cdk-assets 4.7.2 → 4.7.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/THIRD_PARTY_LICENSES +16 -16
- package/bin/cdk-assets.js +59 -19
- package/bin/docker-credential-cdk-assets.js +59 -19
- package/package.json +5 -5
package/THIRD_PARTY_LICENSES
CHANGED
|
@@ -1030,7 +1030,7 @@ The cdk-assets package includes the following third-party software/licensing:
|
|
|
1030
1030
|
|
|
1031
1031
|
----------------
|
|
1032
1032
|
|
|
1033
|
-
** @aws-sdk/core@3.977.
|
|
1033
|
+
** @aws-sdk/core@3.977.9 - https://www.npmjs.com/package/@aws-sdk/core/v/3.977.9 | Apache-2.0
|
|
1034
1034
|
Apache License
|
|
1035
1035
|
Version 2.0, January 2004
|
|
1036
1036
|
http://www.apache.org/licenses/
|
|
@@ -1235,7 +1235,7 @@ Apache License
|
|
|
1235
1235
|
|
|
1236
1236
|
----------------
|
|
1237
1237
|
|
|
1238
|
-
** @aws-sdk/credential-provider-cognito-identity@3.972.
|
|
1238
|
+
** @aws-sdk/credential-provider-cognito-identity@3.972.69 - https://www.npmjs.com/package/@aws-sdk/credential-provider-cognito-identity/v/3.972.69 | Apache-2.0
|
|
1239
1239
|
Apache License
|
|
1240
1240
|
Version 2.0, January 2004
|
|
1241
1241
|
http://www.apache.org/licenses/
|
|
@@ -1441,7 +1441,7 @@ Apache License
|
|
|
1441
1441
|
|
|
1442
1442
|
----------------
|
|
1443
1443
|
|
|
1444
|
-
** @aws-sdk/credential-provider-env@3.972.
|
|
1444
|
+
** @aws-sdk/credential-provider-env@3.972.70 - https://www.npmjs.com/package/@aws-sdk/credential-provider-env/v/3.972.70 | Apache-2.0
|
|
1445
1445
|
Apache License
|
|
1446
1446
|
Version 2.0, January 2004
|
|
1447
1447
|
http://www.apache.org/licenses/
|
|
@@ -1646,11 +1646,11 @@ Apache License
|
|
|
1646
1646
|
|
|
1647
1647
|
----------------
|
|
1648
1648
|
|
|
1649
|
-
** @aws-sdk/credential-provider-http@3.972.
|
|
1649
|
+
** @aws-sdk/credential-provider-http@3.972.72 - https://www.npmjs.com/package/@aws-sdk/credential-provider-http/v/3.972.72 | Apache-2.0
|
|
1650
1650
|
|
|
1651
1651
|
----------------
|
|
1652
1652
|
|
|
1653
|
-
** @aws-sdk/credential-provider-ini@3.973.
|
|
1653
|
+
** @aws-sdk/credential-provider-ini@3.973.15 - https://www.npmjs.com/package/@aws-sdk/credential-provider-ini/v/3.973.15 | Apache-2.0
|
|
1654
1654
|
Apache License
|
|
1655
1655
|
Version 2.0, January 2004
|
|
1656
1656
|
http://www.apache.org/licenses/
|
|
@@ -1855,11 +1855,11 @@ Apache License
|
|
|
1855
1855
|
|
|
1856
1856
|
----------------
|
|
1857
1857
|
|
|
1858
|
-
** @aws-sdk/credential-provider-login@3.972.
|
|
1858
|
+
** @aws-sdk/credential-provider-login@3.972.77 - https://www.npmjs.com/package/@aws-sdk/credential-provider-login/v/3.972.77 | Apache-2.0
|
|
1859
1859
|
|
|
1860
1860
|
----------------
|
|
1861
1861
|
|
|
1862
|
-
** @aws-sdk/credential-provider-node@3.972.
|
|
1862
|
+
** @aws-sdk/credential-provider-node@3.972.81 - https://www.npmjs.com/package/@aws-sdk/credential-provider-node/v/3.972.81 | Apache-2.0
|
|
1863
1863
|
Apache License
|
|
1864
1864
|
Version 2.0, January 2004
|
|
1865
1865
|
http://www.apache.org/licenses/
|
|
@@ -2064,7 +2064,7 @@ Apache License
|
|
|
2064
2064
|
|
|
2065
2065
|
----------------
|
|
2066
2066
|
|
|
2067
|
-
** @aws-sdk/credential-provider-process@3.972.
|
|
2067
|
+
** @aws-sdk/credential-provider-process@3.972.70 - https://www.npmjs.com/package/@aws-sdk/credential-provider-process/v/3.972.70 | Apache-2.0
|
|
2068
2068
|
Apache License
|
|
2069
2069
|
Version 2.0, January 2004
|
|
2070
2070
|
http://www.apache.org/licenses/
|
|
@@ -2269,7 +2269,7 @@ Apache License
|
|
|
2269
2269
|
|
|
2270
2270
|
----------------
|
|
2271
2271
|
|
|
2272
|
-
** @aws-sdk/credential-provider-sso@3.973.
|
|
2272
|
+
** @aws-sdk/credential-provider-sso@3.973.14 - https://www.npmjs.com/package/@aws-sdk/credential-provider-sso/v/3.973.14 | Apache-2.0
