[Aikido] Fix 19 security issues in fast-xml-parser, fast-uri, aws-cdk-lib and 5 more

[aikido-autofix]

Upgrade dependencies to fix critical XML entity injection XSS, XML entity expansion DoS attacks, stack overflow in XML builder, URI normalization bypass, and other security vulnerabilities.

⚠️ Incomplete breaking changes analysis (5/8 analyzed)

⚠️ Breaking changes analysis not available for: brace-expansion, minimatch, ajv

All breaking changes by upgrading aws-cdk-lib from version 2.204.0 to 2.260.0 (CHANGELOG)

Version	Description
2.205.0	L1 resource aws-cdk-lib.aws_ec2.CfnTrafficMirrorFilterRule: Id attribute was removed
2.205.0	L1 resource aws-cdk-lib.aws_kinesis.StreamConsumer: Id attribute was removed
2.205.0	L1 resource aws-cdk-lib.aws_neptune.DBInstance: Id attribute was removed
2.211.0	L1 resource aws-opsworkscm: CfnServer resource is no longer provisionable (AWS::OpsWorksCM::Server). Service is on deprecation path
2.211.0	L1 resource aws-iotfleetwise: Properties DataDestinationConfigs, SignalsToCollect and SignalsToFetch in resource CfnCampaign are now marked as immutable (they will cause a replacement of the resource if updated)
2.212.0	L1 resource aws-rds: AWS::RDS::DBInstance:StatusInfos property is removed
2.212.0	L1 resource aws-sagemaker: AWS::SageMaker::Domain: SingleSignOnApplicationArn property is removed
2.212.0	L1 resource aws-cloudfront: AWS::CloudFront::Function: Name property is now set as immutable
2.214.0	L1 resource aws-ecs: AWS::ECS::Service: AvailabilityZoneRebalancing property default value changed from "ENABLED" to "DISABLED"
2.219.0	L1 resource aws-servicecatalog: AWS::ServiceCatalog::PortfolioPrincipalAssociation: PortfolioId property is now required
2.219.0	L1 resource aws-servicecatalog: AWS::ServiceCatalog::PortfolioPrincipalAssociation: PrincipalARN property is now required
2.219.0	L1 resource aws-servicecatalog: AWS::ServiceCatalog::PortfolioProductAssociation: Id attribute removed
2.220.0	L1 resource aws-neptune: AWS::Neptune::EventSubscription: SnsTopicArn property is now required
2.220.0	L1 resource aws-neptune: AWS::Neptune::EventSubscription: Id attribute removed
2.220.0	L1 resource aws-servicecatalog: AWS::ServiceCatalog::PortfolioShare: Id attribute removed
2.220.0	L1 resource aws-lex: AWS::Lex::ResourcePolicy: ResourceArn property is now immutable
2.220.0	batch: ec2 Managed Compute Environment support default instance classes, deprecate useOptimalInstanceClasses
2.221.0	L1 resource aws-datazone: AWS::DataZone::ProjectProfile: Id property removed
2.221.0	L1 resource aws-logs: AWS::Logs::DeliveryDestination: DeliveryDestinationType attribute removed
2.221.0	L1 resource aws-s3: AWS::S3::AccessGrantsLocation: IamRoleArn property is now required
2.221.0	L1 resource aws-s3: AWS::S3::AccessGrantsLocation: LocationScope property is now required
2.221.0	L1 resource aws-servicecatalog: AWS::ServiceCatalog::TagOptionAssociation: Id attribute removed
2.222.0	bedrock-agentcore: The signature of RuntimeAuthorizerConfiguration.usingCognito() has changed to accept IUserPool and IUserPoolClient constructs instead of string parameters, and now supports multiple clients
2.223.0	L1 resource aws-dynamodb: AWS::DynamoDB::GlobalTable: GlobalTableSettingsReplicationMode property removed
2.223.0	L1 resource aws-dynamodb: AWS::DynamoDB::GlobalTable: GlobalTableSourceArn property removed
2.223.0	L1 resource aws-dynamodb: AWS::DynamoDB::Table: GlobalTableSettingsReplicationMode property removed
2.223.0	L1 resource aws-events: AWS::Events::EventBusPolicy: Id attribute removed
2.224.0	aws-cdk-lib: Reference interfaces (such as IBucketRef, IRoleRef, etc.) were moved to a new aws-cdk-lib.interfaces submodule to prevent cyclic dependencies between service modules
2.224.0	Amazon.CDK.Lib (.NET): The .NET namespace for multiple submodules has changed
2.224.0	L1 resource aws-opensearchserverless: AWS::OpenSearchServerless::Collection: StandbyReplicas property is now immutable
2.224.0	L1 resource aws-servicecatalog: AWS::ServiceCatalog::PortfolioPrincipalAssociation: Id attribute removed
2.225.0	L1 resource aws-dynamodb: AWS::DynamoDB::GlobalTable: ResourcePolicy property is now required
2.227.0	L1 resource aws-backup: AWS::Backup::LogicallyAirGappedBackupVault: EncryptionKeyArn attribute removed
2.233.0	aws-ec2: AWS::EC2::EC2Fleet properties DefaultTargetCapacityType and TargetCapacityUnitType are now immutable.
2.233.0	bedrock-agentcore-alpha: Runtime constructs will no longer automatically include lifecycleConfiguration with default values when not explicitly specified by users.
2.233.0	elasticache-alpha: The engine property in NoPasswordUserProps has been removed.
