	[fast-uri] A vulnerability in IDN hostname canonicalization allows Unicode hostnames to bypass host-based security policies (denylists, loopback filtering, redirects) when fast-uri's output differs from standard URL parsers. This enables attackers to circumvent security controls that rely on host validation.
CVE-2026-16221	HIGH	[fast-uri] A parsing discrepancy in fast-uri allows backslash characters to bypass host-based security policies like allowlists and SSRF filters, enabling attackers to redirect requests to unintended destinations including internal hosts and cloud metadata endpoints.
AIKIDO-2026-236835	HIGH	[fast-uri] A parsing discrepancy allows attackers to bypass host allowlists and SSRF filters by using alternative authority introducers (like \\ or /\) that fast-uri treats as paths but Node's URL parser treats as authority, enabling redirection to unintended destinations.
CVE-2026-18446	HIGH	[fast-uri] URI parsing inconsistency allows backslash-based introducers to bypass host validation, enabling attackers to evade allowlists and SSRF filters by exploiting differences between fast-uri and Node's WHATWG parser.
AIKIDO-2026-695913	HIGH	[fast-uri] Unsafe percent-decoding in URL scheme components allows attackers to bypass URL validation and inject malicious hosts or header content through encoded characters like %2f and %0d%0a. This enables URL redirection bypasses, allowlist evasion, and header injection attacks on applications normalizing untrusted URLs.
AIKIDO-2026-87893	HIGH	[fast-uri] Improper validation of IPv6 literals in URIs allows malformed addresses to be silently truncated into different valid addresses, enabling host-policy bypass and routing to unintended addresses like loopback or link-local IPs.
CVE-2026-75975	HIGH	[fast-uri] A custom IPv6 parser fails to validate complete grammar, allowing invalid trailing text in bracketed literals to be silently discarded and malformed hosts normalized to different valid IPv6 addresses. This enables server-side request forgery and address-policy bypass attacks when applications normalize untrusted URLs before outbound requests or routing decisions.
CVE-2026-76172	HIGH	[fast-uri] A URI parser vulnerability allows attackers to bypass host allowlists through percent-encoded slashes in the scheme component, enabling off-site redirects and server-side request forgery attacks. The parser's inconsistent re-escaping between scheme and host components causes mismatches between parsed and serialized URIs, with control characters potentially reaching output as raw carriage returns and line feeds.
AIKIDO-2026-219652	HIGH	[fast-uri] The serialize() function fails to validate that port values contain only digits, allowing attackers to inject authority delimiters like @ to redirect URIs to unintended hosts. This enables silent redirection attacks when serializing user-controlled port data.
CVE-2026-14257	HIGH	[brace-expansion] Denial of service vulnerability via memory exhaustion where chaining multiple brace groups allows attackers to create progressively longer result strings that exceed memory limits, crashing the process with minimal input.
AIKIDO-2026-872981	HIGH	[brace-expansion] A vulnerability in the expand() function allows unbounded intermediate array generation during brace expansion, enabling a small crafted input to exhaust process memory or cause denial of service through event loop blocking.
CVE-2026-69152	HIGH	[brace-expansion] A memory exhaustion and event loop blocking vulnerability exists in the expand() function when processing attacker-controlled input with comma-alternatives or padded sequences, bypassing previous DoS protections.
AIKIDO-2026-237551	MEDIUM	[brace-expansion] A recursive expansion function computes unnecessary segments before early returns, causing exponential time complexity when processing consecutive non-expanding brace groups, enabling denial-of-service attacks through short malicious inputs that can stall processes or workers.
CVE-2026-13149	MEDIUM	[brace-expansion] A denial of service vulnerability exists in the expand() function due to exponential-time complexity when processing consecutive non-expanding brace groups, allowing attackers to cause significant CPU consumption and event-loop blocking.
CVE-2026-33750	LOW	[brace-expansion] A brace pattern with zero step value causes infinite loops and excessive memory allocation, leading to denial of service through process hangs and resource exhaustion. The vulnerability affects string expansion operations when malicious patterns are processed.