|
|
2273
2273
|
Apache License
|
|
2274
2274
|
Version 2.0, January 2004
|
|
2275
2275
|
http://www.apache.org/licenses/
|
|
@@ -2474,7 +2474,7 @@ Apache License
|
|
|
2474
2474
|
|
|
2475
2475
|
----------------
|
|
2476
2476
|
|
|
2477
|
-
** @aws-sdk/credential-provider-web-identity@3.972.
|
|
2477
|
+
** @aws-sdk/credential-provider-web-identity@3.972.76 - https://www.npmjs.com/package/@aws-sdk/credential-provider-web-identity/v/3.972.76 | Apache-2.0
|
|
2478
2478
|
Apache License
|
|
2479
2479
|
Version 2.0, January 2004
|
|
2480
2480
|
http://www.apache.org/licenses/
|
|
@@ -2679,7 +2679,7 @@ Apache License
|
|
|
2679
2679
|
|
|
2680
2680
|
----------------
|
|
2681
2681
|
|
|
2682
|
-
** @aws-sdk/credential-providers@3.
|
|
2682
|
+
** @aws-sdk/credential-providers@3.1120.0 - https://www.npmjs.com/package/@aws-sdk/credential-providers/v/3.1120.0 | Apache-2.0
|
|
2683
2683
|
Apache License
|
|
2684
2684
|
Version 2.0, January 2004
|
|
2685
2685
|
http://www.apache.org/licenses/
|
|
@@ -3295,11 +3295,11 @@ Apache License
|
|
|
3295
3295
|
|
|
3296
3296
|
----------------
|
|
3297
3297
|
|
|
3298
|
-
** @aws-sdk/nested-clients@3.997.
|
|
3298
|
+
** @aws-sdk/nested-clients@3.997.44 - https://www.npmjs.com/package/@aws-sdk/nested-clients/v/3.997.44 | Apache-2.0
|
|
3299
3299
|
|
|
3300
3300
|
----------------
|
|
3301
3301
|
|
|
3302
|
-
** @aws-sdk/signature-v4-multi-region@3.996.
|
|
3302
|
+
** @aws-sdk/signature-v4-multi-region@3.996.46 - https://www.npmjs.com/package/@aws-sdk/signature-v4-multi-region/v/3.996.46 | Apache-2.0
|
|
3303
3303
|
Apache License
|
|
3304
3304
|
Version 2.0, January 2004
|
|
3305
3305
|
http://www.apache.org/licenses/
|
|
@@ -3505,7 +3505,7 @@ Apache License
|
|
|
3505
3505
|
|
|
3506
3506
|
----------------
|
|
3507
3507
|
|
|
3508
|
-
** @aws-sdk/token-providers@3.
|
|
3508
|
+
** @aws-sdk/token-providers@3.1116.0 - https://www.npmjs.com/package/@aws-sdk/token-providers/v/3.1116.0 | Apache-2.0
|
|
3509
3509
|
Apache License
|
|
3510
3510
|
Version 2.0, January 2004
|
|
3511
3511
|
http://www.apache.org/licenses/
|
|
@@ -3710,7 +3710,7 @@ Apache License
|
|
|
3710
3710
|
|
|
3711
3711
|
----------------
|
|
3712
3712
|
|
|
3713
|
-
** @aws-sdk/xml-builder@3.972.
|
|
3713
|
+
** @aws-sdk/xml-builder@3.972.40 - https://www.npmjs.com/package/@aws-sdk/xml-builder/v/3.972.40 | Apache-2.0
|
|
3714
3714
|
Apache License
|
|
3715
3715
|
Version 2.0, January 2004
|
|
3716
3716
|
http://www.apache.org/licenses/
|
|
@@ -4994,7 +4994,7 @@ Apache License
|
|
|
4994
4994
|
|
|
4995
4995
|
----------------
|
|
4996
4996
|
|
|
4997
|
-
** @smithy/node-http-handler@4.
|
|
4997
|
+
** @smithy/node-http-handler@4.11.3 - https://www.npmjs.com/package/@smithy/node-http-handler/v/4.11.3 | Apache-2.0
|
|
4998
4998
|
Apache License
|
|
4999
4999
|
Version 2.0, January 2004
|
|
5000
5000
|
http://www.apache.org/licenses/
|
package/bin/cdk-assets.js
CHANGED
|
@@ -793,6 +793,7 @@ var require_subprocess = __commonJS({
|
|
|
793
793
|
async function runUserCommandLine(commandLine, options = {}) {
|
|
794
794
|
const child = child_process.spawn(commandLine, {
|
|
795
795
|
...spawnOptions(options),
|
|
796
|
+
// eslint-disable-next-line no-restricted-syntax -- this is the single sanctioned shell entry point (see the module header)
|
|
796
797
|
shell: true
|
|
797
798
|
});
|
|
798
799
|
return monitor(child, commandLine, options);
|
|
@@ -8079,7 +8080,7 @@ var init_tools = __esm({
|
|
|
8079
8080
|
|
|
8080
8081
|
// ../@aws-cdk/cdk-assets-lib/lib/private/shell.ts
|
|
8081
8082
|
async function shell(command6, options) {
|
|
8082
|
-
const displayCommand = (0, tools_exports.renderForDisplay)(command6);
|
|
8083
|
+
const displayCommand = (0, tools_exports.renderForDisplay)(redactSensitiveArgs(command6, options.redactFlags));
|
|
8083
8084
|
handleShellOutput(displayCommand, options, "open");
|
|
8084
8085
|
try {
|
|
8085
8086
|
const result = await (0, tools_exports.run)(command6, {
|
|
@@ -8097,10 +8098,11 @@ async function shell(command6, options) {
|
|
|
8097
8098
|
}
|
|
8098
8099
|
handleShellOutput(displayCommand, options, "close");
|
|
8099
8100
|
const stderr = e6.stderr.trim();
|
|
8101
|
+
const message = e6.message.replace(e6.command, () => displayCommand);