2.234.0	batch: JobQueue.computeEnvironments property now contains computeEnvironment: IComputeEnvironment → IComputeEnvironmentRef, requiring casting for fewer guarantees.
2.234.0	backup: BackupPlanRule.props property now contains backupVault: IBackupVault → IBackupVaultRef, requiring casting for fewer guarantees.
2.234.0	aws-securityhub: Multiple L1 properties and types removed from AWS::SecurityHub::ConnectorV2 including Provider.JiraCloud.AuthStatus, Provider.JiraCloud.AuthUrl, Provider.JiraCloud.CloudId, Provider.JiraCloud.Domain, Provider.ServiceNow.AuthStatus, and types JiraCloud and ServiceNow.
2.234.0	aws-ssm: AWS::SSM::MaintenanceWindowTarget attribute Id removed.
2.235.0	aws-ecs: AWS::ECS::CapacityProvider property ManagedInstancesNetworkConfiguration.SecurityGroups is now required.
2.235.0	ecs: securityGroups is now required in ManagedInstancesCapacityProviderProps.
2.235.0	aws-cdk-lib: Multiple interface changes including JobQueue.computeEnvironments, BackupPlanRule.props, ApiDestination.fromApiDestinationAttributes() return type, and others now use reference interfaces instead of concrete types.
2.235.0	events: ApiDestination.fromApiDestinationAttributes() now returns IApiDestination instead of ApiDestination; EventDestination.bus changed from IEventBus to IEventBusRef.
2.235.0	logs: Return types of FlowLogDestination.bind() and ICluster.executeCommandConfiguration now contain ILogGroupRef instead of ILogGroup.
2.235.0	iot-actions: enableBatchConfig property is explicitly disabled by default.
2.235.0	bedrock-agentcore-alpha: The User Pool Client will be replaced and new Resource Server and Domain resources will be added for existing Gateway stacks using the default Cognito authorizer.
2.237.0	iam: IEncryptedResource now extends IEnvironmentAware instead of IResource. Receivers have fewer guarantees about object shape and may need type guards or casting.
2.238.0	bedrock-agentcore: Interface extensions require new property implementations.
2.238.0	aws-bedrock-agentcore-alpha: Multiple interfaces now require new getter properties: IGateway requires gatewayRef, IGatewayTarget requires gatewayTargetRef, IMemory requires memoryRef, IBedrockAgentRuntime requires runtimeRef, IRuntimeEndpoint requires runtimeEndpointRef, IBrowserCustom requires browserCustomRef, ICodeInterpreterCustom requires codeInterpreterCustomRef.
2.239.0	aws-licensemanager: AWS::LicenseManager::License properties Beneficiary and ProductSKU are now required.
2.239.0	aws-sagemaker: AWS::SageMaker::Cluster property Orchestrator.Eks is now immutable.
2.241.0	aws-codedeploy: AWS::CodeDeploy::DeploymentGroup attribute Id removed.
2.242.0	aws-ssm: AWS::SSM::MaintenanceWindow attribute Id removed.
2.247.0	aws-bedrockagentcore: AWS::BedrockAgentCore::OnlineEvaluationConfig attribute ExecutionStatus removed.
2.247.0	aws-appstream: AWS::AppStream::ImageBuilder property Name is now immutable.
2.247.0	aws-eks: AWS::EKS::Capability vended log type EKS_CAPABILITY_ACK_S3_LOGS removed.
2.249.0	aws-appstream: AWS::AppStream::Stack attribute Id removed.
2.249.0	aws-appsync: AWS::AppSync::GraphQLApi properties LogConfig.CloudWatchLogsRoleArn and LogConfig.FieldLogLevel are now required.
2.249.0	aws-kafkaconnect: AWS::KafkaConnect::Connector property ProvisionedCapacity.McuCount is now required.
2.250.0	aws-emr: AWS::EMR::Cluster property MonitoringConfiguration and types CloudWatchLogConfiguration, EMRConfiguration, and MonitoringConfiguration removed.
2.251.0	L1 CloudFormation resource definitions updated: AWS::ElasticLoadBalancing::LoadBalancer SourceSecurityGroup attribute removed, PolicyItem type removed, and SourceSecurityGroup type removed in aws-elasticloadbalancing
2.254.0	L1 CloudFormation resource definitions updated: AWS::ElastiCache::CacheCluster Id attribute removed, AWS::SageMaker::Model Id attribute removed, and AWS::VpcLattice::AuthPolicy State attribute enum values changed from ACTIVE
2.257.0	L1 CloudFormation resource definitions updated: AWS::NeptuneGraph::GraphSnapshot GraphIdentifier property is now required in aws-neptunegraph
2.258.0	L1 CloudFormation resource definitions updated: AWS::PCAConnectorAD::ServicePrincipalName ConnectorArn and DirectoryRegistrationArn properties are now required, and AWS::PCAConnectorAD::TemplateGroupAccessControlEntry GroupSecurityIdentifier and TemplateArn properties are now required in aws-pcaconnectorad
2.259.0	Runtime.NODEJS_LATEST now resolves to nodejs24.x in every region; existing AWS::Lambda::Function resources will see Runtime change from nodejs22.x to nodejs24.x on next deploy; Node.js 24 removes support for callback-style asynchronous handlers which will cause runtime errors for code still using callback-based handlers

