Skip to content

[Snyk] Upgrade @aws-sdk/client-s3 from 3.826.0 to 3.910.0 #50

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
Sunwuyuan wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Upgrade @aws-sdk/client-s3 from 3.826.0 to 3.910.0 #50

Sunwuyuan wants to merge 1 commit into from

Conversation

@Sunwuyuan
Copy link
Member

@Sunwuyuan Sunwuyuan commented Nov 5, 2025

snyk-top-banner

Snyk has created this PR to upgrade @aws-sdk/client-s3 from 3.826.0 to 3.910.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

  • The recommended version is 45 versions ahead of your current version.

  • The recommended version was released 22 days ago.

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
medium severity Allocation of Resources Without Limits or Throttling
SNYK-JS-AXIOS-12613773		 666 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BRACEEXPANSION-9789073		 666 Proof of Concept
low severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-BRACEEXPANSION-9789073		 666 Proof of Concept
critical severity Predictable Value Range from Previous Values
SNYK-JS-FORMDATA-10841150		 666 Proof of Concept
high severity Uncaught Exception
SNYK-JS-MULTER-10773732		 666 No Known Exploit
medium severity Improper Handling of Unexpected Data Type
SNYK-JS-ONHEADERS-10773729		 666 No Known Exploit
medium severity Improper Validation of Specified Type of Input
SNYK-JS-VALIDATOR-13395830		 666 Proof of Concept
Release notes
Package name: @aws-sdk/client-s3
  • 3.910.0 - 2025-10-14

    3.910.0(2025-10-14)

    Chores
    • codegen: sync for node-http timeout fixes, deprecated documentation (#7422) (c8809d46)
    Documentation Changes
    New Features
    • client-ec2: This release adds support for creating instant, point-in-time copies of EBS volumes within the same Availability Zone (35be968f)
    • client-connect: SDK release for TaskTemplateInfo in Contact for DescribeContact response. (a34b5ea7)
    • client-transcribe: Move UntagResource API body member to query parameter (eefe2472)
    • client-backup: The AWS Backup job attribute extension enhancement helps customers better understand the plan that initiated each job, and the properties of the resource each job creates. (69c1ccd9)
    • client-datazone: Support creating scoped and trustedIdentityPropagation enabled connections. (acbdd2f7)
    • client-transfer: SFTP connectors now support routing connections via customers' VPC. This enables connections to remote servers that are only accessible in a customer's VPC environment, and to servers that are accessible over the internet but need connections coming from an IP address in a customer VPC's CIDR range. (2951a5b6)
    • client-appstream: This release introduces support for Microsoft license included applications streaming. (d7579fed)

    For list of updated packages, view updated-packages.md in assets-3.910.0.zip

  • 3.908.0 - 2025-10-10

    3.908.0(2025-10-10)

    Chores
    • codegen: sync for bowser removal, lstat fixes (#7418) (511167d5)
    Documentation Changes
    • client-rds: Updated the text in the Important section of the ModifyDBClusterParameterGroup page. (23a42361)
    New Features
    • clients: update client endpoints as of 2025-10-10 (b5e87b16)
    • client-lambda: Add InvokedViaFunctionUrl context key to limit invocations to only FURL invokes. (cf1e3beb)
    • client-bedrock-agentcore-control: Bedrock AgentCore release for Gateway, and Memory including Self-Managed Strategies support for Memory. (dd8408b9)
    • client-odb: This release adds APIs that allow you to specify CIDR ranges in your ODB peering connection. (72de496b)
    • client-cloudfront: Added new viewer security policy, TLSv1.2_2025, for CloudFront. (bbe5fc55)
    • client-bedrock-agentcore: Bedrock AgentCore release for Runtime, and Memory. (9ad809ec)
    • client-glue: Addition of AuditContext in GetTable/GetTables Request (cf3d8e19)
    Bug Fixes
    • codegen: apply reserved word escaping to union shape in Json serializer (#7419) (9ee6cdcd)

    For list of updated packages, view updated-packages.md in assets-3.908.0.zip

  • 3.907.0 - 2025-10-09

    3.907.0(2025-10-09)

    Chores
    • util-user-agent-browser: remove bowser from default UA provider (#7413) (a94d95f7)
    • ci: run publish for codegen (#7415) (b2f1ac0c)
    New Features
    • clients: update client endpoints as of 2025-10-09 (98148915)
    • client-wafv2: This release adds the ability to throw WafLimitsExceededException when the maximum number of Application Load Balancer (ALB) associations per AWS WAF v2 WebACL is exceeded. (33438d9d)
    • client-quicksight: This release adds support for ActionConnector and Flow, which are new resources associated with Amazon Quick Suite. Additional updates include expanded Data Source options, further branding customization, and new capabilities that can be restricted by Admins. (72c12a09)
    Tests
    • core: modify request compression threshold values (#7414) (6b45d720)