|
|
8100
8102
|
throw new ProcessFailed(
|
|
8101
8103
|
e6.exitCode,
|
|
8102
8104
|
e6.signal,
|
|
8103
|
-
stderr ? `${
|
|
8105
|
+
stderr ? `${message}: ${stderr}` : message
|
|
8104
8106
|
);
|
|
8105
8107
|
}
|
|
8106
8108
|
throw e6;
|
|
@@ -8129,6 +8131,23 @@ function handleShellOutput(chunk, options, shellEventType) {
|
|
|
8129
8131
|
break;
|
|
8130
8132
|
}
|
|
8131
8133
|
}
|
|
8134
|
+
function redactSensitiveArgs(argv, redactFlags) {
|
|
8135
|
+
if (!redactFlags || redactFlags.length === 0) {
|
|
8136
|
+
return [...argv];
|
|
8137
|
+
}
|
|
8138
|
+
const flags = new Set(redactFlags);
|
|
8139
|
+
const out = new Array();
|
|
8140
|
+
for (let i6 = 0; i6 < argv.length; i6++) {
|
|
8141
|
+
out.push(argv[i6]);
|
|
8142
|
+
if (flags.has(argv[i6]) && i6 + 1 < argv.length) {
|
|
8143
|
+
i6 += 1;
|
|
8144
|
+
const token = argv[i6];
|
|
8145
|
+
const eq = token.indexOf("=");
|
|
8146
|
+
out.push(eq >= 0 ? `${token.slice(0, eq + 1)}<redacted>` : "<redacted>");
|
|
8147
|
+
}
|
|
8148
|
+
}
|
|
8149
|
+
return out;
|
|
8150
|
+
}
|
|
8132
8151
|
var ProcessFailed;
|
|
8133
8152
|
var init_shell = __esm({
|
|
8134
8153
|
"../@aws-cdk/cdk-assets-lib/lib/private/shell.ts"() {
|
|
@@ -8136,6 +8155,7 @@ var init_shell = __esm({
|
|
|
8136
8155
|
init_tools();
|
|
8137
8156
|
__name(shell, "shell");
|
|
8138
8157
|
__name(handleShellOutput, "handleShellOutput");
|
|
8158
|
+
__name(redactSensitiveArgs, "redactSensitiveArgs");
|
|
8139
8159
|
ProcessFailed = class extends Error {
|
|
8140
8160
|
constructor(exitCode, signal, message) {
|
|
8141
8161
|
super(message);
|
|
@@ -8250,6 +8270,10 @@ var init_docker = __esm({
|
|
|
8250
8270
|
await this.execute(buildCommand, {
|
|
8251
8271
|
cwd: options.directory,
|
|
8252
8272
|
subprocessOutputDestination: this.subprocessOutputDestination,
|
|
8273
|
+
// `--build-arg` values are passed literally and are a common (if
|
|
8274
|
+
// discouraged) place for secrets; `--secret` specs can name sensitive
|
|
8275
|
+
// sources. Mask their values wherever the command line is logged.
|
|
8276
|
+
redactFlags: ["--build-arg", "--secret"],
|
|
8253
8277
|
env: {
|
|
8254
8278
|
BUILDX_NO_DEFAULT_ATTESTATIONS: "1"
|
|
8255
8279
|
// Docker Build adds provenance attestations by default that confuse cdk-assets
|
|
@@ -12018,7 +12042,7 @@ var require_semver2 = __commonJS({
|
|
|
12018
12042
|
// ../@aws-cdk/cloud-assembly-schema/cli-version.json
|
|
12019
12043
|
var require_cli_version = __commonJS({
|
|
12020
12044
|
"../@aws-cdk/cloud-assembly-schema/cli-version.json"(exports2, module2) {
|
|
12021
|
-
module2.exports = { version: "2.
|
|
12045
|
+
module2.exports = { version: "2.1140.0" };
|
|
12022
12046
|
}
|
|
12023
12047
|
});
|
|
12024
12048
|
|
|
@@ -33170,12 +33194,13 @@ For more information, please visit: ` + STATIC_STABILITY_DOC_URL);
|
|
|
33170
33194
|
// ../../node_modules/@smithy/node-http-handler/dist-cjs/index.js
|
|
33171
33195
|
var require_dist_cjs5 = __commonJS({
|
|
33172
33196
|
"../../node_modules/@smithy/node-http-handler/dist-cjs/index.js"(exports2) {
|
|
33197
|
+
var { hasOwn: hasOwn2 } = (init_serde(), __toCommonJS(serde_exports));
|
|
33198
|
+
var { streamCollector: streamCollector8 } = (init_serde(), __toCommonJS(serde_exports));
|
|
33199
|
+
exports2.streamCollector = streamCollector8;
|
|
33173
33200
|
var { buildQueryString: buildQueryString2, HttpResponse: HttpResponse2 } = (init_protocols(), __toCommonJS(protocols_exports));
|
|
33174
33201
|
var node_https = require("node:https");
|
|
33175
33202
|
var { Readable: Readable8 } = require("node:stream");
|
|
33176
33203
|
var http2 = require("node:http2");
|
|
33177
|
-
var { streamCollector: streamCollector8 } = (init_serde(), __toCommonJS(serde_exports));
|
|
33178
|
-
exports2.streamCollector = streamCollector8;
|
|
33179
33204
|
function buildAbortError(abortSignal) {
|
|
33180
33205
|
const reason = abortSignal && typeof abortSignal === "object" && "reason" in abortSignal ? abortSignal.reason : void 0;
|
|
33181
33206
|
if (reason) {
|
|
@@ -33198,6 +33223,8 @@ var require_dist_cjs5 = __commonJS({
|
|
|
33198
33223
|
var getTransformedHeaders = /* @__PURE__ */ __name((headers) => {
|
|
33199
33224
|
const transformedHeaders = {};