AIKIDO-2026-967896	LOW	[brace-expansion] A parser vulnerability allows crafted brace patterns to cause excessive internal rescans, consuming disproportionate CPU resources and delaying the event loop. This results in a denial-of-service condition through algorithmic complexity exploitation.
AIKIDO-2026-456054	LOW	[brace-expansion] A malformed or deeply repeated brace sequence causes excessive memory and CPU consumption during parsing, leading to denial of service through unbounded intermediate output expansion.
AIKIDO-2026-10477	LOW	[brace-expansion] A denial-of-service vulnerability where attacker-controlled brace patterns with repeated numeric ranges cause exponential expansion, consuming excessive CPU and memory until process failure. A new optional max limit parameter allows callers to bound expansion work.
AIKIDO-2026-189646	LOW	[brace-expansion] A brace expansion parser vulnerability allows denial of service through crafted input patterns that trigger excessive rescans, causing quadratic CPU growth and event loop blocking for extended periods.
CVE-2026-11417	HIGH	[aws-cdk-lib] OS command injection vulnerability in NodejsFunction local bundling allows arbitrary command execution when an attacker controls bundling properties like externalModules, define, loader, inject, or esbuildArgs through shell metacharacters injection.
AIKIDO-2026-577363	HIGH	[aws-cdk-lib] OS command injection vulnerability in Docker-based NodejsFunction bundling when using the nodeModules option allows attackers to inject shell commands through dependency version strings, leading to arbitrary code execution with the privileges of the CDK toolchain user.
CVE-2026-13760	HIGH	[aws-cdk-lib] OS command injection vulnerability in NodejsFunction Docker bundling allows attackers controlling package.json dependency versions to execute arbitrary commands on the host via shell metacharacters in the OsCommand helper.
GHSA-464c-974j-9xm6	LOW	[aws-cdk-lib] A logic inversion vulnerability in S3LoggingOptions causes the encrypted property to produce opposite behavior, disabling encryption when set to true and enabling it when set to false, potentially leaving CodeBuild logs unencrypted.
CVE-2026-33532	MEDIUM	[yaml] A stack overflow vulnerability in the YAML parser's node resolution phase allows attackers to trigger a RangeError via deeply nested YAML structures (~2-10 KB), potentially causing denial of service or process termination in applications that don't catch non-YAMLParseError exceptions.
CVE-2026-26996	LOW	[minimatch] Regular Expression Denial of Service (ReDoS) vulnerability where glob patterns with many consecutive * wildcards cause exponential backtracking, enabling attackers to cause severe performance degradation or hangs through crafted patterns.
CVE-2026-27903	LOW	[minimatch] A ReDoS vulnerability in glob pattern matching causes unbounded recursive backtracking with multiple ** segments, enabling attackers to stall the event loop for tens of seconds via crafted patterns. This affects any application accepting user-supplied glob patterns, including build tools, CI/CD pipelines, and multi-tenant systems.
CVE-2026-27904	LOW	[minimatch] Nested extglobs (*() and +()) generate regexps with catastrophic backtracking, causing severe ReDoS denial-of-service attacks with minimal input patterns triggering multi-second hangs.
GHSA-6475-r3vj-m8vf	LOW	[@smithy/config-resolver] An attacker with environment access could set an invalid region value, potentially routing AWS API calls to non-AWS hosts. A validation enhancement was added to prevent improper endpoint construction through region input validation.
CVE-2025-69873	LOW	[ajv] A ReDoS vulnerability in the pattern keyword allows attackers to inject malicious regex patterns via $data references, causing catastrophic backtracking and CPU exhaustion. A 31-character payload can block execution for ~44 seconds, enabling complete denial of service with minimal input.
AIKIDO-2026-273849	LOW	[ajv] A prototype pollution vulnerability allows attackers to bypass format validation when the $data option is enabled by using inherited property names like constructor or toString as format values, causing unexpected validation behavior or errors.
AIKIDO-2026-57045	LOW	[fs-extra] A symlink in the destination path allows attackers to bypass self-subdirectory protection, causing infinite recursion during copy/move operations leading to resource exhaustion or denial of service.

