CI Failure: Quality and Safety Checks

[agentcore-devx-automation]

CI Failure

• Name: Quality and Safety Checks
• Branch: main
• Commit: 4a9ce31
• Run: https://github.com/aws/agentcore-cli/actions/runs/30291757160

Please investigate this failure.

[Hweinstock]

Looks like a security audit failure:

@opentelemetry/core  <2.8.0
Severity: moderate
OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation - https://github.com/advisories/GHSA-8988-4f7v-96qf
fix available via `npm audit fix --force`
Will install @opentelemetry/exporter-metrics-otlp-http@0.221.0, which is a breaking change
node_modules/@opentelemetry/exporter-metrics-otlp-http/node_modules/@opentelemetry/core
node_modules/@opentelemetry/otlp-exporter-base/node_modules/@opentelemetry/core
node_modules/@opentelemetry/otlp-transformer/node_modules/@opentelemetry/core
node_modules/@opentelemetry/sdk-logs/node_modules/@opentelemetry/core
node_modules/@opentelemetry/sdk-trace-base/node_modules/@opentelemetry/core
  @opentelemetry/exporter-metrics-otlp-http  <=0.218.0
  Depends on vulnerable versions of @opentelemetry/core
  Depends on vulnerable versions of @opentelemetry/otlp-exporter-base
  Depends on vulnerable versions of @opentelemetry/otlp-transformer
  Depends on vulnerable versions of @opentelemetry/resources
  Depends on vulnerable versions of @opentelemetry/sdk-metrics
  node_modules/@opentelemetry/exporter-metrics-otlp-http
  @opentelemetry/otlp-exporter-base  <=0.218.0
  Depends on vulnerable versions of @opentelemetry/core
  Depends on vulnerable versions of @opentelemetry/otlp-transformer
  node_modules/@opentelemetry/otlp-exporter-base
  @opentelemetry/otlp-transformer  <=0.218.0
  Depends on vulnerable versions of @opentelemetry/core
  Depends on vulnerable versions of @opentelemetry/resources
  Depends on vulnerable versions of @opentelemetry/sdk-logs
  Depends on vulnerable versions of @opentelemetry/sdk-metrics
  Depends on vulnerable versions of @opentelemetry/sdk-trace-base
  node_modules/@opentelemetry/exporter-metrics-otlp-http/node_modules/@opentelemetry/otlp-transformer
  node_modules/@opentelemetry/otlp-exporter-base/node_modules/@opentelemetry/otlp-transformer
  node_modules/@opentelemetry/otlp-transformer
  @opentelemetry/resources  0.8.0 - 2.7.1
  Depends on vulnerable versions of @opentelemetry/core
  node_modules/@opentelemetry/exporter-metrics-otlp-http/node_modules/@opentelemetry/resources
  node_modules/@opentelemetry/otlp-exporter-base/node_modules/@opentelemetry/resources
  node_modules/@opentelemetry/otlp-transformer/node_modules/@opentelemetry/resources
  node_modules/@opentelemetry/sdk-logs/node_modules/@opentelemetry/resources
  node_modules/@opentelemetry/sdk-trace-base/node_modules/@opentelemetry/resources
  @opentelemetry/sdk-logs  <=0.218.0
  Depends on vulnerable versions of @opentelemetry/core
  Depends on vulnerable versions of @opentelemetry/resources
  node_modules/@opentelemetry/exporter-metrics-otlp-http/node_modules/@opentelemetry/sdk-logs
  node_modules/@opentelemetry/otlp-exporter-base/node_modules/@opentelemetry/sdk-logs
  node_modules/@opentelemetry/sdk-logs
  @opentelemetry/sdk-metrics  <=2.7.1
  Depends on vulnerable versions of @opentelemetry/core
  Depends on vulnerable versions of @opentelemetry/resources
  node_modules/@opentelemetry/exporter-metrics-otlp-http/node_modules/@opentelemetry/sdk-metrics
  node_modules/@opentelemetry/otlp-exporter-base/node_modules/@opentelemetry/sdk-metrics
  node_modules/@opentelemetry/otlp-transformer/node_modules/@opentelemetry/sdk-metrics
  @opentelemetry/sdk-trace-base  <=2.7.1
  Depends on vulnerable versions of @opentelemetry/core
  Depends on vulnerable versions of @opentelemetry/resources
  node_modules/@opentelemetry/exporter-metrics-otlp-http/node_modules/@opentelemetry/sdk-trace-base
  node_modules/@opentelemetry/otlp-exporter-base/node_modules/@opentelemetry/sdk-trace-base
  node_modules/@opentelemetry/sdk-trace-base

brace-expansion  <=5.0.7
Severity: high
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash - https://github.com/advisories/GHSA-mh99-v99m-4gvg
fix available via `npm audit fix`
node_modules/brace-expansion

fast-xml-parser  <5.7.0
Severity: moderate
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters - https://github.com/advisories/GHSA-gh4j-gqv2-49f6
fix available via `npm audit fix`
node_modules/fast-xml-parser
  @aws-sdk/xml-builder  3.894.0 - 3.972.18
  Depends on vulnerable versions of fast-xml-parser
  node_modules/@aws-sdk/xml-builder

11 vulnerabilities (10 moderate, 1 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force