|
|
33200
33225
|
for (const name in headers) {
|
|
33226
|
+
if (!hasOwn2(headers, name))
|
|
33227
|
+
continue;
|
|
33201
33228
|
const headerValues = headers[name];
|
|
33202
33229
|
transformedHeaders[name] = Array.isArray(headerValues) ? headerValues.join(",") : headerValues;
|
|
33203
33230
|
}
|
|
@@ -33388,6 +33415,8 @@ var require_dist_cjs5 = __commonJS({
|
|
|
33388
33415
|
}
|
|
33389
33416
|
if (sockets && requests) {
|
|
33390
33417
|
for (const origin in sockets) {
|
|
33418
|
+
if (!hasOwn2(sockets, origin))
|
|
33419
|
+
continue;
|
|
33391
33420
|
const socketsInUse = sockets[origin]?.length ?? 0;
|
|
33392
33421
|
const requestsEnqueued = requests[origin]?.length ?? 0;
|
|
33393
33422
|
if (socketsInUse >= maxSockets && requestsEnqueued >= 2 * maxSockets) {
|
|
@@ -33420,6 +33449,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
|
|
|
33420
33449
|
this.config = await this.configProvider;
|
|
33421
33450
|
}
|
|
33422
33451
|
const config = this.config;
|
|
33452
|
+
const logger2 = config.logger;
|
|
33423
33453
|
const isSSL = request.protocol === "https:";
|
|
33424
33454
|
if (!isSSL && !this.config.httpAgent) {
|
|
33425
33455
|
this.config.httpAgent = await this.config.httpAgentProvider();
|
|
@@ -33463,7 +33493,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
|
|
|
33463
33493
|
});
|
|
33464
33494
|
}
|
|
33465
33495
|
socketWarningTimeoutId = timing.setTimeout(() => {
|
|
33466
|
-
this.socketWarningTimestamp = _NodeHttpHandler.checkSocketUsage(agent, this.socketWarningTimestamp,
|
|
33496
|
+
this.socketWarningTimestamp = _NodeHttpHandler.checkSocketUsage(agent, this.socketWarningTimestamp, logger2);
|
|
33467
33497
|
}, config.socketAcquisitionWarningTimeout ?? (config.requestTimeout ?? 2e3) + (config.connectionTimeout ?? 1e3));
|
|
33468
33498
|
const queryString = request.query ? buildQueryString2(request.query) : "";
|
|
33469
33499
|
let auth = void 0;
|
|
@@ -33527,7 +33557,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
|
|
|
33527
33557
|
}
|
|
33528
33558
|
const effectiveRequestTimeout = requestTimeout ?? config.requestTimeout;
|
|
33529
33559
|
connectionTimeoutId = setConnectionTimeout(req, reject, config.connectionTimeout);
|
|
33530
|
-
requestTimeoutId = setRequestTimeout(req, reject, effectiveRequestTimeout, config.throwOnRequestTimeout,
|
|
33560
|
+
requestTimeoutId = setRequestTimeout(req, reject, effectiveRequestTimeout, config.throwOnRequestTimeout, logger2 ?? console);
|
|
33531
33561
|
socketTimeoutId = setSocketTimeout(req, reject, config.socketTimeout);
|
|
33532
33562
|
const httpAgent = nodeHttpsOptions.agent;
|
|
33533
33563
|
if (typeof httpAgent === "object" && "keepAlive" in httpAgent) {
|
|
@@ -33545,6 +33575,12 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
|
|
|
33545
33575
|
updateHttpClientConfig(key, value) {
|
|
33546
33576
|
this.config = void 0;
|
|
33547
33577
|
this.configProvider = this.configProvider.then((config) => {
|
|
33578
|
+
if (key === /* @__PURE__ */ Symbol.for("logger")) {
|
|
33579
|
+
return {
|
|
33580
|
+
...config,
|
|
33581
|
+
logger: config.logger ?? value
|
|
33582
|
+
};
|
|
33583
|
+
}
|
|
33548
33584
|
return {
|
|
33549
33585
|
...config,
|
|
33550
33586
|
[key]: value
|
|
@@ -34236,7 +34272,7 @@ var init_package = __esm({
|
|
|
34236
34272
|
"../../node_modules/@aws-sdk/nested-clients/package.json"() {
|
|
34237
34273
|
package_default = {
|
|
34238
34274
|
name: "@aws-sdk/nested-clients",
|
|
34239
|
-
version: "3.997.
|
|
34275
|
+
version: "3.997.44",
|
|
34240
34276
|
description: "Nested clients for AWS SDK packages.",
|
|
34241
34277
|
homepage: "https://github.com/aws/aws-sdk-js-v3/tree/main/packages/nested-clients",
|
|
34242
34278
|
license: "Apache-2.0",
|
|
@@ -34336,13 +34372,13 @@ var init_package = __esm({
|
|
|
34336
34372
|
"test:watch": "yarn g:vitest watch"
|
|
34337
34373
|
},
|
|
34338
34374
|
dependencies: {
|
|
34339
|
-
"@aws-sdk/core": "^3.977.
|
|
34340
|
-
"@aws-sdk/signature-v4-multi-region": "^3.996.
|
|
34341
|
-
"@aws-sdk/types": "^3.974.
|
|
34342
|
-
"@smithy/core": "^3.
|
|
34343
|
-
"@smithy/fetch-http-handler": "^5.
|
|
34344
|
-
"@smithy/node-http-handler": "^4.
|
|
34345
|
-
"@smithy/types": "^4.
