Conversation
…ties Upgrades AWS SDK client packages and adds a resolution to eliminate vulnerable fast-xml-parser versions (4.4.1, 5.2.5, 5.5.2) from the dependency tree. Changes: - Broadened fast-xml-parser resolution to force all instances to ~5.5.12 - Updated @aws-sdk/core, @aws-sdk/xml-builder and related packages in amplify-data-construct and amplify-graphql-api-construct - Upgraded direct fast-xml-parser dep from 5.5.2 to ~5.5.12 in constructs - Upgraded AWS SDK clients in test packages to ^3.973.0 After these changes, yarn.lock contains only fast-xml-parser@5.5.12 (safe, >= 5.5.6) with no vulnerable versions remaining.
Remove stale lockfile entries for @aws-sdk packages in the 3.775.x and 3.810.x version families that declared fast-xml-parser 4.4.1. These came from aws-appsync@4.1.10 (via @aws-sdk/client-s3@^3.25.0 resolved to 3.779.0) and @aws-cdk/toolkit-lib@1.16.0 (via @aws-sdk/client-*@^3 resolved to 3.810.0). After removal, yarn install re-resolved these ranges to the latest compatible versions which use @aws-sdk/core >= 3.974.8 (no fast-xml-parser dependency). Remaining: @aws-sdk/core@3.622.0 from @aws-amplify/ai-constructs@1.6.1 still declares fast-xml-parser 4.4.1, but the resolution forces it to 5.5.12. This will be addressed separately.
Main yarn.lock: - fast-xml-parser ~5.5.12 → ~5.7.2 (resolves to 5.7.3) - fast-xml-builder 1.1.4 → 1.2.0 - axios 1.15.0 → 1.16.1 - @xmldom/xmldom 0.9.9 → 0.9.10 - basic-ftp 5.2.2 → 6.0.1 - picomatch 2.3.1/4.0.3 → 2.3.2/4.0.4 - flatted 3.3.3 → 3.4.2 - fast-uri 3.0.6 → 3.1.2 - tmp 0.2.5 → 0.2.7 - @aws-amplify/ai-constructs 1.6.1 → 1.6.2 scripts/yarn.lock: - axios 1.12.0 → 1.16.1 - minimatch 9.0.5 → 10.2.5 - fast-xml-parser 4.4.1 → 5.8.0 jsonServer/yarn.lock: - minimatch 3.1.2 → 3.1.5 jsonServer/src-server/yarn.lock: - lodash 4.17.21 → 4.18.1
…s and update license disclaimer
…onstruct completeness
## Description Splits the e2e CI infrastructure out of the mixed draft #3493 into a clean, self-contained change off `main`. This PR contains **only** the CI/e2e-infra file-set; the generation/conversation test fixes ship separately, and the generation IAM change is #3495. ### Two self-contained waved CodeBuild batches The single e2e batch is split into two independent batches — `api+gql` (~78 shards) and `cdk` (~108 shards) — each with its own prep/build/verify chain and cleanup. Every shard is chained into an index-offset wave window (`SPLIT_E2E_WAVE_SIZE`) so in-flight builds stay under the orchestrator's concurrent-build ceiling. A `cloudE2ESplit` trigger and a `wait-for-all-codebuild-split` aggregator drive and join the two batches. The legacy single-batch path is retained. ### Reconciliation self-check The generator now asserts that the split total equals the combined total with no missing/extra/duplicate/overlapping shards. Current run: **PASS (186 == 186)**. ### Region pool `sa-east-1` is removed from the round-robin region assignment — its limited Amplify service coverage (RDS/OpenSearch) was producing e2e failures. ### CDK OOM: shard-split via RUN_SOLO The five heavy CDK construct-deploy suites (utils, log-config, gsi-projection-type, ddb-iam-access, data-construct) were bin-packed into one shard and exhausted the worker heap (SIGKILL/OOM). They are added to the existing `RUN_SOLO` list so each deploys in its own shard. This grows the cdk batch to 108 and the combined workflow to 186; no test is dropped. ### Gen1 placeholder app: self-healing + cleanup-protect An idempotent, self-healing `ensureGen1PlaceholderApp(region)` is added to `amplify-e2e-core` and wired into a jest `globalSetup` hook in the two e2e packages that run `amplify init`, so the Gen1 deprecation-bypass placeholder app (and its `test` backend env) is recreated per shard before any test runs. `cleanup-e2e-resources` is updated to skip deleting `DoNotDeleteAppToBypassGen1Deprecation` so it persists across runs. ## How did you test this change? - Regenerated specs with `yarn ts-node ./scripts/split-e2e-tests.ts prod`; output is deterministic (no diff on re-run). - Reconciliation self-check: **PASS**, split total 186 == combined 186, no missing/extra/duplicate/overlap; max in-flight per batch within cap; no sa-east-1 assignments. ## Notes Draft. Supersedes the CI portion of #3493. Companion PRs: generation/conversation e2e test fixes (separate) and #3495 (generation IAM).
