fix(security): bump vulnerable dependencies to patched versions

[laileni-aws]

Summary

Resolves open Dependabot security alerts across the npm and Maven manifests by bumping vulnerable dependencies to their patched versions. This is a combined dependency-only security fix off main.

npm (plugin/webview)

Direct deps (package.json):

• uuid^8.3.2 → ^11.1.1 (alert Account for Windows and MSFT Edge limitations when loading WebViews #42) — not referenced in source
• webpack^5.61.0 → ^5.104.1 (resolves to 5.108.4; alerts Display chat default message and prompt #19, Adds step to upload and download build artifacts #20)

Transitive deps pinned via overrides and regenerated package-lock.json:

• js-yaml → 4.3.0 (alerts Toggle suggestions #13, Deserialization support for AWS LSP extended InitializeResult #49)
• serialize-javascript → 7.0.7 (alerts Render Chat response in the webview #28, Adds line param to unsetVerticalIndent #41)
• postcss → 8.5.19 (alert Implement telemetry types generator #38)
• picomatch → 2.3.2 (alert Make command handling in Q chat webview async #35)
• flatted → 3.4.2 (alert Fix to allow only one radio button to be selected #32)
• immutable → 4.3.9 (alert Use project local Node and NPM for build #30)
• minimatch → 3.1.4 (alert Send chat prompt message to lsp #26)
• diff → 4.0.4 (alert Update CI Maven action #17)

Maven

• telemetry/pom.xml: jackson-databind 2.17.1 → 2.18.9 (alerts Update dependency manifest #45, Fix Chat webview rendering #46, Remove duplicate JavaPoet dependency #47, Trigger customization notifications on ide, stacking multiple notifications vertically and refactor/add support for more methods in PluginStore #48)
• plugin/pom.xml: nimbus-jose-jwt 9.41.2 → 10.0.2 (alert Refactored to add AmazonQView parent class containing common setup  #11)

Verification

• npm run webpack build passes with the upgraded dependencies (webpack 5.108.4).
• Resolved lockfile versions confirmed for every bumped package.
• Both POMs are XML well-formed; target versions confirmed present on Maven Central. Dependabot independently proposed nimbus-jose-jwt 10.0.2, corroborating compatibility.
• Note: a full Maven/Tycho build was not run in this environment (no local Maven + Eclipse p2 target platform). CI is expected to validate the Maven modules.

Notes

• The remaining npm audit moderates (ajv, brace-expansion, micromatch) correspond to alerts Dependabot auto-dismissed (not open), so they are intentionally out of scope.

Opened as a draft for review.

[laileni-aws]

Summary

Resolves open Dependabot security alerts across the npm and Maven manifests by bumping vulnerable dependencies to their patched versions. This is a combined dependency-only security fix off main.

npm (plugin/webview)

Direct deps (package.json):

• uuid^8.3.2 → ^11.1.1 (alert Account for Windows and MSFT Edge limitations when loading WebViews #42) — not referenced in source
• webpack^5.61.0 → ^5.104.1 (resolves to 5.108.4; alerts Display chat default message and prompt #19, Adds step to upload and download build artifacts #20)

Transitive deps pinned via overrides and regenerated package-lock.json:

• js-yaml → 4.3.0 (alerts Toggle suggestions #13, Deserialization support for AWS LSP extended InitializeResult #49)
• serialize-javascript → 7.0.7 (alerts Render Chat response in the webview #28, Adds line param to unsetVerticalIndent #41)
• postcss → 8.5.19 (alert Implement telemetry types generator #38)
• picomatch → 2.3.2 (alert Make command handling in Q chat webview async #35)
• flatted → 3.4.2 (alert Fix to allow only one radio button to be selected #32)
• immutable → 4.3.9 (alert Use project local Node and NPM for build #30)
• minimatch → 3.1.4 (alert Send chat prompt message to lsp #26)
• diff → 4.0.4 (alert Update CI Maven action #17)

Maven

• telemetry/pom.xml: jackson-databind 2.17.1 → 2.18.9 (alerts Update dependency manifest #45, Fix Chat webview rendering #46, Remove duplicate JavaPoet dependency #47, Trigger customization notifications on ide, stacking multiple notifications vertically and refactor/add support for more methods in PluginStore #48)
• plugin/pom.xml: nimbus-jose-jwt 9.41.2 → 10.0.2 (alert Refactored to add AmazonQView parent class containing common setup  #11)

Verification

• npm run webpack build passes with the upgraded dependencies (webpack 5.108.4).
• Resolved lockfile versions confirmed for every bumped package.
• Both POMs are XML well-formed; target versions confirmed present on Maven Central. Dependabot independently proposed nimbus-jose-jwt 10.0.2, corroborating compatibility.
• Note: a full Maven/Tycho build was not run in this environment (no local Maven + Eclipse p2 target platform). CI is expected to validate the Maven modules.