|
|
34375
|
+
"@aws-sdk/core": "^3.977.9",
|
|
34376
|
+
"@aws-sdk/signature-v4-multi-region": "^3.996.46",
|
|
34377
|
+
"@aws-sdk/types": "^3.974.5",
|
|
34378
|
+
"@smithy/core": "^3.33.3",
|
|
34379
|
+
"@smithy/fetch-http-handler": "^5.7.2",
|
|
34380
|
+
"@smithy/node-http-handler": "^4.11.3",
|
|
34381
|
+
"@smithy/types": "^4.17.2",
|
|
34346
34382
|
tslib: "^2.6.2"
|
|
34347
34383
|
},
|
|
34348
34384
|
devDependencies: {
|
|
@@ -40407,7 +40443,7 @@ var require_dist_cjs8 = __commonJS({
|
|
|
40407
40443
|
const tokenString = JSON.stringify(ssoToken, null, 2);
|
|
40408
40444
|
return writeFile(tokenFilepath, tokenString);
|
|
40409
40445
|
}, "writeSSOTokenToFile");
|
|
40410
|
-
var
|
|
40446
|
+
var lastRefreshAttemptTimes = /* @__PURE__ */ new Map();
|
|
40411
40447
|
var fromSso = /* @__PURE__ */ __name((init = {}) => async ({ callerClientConfig } = {}) => {
|
|
40412
40448
|
init.logger?.debug("@aws-sdk/token-providers - fromSso");
|
|
40413
40449
|
const profiles = await parseKnownFiles2(init);
|
|
@@ -40442,11 +40478,15 @@ var require_dist_cjs8 = __commonJS({
|
|
|
40442
40478
|
validateTokenKey("accessToken", ssoToken.accessToken);
|
|
40443
40479
|
validateTokenKey("expiresAt", ssoToken.expiresAt);
|
|
40444
40480
|
const { accessToken, expiresAt } = ssoToken;
|
|
40445
|
-
const existingToken = {
|
|
40481
|
+
const existingToken = {
|
|
40482
|
+
token: accessToken,
|
|
40483
|
+
expiration: new Date(expiresAt)
|
|
40484
|
+
};
|
|
40446
40485
|
if (existingToken.expiration.getTime() - Date.now() > EXPIRE_WINDOW_MS) {
|
|
40447
40486
|
return existingToken;
|
|
40448
40487
|
}
|
|
40449
|
-
|
|
40488
|
+
const lastRefreshAttemptTime = lastRefreshAttemptTimes.get(ssoSessionName) ?? 0;
|
|
40489
|
+
if (Date.now() - lastRefreshAttemptTime < 30 * 1e3) {
|
|
40450
40490
|
validateTokenExpiry(existingToken);
|
|
40451
40491
|
return existingToken;
|
|
40452
40492
|
}
|
|
@@ -40454,7 +40494,7 @@ var require_dist_cjs8 = __commonJS({
|
|
|
40454
40494
|
validateTokenKey("clientSecret", ssoToken.clientSecret, true);
|
|
40455
40495
|
validateTokenKey("refreshToken", ssoToken.refreshToken, true);
|
|
40456
40496
|
try {
|
|
40457
|
-
|
|
40497
|
+
lastRefreshAttemptTimes.set(ssoSessionName, Date.now());
|
|
40458
40498
|
const newSsoOidcToken = await getNewSsoOidcToken(ssoToken, ssoRegion, init, callerClientConfig);
|
|
40459
40499
|
validateTokenKey("accessToken", newSsoOidcToken.accessToken);
|
|
40460
40500
|
validateTokenKey("expiresIn", newSsoOidcToken.expiresIn);
|
|
@@ -840,6 +840,7 @@ var require_subprocess = __commonJS({
|
|
|
840
840
|
async function runUserCommandLine(commandLine, options = {}) {
|
|
841
841
|
const child = child_process.spawn(commandLine, {
|
|
842
842
|
...spawnOptions(options),
|
|
843
|
+
// eslint-disable-next-line no-restricted-syntax -- this is the single sanctioned shell entry point (see the module header)
|
|
843
844
|
shell: true
|
|
844
845
|
});
|
|
845
846
|
return monitor(child, commandLine, options);
|
|
@@ -8126,7 +8127,7 @@ var init_tools = __esm({
|
|
|
8126
8127
|
|
|
8127
8128
|
// ../@aws-cdk/cdk-assets-lib/lib/private/shell.ts
|
|
8128
8129
|
async function shell(command6, options) {
|
|
8129
|
-
const displayCommand = (0, tools_exports.renderForDisplay)(command6);
|
|
8130
|
+
const displayCommand = (0, tools_exports.renderForDisplay)(redactSensitiveArgs(command6, options.redactFlags));
|
|
8130
8131
|
handleShellOutput(displayCommand, options, "open");
|
|
8131
8132
|
try {
|
|
8132
8133
|
const result = await (0, tools_exports.run)(command6, {
|
|
@@ -8144,10 +8145,11 @@ async function shell(command6, options) {
|
|
|
8144
8145
|
}
|
|
8145
8146
|
handleShellOutput(displayCommand, options, "close");
|
|
8146
8147
|
const stderr = e6.stderr.trim();
|
|
8148
|
+
const message = e6.message.replace(e6.command, () => displayCommand);
|
|
8147
8149
|
throw new ProcessFailed(
|
|
8148
8150
|
e6.exitCode,
|
|
8149
8151
|
e6.signal,
|
|
8150
|
-
stderr ? `${
|
|
8152
|
+
stderr ? `${message}: ${stderr}` : message
|
|
8151
8153
|
);
|
|
8152
8154
|
}
|
|
8153
8155
|
throw e6;
|
|