✅ 19 CVEs resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2026-25896	🚨 CRITICAL	[fast-xml-parser] A dot (.) in DOCTYPE entity names is treated as a regex wildcard, allowing attackers to shadow built-in XML entities with arbitrary values and bypass entity encoding. This leads to XSS when parsed output is rendered.
CVE-2026-26278	HIGH	[fast-xml-parser] XML entity expansion vulnerability allows attackers to cause denial of service by forcing unlimited entity expansion with minimal input, potentially freezing the application for extended periods.
CVE-2026-27942	HIGH	[fast-xml-parser] XML builder with preserveOrder:true causes stack overflow leading to denial of service when processing certain inputs. The application crashes due to improper recursion handling during XML construction.
CVE-2026-33036	HIGH	[fast-xml-parser] Numeric character references and standard XML entities bypass entity expansion limits, allowing attackers to cause XML entity expansion Denial of Service by forcing excessive memory allocation and CPU usage through crafted XML payloads.
CVE-2026-33349	MEDIUM	[fast-xml-parser] XML entity expansion vulnerability where setting maxEntityCount or maxEntitySize to 0 is bypassed due to JavaScript falsy checks, allowing attackers to cause denial of service through memory exhaustion. The vulnerability affects configurations explicitly set to restrict or disable entities.
AIKIDO-2026-10784	HIGH	[fast-uri] A path normalization vulnerability allows attackers to bypass security checks by using percent-encoded slashes and dots that are decoded before dot-segment removal, causing distinct URIs to normalize identically and compare equal.
CVE-2026-6321	HIGH	[fast-uri] A vulnerability in URI normalization allows attackers to bypass path-based access controls by using percent-encoded separators and dot segments that normalize to unintended paths. This enables policy bypass attacks where restricted paths can be accessed through specially crafted encoded URLs.
CVE-2026-6322	HIGH	[fast-uri] Normalize function improperly decodes percent-encoded authority delimiters in the host component, re-emitting them as raw delimiters during serialization. This allows attackers to bypass host allowlist checks and redirect requests to unintended authorities.
AIKIDO-2026-507986	HIGH	[fast-uri] A security bypass vulnerability exists in host canonicalization for Unicode/IDN values due to inconsistent ASCII/Unicode host handling, which could allow attackers to bypass security checks through improper host normalization.
CVE-2026-11417	HIGH	[aws-cdk-lib] OS command injection vulnerability in NodejsFunction local bundling pipeline allows arbitrary command execution if an attacker controls bundling properties like externalModules, define, loader, inject, or esbuildArgs through shell metacharacters injection.
AIKIDO-2026-577363	HIGH	[aws-cdk-lib] OS command injection vulnerability in Docker-based NodejsFunction bundling when using the nodeModules option allows attackers to inject shell commands through dependency version strings, leading to arbitrary code execution with the privileges of the CDK toolchain user.
CVE-2026-33750	LOW	[brace-expansion] A brace pattern with zero step value causes an infinite loop, leading to denial of service through process hangs and excessive memory allocation. The vulnerability affects string expansion operations when malicious or malformed patterns are processed.
AIKIDO-2026-10477	LOW	[brace-expansion] A denial-of-service vulnerability allows attackers to craft malicious brace patterns with repeated numeric ranges that cause exponential expansion, consuming excessive CPU and memory until process failure. The fix introduces an optional maximum limit parameter to bound expansion work.
CVE-2026-33532	MEDIUM	[yaml] A stack overflow vulnerability in the YAML parser's node resolution phase allows attackers to trigger a RangeError via deeply nested YAML structures (~2-10 KB), potentially causing denial of service or process termination in applications that don't catch non-YAMLParseError exceptions.
CVE-2026-26996	LOW	[minimatch] A Regular Expression Denial of Service (ReDoS) vulnerability exists when glob patterns contain many consecutive * wildcards followed by a literal character, causing exponential backtracking with O(4^N) complexity. Applications passing user-controlled strings as patterns to minimatch() are vulnerable to severe performance degradation or hangs.
CVE-2026-27903	LOW	[minimatch] A ReDoS vulnerability in glob pattern matching causes unbounded recursive backtracking with multiple GLOBSTAR segments, enabling attackers to stall the event loop for tens of seconds via crafted patterns in build tools, CI/CD pipelines, or multi-tenant systems.
CVE-2026-27904	LOW	[minimatch] Nested extglobs (*() and +()) generate regexps with catastrophic backtracking, causing severe ReDoS denial-of-service attacks with minimal input patterns triggering multi-second hangs.
GHSA-6475-r3vj-m8vf	LOW	[@smithy/config-resolver] An attacker with environment access could set an invalid region value, potentially routing AWS API calls to non-AWS hosts. A validation enhancement was added to prevent improper endpoint construction through region input validation.
CVE-2025-69873	LOW	[ajv] A ReDoS vulnerability allows attackers to inject malicious regex patterns via the $data option, causing catastrophic backtracking and CPU exhaustion. A 31-character payload can block execution for ~44 seconds, enabling complete denial of service with minimal effort.

