-
Notifications
You must be signed in to change notification settings - Fork 144
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore: Override smithy-client to fix CodeQL warning #346
Conversation
package.json
Outdated
@@ -1,6 +1,6 @@ | |||
{ | |||
"name": "aws-actions-amazon-ecs-render-task-definition", | |||
"version": "1.6.0", | |||
"version": "1.6.1", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
why are we manually updating our release version? We should let the update happen as part of the release automation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
+1
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ack, will remove manual update of release version
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Added comment
Addressed version number comment with new commit. |
Issue #, if available:
Code scanning alert
Description of changes:
The code-scanning alert points towards this generated line as the security issue. The root cause seems to be the
smithy-client
dependency inherited from theaws-sdk/client-ecs
devDependency declared inpackage.json
. Indeed, the latest version of the smithy-client exports the "quoteHeader" function where the problematic line stems from. Path:@smithy/smithy-client/dist-types/ts3.4/quote-header.d.ts
Adding the
@smithy/smithy-client": "3.3.6"
override topackage.json
, followed by this string of commands:Results in
dist/index.js
no longer containing the problematic line. You should see in the diff for this file the removal of:The changes were tested by running a workflow that calls the action defined by this PR's commit from a simple ecs application.
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.