@@ -8176,6 +8178,23 @@ function handleShellOutput(chunk, options, shellEventType) {
|
|
|
8176
8178
|
break;
|
|
8177
8179
|
}
|
|
8178
8180
|
}
|
|
8181
|
+
function redactSensitiveArgs(argv, redactFlags) {
|
|
8182
|
+
if (!redactFlags || redactFlags.length === 0) {
|
|
8183
|
+
return [...argv];
|
|
8184
|
+
}
|
|
8185
|
+
const flags = new Set(redactFlags);
|
|
8186
|
+
const out = new Array();
|
|
8187
|
+
for (let i6 = 0; i6 < argv.length; i6++) {
|
|
8188
|
+
out.push(argv[i6]);
|
|
8189
|
+
if (flags.has(argv[i6]) && i6 + 1 < argv.length) {
|
|
8190
|
+
i6 += 1;
|
|
8191
|
+
const token = argv[i6];
|
|
8192
|
+
const eq = token.indexOf("=");
|
|
8193
|
+
out.push(eq >= 0 ? `${token.slice(0, eq + 1)}<redacted>` : "<redacted>");
|
|
8194
|
+
}
|
|
8195
|
+
}
|
|
8196
|
+
return out;
|
|
8197
|
+
}
|
|
8179
8198
|
var ProcessFailed;
|
|
8180
8199
|
var init_shell = __esm({
|
|
8181
8200
|
"../@aws-cdk/cdk-assets-lib/lib/private/shell.ts"() {
|
|
@@ -8183,6 +8202,7 @@ var init_shell = __esm({
|
|
|
8183
8202
|
init_tools();
|
|
8184
8203
|
__name(shell, "shell");
|
|
8185
8204
|
__name(handleShellOutput, "handleShellOutput");
|
|
8205
|
+
__name(redactSensitiveArgs, "redactSensitiveArgs");
|
|
8186
8206
|
ProcessFailed = class extends Error {
|
|
8187
8207
|
constructor(exitCode, signal, message) {
|
|
8188
8208
|
super(message);
|
|
@@ -8297,6 +8317,10 @@ var init_docker = __esm({
|
|
|
8297
8317
|
await this.execute(buildCommand, {
|
|
8298
8318
|
cwd: options.directory,
|
|
8299
8319
|
subprocessOutputDestination: this.subprocessOutputDestination,
|
|
8320
|
+
// `--build-arg` values are passed literally and are a common (if
|
|
8321
|
+
// discouraged) place for secrets; `--secret` specs can name sensitive
|
|
8322
|
+
// sources. Mask their values wherever the command line is logged.
|
|
8323
|
+
redactFlags: ["--build-arg", "--secret"],
|
|
8300
8324
|
env: {
|
|
8301
8325
|
BUILDX_NO_DEFAULT_ATTESTATIONS: "1"
|
|
8302
8326
|
// Docker Build adds provenance attestations by default that confuse cdk-assets
|
|
@@ -12065,7 +12089,7 @@ var require_semver2 = __commonJS({
|
|
|
12065
12089
|
// ../@aws-cdk/cloud-assembly-schema/cli-version.json
|
|
12066
12090
|
var require_cli_version = __commonJS({
|
|
12067
12091
|
"../@aws-cdk/cloud-assembly-schema/cli-version.json"(exports2, module2) {
|
|
12068
|
-
module2.exports = { version: "2.
|
|
12092
|
+
module2.exports = { version: "2.1140.0" };
|
|
12069
12093
|
}
|
|
12070
12094
|
});
|
|
12071
12095
|
|
|
@@ -33217,12 +33241,13 @@ For more information, please visit: ` + STATIC_STABILITY_DOC_URL);
|
|
|
33217
33241
|
// ../../node_modules/@smithy/node-http-handler/dist-cjs/index.js
|
|
33218
33242
|
var require_dist_cjs5 = __commonJS({
|
|
33219
33243
|
"../../node_modules/@smithy/node-http-handler/dist-cjs/index.js"(exports2) {
|
|
33244
|
+
var { hasOwn: hasOwn2 } = (init_serde(), __toCommonJS(serde_exports));
|
|
33245
|
+
var { streamCollector: streamCollector8 } = (init_serde(), __toCommonJS(serde_exports));
|
|
33246
|
+
exports2.streamCollector = streamCollector8;
|
|
33220
33247
|
var { buildQueryString: buildQueryString2, HttpResponse: HttpResponse2 } = (init_protocols(), __toCommonJS(protocols_exports));
|
|
33221
33248
|
var node_https = require("node:https");
|
|
33222
33249
|
var { Readable: Readable8 } = require("node:stream");
|
|
33223
33250
|
var http2 = require("node:http2");
|
|
33224
|
-
var { streamCollector: streamCollector8 } = (init_serde(), __toCommonJS(serde_exports));
|
|
33225
|
-
exports2.streamCollector = streamCollector8;
|
|
33226
33251
|
function buildAbortError(abortSignal) {
|
|
33227
33252
|
const reason = abortSignal && typeof abortSignal === "object" && "reason" in abortSignal ? abortSignal.reason : void 0;
|
|
33228
33253
|
if (reason) {
|
|
@@ -33245,6 +33270,8 @@ var require_dist_cjs5 = __commonJS({
|
|
|
33245
33270
|
var getTransformedHeaders = /* @__PURE__ */ __name((headers) => {
|
|
33246
33271
|
const transformedHeaders = {};
|
|
33247
33272
|
for (const name in headers) {
|
|
33273
|
+
if (!hasOwn2(headers, name))
|
|
33274
|
+
continue;
|