Notes

• The remaining npm audit moderates (ajv, brace-expansion, micromatch) correspond to alerts Dependabot auto-dismissed (not open), so they are intentionally out of scope.

Opened as a draft for review.

[laileni-aws]

Summary

Resolves open Dependabot security alerts across the npm and Maven manifests by bumping vulnerable dependencies to their patched versions. This is a combined dependency-only security fix off main.

npm (plugin/webview)

Direct deps (package.json):

• uuid^8.3.2 → ^11.1.1 (alert Account for Windows and MSFT Edge limitations when loading WebViews #42) — not referenced in source
• webpack^5.61.0 → ^5.104.1 (resolves to 5.108.4; alerts Display chat default message and prompt #19, Adds step to upload and download build artifacts #20)

Transitive deps pinned via overrides and regenerated package-lock.json:

• js-yaml → 4.3.0 (alerts Toggle suggestions #13, Deserialization support for AWS LSP extended InitializeResult #49)
• serialize-javascript → 7.0.7 (alerts Render Chat response in the webview #28, Adds line param to unsetVerticalIndent #41)
• postcss → 8.5.19 (alert Implement telemetry types generator #38)
• picomatch → 2.3.2 (alert Make command handling in Q chat webview async #35)
• flatted → 3.4.2 (alert Fix to allow only one radio button to be selected #32)
• immutable → 4.3.9 (alert Use project local Node and NPM for build #30)
• minimatch → 3.1.4 (alert Send chat prompt message to lsp #26)
• diff → 4.0.4 (alert Update CI Maven action #17)

Maven

• telemetry/pom.xml: jackson-databind 2.17.1 → 2.18.9 (alerts Update dependency manifest #45, Fix Chat webview rendering #46, Remove duplicate JavaPoet dependency #47, Trigger customization notifications on ide, stacking multiple notifications vertically and refactor/add support for more methods in PluginStore #48)
• plugin/pom.xml: nimbus-jose-jwt 9.41.2 → 10.0.2 (alert Refactored to add AmazonQView parent class containing common setup  #11)

Verification

• npm run webpack build passes with the upgraded dependencies (webpack 5.108.4).
• Resolved lockfile versions confirmed for every bumped package.
• Both POMs are XML well-formed; target versions confirmed present on Maven Central. Dependabot independently proposed nimbus-jose-jwt 10.0.2, corroborating compatibility.
• Note: a full Maven/Tycho build was not run in this environment (no local Maven + Eclipse p2 target platform). CI is expected to validate the Maven modules.

Notes

• The remaining npm audit moderates (ajv, brace-expansion, micromatch) correspond to alerts Dependabot auto-dismissed (not open), so they are intentionally out of scope.

Opened as a draft for review.

[laileni-aws]

Summary

Resolves open Dependabot security alerts across the npm and Maven manifests by bumping vulnerable dependencies to their patched versions. This is a combined dependency-only security fix off main.

npm (plugin/webview)

Direct deps (package.json):

• uuid^8.3.2 → ^11.1.1 (alert Account for Windows and MSFT Edge limitations when loading WebViews #42) — not referenced in source
• webpack^5.61.0 → ^5.104.1 (resolves to 5.108.4; alerts Display chat default message and prompt #19, Adds step to upload and download build artifacts #20)

Transitive deps pinned via overrides and regenerated package-lock.json:

• js-yaml → 4.3.0 (alerts Toggle suggestions #13, Deserialization support for AWS LSP extended InitializeResult #49)
• serialize-javascript → 7.0.7 (alerts Render Chat response in the webview #28, Adds line param to unsetVerticalIndent #41)
• postcss → 8.5.19 (alert Implement telemetry types generator #38)
• picomatch → 2.3.2 (alert Make command handling in Q chat webview async #35)
• flatted → 3.4.2 (alert Fix to allow only one radio button to be selected #32)
• immutable → 4.3.9 (alert Use project local Node and NPM for build #30)
• minimatch → 3.1.4 (alert Send chat prompt message to lsp #26)
• diff → 4.0.4 (alert Update CI Maven action #17)

Maven

• telemetry/pom.xml: jackson-databind 2.17.1 → 2.18.9 (alerts Update dependency manifest #45, Fix Chat webview rendering #46, Remove duplicate JavaPoet dependency #47, Trigger customization notifications on ide, stacking multiple notifications vertically and refactor/add support for more methods in PluginStore #48)
• plugin/pom.xml: nimbus-jose-jwt 9.41.2 → 10.0.2 (alert Refactored to add AmazonQView parent class containing common setup  #11)

Verification

• npm run webpack build passes with the upgraded dependencies (webpack 5.108.4).
• Resolved lockfile versions confirmed for every bumped package.
• Both POMs are XML well-formed; target versions confirmed present on Maven Central. Dependabot independently proposed nimbus-jose-jwt 10.0.2, corroborating compatibility.
• Note: a full Maven/Tycho build was not run in this environment (no local Maven + Eclipse p2 target platform). CI is expected to validate the Maven modules.

Notes

• The remaining npm audit moderates (ajv, brace-expansion, micromatch) correspond to alerts Dependabot auto-dismissed (not open), so they are intentionally out of scope.

Opened as a draft for review.

[laileni-aws]

Summary

Resolves open Dependabot security alerts across the npm and Maven manifests by bumping vulnerable dependencies to their patched versions. This is a combined dependency-only security fix off main.

npm (plugin/webview)

Direct deps (package.json):

• uuid^8.3.2 → ^11.1.1 (alert Account for Windows and MSFT Edge limitations when loading WebViews #42) — not referenced in source
• webpack^5.61.0 → ^5.104.1 (resolves to 5.108.4; alerts Display chat default message and prompt #19, Adds step to upload and download build artifacts #20)

Transitive deps pinned via overrides and regenerated package-lock.json:

• js-yaml → 4.3.0 (alerts Toggle suggestions #13, Deserialization support for AWS LSP extended InitializeResult #49)
• serialize-javascript → 7.0.7 (alerts Render Chat response in the webview #28, Adds line param to unsetVerticalIndent #41)
• postcss → 8.5.19 (alert Implement telemetry types generator #38)
• picomatch → 2.3.2 (alert Make command handling in Q chat webview async #35)
• flatted → 3.4.2 (alert Fix to allow only one radio button to be selected #32)
• immutable → 4.3.9 (alert Use project local Node and NPM for build #30)
• minimatch → 3.1.4 (alert Send chat prompt message to lsp #26)
• diff → 4.0.4 (alert Update CI Maven action #17)

Maven

• telemetry/pom.xml: jackson-databind 2.17.1 → 2.18.9 (alerts Update dependency manifest #45, Fix Chat webview rendering #46, Remove duplicate JavaPoet dependency #47, Trigger customization notifications on ide, stacking multiple notifications vertically and refactor/add support for more methods in PluginStore #48)
• plugin/pom.xml: nimbus-jose-jwt 9.41.2 → 10.0.2 (alert Refactored to add AmazonQView parent class containing common setup  #11)

Verification

• npm run webpack build passes with the upgraded dependencies (webpack 5.108.4).
• Resolved lockfile versions confirmed for every bumped package.
• Both POMs are XML well-formed; target versions confirmed present on Maven Central. Dependabot independently proposed nimbus-jose-jwt 10.0.2, corroborating compatibility.
• Note: a full Maven/Tycho build was not run in this environment (no local Maven + Eclipse p2 target platform). CI is expected to validate the Maven modules.

Notes

• The remaining npm audit moderates (ajv, brace-expansion, micromatch) correspond to alerts Dependabot auto-dismissed (not open), so they are intentionally out of scope.

Opened as a draft for review.

[laileni-aws]

Summary

Resolves open Dependabot security alerts across the npm and Maven manifests by bumping vulnerable dependencies to their patched versions. This is a combined dependency-only security fix off main.

npm (plugin/webview)

Direct deps (package.json):

• uuid^8.3.2 → ^11.1.1 (alert Account for Windows and MSFT Edge limitations when loading WebViews #42) — not referenced in source
• webpack^5.61.0 → ^5.104.1 (resolves to 5.108.4; alerts Display chat default message and prompt #19, Adds step to upload and download build artifacts #20)

Transitive deps pinned via overrides and regenerated package-lock.json:

• js-yaml → 4.3.0 (alerts Toggle suggestions #13, Deserialization support for AWS LSP extended InitializeResult #49)
• serialize-javascript → 7.0.7 (alerts Render Chat response in the webview #28, Adds line param to unsetVerticalIndent #41)
• postcss → 8.5.19 (alert Implement telemetry types generator #38)
• picomatch → 2.3.2 (alert Make command handling in Q chat webview async #35)
• flatted → 3.4.2 (alert Fix to allow only one radio button to be selected #32)
• immutable → 4.3.9 (alert Use project local Node and NPM for build #30)
• minimatch → 3.1.4 (alert Send chat prompt message to lsp #26)
• diff → 4.0.4 (alert Update CI Maven action #17)