…y advisories - @aws-sdk/xml-builder ^3.972.0 -> ^3.972.31 in both constructs (root resolution @aws-sdk/core/@aws-sdk/xml-builder -> ^3.972.31). 3.972.31 is the first release containing aws-sdk-js-v3#7863, which replaces fast-xml-parser with an internal XML parser. - @opentelemetry/core pinned to >=2.8.0 via root resolutions (GHSA-8988-4f7v-96qf); resolves to 2.8.0. - uuid pinned to ^11.1.1 via root resolutions + both constructs (GHSA-w5hq-g745-h8pq); resolves to 11.1.1, the patched legacy-11 release. Avoids uuid 14.x which is ESM-first.
…m constructs Bumps @aws-sdk client packages (client-bedrock-runtime, client-sso, client-sso-oidc, client-sts, token-providers) to ^3.1074.0 and pins @aws-sdk/core to ^3.974.23 (the 3.1074 release line). Adds a root resolution forcing all @aws-sdk/core to 3.974.23, which depends on @aws-sdk/xml-builder@^3.972.31 — the version that removed fast-xml-parser. This collapses the previously stale core/xml-builder 3.972.15/22/26 resolutions (which still pulled fast-xml-parser) onto the fast-xml-parser-free 3.972.31. Removes the now-orphaned fast-xml-parser dependency chain (fast-xml-parser, fast-xml-builder, @nodable/entities, path-expression-matcher, strnum, xml-naming) from both constructs' dependencies + bundledDependencies and the root nohoist config, since xml-builder@3.972.31 no longer pulls them. The **/fast-xml-parser and **/fast-xml-builder safety resolutions are retained to keep legacy @aws-sdk v3 consumers (client-s3@3.6.1, client-sts@3.186.0) on the patched fast-xml-parser@5.7.3.
…error/null guards) Two Gen2-cdk e2e suites (generation, conversation) were failing for reasons unrelated to product code. This change fixes the test fixtures and adds fail-fast hygiene guards. Test-side only; no product behavior changes. Model ids The fixtures invoked anthropic.claude-3-haiku-20240307-v1:0, a legacy Bedrock model that has been auto-revoked in the e2e account; invoking it returned ResourceNotFoundException, AppSync resolved null, and the tests crashed on a null-deref. - generation: the @generation transformer's AppSync->Bedrock IAM role grants bedrock:InvokeModel only on the foundation-model ARN, so a cross-region inference profile fails with AccessDenied. The generation fixture is switched to the active on-demand foundation model mistral.mistral-large-2407-v1:0, which the e2e account can invoke under the existing IAM and which satisfies the basic text/scalar assertions. - conversation: routes via @aws-amplify/ai-constructs, which handles inference-profile IAM, so the conversation fixture uses the active inference profile us.anthropic.claude-haiku-4-5-20251001-v1:0. Fail-fast guards generation.test.ts: assert the GraphQL response has no errors and that the generated recipe is not null before dereferencing, so a Bedrock/GraphQL error is printed instead of a TypeError. conversation.test.ts: replace the ineffective toBeDefined() check on the stream part with not.toBeNull(), guard the .length read when the part is null, and add a max-iteration / overall-timeout guard inside the subscription for-await loop so a non-streaming assistant fails fast with a descriptive message instead of cascading into the jest timeout. --- Prompt: Split the mixed e2e/CI branch into a clean draft PR off main containing only the generation/conversation e2e test fixes: switch the dead legacy claude-3-haiku model id to a working model (generation -> mistral plain on-demand FM, conversation -> working inference profile) and add the error/null fail-fast guards. tsc the construct-tests package and commit (no --no-verify). (cherry picked from commit d3e8617)
…ol-use/structured output) (cherry picked from commit 3a02ac7)
