Conversation
chore: upgrade aws-cdk and amplify-core versions
chore: add script to run PR workflow from command line
chore: update form-data
Bumps [axios](https://github.com/axios/axios) from 1.8.3 to 1.12.1. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.8.3...v1.12.1) --- updated-dependencies: - dependency-name: axios dependency-version: 1.12.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…s-1.12.1 build(deps): bump axios from 1.8.3 to 1.12.1
Bumps [validator](https://github.com/validatorjs/validator.js) from 13.11.0 to 13.15.20. - [Release notes](https://github.com/validatorjs/validator.js/releases) - [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md) - [Commits](validatorjs/validator.js@13.11.0...13.15.20) --- updated-dependencies: - dependency-name: validator dependency-version: 13.15.20 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.0 to 4.1.1. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.1.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
…dator-13.15.20 build(deps): bump validator from 13.11.0 to 13.15.20
…aml-4.1.1 build(deps): bump js-yaml from 4.1.0 to 4.1.1
Bumps [validator](https://github.com/validatorjs/validator.js) from 13.15.20 to 13.15.23. - [Release notes](https://github.com/validatorjs/validator.js/releases) - [Changelog](https://github.com/validatorjs/validator.js/blob/master/CHANGELOG.md) - [Commits](validatorjs/validator.js@13.15.20...13.15.23) --- updated-dependencies: - dependency-name: validator dependency-version: 13.15.23 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…dator-13.15.23 build(deps): bump validator from 13.15.20 to 13.15.23
Bumps [qs](https://github.com/ljharb/qs) from 6.11.2 to 6.14.1. - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.11.2...v6.14.1) --- updated-dependencies: - dependency-name: qs dependency-version: 6.14.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…-workflow-token-permissions ci: add explicit permissions to GitHub Actions workflows
….14.1 build(deps): bump qs from 6.11.2 to 6.14.1
…-xml-parser-4.5.4 build(deps): bump fast-xml-parser from 4.5.3 to 4.5.4
* chore: upgrade to aws sdk v3 * chore: liscense * chore: versions * fix: upgrade node, fixes for migration --------- Co-authored-by: aws-amplify-bot <aws@amazon.com>
This test trigger a GitHub workflow that is very reliable, and normally completes within the specified 25 min timeout. But we have seen cases recently where it took as long as 36 min to complete. Increasing the timeout to avoid unnecessary canary failures.
…timeout chore: increase iOS canary timeout
…Android e2e tests (#993)
- Add tar@^7.5.8 resolution to force all dependencies to use secure version - Fixes CVE-2026-26960: Arbitrary file read/write via hardlink escape - Fixes CVE-2026-24842: Arbitrary file creation via hardlink path traversal - Fixes CVE-2026-23950: Race condition on macOS APFS - Fixes CVE-2026-23745: File overwrite via insufficient path sanitization The resolution approach is used because lerna 5.1.6 transitively depends on tar@^6.1.0 through @lerna/pack-directory. Using resolutions ensures all tar instances use the patched version without requiring a lerna major upgrade.
Increasing the timeout again, to deal with increased latency in recent workflow runs
…lve node-pty faults in linux (#995)
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.9 to 7.5.10. - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.9...v7.5.10) --- updated-dependencies: - dependency-name: tar dependency-version: 7.5.10 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
…7.5.10 build(deps): bump tar from 7.5.9 to 7.5.10
…rary file write) (#1002) Dependency trace: - lerna@5.6.2 → @nrwl/devkit@15.9.7 → tmp@~0.2.1 (resolved to 0.2.1) - lerna@5.6.2 → nx@15.9.7 → tmp@~0.2.1 (resolved to 0.2.1) Direct parent analysis: - lerna@5.6.2 is the latest and final release in the 5.x line. - @nrwl/devkit and nx 15.9.7 both specify tmp@~0.2.1, which DOES accept tmp@0.2.4+ (the fixed version), but the lockfile had resolved to 0.2.1 (the latest at the time the lockfile was created). - No bump of lerna within its major resolves this since 5.6.2 is already latest. Resolution 'tmp': '^0.2.4' forces all instances to 0.2.5 (latest 0.2.x), fixing the CVE. The ~0.2.1 range in both @nrwl/devkit and nx accepts this.
Updates js-yaml from 3.14.1 to 3.14.2 and 4.1.0 to 4.1.1 to fix prototype pollution in merge (<<) keys (CVE-2025-64718). Resolves Dependabot alerts #95, #96.
Adds a resolution to upgrade immutable from 3.7.6 to 4.3.8 to fix Prototype Pollution vulnerability (CVE-2026-29063). The package is a transitive dependency of @ardatan/relay-compiler. Resolves Dependabot alert #136.
Adds a resolution to upgrade fast-xml-parser from 5.3.6 to 5.3.8 to fix stack overflow in XMLBuilder with preserveOrder (CVE-2026-27942). Transitive dependency of @aws-sdk/xml-builder. Resolves Dependabot alert #134.
fix(deps): resolve CVE-2026-29063 prototype pollution in immutable
…(ReDoS) (#1001) All direct parents (eslint@7.32.0, jest@27.5.1, lerna@5.6.2, copyfiles@2.4.1, codecov@3.8.3, @commitlint/config-lerna-scopes@17.8.1) are already at their latest versions within their current major. Their semver ranges (^3.0.x) accept minimatch@3.1.3+, but the lockfile had resolved to 3.1.2 (the latest at the time). Additionally, nx@15 (via lerna@5) pinned minimatch@3.0.5. No amount of bumping direct parents within their current majors changes this. Resolution 'minimatch': '^3.1.3' forces all instances to 3.1.5 (latest 3.x), eliminating all three vulnerable versions (3.0.5, 3.1.2, 5.1.6).