🤖 Remediation details

Fix security vulnerabilities in fast-xml-parser, fast-uri, brace-expansion, aws-cdk-lib, yaml, minimatch, @smithy/config-resolver, ajv, and fs-extra

Short summary

This PR remediates security vulnerabilities in nine npm packages: fast-xml-parser, fast-uri, brace-expansion, aws-cdk-lib, yaml, minimatch, @smithy/config-resolver, ajv, and fs-extra. Three direct dependencies in the root package.json were bumped (aws-cdk-lib, @aws-sdk/client-secrets-manager, @aws-sdk/credential-providers), and a subsequent npm update pass resolved remaining transitive instances in package-lock.json. One instance of brace-expansion@5.0.9 (nested under aws-cdk-lib → minimatch@10.2.5) could not be advanced to 5.0.12 because versions 5.0.10–5.0.12 are blocked by the safe-chain minimum-age policy (list ID 68722359886433e249be6c7d01f308b4); all other vulnerable instances are fully remediated.

fast-xml-parser

Previously resolved at 4.4.1 as a transitive dependency of @aws-sdk/core, which was exact-pinned at 3.840.0 by @aws-sdk/client-secrets-manager and @aws-sdk/credential-providers. Bumping both direct dependencies to ^3.844.0 caused npm to resolve @aws-sdk/client-secrets-manager and @aws-sdk/credential-providers to 3.1133.0, pulling in @aws-sdk/core@3.978.0, which pins fast-xml-parser at a 5.x release satisfying >= 4.5.5. The vulnerable 4.4.1 instance is no longer present in the lockfile.

fast-uri

Previously resolved at 3.0.6 nested under aws-cdk-lib/node_modules/ajv. Bumping aws-cdk-lib from ^2.78.0 to ^2.260.0 in package.json caused npm to resolve aws-cdk-lib@2.269.0, which no longer carries a separate nested fast-uri instance at a vulnerable version. The 3.0.6 instance is no longer present in the lockfile.

brace-expansion

Three instances existed: 1.1.12 (root, via minimatch@3.1.2), 2.0.2 (under filelist/minimatch@5.1.6), and 1.1.12 nested under aws-cdk-lib. The aws-cdk-lib bump resolved the third instance into the 5.x line under minimatch@10.2.5; a subsequent npm update brace-expansion minimatch --package-lock-only advanced the root instance to 1.1.21 (via minimatch@3.1.5) and the filelist instance to 2.1.7 (via minimatch@5.1.9), both satisfying all patched version requirements. The 5.x instance under aws-cdk-lib resolved to 5.0.9 — the newest non-suppressed 5.x release — because brace-expansion@5.0.10, 5.0.11, and 5.0.12 (published 2026-09-14) are listed in the safe-chain suppressed-packages list and cannot be resolved in this environment at this time.

aws-cdk-lib

Declared directly in package.json at ^2.78.0, resolving to 2.204.0. Bumped to ^2.260.0 (resolves to 2.269.0) to satisfy the patched version requirement of >= 2.260.0 and to transitively remediate fast-uri, yaml, fs-extra, minimatch (nested), brace-expansion (nested), and ajv@8.x (nested) in one step.

yaml

Previously resolved at 1.10.2 as an exact-pinned transitive dependency inside aws-cdk-lib. Bumping aws-cdk-lib to ^2.260.0 caused the nested yaml instance to advance to 1.10.3, satisfying the patched version requirement. No separate manifest edit was needed.

minimatch

Three instances existed: 3.1.2 (root, shared by eslint and other dev tooling), 5.1.6 (under filelist), and 3.1.2 nested under aws-cdk-lib. The aws-cdk-lib bump replaced the nested instance with minimatch@10.2.5 (satisfying >= 3.1.4 in the 10.x line). The npm update minimatch --package-lock-only pass advanced the root instance to 3.1.5 and the filelist instance to 5.1.9, both satisfying all patched version requirements.