…` assertions for haiku-4-5 The conversation happy-path e2e asserted every streamed ConversationMessageStreamPart had a non-null `p` and aggregated `p` into a non-empty string. That premise is wrong: `p` is optional stream padding, not response text. The ai-constructs Bedrock converse adapter only sets `p` when the underlying Bedrock contentBlockDelta carries a string padding field, and never sets it on control frames (contentBlockStop, the final stopReason chunk). claude-haiku-4-5 emits no `p` padding at all, so the subscription delivers `p: null` on every part, failing `expect(streamPart.p).not.toBeNull()` on the first frame and cascading the other cases into timeouts. Verified directly against us.anthropic.claude-haiku-4-5-20251001-v1:0 via Bedrock ConverseStream: the model returns the full pirate response (stopReason end_turn) with text delivered through contentBlockDelta/contentBlockText and no `p` padding on any frame. The assistant text is mapped correctly, so this is a test-assertion issue, not a resolver bug. Drop the contradictory not-null assertion, keep the `p` length check when padding is present, and assert the aggregate streamed contentBlockText is non-empty so the test still meaningfully verifies a real streaming response was received. --- Prompt: Gen2 PR #3500 conversation e2e shard failed at conversation.test.ts:136 expect(streamPart.p).not.toBeNull() with model us.anthropic.claude-haiku-4-5. Determine whether haiku-4-5 returns the pirate text interleaved with null-p control frames (assertion is wrong, fix it properly) or whether no assistant text arrives (real resolver bug, report it, do not loosen the test). Gather evidence from the CI log and the stream-part type/resolver, then fix or report. Commit to the branch with a conventional message, no --no-verify, follow CODING_GUIDELINES.md, and push. (cherry picked from commit 84331e7)
…ile for conversation haiku-4-5 ai-constructs v1.6.2 only grants correct Bedrock IAM for global.-prefixed model ids; switch pirateChat @conversation aiModel from us. to global. profile.
…S3/IAM operations Cherry-picked from 7a697364c (excluding stray .roko notepad file). Adds ConfiguredRetryStrategy + isNetworkError guards to cleanup-e2e-resources.ts and TimeoutError/ETIMEDOUT/ECONNRESET handling to retries.ts.
…-only buildspec for iteration
…ckInput (ai-constructs sends SDK ToolUseBlock.type)
… in a separate PR)
…eardown for log_config
…core event-stream dynamic import); keep cap-3
…modules for log_config tests
…ta exposure The RDS secondary-index request template (generateIndexQueryRequestTemplate) was not forwarding ctx.stash.authFilter to the SQL Lambda, allowing any authenticated user to bypass owner/group row-level authorization by querying through auto-generated index query fields (e.g., listByRep). Add constructAuthFilterStatement, constructNonScalarFieldsStatement, constructArrayFieldsStatement, and constructFieldMappingInput to match the standard list query path which correctly applies these filters.
…test The RDS index query now calls constructNonScalarFieldsStatement and constructArrayFieldsStatement which require ctx.output.getObject. Add the mock to the test's constructMockContext helper.
Add a unit test that directly exercises RDSIndexVTLGenerator and asserts the generated VTL contains ctx.stash.authFilter forwarding to the SQL Lambda payload. This ensures the authorization bypass cannot regress.
sarayev
approved these changes
Jul 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of changes
This PR releases the API plugin with the following important changes:
CDK / CloudFormation Parameters Changed
Issue #, if available
Description of how you validated changes
Checklist
yarn testpassesBy submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.