Repository navigation
Migrate lib/upload-s3.js from AWS SDK v2 to v3 (lib-storage Upload) - #84
Open
Riarstudio wants to merge 1 commit into
Open
Riarstudio wants to merge 1 commit into
Riarstudio wants to merge 1 commit into
Conversation
AWS SDK for JavaScript v2 reached end-of-support on September 8, 2025 and receives no security patches (GHSA-j965-2qgj-vjmq). Replace the v2 managed upload s3.upload(...).promise() with the Upload class from @aws-sdk/lib-storage (same partSize/queueSize options) driven by an S3Client from @aws-sdk/client-s3; the logger config moves into the client constructor. package.json: add @aws-sdk/client-s3 and @aws-sdk/lib-storage; aws-sdk stays for lib/iam.js and lib/secrets-manager.js, which are out of scope.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #83.
What
Migrates the S3 upload path from AWS SDK for JavaScript v2 to v3. AWS SDK v2 reached
end-of-support on September 8, 2025 and receives no security patches (advisory
GHSA-j965-2qgj-vjmq, applies to all v2 versions; remediation is migration to v3).
Changes
lib/upload-s3.js—new AWS.S3({ region })becomesnew S3Client({ region, logger })from
@aws-sdk/client-s3(the v2 globalAWS.config.update({ logger })moves into theclient constructor). The managed upload
s3.upload(params, { partSize, queueSize: 1 }).promise()becomes
new Upload({ client, params, partSize, queueSize: 1 }).done()from@aws-sdk/lib-storage— same multipart behavior, same options, streamBodyunchanged.package.json— adds@aws-sdk/client-s3and@aws-sdk/lib-storage.aws-sdkiskept:
lib/iam.jsandlib/secrets-manager.jsstill use it and are out of scope here.Verification
07de5cc; preservation check passed; patched tree re-validated.npm installpassed in our verification sandbox (registry egress).npm testcurrently fails on unmodified master at test-harness load:test/handler.jscallschai.use(...)and throwsTypeError: fn is not a functionwith the repo's pinned chai/chai-as-promised versions. Wereproduced the identical failure on the unpatched tree in the same
sandbox, so it is pre-existing and unrelated to this change — but it does
mean the suite could not exercise the migrated code. The change is
confined to
lib/upload-s3.jsand is a mechanical equivalent of theprevious implementation.
npx eslint .reports pre-existing findings across the repo (includingfiles this PR doesn't touch); the migrated file matches the repo's
existing style.