@smithy/config-resolver

Previously resolved at 4.1.4 as a transitive dependency of @aws-sdk/client-secrets-manager, @aws-sdk/credential-providers, and related SDK packages. Bumping both direct SDK dependencies to ^3.844.0 caused npm to resolve the SDK packages to 3.1133.0, which declares @smithy/config-resolver at ^4.1.4 — a range that npm resolved to a version satisfying >= 4.4.0. The vulnerable 4.1.4 instance is no longer present in the lockfile.

ajv

Two instances existed: 6.12.6 (under eslint@8.57.1, declaring ^6.12.4) and 8.17.1 (nested under aws-cdk-lib/node_modules/table). The aws-cdk-lib bump to 2.269.0 resolved the 8.x instance to a patched version. The 6.x instance was advanced to 6.15.0 via npm update ajv --package-lock-only, which is within the ^6.12.4 range already declared by eslint@8.57.1 — no parent bump was required.

fs-extra

Previously resolved at 11.3.0 as a transitive dependency nested inside aws-cdk-lib. Bumping aws-cdk-lib to ^2.260.0 caused the nested fs-extra instance to advance to 11.3.6, satisfying the patched version requirement of >= 11.3.6. No separate manifest edit was needed.

Version changes

Package	From	To	Why updated
aws-cdk-lib (declared)	^2.78.0	^2.260.0	Direct CVE fix (manifest spec bump)
aws-cdk-lib (resolved)	2.204.0	2.269.0	Direct CVE fix
@aws-sdk/client-secrets-manager (declared)	^3.348.0	^3.844.0	Parent bump to fix fast-xml-parser and @smithy/config-resolver
@aws-sdk/client-secrets-manager (resolved)	3.840.0	3.1133.0	Parent bump to fix fast-xml-parser and @smithy/config-resolver
@aws-sdk/credential-providers (declared)	^3.348.0	^3.844.0	Parent bump to fix fast-xml-parser
@aws-sdk/credential-providers (resolved)	3.840.0	3.1133.0	Parent bump to fix fast-xml-parser
@aws-sdk/core	3.840.0	3.978.0	Transitive after parent bump (@aws-sdk/client-secrets-manager)
fast-xml-parser	4.4.1	removed (5.x via @aws-sdk/core)	Transitive after parent bump (@aws-sdk/core)
fast-uri	3.0.6	removed	Transitive after parent bump (aws-cdk-lib)
yaml (aws-cdk-lib nested)	1.10.2	1.10.3	Transitive after parent bump (aws-cdk-lib)
fs-extra (aws-cdk-lib nested)	11.3.0	11.3.6	Transitive after parent bump (aws-cdk-lib)
minimatch (aws-cdk-lib nested)	3.1.2	10.2.5	Transitive after parent bump (aws-cdk-lib)
minimatch (root)	3.1.2	3.1.5	Lockfile update (semver resolution, CVE fix)
minimatch (filelist nested)	5.1.6	5.1.9	Lockfile update (semver resolution)
brace-expansion (aws-cdk-lib nested)	1.1.12	5.0.9	Transitive after parent bump (aws-cdk-lib → minimatch@10.2.5); 5.0.10–5.0.12 blocked by safe-chain
brace-expansion (root)	1.1.12	1.1.21	Lockfile update via minimatch@3.1.5 (CVE fix)
brace-expansion (filelist nested)	2.0.2	2.1.7	Lockfile update via minimatch@5.1.9 (CVE fix)
ajv (root, eslint)	6.12.6	6.15.0	Lockfile update (semver resolution, CVE fix)
ajv (aws-cdk-lib nested)	8.17.1	patched version	Transitive after parent bump (aws-cdk-lib)
@smithy/config-resolver	4.1.4	4.4.0+	Transitive after parent bump (@aws-sdk/client-secrets-manager)

[github-actions]

