fix(IDS-7369): repin @hapi/hapi 21.4.9 and @aws-sdk/client-s3 3.1064.0 - #452
Open
hamzabenali-okta wants to merge 2 commits into
Open
fix(IDS-7369): repin @hapi/hapi 21.4.9 and @aws-sdk/client-s3 3.1064.0#452hamzabenali-okta wants to merge 2 commits into
hamzabenali-okta wants to merge 2 commits into
Conversation
Now that @hapi/hapi@21.4.9 and @aws-sdk/client-s3@3.1064.0 are available in the node22 verquire store (IDS-7307), repin both externals/dependencies so the extension consumes the patched transitive deps at runtime: - @hapi/content 6.0.0 -> 6.0.2 (clears SEC-29155) - fast-xml-parser removed entirely by the newer SDK (clears SEC-9999) The changed lockfile entries are confined to the @aws-sdk / @smithy / @Hapi trees of the two externals. Bump version to 2.13.5. The s3 test imported sdkStreamMixin from @smithy/util-stream, which the newer SDK folded into @smithy/core/serde; repoint that test-only import. No new npm packages added (all resolved from a0us.jfrog.io). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Rebuild dist/ for 2.13.5. The client (UI) bundle rebuilds byte-identical to
2.13.4 modulo the version string. The extension bundle differs only in the two
external require("name@version") strings (@hapi/hapi@21.4.9,
@aws-sdk/client-s3@3.1064.0) and CLIENT_VERSION — externals are not bundled and
no bundled dependency changed version.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
✏️ Changes
Repin
@hapi/hapiand@aws-sdk/client-s3to the versions now available in our runtime module store, so the Authorization Extension consumes the patched transitive dependencies at runtime and clears two dependency security findings.@hapi/hapi21.3.3→21.4.9— pulls@hapi/content6.0.0→6.0.2.@aws-sdk/client-s33.738.0→3.1064.0— the newer SDK droppedfast-xml-parser(and itsstrnumdep) entirely, resolving that finding.Design standpoint: both packages are declared as
auth0-extension.externals, so they are resolved from the runtime module store rather than bundled. Repinning the externals (and the matchingdependenciesentries) is what actually picks up the fixes. No production code changed.Code itself:
package.json— repin both externals + dependencies; bump version2.13.4→2.13.5.server/plugins/html.js— bumpEXTENSION_VERSIONto2.13.5.CHANGELOG.md— add a2.13.5entry.package-lock.json— regenerated; churn is confined entirely to the@aws-sdk/@smithy/@hapitrees of the two externals. No new packages added.tests/unit/server/s3-storage-context.tests.js— the newer SDK folded@smithy/util-streaminto@smithy/core/serde; repoint that test-onlysdkStreamMixinimport. Not a production dependency.dist/— rebuilt at2.13.5. The UI bundle rebuilds byte-identical to2.13.4modulo the version string; the extension bundle differs only in the two externalrequire("name@version")strings andCLIENT_VERSION.Why the dependency update is needed: the security findings flag outdated transitive libraries (
@hapi/content@6.0.0,fast-xml-parser@4.4.1). The fixed versions only become reachable once the parent externals are bumped to the runtime-store-available releases.📷 Screenshots
Local testing
🔗 References
axiosbump PR (rebuild2.13.4).🎯 Testing
All 523 unit tests pass. The full
S3StorageContextsuite (read, write, and every region-redirect error path) was re-verified against@aws-sdk/client-s3@3.1064.0using theaws-sdk-client-mockharness.✅ This change has been tested in a Webtask
✅ This change has unit test coverage
🚫 This change has integration test coverage
🚫 This change has been tested for performance
🚀 Deployment
✅ This can be deployed any time — the required externals (
@hapi/hapi@21.4.9,@aws-sdk/client-s3@3.1064.0) are already available in the runtime module store, so there is no lockstep dependency.🎡 Rollout
In order to verify that the deployment was successful we will confirm the new
2.13.5version is serving in the develop environment, exercise the S3 storage path, and confirm the two dependency findings are cleared on the next security scan.🔥 Rollback
We will rollback if the extension fails to start on the repinned externals, or if the S3 storage read/write path regresses in production.
📄 Procedure
Revert to the previous
2.13.4bundle and republish the extension. Since this is an externals/version repin with no data-model or config change, rollback is a straight redeploy of the prior version with no migration required.