|
33248
33275
|
const headerValues = headers[name];
|
|
33249
33276
|
transformedHeaders[name] = Array.isArray(headerValues) ? headerValues.join(",") : headerValues;
|
|
33250
33277
|
}
|
|
@@ -33435,6 +33462,8 @@ var require_dist_cjs5 = __commonJS({
|
|
|
33435
33462
|
}
|
|
33436
33463
|
if (sockets && requests) {
|
|
33437
33464
|
for (const origin in sockets) {
|
|
33465
|
+
if (!hasOwn2(sockets, origin))
|
|
33466
|
+
continue;
|
|
33438
33467
|
const socketsInUse = sockets[origin]?.length ?? 0;
|
|
33439
33468
|
const requestsEnqueued = requests[origin]?.length ?? 0;
|
|
33440
33469
|
if (socketsInUse >= maxSockets && requestsEnqueued >= 2 * maxSockets) {
|
|
@@ -33467,6 +33496,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
|
|
|
33467
33496
|
this.config = await this.configProvider;
|
|
33468
33497
|
}
|
|
33469
33498
|
const config = this.config;
|
|
33499
|
+
const logger2 = config.logger;
|
|
33470
33500
|
const isSSL = request.protocol === "https:";
|
|
33471
33501
|
if (!isSSL && !this.config.httpAgent) {
|
|
33472
33502
|
this.config.httpAgent = await this.config.httpAgentProvider();
|
|
@@ -33510,7 +33540,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
|
|
|
33510
33540
|
});
|
|
33511
33541
|
}
|
|
33512
33542
|
socketWarningTimeoutId = timing.setTimeout(() => {
|
|
33513
|
-
this.socketWarningTimestamp = _NodeHttpHandler.checkSocketUsage(agent, this.socketWarningTimestamp,
|
|
33543
|
+
this.socketWarningTimestamp = _NodeHttpHandler.checkSocketUsage(agent, this.socketWarningTimestamp, logger2);
|
|
33514
33544
|
}, config.socketAcquisitionWarningTimeout ?? (config.requestTimeout ?? 2e3) + (config.connectionTimeout ?? 1e3));
|
|
33515
33545
|
const queryString = request.query ? buildQueryString2(request.query) : "";
|
|
33516
33546
|
let auth = void 0;
|
|
@@ -33574,7 +33604,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
|
|
|
33574
33604
|
}
|
|
33575
33605
|
const effectiveRequestTimeout = requestTimeout ?? config.requestTimeout;
|
|
33576
33606
|
connectionTimeoutId = setConnectionTimeout(req, reject, config.connectionTimeout);
|
|
33577
|
-
requestTimeoutId = setRequestTimeout(req, reject, effectiveRequestTimeout, config.throwOnRequestTimeout,
|
|
33607
|
+
requestTimeoutId = setRequestTimeout(req, reject, effectiveRequestTimeout, config.throwOnRequestTimeout, logger2 ?? console);
|
|
33578
33608
|
socketTimeoutId = setSocketTimeout(req, reject, config.socketTimeout);
|
|
33579
33609
|
const httpAgent = nodeHttpsOptions.agent;
|
|
33580
33610
|
if (typeof httpAgent === "object" && "keepAlive" in httpAgent) {
|
|
@@ -33592,6 +33622,12 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
|
|
|
33592
33622
|
updateHttpClientConfig(key, value) {
|
|
33593
33623
|
this.config = void 0;
|
|
33594
33624
|
this.configProvider = this.configProvider.then((config) => {
|
|
33625
|
+
if (key === /* @__PURE__ */ Symbol.for("logger")) {
|
|
33626
|
+
return {
|
|
33627
|
+
...config,
|
|
33628
|
+
logger: config.logger ?? value
|
|
33629
|
+
};
|
|
33630
|
+
}
|
|
33595
33631
|
return {
|
|
33596
33632
|
...config,
|
|
33597
33633
|
[key]: value
|
|
@@ -34283,7 +34319,7 @@ var init_package = __esm({
|
|
|
34283
34319
|
"../../node_modules/@aws-sdk/nested-clients/package.json"() {
|
|
34284
34320
|
package_default = {
|
|
34285
34321
|
name: "@aws-sdk/nested-clients",
|
|
34286
|
-
version: "3.997.
|
|
34322
|
+
version: "3.997.44",
|
|
34287
34323
|
description: "Nested clients for AWS SDK packages.",
|
|
34288
34324
|
homepage: "https://github.com/aws/aws-sdk-js-v3/tree/main/packages/nested-clients",
|
|
34289
34325
|
license: "Apache-2.0",
|
|
@@ -34383,13 +34419,13 @@ var init_package = __esm({
|
|
|
34383
34419
|
"test:watch": "yarn g:vitest watch"
|
|
34384
34420
|
},
|
|
34385
34421
|
dependencies: {
|
|
34386
|
-
"@aws-sdk/core": "^3.977.
|
|
34387
|
-
"@aws-sdk/signature-v4-multi-region": "^3.996.
|
|
34388
|
-
"@aws-sdk/types": "^3.974.
|
|
34389
|
-
"@smithy/core": "^3.
|
|
34390
|
-
"@smithy/fetch-http-handler": "^5.
|
|
34391
|
-
"@smithy/node-http-handler": "^4.
|
|
34392
|
-
"@smithy/types": "^4.
