Skip to content

chore: update swift nio dependency for dependabot alert - #47

Merged
thisisabhash merged 1 commit into
mainfrom
chore/dependabot-alert
Jun 29, 2026
Merged

chore: update swift nio dependency for dependabot alert#47
thisisabhash merged 1 commit into
mainfrom
chore/dependabot-alert

Conversation

@thisisabhash

Copy link
Copy Markdown
Member

Issue #, if available:
https://github.com/aws-amplify/aws-appsync-apollo-extensions-swift/security/dependabot/6
https://github.com/aws-amplify/aws-appsync-apollo-extensions-swift/security/dependabot/5
https://github.com/aws-amplify/aws-appsync-apollo-extensions-swift/security/dependabot/3
https://github.com/aws-amplify/aws-appsync-apollo-extensions-swift/security/dependabot/4
https://github.com/aws-amplify/aws-appsync-apollo-extensions-swift/security/dependabot/2

Description of changes:

Summary

  • Update amplify-swift dependency from 2.53.2 to 2.58.3 in the integration test app
  • Resolve 5 open Dependabot security alerts by upgrading transitive SwiftNIO dependencies to patched versions

Security Fixes

Alert Package Vulnerability Severity Old Version Fixed Version
#6 swift-nio HTTPDecoder accepts unbounded HTTP/1 header blocks (DoS) Moderate 2.93.0 2.101.0
#3 swift-nio Out-of-bounds write via ByteBuffer index/length UInt32 overflow Moderate 2.93.0 2.101.0
#2 swift-nio CRLF Injection in outbound HTTP request URI Moderate 2.93.0 2.101.0
#4 swift-nio-extras NIOHTTPRequestDecompressor ratio limit bypass via inflated Content-Length Moderate 1.32.0 1.34.1
#5 swift-nio-http2 HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo-header Moderate 1.39.0 1.44.0

Changes

  • project.pbxproj — Bump amplify-swift minimum version constraint from 2.53.2 to 2.58.3
  • Package.resolved — Re-resolve all dependency pins with patched versions of swift-nio (2.101.0), swift-nio-extras (1.34.1), and swift-nio-http2 (1.44.0)

Test plan

  • xcodebuild -resolvePackageDependencies succeeds
  • xcodebuild build compiles cleanly on iOS Simulator
  • Integration tests pass in CI

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@thisisabhash
thisisabhash requested a review from a team as a code owner June 29, 2026 18:04
@thisisabhash
thisisabhash merged commit 39ebfd6 into main Jun 29, 2026
11 of 15 checks passed
@thisisabhash
thisisabhash deleted the chore/dependabot-alert branch June 29, 2026 18:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants