Bump uuid and @aws-sdk/client-dynamodb in /backend/src/mithrandir#1092
Bump uuid and @aws-sdk/client-dynamodb in /backend/src/mithrandir#1092dependabot[bot] wants to merge 1 commit into
Conversation
Removes [uuid](https://github.com/uuidjs/uuid). It's no longer used after updating ancestor dependency [@aws-sdk/client-dynamodb](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-dynamodb). These dependencies need to be updated together. Removes `uuid` Updates `@aws-sdk/client-dynamodb` from 3.758.0 to 3.1041.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-dynamodb/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1041.0/clients/client-dynamodb) --- updated-dependencies: - dependency-name: uuid dependency-version: dependency-type: indirect - dependency-name: "@aws-sdk/client-dynamodb" dependency-version: 3.1041.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Routine Dependabot AWS SDK bump; mithrandir Lambda runs on nodejs22.x so the new >=20 engine requirement is satisfied, and the removed uuid package was already unused (codebase calls node:crypto randomUUID).
Extended reasoning...
Overview
Dependabot-only PR touching backend/src/mithrandir/package.json and package-lock.json. Bumps @aws-sdk/client-dynamodb from 3.758.0 to 3.1041.0 and drops the now-unused uuid package. No source code changes.
Security risks
None introduced by the diff itself. The mithrandir Lambda is the SailApps auth/token handler (security-sensitive), but this PR contains no logic changes — only transitive dep updates. The expanded transitive dependency surface (e.g. @nodable/entities, fast-xml-builder, @aws/lambda-invoke-store) is a normal consequence of staying current on the official AWS SDK.
Level of scrutiny
Low. This is the standard Dependabot pattern: package.json + lockfile, no behavioral code changes. The two compatibility checks both pass: (1) the new SDK requires Node >=20 and template.yaml line 147 sets Runtime: nodejs22.x; (2) @aws-sdk/lib-dynamodb@3.758.0 declares peer @aws-sdk/client-dynamodb: ^3.758.0, satisfied by 3.1041.0. The uuid removal is safe because index.ts:360 already uses randomUUID() from node:crypto.
Other factors
No prior reviewer comments. Bug hunters found no issues. The version jump spans many months of AWS SDK releases, but each release is a routine codegen/endpoint update, and lockfile updates of this kind are exactly what Dependabot is designed for.
|
Superseded by #1110. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/backend/src/mithrandir/multi-49f662c009
branch
Removes uuid. It's no longer used after updating ancestor dependency @aws-sdk/client-dynamodb. These dependencies need to be updated together.
Removes
uuidUpdates
@aws-sdk/client-dynamodbfrom 3.758.0 to 3.1041.0Release notes
Sourced from @aws-sdk/client-dynamodb's releases.
... (truncated)
Changelog
Sourced from @aws-sdk/client-dynamodb's changelog.
... (truncated)
Commits
5df4c01Publish v3.1041.07736067Publish v3.1040.0856c9c0test(client-dynamodb): fix table cleanup criteria (#7976)51c8215Publish v3.1039.097d9277test(client-dynamodb): enable verbose e2e test mode (#7974)8009782test(client-dynamodb): e2e test table cleanup (#7971)3dfb72bchore(codegen): sync for adaptive retry fixes (#7970)3fbf6c5Publish v3.1038.0e9f8d8achore(codegen): sync for typed waiter-result values (#7965)7babd8bPublish v3.1037.0Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.