Merge pull request #63 from aws-solutions/release/v1.1.2

Release v1.1.2

Author: groverlalit

CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.1.2] - 2025-11-20
+
+### Security
+
+- Upgraded `js-yaml` to mitigate [CVE-2025-64718](https://nvd.nist.gov/vuln/detail/CVE-2025-64718)
+- Upgraded `glob` to mitigate [CVE-2025-64756](https://nvd.nist.gov/vuln/detail/CVE-2025-64756)
+
 ## [1.1.1] - 2025-11-14
 
 ### Fixed

NOTICE

@@ -2,7 +2,7 @@ openapi: 3.0.0
 info:
   title: Innovation Sandbox on AWS
   description: API documentation for the Innovation Sandbox on AWS solution.
-  version: 1.1.1
+  version: 1.1.2
   license:
     name: Apache 2.0
     url: "http://www.apache.org/licenses/LICENSE-2.0.html"

docs/openapi/innovation-sandbox-api.yaml

@@ -1,6 +1,6 @@
 {
   "name": "@amzn/innovation-sandbox-on-aws",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "Innovation Sandbox on AWS (SO0284)",
   "scripts": {
     "preinstall": "npm run generate-local-package-lock --workspaces --if-present",
@@ -55,7 +55,7 @@
     "@types/luxon": "^3.4.2",
     "@types/object-hash": "^3.0.6",
     "@types/supertest": "^6.0.2",
-    "@vitest/coverage-v8": "^3.1.1",
+    "@vitest/coverage-v8": "^4.0.10",
     "aws-sdk-client-mock": "^4.0.2",
     "fs-extra": "^11.2.0",
     "js-yaml": "^4.1.0",
@@ -66,7 +66,7 @@
     "ts-retry": "^5.0.1",
     "tsconfig-paths": "^4.2.0",
     "tsx": "^4.19.4",
-    "vitest": "^3.1.1",
+    "vitest": "^4.0.10",
     "vitest-mock-extended": "^2.0.2"
   },
   "prettier": {

package-lock.json

@@ -1,6 +1,6 @@
 id: SO0284
 name: innovation-sandbox-on-aws
-version: v1.1.1
+version: v1.1.2
 cloudformation_templates:
   - template: InnovationSandbox-AccountPool.template
     main_template: true

package.json

@@ -1,7 +1,7 @@
 {
   "name": "@amzn/innovation-sandbox-commons",
   "description": "Common - Innovation Sandbox on AWS (SO0284)",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "scripts": {
     "build": "tsc --incremental --noEmit",
     "test": "vitest run"

solution-manifest.yaml

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 import { Granularity } from "@aws-sdk/client-cost-explorer";
 import { DateTime } from "luxon";
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 
 import {
   AccountsCostReport,
@@ -22,8 +22,10 @@ vi.mock("@amzn/innovation-sandbox-commons/utils/cross-account-roles.js", () => {
 const costExplorerService = IsbServices.costExplorer({
   USER_AGENT_EXTRA: "test-agent",
 });
-beforeEach(() => {
-  vi.restoreAllMocks();
+
+afterEach(() => {
+  vi.resetAllMocks();
+  vi.useRealTimers();
 });
 
 const testAccount1 = "123456789012";

source/common/package.json

@@ -25,6 +25,7 @@ import {
   LeaseTerminatedManualSchema,
   LeaseTerminatedQuarantinedSchema,
 } from "@amzn/innovation-sandbox-commons/events/lease-terminated-event.js";
+import { LeaseUnfrozenEventSchema } from "@amzn/innovation-sandbox-commons/events/lease-unfrozen-event.js";
 import { IsbServices } from "@amzn/innovation-sandbox-commons/isb-services/index.js";
 import { SynthesizedEmail } from "@amzn/innovation-sandbox-commons/isb-services/notification/email-service.js";
 import { EmailNotificationEnvironmentSchema } from "@amzn/innovation-sandbox-commons/lambda/environments/email-notification-lambda-environment.js";
@@ -36,7 +37,6 @@ import {
   SESServiceException,
 } from "@aws-sdk/client-ses";
 import { mockClient } from "aws-sdk-client-mock";
-import { LeaseUnfrozenEventSchema } from "events/lease-unfrozen-event.js";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const managerEmails = ["[email protected]", "[email protected]"];

source/common/test/isb-services/cost-explorer-service.test.ts

@@ -2,9 +2,9 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import { injectSanitizedLambdaContext } from "@amzn/innovation-sandbox-commons/lambda/middleware/inject-sanitized-lambda-context.js";
+import { createAPIGatewayProxyEvent } from "@amzn/innovation-sandbox-commons/test/lambdas/fixtures.js";
 import { Logger } from "@aws-lambda-powertools/logger";
 import { APIGatewayProxyEvent } from "aws-lambda";
-import { createAPIGatewayProxyEvent } from "test/lambdas/fixtures.js";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 describe("injectSanitizedLambdaContext", () => {
@@ -33,7 +33,7 @@ describe("injectSanitizedLambdaContext", () => {
   });
 
   afterEach(() => {
-    vi.restoreAllMocks();
+    vi.resetAllMocks();
   });
 
   it("should sanitize authorization headers before logging", async () => {