Bug description
It looks like [email protected] has a security vulnerability within it's @aws-sdk/** dependency fast-xml-parser.
Within fast-xml-parser a vulnerability to ReDOS exists on currency.js (discovered by Gauss Security Labs R&D team).
A quick run of pnpm why fast-xml-parser outlines where it's usage lies.
**└── fast-xml-parser 4.2.5**
dependencies:
@datadog/datadog-ci 2.41.0
└─┬ @aws-sdk/client-cloudwatch-logs 3.556.0
├─┬ @aws-sdk/client-sts 3.556.0
│ ├─┬ @aws-sdk/core 3.556.0
│ │ └── fast-xml-parser 4.2.5
│ └─┬ @aws-sdk/credential-provider-node 3.556.0 peer
│ ├─┬ @aws-sdk/credential-provider-ini 3.556.0
│ │ └─┬ @aws-sdk/credential-provider-sso 3.556.0
│ │ ├─┬ @aws-sdk/client-sso 3.556.0
│ │ │ └─┬ @aws-sdk/core 3.556.0
│ │ │ └── fast-xml-parser 4.2.5
│ │ └─┬ @aws-sdk/token-providers 3.556.0
│ │ └─┬ @aws-sdk/client-sso-oidc 3.556.0
│ │ └─┬ @aws-sdk/core 3.556.0
│ │ └── fast-xml-parser 4.2.5
│ └─┬ @aws-sdk/credential-provider-sso 3.556.0
│ ├─┬ @aws-sdk/client-sso 3.556.0
│ │ └─┬ @aws-sdk/core 3.556.0
│ │ └── fast-xml-parser 4.2.5
│ └─┬ @aws-sdk/token-providers 3.556.0
│ └─┬ @aws-sdk/client-sso-oidc 3.556.0
│ └─┬ @aws-sdk/core 3.556.0
│ └── fast-xml-parser 4.2.5
├─┬ @aws-sdk/core 3.556.0
│ └── fast-xml-parser 4.2.5
└─┬ @aws-sdk/credential-provider-node 3.556.0
├─┬ @aws-sdk/credential-provider-ini 3.556.0
│ └─┬ @aws-sdk/credential-provider-sso 3.556.0
│ ├─┬ @aws-sdk/client-sso 3.556.0
│ │ └─┬ @aws-sdk/core 3.556.0
│ │ └── fast-xml-parser 4.2.5
│ └─┬ @aws-sdk/token-providers 3.556.0
│ └─┬ @aws-sdk/client-sso-oidc 3.556.0
│ └─┬ @aws-sdk/core 3.556.0
│ └── fast-xml-parser 4.2.5
└─┬ @aws-sdk/credential-provider-sso 3.556.0
├─┬ @aws-sdk/client-sso 3.556.0
│ └─┬ @aws-sdk/core 3.556.0
│ └── fast-xml-parser 4.2.5
└─┬ @aws-sdk/token-providers 3.556.0
└─┬ @aws-sdk/client-sso-oidc 3.556.0
└─┬ @aws-sdk/core 3.556.0
Describe what you expected
Resolve the issue by bumping the appropriate aws-sdk dependencies.
Steps to reproduce the issue
For any node project with @datadog/datadog-ci installed with a version of 2.40.0 ~ 2.41.0
Additional context
Package manager: pnpm
Command
None
Bug description
It looks like [email protected] has a security vulnerability within it's
@aws-sdk/**dependencyfast-xml-parser.Within
fast-xml-parsera vulnerability to ReDOS exists on currency.js (discovered by Gauss Security Labs R&D team).A quick run of
pnpm why fast-xml-parseroutlines where it's usage lies.Describe what you expected
Resolve the issue by bumping the appropriate aws-sdk dependencies.
Steps to reproduce the issue
For any node project with @datadog/datadog-ci installed with a version of 2.40.0 ~ 2.41.0
Additional context
Package manager: pnpm
Command
None