Merge pull request #33 from aws-solutions/release/v1.8.5

Updated to version v1.8.5
aws-solutions · Oct 25, 2023 · 32e3782 · 32e3782
2 parents 47fb25d + 72583b5
commit 32e3782
Show file tree

Hide file tree

Showing 12 changed files with 1,171 additions and 558 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,15 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.8.5] - 2023-10-26
+
+### Changed
+
+- Upgraded @babel/traverse to mitigate CVE-2023-45133
+- Upgraded chaijs/get-func-name to mitigate CVE-2023-43646
+- Upgraded urllib3 to mitigate CVE-2023-45803 and CVE-2023-43804
+- Upgraded other dev dependencies (moto, pytest, pytest-env)
+
 ## [1.8.4] - 2023-08-07
 
 ### Changed

diff --git a/source/lambda/event_parser/npm-shrinkwrap.json b/source/lambda/event_parser/npm-shrinkwrap.json
diff --git a/source/lambda/multi_account_custom_resources/npm-shrinkwrap.json b/source/lambda/multi_account_custom_resources/npm-shrinkwrap.json
diff --git a/source/lambda/query_runner/npm-shrinkwrap.json b/source/lambda/query_runner/npm-shrinkwrap.json
diff --git a/source/lambda/quicksight-custom-resources/requirements-dev.txt b/source/lambda/quicksight-custom-resources/requirements-dev.txt
@@ -1,36 +1,7 @@
 mock==5.1.0
-moto==4.1.0
-pytest==7.2.0
+moto==4.2.6
+pytest==7.4.2
 pytest-cov==4.1.0
-pytest-env==0.8.1
-## boto3 and botocore should match Lambda runtime: https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html
-boto3==1.20.32
-botocore==1.23.32
-## jmespath, python-dateutil, s3transfer, six, and urllib3 should match Lambda runtime
-jmespath==0.10.0
-python-dateutil==2.8.2
-s3transfer==0.5.2
-six==1.16.0
-urllib3==1.26.9
-## The following requirements were added by pip freeze:
-attrs==22.2.0
-certifi==2023.07.22
-cffi==1.15.1
-charset-normalizer==2.1.1
-coverage==7.0.5
-cryptography~=41.0.0
-exceptiongroup==1.1.0
-idna==3.4
-iniconfig==2.0.0
-Jinja2==3.1.2
-MarkupSafe==2.1.1
-packaging==23.0
-pluggy==1.0.0
-pycparser==2.21
-requests==2.31.0
-responses==0.22.0
-toml==0.10.2
-tomli==2.0.1
-types-toml==0.10.8.1
-Werkzeug~=2.2.3
-xmltodict==0.13.0
+pytest-env==1.0.1
+boto3
+botocore
diff --git a/source/lambda/quicksight-custom-resources/requirements.txt b/source/lambda/quicksight-custom-resources/requirements.txt
@@ -2,9 +2,5 @@ crhelper==2.0.11
 PyYAML==6.0
 requests==2.31.0
 tenacity~=8.2.2
-## urllib3 should match Lambda runtime
-urllib3==1.26.9
-## The following requirements were added by pip freeze:
-certifi==2023.07.22
-charset-normalizer==2.1.1
-idna==3.4
+urllib3<2
+
diff --git a/source/lambda/solution_helper/requirements-dev.txt b/source/lambda/solution_helper/requirements-dev.txt
@@ -1,19 +1,5 @@
 coverage==7.0.5
-pytest==7.2.0
+pytest==7.4.2
 pytest-cov==4.1.0
-## boto3 and botocore should match Lambda runtime: https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html
-boto3==1.20.32
-botocore==1.23.32
-# ## jmespath, python-dateutil, s3transfer, six, and urllib3 should match Lambda runtime
-jmespath==0.10.0
-python-dateutil==2.8.2
-s3transfer==0.5.2
-six==1.16.0
-urllib3==1.26.9
-## The following requirements were added by pip freeze:
-attrs==22.2.0
-exceptiongroup==1.1.0
-iniconfig==2.0.0
-packaging==23.0
-pluggy==1.0.0
-tomli==2.0.1
+boto3
+botocore
diff --git a/source/lambda/solution_helper/requirements.txt b/source/lambda/solution_helper/requirements.txt
@@ -1,8 +1,4 @@
 crhelper==2.0.11
 requests==2.31.0
-## urllib3 should match Lambda runtime
-urllib3==1.26.9
-## The following requirements were added by pip freeze:
-certifi==2023.07.22
-charset-normalizer==2.1.1
-idna==3.4
+urllib3<2
+