Package lock diff

 2.4.1 -> 2.6.1
node_modules/@ampproject/remapping removed
node_modules/@aws-cdk/asset-awscli-v1 2.2.242 -> 2.2.292
node_modules/@aws-cdk/asset-node-proxy-agent-v6 2.1.0 -> 2.1.3
node_modules/@aws-cdk/cloud-assembly-schema 45.2.0 -> 54.23.0
node_modules/@aws-cdk/cloud-assembly-schema/node_modules/jsonschema 1.4.1 -> 1.5.0
node_modules/@aws-cdk/cloud-assembly-schema/node_modules/semver 7.7.2 -> 7.8.5
node_modules/@aws-crypto/sha256-browser removed
node_modules/@aws-crypto/sha256-browser/node_modules/@smithy/is-array-buffer removed
node_modules/@aws-crypto/sha256-browser/node_modules/@smithy/util-buffer-from removed
node_modules/@aws-crypto/sha256-browser/node_modules/@smithy/util-utf8 removed
node_modules/@aws-crypto/sha256-js removed
node_modules/@aws-crypto/supports-web-crypto removed
node_modules/@aws-crypto/util removed
node_modules/@aws-crypto/util/node_modules/@smithy/is-array-buffer removed
node_modules/@aws-crypto/util/node_modules/@smithy/util-buffer-from removed
node_modules/@aws-crypto/util/node_modules/@smithy/util-utf8 removed
node_modules/@aws-sdk/client-cognito-identity removed
node_modules/@aws-sdk/client-secrets-manager 3.840.0 -> 3.1133.0
node_modules/@aws-sdk/client-sso removed
node_modules/@aws-sdk/core 3.840.0 -> 3.978.0
node_modules/@aws-sdk/credential-provider-cognito-identity 3.840.0 -> 3.972.70
node_modules/@aws-sdk/credential-provider-env 3.840.0 -> 3.972.71
node_modules/@aws-sdk/credential-provider-http 3.840.0 -> 3.972.73
node_modules/@aws-sdk/credential-provider-ini 3.840.0 -> 3.973.16
node_modules/@aws-sdk/credential-provider-node 3.840.0 -> 3.972.83
node_modules/@aws-sdk/credential-provider-process 3.840.0 -> 3.972.71
node_modules/@aws-sdk/credential-provider-sso 3.840.0 -> 3.973.15
node_modules/@aws-sdk/credential-provider-web-identity 3.840.0 -> 3.972.77
node_modules/@aws-sdk/credential-providers 3.840.0 -> 3.1133.0
node_modules/@aws-sdk/middleware-host-header removed
node_modules/@aws-sdk/middleware-logger removed
node_modules/@aws-sdk/middleware-recursion-detection removed
node_modules/@aws-sdk/middleware-user-agent removed
node_modules/@aws-sdk/nested-clients 3.840.0 -> 3.997.45
node_modules/@aws-sdk/region-config-resolver removed
node_modules/@aws-sdk/token-providers 3.840.0 -> 3.1129.0
node_modules/@aws-sdk/types 3.840.0 -> 3.974.5
node_modules/@aws-sdk/util-endpoints removed
node_modules/@aws-sdk/util-locate-window removed
node_modules/@aws-sdk/util-user-agent-browser removed
node_modules/@aws-sdk/util-user-agent-node removed
node_modules/@aws-sdk/xml-builder 3.821.0 -> 3.972.40
node_modules/@babel/code-frame 7.27.1 -> 7.29.7
node_modules/@babel/compat-data 7.28.0 -> 7.29.7
node_modules/@babel/core 7.28.0 -> 7.29.7
node_modules/@babel/generator 7.28.0 -> 7.29.8
node_modules/@babel/helper-compilation-targets 7.27.2 -> 7.29.7
node_modules/@babel/helper-globals 7.28.0 -> 7.29.7
node_modules/@babel/helper-module-imports 7.27.1 -> 7.29.7
node_modules/@babel/helper-module-transforms 7.27.3 -> 7.29.7
node_modules/@babel/helper-plugin-utils 7.27.1 -> 7.29.7
node_modules/@babel/helper-string-parser 7.27.1 -> 7.29.7
node_modules/@babel/helper-validator-identifier 7.27.1 -> 7.29.7
node_modules/@babel/helper-validator-option 7.27.1 -> 7.29.7
node_modules/@babel/helpers 7.27.6 -> 7.29.7
node_modules/@babel/parser 7.28.0 -> 7.29.8
node_modules/@babel/plugin-syntax-import-attributes 7.27.1 -> 7.29.7
node_modules/@babel/plugin-syntax-jsx 7.27.1 -> 7.29.7