    For list of updated packages, view updated-packages.md in assets-3.907.0.zip

  • 3.906.0 - 2025-10-08

    3.906.0(2025-10-08)

    Chores
    New Features
    • clients: update client endpoints as of 2025-10-08 (9f44c29c)
    • client-license-manager-user-subscriptions: Released support for IPv6 and dual-stack active directories (288c63a8)
    • client-outposts: This release adds the new StartOutpostDecommission API, which starts the decommission process to return Outposts racks or servers. (2bfac290)
    • client-bedrock-agentcore-control: Adding support for authorizer type AWS_IAM to AgentCore Control Gateway. (c3b83d46)
    • client-service-quotas: introduces Service Quotas Automatic Management. Users can opt-in to monitoring and managing service quotas, receive notifications when quota usage reaches thresholds, configure notification channels, subscribe to EventBridge events for automation, and view notifications in the AWS Health dashboard. (136894bf)

    For list of updated packages, view updated-packages.md in assets-3.906.0.zip

  • 3.901.0 - 2025-10-01

    3.901.0(2025-10-01)

    Chores
    Documentation Changes
    • client-ecs: This is a documentation only Amazon ECS release that adds additional information for health checks. (a5652334)
    • client-database-migration-service: This is a doc-only update, revising text for kms-key-arns. (629c6306)
    New Features
    • client-chime-sdk-meetings: Add support to receive dual stack MediaPlacement URLs in Chime Meetings SDK (c32ced42)
    • client-cleanroomsml: This release introduces data access budgets to view how many times an input channel can be used for ML jobs in a collaboration. (a6cc054b)
    • client-cleanrooms: This release introduces data access budgets to control how many times a table can be used for queries and jobs in a collaboration. (783dbc10)
    • client-pcs: Added the UpdateCluster API action to modify cluster configurations, and Slurm custom settings for queues. (3b9d480e)
    • client-ivs-realtime: Remove incorrect ReadOnly trait on IVS RealTime ImportPublicKey API (8b79cdc1)

    For list of updated packages, view updated-packages.md in assets-3.901.0.zip

  • 3.899.0 - 2025-09-29
  • 3.896.0 - 2025-09-24
  • 3.895.0 - 2025-09-23
  • 3.894.0 - 2025-09-22
  • 3.893.0 - 2025-09-19
  • 3.892.0 - 2025-09-18
  • 3.891.0 - 2025-09-17
  • 3.890.0 - 2025-09-16
  • 3.888.0 - 2025-09-12
  • 3.887.0 - 2025-09-11
  • 3.886.0 - 2025-09-10
  • 3.884.0 - 2025-09-08
  • 3.883.0 - 2025-09-05
  • 3.882.0 - 2025-09-04
  • 3.879.0 - 2025-08-29
  • 3.878.0 - 2025-08-28
  • 3.876.0 - 2025-08-26
  • 3.873.0 - 2025-08-21
  • 3.872.0 - 2025-08-20
  • 3.864.0 - 2025-08-08
  • 3.863.0 - 2025-08-07
  • 3.862.0 - 2025-08-06
  • 3.859.0 - 2025-08-01
  • 3.858.0 - 2025-07-31
  • 3.857.0 - 2025-07-30
  • 3.856.0 - 2025-07-29
  • 3.855.0 - 2025-07-28
  • 3.850.0 - 2025-07-21
  • 3.848.0 - 2025-07-17
  • 3.846.0 - 2025-07-16
  • 3.845.0 - 2025-07-15
  • 3.844.0 - 2025-07-09
  • 3.842.0 - 2025-07-02
  • 3.840.0 - 2025-06-30
  • 3.839.0 - 2025-06-27
  • 3.837.0 - 2025-06-25
  • 3.835.0 - 2025-06-23
  • 3.832.0 - 2025-06-18
  • 3.830.0 - 2025-06-16
  • 3.828.0 - 2025-06-11
  • 3.826.0 - 2025-06-06
from @aws-sdk/client-s3 GitHub release notes

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

@snyk-bot
fix: upgrade @aws-sdk/client-s3 from 3.826.0 to 3.910.0
5e8273f 
Snyk has created this PR to upgrade @aws-sdk/client-s3 from 3.826.0 to 3.910.0.