🤖 Remediation details

Fix security vulnerabilities in fast-xml-parser, fast-uri, aws-cdk-lib, brace-expansion, yaml, minimatch, @smithy/config-resolver, and ajv

Short summary

This PR remediates security vulnerabilities in eight npm packages: fast-xml-parser, fast-uri, aws-cdk-lib, brace-expansion, yaml, minimatch, @smithy/config-resolver, and ajv. Three direct dependencies in the root package.json were bumped (aws-cdk-lib, @aws-sdk/client-secrets-manager, @aws-sdk/credential-providers) to pull in fixed transitive versions; remaining transitive instances were updated via lockfile-only npm update commands. All changes are reflected in package-lock.json.

---

fast-xml-parser

Previously resolved at 4.4.1 as a transitive dependency of @aws-sdk/core, which exact-pinned that version. Bumping @aws-sdk/client-secrets-manager and @aws-sdk/credential-providers to ^3.844.0 in package.json caused npm to resolve @aws-sdk/core at a version that no longer carries a root-level fast-xml-parser entry, eliminating the vulnerable instance entirely. The parent bump was necessary because @aws-sdk/core used an exact pin that blocked any lockfile-only update.

fast-uri

Resolved at 3.0.6 as a transitive dependency nested under aws-cdk-lib's own copy of ajv. Bumping aws-cdk-lib to ^2.260.0 in package.json brought in a newer ajv (8.20.0) that declares fast-uri@^3.0.1, allowing resolution up to 3.1.2. A full fix to 3.1.3 could not be achieved: the instance is deeply nested inside aws-cdk-lib's bundled subtree and npm update as well as multiple override shapes all failed to advance it beyond 3.1.2 in the virtual lockfile tree.

aws-cdk-lib

A direct dependency in package.json, bumped from ^2.78.0 to ^2.260.0 to address vulnerabilities in aws-cdk-lib itself. This single manifest edit also resolved the nested vulnerable instances of yaml, minimatch, brace-expansion, ajv (8.x), and fast-uri that are carried inside aws-cdk-lib's own dependency subtree, since those are all governed by the version of aws-cdk-lib that npm resolves.

brace-expansion

Resolved at 1.1.12 (root, via minimatch@3.x) and 2.0.2 (via filelist's minimatch@5.x). Both instances were updated via npm update brace-expansion --package-lock-only after the parent minimatch instances were themselves refreshed; the ^1.1.7 and ^2.0.1 ranges declared by their respective minimatch parents already permitted the patched versions, so no manifest edit was required. The aws-cdk-lib-nested instance moved to 5.0.6 as a side-effect of the aws-cdk-lib bump.

yaml

Resolved at 1.10.2 as a transitive dependency exact-pinned by aws-cdk-lib@2.204.0. Bumping aws-cdk-lib to ^2.260.0 in package.json caused npm to resolve aws-cdk-lib@2.260.0, which exact-pins yaml@1.10.3, directly satisfying the patched version requirement without any additional lockfile-only step.

minimatch