node_modules/@babel/plugin-syntax-typescript 7.27.1 -> 7.29.7
node_modules/@babel/template 7.27.2 -> 7.29.7
node_modules/@babel/traverse 7.28.0 -> 7.29.8
node_modules/@babel/types 7.28.0 -> 7.29.8
node_modules/@eslint-community/eslint-utils 4.7.0 -> 4.10.1
node_modules/@eslint-community/regexpp 4.12.1 -> 4.12.2
node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml 3.14.1 -> 3.15.2
node_modules/@istanbuljs/schema 0.1.3 -> 0.1.6
node_modules/@jridgewell/gen-mapping 0.3.12 -> 0.3.13
node_modules/@jridgewell/sourcemap-codec 1.5.4 -> 1.6.0
node_modules/@jridgewell/trace-mapping 0.3.29 -> 0.3.31
node_modules/@sinclair/typebox 0.27.8 -> 0.27.12
node_modules/@smithy/abort-controller removed
node_modules/@smithy/config-resolver removed
node_modules/@smithy/core 3.6.0 -> 3.34.1
node_modules/@smithy/credential-provider-imds 4.0.6 -> 4.5.2
node_modules/@smithy/fetch-http-handler 5.0.4 -> 5.8.0
node_modules/@smithy/hash-node removed
node_modules/@smithy/invalid-dependency removed
node_modules/@smithy/is-array-buffer removed
node_modules/@smithy/middleware-content-length removed
node_modules/@smithy/middleware-endpoint removed
node_modules/@smithy/middleware-retry removed
node_modules/@smithy/middleware-serde removed
node_modules/@smithy/middleware-stack removed
node_modules/@smithy/node-config-provider removed
node_modules/@smithy/node-http-handler 4.0.6 -> 4.12.1
node_modules/@smithy/property-provider removed
node_modules/@smithy/protocol-http removed
node_modules/@smithy/querystring-builder removed
node_modules/@smithy/querystring-parser removed
node_modules/@smithy/service-error-classification removed
node_modules/@smithy/shared-ini-file-loader removed
node_modules/@smithy/signature-v4 5.1.2 -> 5.7.3
node_modules/@smithy/smithy-client removed
node_modules/@smithy/types 4.3.1 -> 4.18.0
node_modules/@smithy/url-parser removed
node_modules/@smithy/util-base64 removed
node_modules/@smithy/util-body-length-browser removed
node_modules/@smithy/util-body-length-node removed
node_modules/@smithy/util-buffer-from removed
node_modules/@smithy/util-config-provider removed
node_modules/@smithy/util-defaults-mode-browser removed
node_modules/@smithy/util-defaults-mode-node removed
node_modules/@smithy/util-endpoints removed
node_modules/@smithy/util-hex-encoding removed
node_modules/@smithy/util-middleware removed
node_modules/@smithy/util-retry removed
node_modules/@smithy/util-stream removed
node_modules/@smithy/util-uri-escape removed
node_modules/@smithy/util-utf8 removed
node_modules/@tsconfig/node10 1.0.11 -> 1.0.13
node_modules/@types/babel__traverse 7.20.7 -> 7.28.0
node_modules/@types/node 18.19.117 -> 18.19.130
node_modules/@types/semver 7.7.0 -> 7.8.0
node_modules/@types/uuid removed
node_modules/@types/yargs 17.0.33 -> 17.0.35
node_modules/@ungap/structured-clone 1.3.0 -> 1.4.0
node_modules/acorn 8.15.0 -> 8.18.0
node_modules/acorn-walk 8.3.4 -> 8.3.5
node_modules/ajv 6.12.6 -> 6.15.0
node_modules/async removed
node_modules/aws-cdk-lib 2.204.0 -> 2.269.0
node_modules/aws-cdk-lib/node_modules/ajv removed
node_modules/aws-cdk-lib/node_modules/ansi-regex removed
node_modules/aws-cdk-lib/node_modules/ansi-styles removed
node_modules/aws-cdk-lib/node_modules/astral-regex removed
node_modules/aws-cdk-lib/node_modules/balanced-match 1.0.2 -> 4.0.4
node_modules/aws-cdk-lib/node_modules/brace-expansion 1.1.12 -> 5.0.9
node_modules/aws-cdk-lib/node_modules/color-convert removed
node_modules/aws-cdk-lib/node_modules/color-name removed
