Skip to content

update AWS SDK from v2 to v3; npm audit fix#938

Merged
cclauss merged 3 commits intomapbox:masterfrom
mdaniels5757:update-aws-sdk
Feb 20, 2026
Merged

update AWS SDK from v2 to v3; npm audit fix#938
cclauss merged 3 commits intomapbox:masterfrom
mdaniels5757:update-aws-sdk

Conversation

@mdaniels5757
Copy link
Contributor

@mdaniels5757 mdaniels5757 commented Feb 14, 2026

Note: I've run npm run test, but haven't done any additional testing. (I don't even use this tool directly, it's just a transitive dependency, that I noticed due to #932.)

@mdaniels5757 mdaniels5757 requested a review from a team as a code owner February 14, 2026 17:47
@mdaniels5757
Copy link
Contributor Author

Fixed lint.

@mdaniels5757
Copy link
Contributor Author

mdaniels5757 commented Feb 20, 2026

Re-ran npm audit fix. Note that:

"nock": "^13.5.4",
"node-addon-api": "^8.1.0",
"nyc": "^17.0.0",
"rimraf": "^6.1.2",
Copy link
Collaborator

@cclauss cclauss Feb 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://www.npmjs.com/package/rimraf

[!CAUTION]

Please Be Safe, this tool deletes and moves stuff, by design

It is your responsibility as a user to never pass untrusted user input to this module, or your system can be destroyed or compromised.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This package is not new to this project; it has been used in tests since at least 2015.
The tests fail without it. Despite that, it was not actually installed when developers ran npm install in this repository. I can remove it, if you like, but then of course running npm ci; npm run test will fail (as it already does).

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My comment was just a caution, not a request for a change.

Also, let's get the tests to pass like:

Note that eslint-config-mapbox has to be pinned due to
mapbox/eslint-plugin-mapbox#3.
@cclauss cclauss merged commit 1575476 into mapbox:master Feb 20, 2026
20 checks passed
@mdaniels5757 mdaniels5757 deleted the update-aws-sdk branch February 20, 2026 22:50
cclauss added a commit to cclauss/node-pre-gyp that referenced this pull request Feb 21, 2026
* update AWS SDK from v2 to v3

* npm audit fix

Note that eslint-config-mapbox has to be pinned due to
mapbox/eslint-plugin-mapbox#3.

* Allow npm audit to fail without breaking CI

---------

Co-authored-by: Christian Clauss <cclauss@me.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Upgrade tar package to ^7.5.3 - CVE-2026-23745 - HIGH Migrate AWS SDK for JavaScript v2 APIs to v3

2 participants