Resolved at 3.1.2 in three separate instances (root hoisted, aws-cdk-lib nested, filelist nested). The aws-cdk-lib-nested instance was resolved to 10.2.5 as a side-effect of the aws-cdk-lib bump (that version of aws-cdk-lib declares minimatch@^10.2.5). The root and filelist instances were advanced to 3.1.5 and 5.1.9 respectively via npm update minimatch --package-lock-only, which was sufficient because their parent packages (@eslint/eslintrc, eslint, filelist, etc.) all declare caret ranges that already permitted the patched versions.

@smithy/config-resolver

Resolved at 4.1.4 as a transitive dependency shared across multiple @aws-sdk packages. Bumping @aws-sdk/client-secrets-manager and @aws-sdk/credential-providers to ^3.844.0 in package.json caused npm to resolve those packages at versions that declare @smithy/config-resolver@^4.1.4, a range that permits 4.4.0+. A subsequent npm update @smithy/config-resolver --package-lock-only refreshed the lockfile entry to the patched version.

ajv

Present in two instances: 6.12.6 (root, pulled in by eslint and @eslint/eslintrc) and 8.17.1 (nested under aws-cdk-lib's table dependency). The 8.x instance was advanced to 8.20.0 as a side-effect of the aws-cdk-lib bump. The 6.x instance was advanced to 6.15.0 via npm update ajv --package-lock-only; the parent eslint@8.57.1 already declares ajv@^6.12.4, which permits 6.14.0+, so no manifest edit was needed.

---

Version changes

Package	From	To	Why updated
aws-cdk-lib	^2.78.0 (resolved 2.204.0)	^2.260.0 (resolved 2.260.0)	Direct CVE fix; manifest spec bumped
@aws-sdk/client-secrets-manager	^3.348.0 (resolved 3.840.0)	^3.844.0 (resolved 3.1078.0)	Parent bump to fix fast-xml-parser and @smithy/config-resolver transitives
@aws-sdk/credential-providers	^3.348.0 (resolved 3.840.0)	^3.844.0 (resolved 3.1078.0)	Parent bump to fix fast-xml-parser and @smithy/config-resolver transitives
yaml (aws-cdk-lib nested)	1.10.2	1.10.3	Transitive CVE fix via aws-cdk-lib bump
minimatch (aws-cdk-lib nested)	3.1.2	10.2.5	Transitive CVE fix via aws-cdk-lib bump
minimatch (root)	3.1.2	3.1.5	Transitive CVE fix; lockfile-only update
minimatch (filelist nested)	5.1.6	5.1.9	Transitive CVE fix; lockfile-only update
brace-expansion (root)	1.1.12	1.1.15	Transitive CVE fix; lockfile-only update after minimatch refresh
brace-expansion (filelist nested)	2.0.2	2.1.1	Transitive CVE fix; lockfile-only update after minimatch refresh
brace-expansion (aws-cdk-lib nested)	1.1.12	5.0.6	Transitive fix via aws-cdk-lib bump
ajv (root)	6.12.6	6.15.0	Transitive CVE fix; lockfile-only update
ajv (aws-cdk-lib nested)	8.17.1	8.20.0	Transitive CVE fix via aws-cdk-lib bump
fast-uri (aws-cdk-lib/ajv nested)	3.0.6	3.1.2	Partial transitive fix via aws-cdk-lib bump; could not advance to 3.1.3
fast-xml-parser (root)	4.4.1	removed	Transitive CVE fix via @aws-sdk/client-secrets-manager parent bump; instance eliminated
@smithy/config-resolver (root)	4.1.4	resolved to patched version	Transitive CVE fix via @aws-sdk parent bump + lockfile-only update
@aws-sdk/core	3.840.0	3.974.26	Transitive after @aws-sdk/client-secrets-manager and @aws-sdk/credential-providers parent bumps