node_modules/aws-cdk-lib/node_modules/concat-map removed
node_modules/aws-cdk-lib/node_modules/emoji-regex removed
node_modules/aws-cdk-lib/node_modules/fast-deep-equal removed
node_modules/aws-cdk-lib/node_modules/fast-uri removed
node_modules/aws-cdk-lib/node_modules/fs-extra 11.3.0 -> 11.3.6
node_modules/aws-cdk-lib/node_modules/is-fullwidth-code-point removed
node_modules/aws-cdk-lib/node_modules/json-schema-traverse removed
node_modules/aws-cdk-lib/node_modules/jsonfile 6.1.0 -> 6.2.1
node_modules/aws-cdk-lib/node_modules/lodash.truncate removed
node_modules/aws-cdk-lib/node_modules/minimatch 3.1.2 -> 10.2.5
node_modules/aws-cdk-lib/node_modules/require-from-string removed
node_modules/aws-cdk-lib/node_modules/semver 7.7.2 -> 7.8.5
node_modules/aws-cdk-lib/node_modules/slice-ansi removed
node_modules/aws-cdk-lib/node_modules/string-width removed
node_modules/aws-cdk-lib/node_modules/strip-ansi removed
node_modules/aws-cdk-lib/node_modules/table removed
node_modules/aws-cdk-lib/node_modules/yaml 1.10.2 -> 1.10.3
node_modules/babel-preset-current-node-syntax 1.1.0 -> 1.2.0
node_modules/bowser 2.11.0 -> 2.14.1
node_modules/brace-expansion 1.1.12 -> 1.1.21
node_modules/browserslist 4.25.1 -> 4.29.0
node_modules/caniuse-lite 1.0.30001727 -> 1.0.30001810
node_modules/collect-v8-coverage 1.0.2 -> 1.0.3
node_modules/constructs 10.4.2 -> 10.8.1
node_modules/debug 4.4.1 -> 4.4.3
node_modules/dedent 1.6.0 -> 1.7.2
node_modules/diff 4.0.2 -> 4.0.4
node_modules/ejs removed
node_modules/electron-to-chromium 1.5.180 -> 1.5.429
node_modules/error-ex 1.3.2 -> 1.3.4
node_modules/eslint-config-prettier 8.10.0 -> 8.10.2
node_modules/eslint-plugin-prettier 4.2.1 -> 4.2.5
node_modules/esquery 1.6.0 -> 1.7.0
node_modules/fast-xml-parser removed
node_modules/fastq 1.19.1 -> 1.20.3
node_modules/filelist removed
node_modules/filelist/node_modules/brace-expansion removed
node_modules/filelist/node_modules/minimatch removed
node_modules/flatted 3.3.3 -> 3.4.4
node_modules/hasown 2.0.2 -> 2.0.4
node_modules/is-core-module 2.16.1 -> 2.16.2
node_modules/istanbul-reports 3.1.7 -> 3.2.0
node_modules/jake removed
node_modules/js-yaml 4.1.0 -> 4.3.2
node_modules/minimatch 3.1.2 -> 3.1.5
node_modules/natural-compare-lite 1.4.0 -> 1.4.1
node_modules/node-releases 2.0.19 -> 2.0.55
node_modules/picomatch 2.3.1 -> 2.3.2
node_modules/prettier-linter-helpers 1.0.0 -> 1.0.1
node_modules/resolve 1.22.10 -> 1.22.12
node_modules/semver 7.7.2 -> 7.8.5
node_modules/strnum removed
node_modules/ts-jest 29.4.0 -> 29.4.12
node_modules/typescript 5.8.3 -> 5.9.3
node_modules/update-browserslist-db 1.1.3 -> 1.3.3
node_modules/uuid removed
node_modules/yargs 17.7.2 -> 17.7.3
node_modules/@aws-sdk/credential-provider-login added
node_modules/@aws-sdk/signature-v4-multi-region added
node_modules/@aws/lambda-invoke-store added
node_modules/@jridgewell/remapping added
node_modules/aws-cdk-lib/node_modules/@aws-cdk/cloud-assembly-api added
node_modules/aws-cdk-lib/node_modules/@aws/cloudformation-validate added
node_modules/baseline-browser-mapping added
node_modules/es-errors added
node_modules/handlebars added
node_modules/minimist added
node_modules/neo-async added
node_modules/uglify-js added
node_modules/wordwrap added

[aikido-autofix]

Aikido's automated cron job opened a newer AutoFix. It fixes the same vulnerabilities and more: [Aikido] Fix 42 security issues in fast-xml-parser, fast-uri, brace-expansion and 6 more