|
|
34422
|
+
"@aws-sdk/core": "^3.977.9",
|
|
34423
|
+
"@aws-sdk/signature-v4-multi-region": "^3.996.46",
|
|
34424
|
+
"@aws-sdk/types": "^3.974.5",
|
|
34425
|
+
"@smithy/core": "^3.33.3",
|
|
34426
|
+
"@smithy/fetch-http-handler": "^5.7.2",
|
|
34427
|
+
"@smithy/node-http-handler": "^4.11.3",
|
|
34428
|
+
"@smithy/types": "^4.17.2",
|
|
34393
34429
|
tslib: "^2.6.2"
|
|
34394
34430
|
},
|
|
34395
34431
|
devDependencies: {
|
|
@@ -40454,7 +40490,7 @@ var require_dist_cjs8 = __commonJS({
|
|
|
40454
40490
|
const tokenString = JSON.stringify(ssoToken, null, 2);
|
|
40455
40491
|
return writeFile(tokenFilepath, tokenString);
|
|
40456
40492
|
}, "writeSSOTokenToFile");
|
|
40457
|
-
var
|
|
40493
|
+
var lastRefreshAttemptTimes = /* @__PURE__ */ new Map();
|
|
40458
40494
|
var fromSso = /* @__PURE__ */ __name((init = {}) => async ({ callerClientConfig } = {}) => {
|
|
40459
40495
|
init.logger?.debug("@aws-sdk/token-providers - fromSso");
|
|
40460
40496
|
const profiles = await parseKnownFiles2(init);
|
|
@@ -40489,11 +40525,15 @@ var require_dist_cjs8 = __commonJS({
|
|
|
40489
40525
|
validateTokenKey("accessToken", ssoToken.accessToken);
|
|
40490
40526
|
validateTokenKey("expiresAt", ssoToken.expiresAt);
|
|
40491
40527
|
const { accessToken, expiresAt } = ssoToken;
|
|
40492
|
-
const existingToken = {
|
|
40528
|
+
const existingToken = {
|
|
40529
|
+
token: accessToken,
|
|
40530
|
+
expiration: new Date(expiresAt)
|
|
40531
|
+
};
|
|
40493
40532
|
if (existingToken.expiration.getTime() - Date.now() > EXPIRE_WINDOW_MS) {
|
|
40494
40533
|
return existingToken;
|
|
40495
40534
|
}
|
|
40496
|
-
|
|
40535
|
+
const lastRefreshAttemptTime = lastRefreshAttemptTimes.get(ssoSessionName) ?? 0;
|
|
40536
|
+
if (Date.now() - lastRefreshAttemptTime < 30 * 1e3) {
|
|
40497
40537
|
validateTokenExpiry(existingToken);
|
|
40498
40538
|
return existingToken;
|
|
40499
40539
|
}
|
|
@@ -40501,7 +40541,7 @@ var require_dist_cjs8 = __commonJS({
|
|
|
40501
40541
|
validateTokenKey("clientSecret", ssoToken.clientSecret, true);
|
|
40502
40542
|
validateTokenKey("refreshToken", ssoToken.refreshToken, true);
|
|
40503
40543
|
try {
|
|
40504
|
-
|
|
40544
|
+
lastRefreshAttemptTimes.set(ssoSessionName, Date.now());
|
|
40505
40545
|
const newSsoOidcToken = await getNewSsoOidcToken(ssoToken, ssoRegion, init, callerClientConfig);
|
|
40506
40546
|
validateTokenKey("accessToken", newSsoOidcToken.accessToken);
|
|
40507
40547
|
validateTokenKey("expiresIn", newSsoOidcToken.expiresIn);
|
package/package.json
CHANGED
|
@@ -37,7 +37,7 @@
|
|
|
37
37
|
"organization": true
|
|
38
38
|
},
|
|
39
39
|
"devDependencies": {
|
|
40
|
-
"@aws-cdk/cloud-assembly-schema": "54.
|
|
40
|
+
"@aws-cdk/cloud-assembly-schema": "54.22.0",
|
|
41
41
|
"@aws-sdk/client-s3": "^3",
|
|
42
42
|
"@cdklabs/eslint-plugin": "^2.0.18",
|
|
43
43
|
"@stylistic/eslint-plugin": "^3",
|
|
@@ -53,7 +53,7 @@
|
|
|
53
53
|
"eslint-config-prettier": "^10.1.8",
|
|
54
54
|
"eslint-import-resolver-typescript": "^4.4.5",
|
|
55
55
|
"eslint-plugin-import": "^2.32.0",
|
|
56
|
-
"eslint-plugin-jest": "^29.16.
|
|
56
|
+
"eslint-plugin-jest": "^29.16.5",
|
|
57
57
|
"eslint-plugin-jsdoc": "^62.9.0",
|
|
58
58
|
"eslint-plugin-prettier": "^4.2.5",
|
|
59
59
|
"jest": "^29.7.0",
|
|
@@ -62,10 +62,10 @@
|
|
|
62
62
|
"node-backpack": "^1.1.46",
|
|
63
63
|
"nx": "^22.7.8",
|
|
64
64
|
"prettier": "^2.8",
|
|
65
|
-
"projen": "^0.
|
|
65
|
+
"projen": "^0.103.5",
|
|
66
66
|
"ts-jest": "^29.4.12",
|
|
67
67
|
"typescript": "5.9",
|
|
68
|
-
"@aws-cdk/cdk-assets-lib": "^1.
|
|
68
|
+
"@aws-cdk/cdk-assets-lib": "^1.5.0",
|
|
69
69
|
"yargs": "^17.7.3"
|
|
70
70
|
},
|
|
71
71
|
"dependencies": {},
|
|
@@ -89,7 +89,7 @@
|
|
|
89
89
|
"publishConfig": {
|
|
90
90
|
"access": "public"
|
|
91
91
|
},
|
|
92
|
-
"version": "4.7.
|
|
92
|
+
"version": "4.7.3",
|
|
93
93
|
"packageManager": "yarn@4.17.1",
|
|
94
94
|
"types": "lib/index.d.ts",
|
|
95
95
|
"//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"yarn projen\"."
|