[github-actions]

Package lock diff

 2.4.1 -> 2.6.1
node_modules/@aws-cdk/asset-awscli-v1 2.2.242 -> 2.2.282
node_modules/@aws-cdk/asset-node-proxy-agent-v6 2.1.0 -> 2.1.2
node_modules/@aws-cdk/cloud-assembly-schema 45.2.0 -> 54.8.0
node_modules/@aws-cdk/cloud-assembly-schema/node_modules/jsonschema 1.4.1 -> 1.5.0
node_modules/@aws-cdk/cloud-assembly-schema/node_modules/semver 7.7.2 -> 7.8.4
node_modules/@aws-crypto/sha256-browser removed
node_modules/@aws-crypto/sha256-browser/node_modules/@smithy/is-array-buffer removed
node_modules/@aws-crypto/sha256-browser/node_modules/@smithy/util-buffer-from removed
node_modules/@aws-crypto/sha256-browser/node_modules/@smithy/util-utf8 removed
node_modules/@aws-crypto/sha256-js removed
node_modules/@aws-crypto/supports-web-crypto removed
node_modules/@aws-crypto/util removed
node_modules/@aws-crypto/util/node_modules/@smithy/is-array-buffer removed
node_modules/@aws-crypto/util/node_modules/@smithy/util-buffer-from removed
node_modules/@aws-crypto/util/node_modules/@smithy/util-utf8 removed
node_modules/@aws-sdk/client-cognito-identity 3.840.0 -> 3.1078.0
node_modules/@aws-sdk/client-secrets-manager 3.840.0 -> 3.1078.0
node_modules/@aws-sdk/client-sso removed
node_modules/@aws-sdk/core 3.840.0 -> 3.974.26
node_modules/@aws-sdk/credential-provider-cognito-identity 3.840.0 -> 3.972.51
node_modules/@aws-sdk/credential-provider-env 3.840.0 -> 3.972.52
node_modules/@aws-sdk/credential-provider-http 3.840.0 -> 3.972.54
node_modules/@aws-sdk/credential-provider-ini 3.840.0 -> 3.972.59
node_modules/@aws-sdk/credential-provider-node 3.840.0 -> 3.972.61
node_modules/@aws-sdk/credential-provider-process 3.840.0 -> 3.972.52
node_modules/@aws-sdk/credential-provider-sso 3.840.0 -> 3.972.58
node_modules/@aws-sdk/credential-provider-web-identity 3.840.0 -> 3.972.58
node_modules/@aws-sdk/credential-providers 3.840.0 -> 3.1078.0
node_modules/@aws-sdk/middleware-host-header removed
node_modules/@aws-sdk/middleware-logger removed
node_modules/@aws-sdk/middleware-recursion-detection removed
node_modules/@aws-sdk/middleware-user-agent removed
node_modules/@aws-sdk/nested-clients 3.840.0 -> 3.997.26
node_modules/@aws-sdk/region-config-resolver removed
node_modules/@aws-sdk/token-providers 3.840.0 -> 3.1078.0
node_modules/@aws-sdk/types 3.840.0 -> 3.973.15
node_modules/@aws-sdk/util-endpoints removed
node_modules/@aws-sdk/util-locate-window removed
node_modules/@aws-sdk/util-user-agent-browser removed
node_modules/@aws-sdk/util-user-agent-node removed
node_modules/@aws-sdk/xml-builder 3.821.0 -> 3.972.33
node_modules/@smithy/abort-controller removed
node_modules/@smithy/config-resolver removed
node_modules/@smithy/core 3.6.0 -> 3.29.0
node_modules/@smithy/credential-provider-imds 4.0.6 -> 4.4.5
node_modules/@smithy/fetch-http-handler 5.0.4 -> 5.6.2
node_modules/@smithy/hash-node removed
node_modules/@smithy/invalid-dependency removed
