Security Vulnerability in aws-cdk-lib v2.179.0 – Upgrade Required

[hylickipiotr]

The project currently uses aws-cdk-lib v2.179.0, which is affected by a security vulnerability as per GHSA-5pq3-h73f-66hr. To mitigate this risk, the package must be upgraded to v2.184.0 or later.

[krmorse]

+1

[teseo]

+1

[krmorse]

I'm curious for this one how important it is that it's pinned to an exact version. I know currently that you get typescript errors if you're using a different cdk version in your project, but I doubt there is anything in SST that would break if we changed it to ^2.187.0 or similar...

Especially because this library releases multiple times per week, so it's immediately out of date

[revmischa]

+1

[krmorse]

There is another vulnerability documented at GHSA-5pq3-h73f-66hr, so 2.189.0 is probably the minimum version now

[krmorse]

another vunlerabiliity, so minimum version should be 2.189.1 now...
GHSA-qc59-cxj2-c2w4

[krmorse]

i'm happy to take a crack at this but i wanted to do #69 first to make sure i understood the contrib process first