Skip to content

[agent] chore(deps): migrate aws-sdk v2 to @aws-sdk/client-s3 v3#747

Draft
github-actions[bot] wants to merge 1 commit into
mainfrom
security/migrate-aws-sdk-v3-33f762f620106171
Draft

[agent] chore(deps): migrate aws-sdk v2 to @aws-sdk/client-s3 v3#747
github-actions[bot] wants to merge 1 commit into
mainfrom
security/migrate-aws-sdk-v3-33f762f620106171

Conversation

@github-actions
Copy link
Copy Markdown
Contributor

Addresses Dependabot alerts #94 and #95: GHSA-j965-2qgj-vjmq — AWS SDK for JavaScript v2 users should migrate to v3.

Summary

AWS SDK for JavaScript v2 (aws-sdk) reached end-of-support on September 8, 2025. This advisory (CVSSv3.1: 3.7 LOW, CWE-20 Improper Input Validation) recommends migrating to v3 for continued security support. There is no patched v2 release — migration to v3 is the only remediation.

Changes

  • packages/dl-center/package.json: replaced aws-sdk: ^2.1441.0 with @aws-sdk/client-s3: ^3.1045.0
  • packages/dl-center/src/download-center.ts:
    • Import S3Client, GetObjectCommand, PutObjectCommand from @aws-sdk/client-s3
    • DownloadCenter constructor now creates an S3Client instead of S3 (v2)
    • S3BucketConfig interface is kept backward-compatible: s3ForcePathStyle maps to forcePathStyle, sslEnabled maps to tls; added optional region (defaults to us-east-1)
    • downloadAsset reads the response stream to a Buffer via Body.transformToByteArray()
    • uploadAsset uses PutObjectCommand via s3.send()
    • Exported Content type to replace the removed v2 Body type alias

Test results

10/11 tests pass. The 1 failure (can upload and download a valid config file) is a pre-existing sandbox network issue (the fixture compass.json references live downloads.mongodb.com URLs that are blocked in the sandbox environment) — this test was also failing before this change.

Generated by Dependabot remediation agent · ● 1.5M ·

Addresses GHSA-j965-2qgj-vjmq (Dependabot alerts #94 and #95):
AWS SDK for JavaScript v2 reached end-of-support on 2025-09-08.
The advisory recommends migrating to v3 for continued support and
enhanced security features.

Changes:
- Replace 'aws-sdk' with '@aws-sdk/client-s3' in packages/dl-center
- Migrate DownloadCenter class to use S3Client, GetObjectCommand,
  PutObjectCommand from v3 SDK
- Keep S3BucketConfig interface backward-compatible (s3ForcePathStyle
  and sslEnabled map to forcePathStyle and tls internally)
- downloadAsset now returns Buffer (reads stream to completion using
  Body.transformToByteArray())
- Export Content type for upload body

Co-authored-by: Copilot <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants