fix(IDS-7369): repin @hapi/hapi 21.4.9 and @aws-sdk/client-s3 3.1064.0

[hamzabenali-okta]

✏️ Changes

Repin @hapi/hapi and @aws-sdk/client-s3 to the versions now available in our runtime module store, so the Authorization Extension consumes the patched transitive dependencies at runtime and clears two dependency security findings.

• @hapi/hapi 21.3.3 → 21.4.9 — pulls @hapi/content 6.0.0 → 6.0.2.
• @aws-sdk/client-s3 3.738.0 → 3.1064.0 — the newer SDK dropped fast-xml-parser (and its strnum dep) entirely, resolving that finding.

Design standpoint: both packages are declared as auth0-extension.externals, so they are resolved from the runtime module store rather than bundled. Repinning the externals (and the matching dependencies entries) is what actually picks up the fixes. No production code changed.

Code itself:

• package.json — repin both externals + dependencies; bump version 2.13.4 → 2.13.5.
• server/plugins/html.js — bump EXTENSION_VERSION to 2.13.5.
• CHANGELOG.md — add a 2.13.5 entry.
• package-lock.json — regenerated; churn is confined entirely to the @aws-sdk / @smithy / @hapi trees of the two externals. No new packages added.
• tests/unit/server/s3-storage-context.tests.js — the newer SDK folded @smithy/util-stream into @smithy/core/serde; repoint that test-only sdkStreamMixin import. Not a production dependency.
• dist/ — rebuilt at 2.13.5. The UI bundle rebuilds byte-identical to 2.13.4 modulo the version string; the extension bundle differs only in the two external require("name@version") strings and CLIENT_VERSION.

Why the dependency update is needed: the security findings flag outdated transitive libraries (@hapi/content@6.0.0, fast-xml-parser@4.4.1). The fixed versions only become reachable once the parent externals are bumped to the runtime-store-available releases.

📷 Screenshots

Local testing

🔗 References

• Internal tracking ticket (see linked issue).
• Companion change that made the updated externals available in the runtime module store.
• Prior pattern: the earlier axios bump PR (rebuild 2.13.4).

🎯 Testing

All 523 unit tests pass. The full S3StorageContext suite (read, write, and every region-redirect error path) was re-verified against @aws-sdk/client-s3@3.1064.0 using the aws-sdk-client-mock harness.

✅ This change has been tested in a Webtask

✅ This change has unit test coverage

🚫 This change has integration test coverage

🚫 This change has been tested for performance

🚀 Deployment

✅ This can be deployed any time — the required externals (@hapi/hapi@21.4.9, @aws-sdk/client-s3@3.1064.0) are already available in the runtime module store, so there is no lockstep dependency.

🎡 Rollout

In order to verify that the deployment was successful we will confirm the new 2.13.5 version is serving in the develop environment, exercise the S3 storage path, and confirm the two dependency findings are cleared on the next security scan.

🔥 Rollback

We will rollback if the extension fails to start on the repinned externals, or if the S3 storage read/write path regresses in production.

📄 Procedure

Revert to the previous 2.13.4 bundle and republish the extension. Since this is an externals/version repin with no data-model or config change, rollback is a straight redeploy of the prior version with no migration required.

[sauntimo]

Tested in prod with webtask and s3 storage. Good to merge & deploy. Thanks @hamzabenali-okta!