…on validation Adds a resolution to upgrade @smithy/config-resolver from 2.x to 4.x to adopt defense-in-depth enhancement for region parameter value validation in AWS SDK for JavaScript v3. Resolves Dependabot alert #99.
…g-resolver fix(deps): bump @smithy/config-resolver to 4.4.10 (defense-in-depth)
…lnate/once (CVE-2026-3449) (#1004) Instead of pinning @tootallnate/once to a vulnerable v2.0.0, resolve http-proxy-agent to v7 which dropped the @tootallnate/once dependency entirely. This forces all consumers (codecov/teeny-request, jest/jsdom, lerna/make-fetch-happen) to use http-proxy-agent@7.0.0 which only depends on agent-base@7 and debug@4. This completely removes @tootallnate/once from the dependency tree, fully resolving CVE-2026-3449 without the ESM/CJS compatibility issues of @tootallnate/once@3.0.1.
chore: increase iOS canary timeout
…make cleanup resilient (#1020)
* fix: resolve critical dependabot security vulnerabilities - Bump axios from 1.13.5 to 1.15.0 via yarn resolution (fixes CVE for SSRF via NO_PROXY bypass and cloud metadata exfiltration via header injection chain) - Bump handlebars from 4.7.7 to 4.7.9 in graphql-docs-generator direct dependency (fixes JavaScript Injection via AST Type Confusion) - Add handlebars >=4.7.9 yarn resolution to force patched version in transitive dependency via lerna > conventional-changelog-writer Resolves Dependabot alerts #156, #164, #178, #179 * chore: remove unintended packageManager field
* build(deps): bump tar from 7.5.10 to 7.5.11 Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.10 to 7.5.11. - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v7.5.10...v7.5.11) --- updated-dependencies: - dependency-name: tar dependency-version: 7.5.11 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump yauzl from 3.2.0 to 3.2.1 Bumps [yauzl](https://github.com/thejoshwolfe/yauzl) from 3.2.0 to 3.2.1. - [Commits](thejoshwolfe/yauzl@3.2.0...3.2.1) --- updated-dependencies: - dependency-name: yauzl dependency-version: 3.2.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump flatted from 3.3.2 to 3.4.2 Bumps [flatted](https://github.com/WebReflection/flatted) from 3.3.2 to 3.4.2. - [Commits](WebReflection/flatted@v3.3.2...v3.4.2) --- updated-dependencies: - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump lodash-es from 4.17.23 to 4.18.1 Bumps [lodash-es](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.23...4.18.1) --- updated-dependencies: - dependency-name: lodash-es dependency-version: 4.18.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump basic-ftp from 5.2.0 to 5.2.2 Bumps [basic-ftp](https://github.com/patrickjuchli/basic-ftp) from 5.2.0 to 5.2.2. - [Release notes](https://github.com/patrickjuchli/basic-ftp/releases) - [Changelog](https://github.com/patrickjuchli/basic-ftp/blob/master/CHANGELOG.md) - [Commits](patrickjuchli/basic-ftp@v5.2.0...v5.2.2) --- updated-dependencies: - dependency-name: basic-ftp dependency-version: 5.2.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump lodash from 4.17.23 to 4.18.1 Bumps [lodash](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.23...4.18.1) --- updated-dependencies: - dependency-name: lodash dependency-version: 4.18.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump brace-expansion from 1.1.12 to 1.1.14 Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.12 to 1.1.14. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.12...v1.1.14) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 1.1.14 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump follow-redirects from 1.15.11 to 1.16.0 Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.15.11 to 1.16.0. - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.11...v1.16.0) --- updated-dependencies: - dependency-name: follow-redirects dependency-version: 1.16.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump uuid from 7.0.1 to 14.0.0 Bumps [uuid](https://github.com/uuidjs/uuid) from 7.0.1 to 14.0.0. - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v7.0.1...v14.0.0) --- updated-dependencies: - dependency-name: uuid dependency-version: 14.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump uuid in /packages/amplify-codegen-e2e-core Bumps [uuid](https://github.com/uuidjs/uuid) from 7.0.1 to 14.0.0. - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v7.0.1...v14.0.0) --- updated-dependencies: - dependency-name: uuid dependency-version: 14.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump axios from 1.15.0 to 1.16.0 Bumps [axios](https://github.com/axios/axios) from 1.15.0 to 1.16.0. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.15.0...v1.16.0) --- updated-dependencies: - dependency-name: axios dependency-version: 1.16.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * chore: update dependency licenses * fix: revert uuid to 9.0.1 (v14 is ESM-only, breaks Jest) --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: svidgen <svidgen@users.noreply.github.com>
…erated Dart code (#1033)
soberm
approved these changes
Jul 23, 2026
svidgen
approved these changes
Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
12 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Promote
main→releasefor the codegen release (release Step 2). This PR is a branch promotion only — no source modifications.What's being released
mainis 76 commits ahead ofrelease. Highlights:fix(appsync-modelgen-plugin): map identityPool provider to IAM in generated Dart code (fix(appsync-modelgen-plugin): map identityPool provider to IAM in generated Dart code #1033)E2E status (main @
891ca29)✅ GREEN.
9530dc86— all 27 real codegen test shards passed. The only 2 non-green shards (cleanup_e2e_resourcesteardown +w_datastore_modelgen_flutter...afterEachteardown hang) were confirmed flaky teardown, not product regressions.04d58443of the failed shards came back 100% SUCCEEDED (all 4 sub-suites of the flutter shard passed; cleanup passed), confirming no regression on891ca29.CodeBuild project
amplify-codegen-e2e-workflow, account 594813022831, us-east-1.