Security vulnerability found in fast-xml-parser

[reggieWayflyer]

Bug description

It looks like [email protected] has a security vulnerability within it's @aws-sdk/** dependency fast-xml-parser.

Within fast-xml-parser a vulnerability to ReDOS exists on currency.js (discovered by Gauss Security Labs R&D team).

A quick run of pnpm why fast-xml-parser outlines where it's usage lies.

            **└── fast-xml-parser 4.2.5**
dependencies:
@datadog/datadog-ci 2.41.0
└─┬ @aws-sdk/client-cloudwatch-logs 3.556.0
  ├─┬ @aws-sdk/client-sts 3.556.0
  │ ├─┬ @aws-sdk/core 3.556.0
  │ │ └── fast-xml-parser 4.2.5
  │ └─┬ @aws-sdk/credential-provider-node 3.556.0 peer
  │   ├─┬ @aws-sdk/credential-provider-ini 3.556.0
  │   │ └─┬ @aws-sdk/credential-provider-sso 3.556.0
  │   │   ├─┬ @aws-sdk/client-sso 3.556.0
  │   │   │ └─┬ @aws-sdk/core 3.556.0
  │   │   │   └── fast-xml-parser 4.2.5
  │   │   └─┬ @aws-sdk/token-providers 3.556.0
  │   │     └─┬ @aws-sdk/client-sso-oidc 3.556.0
  │   │       └─┬ @aws-sdk/core 3.556.0
  │   │         └── fast-xml-parser 4.2.5
  │   └─┬ @aws-sdk/credential-provider-sso 3.556.0
  │     ├─┬ @aws-sdk/client-sso 3.556.0
  │     │ └─┬ @aws-sdk/core 3.556.0
  │     │   └── fast-xml-parser 4.2.5
  │     └─┬ @aws-sdk/token-providers 3.556.0
  │       └─┬ @aws-sdk/client-sso-oidc 3.556.0
  │         └─┬ @aws-sdk/core 3.556.0
  │           └── fast-xml-parser 4.2.5
  ├─┬ @aws-sdk/core 3.556.0
  │ └── fast-xml-parser 4.2.5
  └─┬ @aws-sdk/credential-provider-node 3.556.0
    ├─┬ @aws-sdk/credential-provider-ini 3.556.0
    │ └─┬ @aws-sdk/credential-provider-sso 3.556.0
    │   ├─┬ @aws-sdk/client-sso 3.556.0
    │   │ └─┬ @aws-sdk/core 3.556.0
    │   │   └── fast-xml-parser 4.2.5
    │   └─┬ @aws-sdk/token-providers 3.556.0
    │     └─┬ @aws-sdk/client-sso-oidc 3.556.0
    │       └─┬ @aws-sdk/core 3.556.0
    │         └── fast-xml-parser 4.2.5
    └─┬ @aws-sdk/credential-provider-sso 3.556.0
      ├─┬ @aws-sdk/client-sso 3.556.0
      │ └─┬ @aws-sdk/core 3.556.0
      │   └── fast-xml-parser 4.2.5
      └─┬ @aws-sdk/token-providers 3.556.0
        └─┬ @aws-sdk/client-sso-oidc 3.556.0
          └─┬ @aws-sdk/core 3.556.0

Describe what you expected

Resolve the issue by bumping the appropriate aws-sdk dependencies.

Steps to reproduce the issue

For any node project with @datadog/datadog-ci installed with a version of 2.40.0 ~ 2.41.0

Additional context

Package manager: pnpm

Command

None

[Drarig29]

Hi! This will be fixed in the next patch. Thanks for reporting 🙇

[Hyokune]

Hello, do we know when the next patch will be releasing? 🙏

[Drarig29]

We just released a new version!