node_modules/@smithy/is-array-buffer removed
node_modules/@smithy/middleware-content-length removed
node_modules/@smithy/middleware-endpoint removed
node_modules/@smithy/middleware-retry removed
node_modules/@smithy/middleware-serde removed
node_modules/@smithy/middleware-stack removed
node_modules/@smithy/node-config-provider removed
node_modules/@smithy/node-http-handler 4.0.6 -> 4.9.2
node_modules/@smithy/property-provider removed
node_modules/@smithy/protocol-http removed
node_modules/@smithy/querystring-builder removed
node_modules/@smithy/querystring-parser removed
node_modules/@smithy/service-error-classification removed
node_modules/@smithy/shared-ini-file-loader removed
node_modules/@smithy/signature-v4 5.1.2 -> 5.6.1
node_modules/@smithy/smithy-client removed
node_modules/@smithy/types 4.3.1 -> 4.15.1
node_modules/@smithy/url-parser removed
node_modules/@smithy/util-base64 removed
node_modules/@smithy/util-body-length-browser removed
node_modules/@smithy/util-body-length-node removed
node_modules/@smithy/util-buffer-from removed
node_modules/@smithy/util-config-provider removed
node_modules/@smithy/util-defaults-mode-browser removed
node_modules/@smithy/util-defaults-mode-node removed
node_modules/@smithy/util-endpoints removed
node_modules/@smithy/util-hex-encoding removed
node_modules/@smithy/util-middleware removed
node_modules/@smithy/util-retry removed
node_modules/@smithy/util-stream removed
node_modules/@smithy/util-uri-escape removed
node_modules/@smithy/util-utf8 removed
node_modules/@types/uuid removed
node_modules/ajv 6.12.6 -> 6.15.0
node_modules/aws-cdk-lib 2.204.0 -> 2.260.0
node_modules/aws-cdk-lib/node_modules/ajv 8.17.1 -> 8.20.0
node_modules/aws-cdk-lib/node_modules/balanced-match 1.0.2 -> 4.0.4
node_modules/aws-cdk-lib/node_modules/brace-expansion 1.1.12 -> 5.0.6
node_modules/aws-cdk-lib/node_modules/concat-map removed
node_modules/aws-cdk-lib/node_modules/fast-uri 3.0.6 -> 3.1.2
node_modules/aws-cdk-lib/node_modules/fs-extra 11.3.0 -> 11.3.5
node_modules/aws-cdk-lib/node_modules/jsonfile 6.1.0 -> 6.2.1
node_modules/aws-cdk-lib/node_modules/minimatch 3.1.2 -> 10.2.5
node_modules/aws-cdk-lib/node_modules/semver 7.7.2 -> 7.8.1
node_modules/aws-cdk-lib/node_modules/yaml 1.10.2 -> 1.10.3
node_modules/bowser 2.11.0 -> 2.14.1
node_modules/brace-expansion 1.1.12 -> 1.1.15
node_modules/constructs 10.4.2 -> 10.6.0
node_modules/fast-xml-parser removed
node_modules/filelist/node_modules/brace-expansion 2.0.2 -> 2.1.1
node_modules/filelist/node_modules/minimatch 5.1.6 -> 5.1.9
node_modules/minimatch 3.1.2 -> 3.1.5
node_modules/strnum removed
node_modules/uuid removed
node_modules/@aws-sdk/credential-provider-login added
node_modules/@aws-sdk/signature-v4-multi-region added
node_modules/@aws/lambda-invoke-store added
node_modules/aws-cdk-lib/node_modules/@aws-cdk/cloud-assembly-api added

[aikido-autofix]

Closed by Aikido: a new AutoFix has been created → #44