aws-cdk-lib: unmaintained transitive dependency with critical vulnerabilities

[caseytoomey]

Describe the bug

Similar to this issue with aws-cdk: #26417

aws-cdk-lib has a dependency on @aws-cdk/asset-node-proxy-agent-v5, which includes a layer containing vm2. vm2 has critical vulnerabilities and is no longer maintained. This doesn't seem to get picked up by yarn or npm audit.

Not sure if this is the best spot for this issue but I wasn't able to directly create an issue for @aws-cdk/asset-node-proxy-agent-v5 on GitHub.

Expected Behavior

No usage of proxy-agent v5 / vm2.

Current Behavior

proxy-agent v5 is used which has reliance on the vulnerable vm2 package.

Reproduction Steps

n/a

Possible Solution

Update the asset to use proxy agent 6.3.0

Additional Information/Context

No response

CDK CLI Version

2.90.0

Framework Version

No response

Node.js Version

18

OS

Linux

Language

Typescript

Language Version

No response

Other information

No response

[haydster7]

Would be fixed by updating dependency to new release (3 days ago) node-proxy-agent-v6v2.0.1

[rix0rrr]

Fixed by #26722

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.