See this package in npm:
@aws-sdk/client-s3

See this project in Snyk:
https://app.snyk.io/org/sunwuyuan/project/7f95d725-ca6f-4cce-ab56-8b055b9f632f?utm_source=github&utm_medium=referral&page=upgrade-pr
@vercel
Copy link

vercel bot commented Nov 5, 2025 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Preview Comments Updated (UTC)
our-world Error Error Nov 5, 2025 8:37am

@claude
Copy link

claude bot commented Nov 5, 2025

Pull Request Review - AWS SDK S3 Client Upgrade (3.826.0 to 3.910.0)

Summary

This PR upgrades @aws-sdk/client-s3 from version 3.826.0 to 3.910.0 (45 versions ahead) to address multiple security vulnerabilities.

Code Quality & Best Practices - POSITIVE

  • The upgrade follows semantic versioning with a minor version bump
  • Package.json properly uses caret versioning strategy
  • The change is minimal and focused (single dependency)
  • Project uses ES modules which is modern and well-supported
  • Uses pnpm-lock.yaml - ensure CI/CD uses pnpm consistently

Potential Bugs & Issues - LOW RISK

I reviewed the codebase usage in src/services/assets.js and scripts/migrate-s3-assets.js

Commands Used:

  • PutObjectCommand - Standard, stable API
  • ListObjectsV2Command - Standard, stable API
  • CopyObjectCommand - Standard, stable API
  • GetObjectCommand - Standard, stable API

Risk Assessment: LOW - All commands used are core S3 APIs with stable interfaces. Release notes show no breaking changes in this version range.

Security Concerns - CRITICAL FIXES

This upgrade resolves 7 vulnerabilities:

  • CRITICAL: Predictable Value Range (form-data) - concerning for file upload functionality
  • HIGH: Uncaught Exception (multer) - used in asset upload system
  • MEDIUM: Allocation of Resources Without Limits (axios)
  • MEDIUM: Improper Handling of Unexpected Data Type (on-headers)
  • MEDIUM: Improper Validation of Specified Type (validator)
  • LOW: ReDoS in brace-expansion (2 instances)

Security Review of S3 Usage:

  1. ACL Usage (src/services/assets.js:160): Using public-read ACL - Consider using bucket policies instead
  2. Credentials Storage: Properly retrieved from config (not hardcoded) - GOOD
  3. File Upload Validation: Good file type detection, MIME validation, metadata sanitization, and file size limits

Recommendation: APPROVE THIS UPGRADE - The security fixes are important

Performance Considerations - IMPROVED

Improvements in v3.910.0:

  • Bundle Size Optimizations: Rollup for dist-cjs, removed bowser dependency
  • Network Performance: Better socketTimeout handling
  • Current implementation has good batch processing and rate limiting

Recommendation: No performance concerns with this upgrade

Test Coverage - NEEDS IMPROVEMENT

Current State:

  • No test files found in the repository
  • package.json shows test script is not configured

Critical Areas Lacking Tests:

  1. S3 upload functionality
  2. Migration scripts
  3. File type validation and sanitization
  4. Error handling for network failures

Risk Mitigation Recommendations:

  1. Manual testing of file uploads after deployment
  2. Test S3 migration script in dry-run mode first
  3. Monitor error logs after deployment
  4. Consider rolling deployment strategy

Follow-up: Add test coverage for S3 functionality (high priority)

Additional Observations

  1. Error Handling: Migration script has good handling of network errors and graceful degradation
  2. Documentation: Migration script has excellent inline documentation
  3. Breaking Changes: No breaking changes identified in AWS SDK v3 release notes from 3.826.0 to 3.910.0

Final Recommendations

Immediate Actions:

  1. APPROVE AND MERGE - Security fixes are important
  2. Test file uploads in staging environment before production
  3. Run migration script with --dry-run flag first
  4. Monitor application logs for any S3-related errors post-deployment

Follow-up Tasks (Not blocking):

  1. Add test coverage for S3 functionality (high priority)
  2. Review ACL usage - consider bucket policies
  3. Create CLAUDE.md to document project conventions
  4. Set up CI/CD with automated testing

Verdict: APPROVED

Confidence Level: High

Reasoning:

  • Security vulnerabilities are addressed (critical and high severity)
  • No breaking changes in AWS SDK upgrade
  • Code uses stable, well-documented S3 APIs
  • Good error handling exists in current implementation
  • Risk is minimal with proper post-deployment monitoring

Note: The lack of automated tests is concerning for long-term maintenance, but should not block this security update.

Review completed by Claude Code
Reviewed files: package.json, src/services/assets.js, scripts/migrate-s3-assets.js

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@Sunwuyuan @snyk-bot