Maven

• telemetry/pom.xml: jackson-databind 2.17.1 → 2.18.9 (alerts Update dependency manifest #45, Fix Chat webview rendering #46, Remove duplicate JavaPoet dependency #47, Trigger customization notifications on ide, stacking multiple notifications vertically and refactor/add support for more methods in PluginStore #48)
• plugin/pom.xml: nimbus-jose-jwt 9.41.2 → 10.0.2 (alert Refactored to add AmazonQView parent class containing common setup  #11)

Verification

• npm run webpack build passes with the upgraded dependencies (webpack 5.108.4).
• Resolved lockfile versions confirmed for every bumped package.
• Both POMs are XML well-formed; target versions confirmed present on Maven Central. Dependabot independently proposed nimbus-jose-jwt 10.0.2, corroborating compatibility.
• Note: a full Maven/Tycho build was not run in this environment (no local Maven + Eclipse p2 target platform). CI is expected to validate the Maven modules.

Notes

• The remaining npm audit moderates (ajv, brace-expansion, micromatch) correspond to alerts Dependabot auto-dismissed (not open), so they are intentionally out of scope.

Opened as a draft for review.

[laileni-aws]

Summary

Resolves open Dependabot security alerts across the npm and Maven manifests by bumping vulnerable dependencies to their patched versions. This is a combined dependency-only security fix off main.

npm (plugin/webview)

Direct deps (package.json):

• uuid^8.3.2 → ^11.1.1 (alert Account for Windows and MSFT Edge limitations when loading WebViews #42) — not referenced in source
• webpack^5.61.0 → ^5.104.1 (resolves to 5.108.4; alerts Display chat default message and prompt #19, Adds step to upload and download build artifacts #20)

Transitive deps pinned via overrides and regenerated package-lock.json:

• js-yaml → 4.3.0 (alerts Toggle suggestions #13, Deserialization support for AWS LSP extended InitializeResult #49)
• serialize-javascript → 7.0.7 (alerts Render Chat response in the webview #28, Adds line param to unsetVerticalIndent #41)
• postcss → 8.5.19 (alert Implement telemetry types generator #38)
• picomatch → 2.3.2 (alert Make command handling in Q chat webview async #35)
• flatted → 3.4.2 (alert Fix to allow only one radio button to be selected #32)
• immutable → 4.3.9 (alert Use project local Node and NPM for build #30)
• minimatch → 3.1.4 (alert Send chat prompt message to lsp #26)
• diff → 4.0.4 (alert Update CI Maven action #17)

Maven

• telemetry/pom.xml: jackson-databind 2.17.1 → 2.18.9 (alerts Update dependency manifest #45, Fix Chat webview rendering #46, Remove duplicate JavaPoet dependency #47, Trigger customization notifications on ide, stacking multiple notifications vertically and refactor/add support for more methods in PluginStore #48)
• plugin/pom.xml: nimbus-jose-jwt 9.41.2 → 10.0.2 (alert Refactored to add AmazonQView parent class containing common setup  #11)

Verification

• npm run webpack build passes with the upgraded dependencies (webpack 5.108.4).
• Resolved lockfile versions confirmed for every bumped package.
• Both POMs are XML well-formed; target versions confirmed present on Maven Central. Dependabot independently proposed nimbus-jose-jwt 10.0.2, corroborating compatibility.
• Note: a full Maven/Tycho build was not run in this environment (no local Maven + Eclipse p2 target platform). CI is expected to validate the Maven modules.

Notes

• The remaining npm audit moderates (ajv, brace-expansion, micromatch) correspond to alerts Dependabot auto-dismissed (not open), so they are intentionally out of scope.

Opened as a draft for review.

[laileni-aws]

Summary

Resolves open Dependabot security alerts across the npm and Maven manifests by bumping vulnerable dependencies to their patched versions. This is a combined dependency-only security fix off main.

npm (plugin/webview)

Direct deps (package.json):

• uuid^8.3.2 → ^11.1.1 (alert Account for Windows and MSFT Edge limitations when loading WebViews #42) — not referenced in source
• webpack^5.61.0 → ^5.104.1 (resolves to 5.108.4; alerts Display chat default message and prompt #19, Adds step to upload and download build artifacts #20)

Transitive deps pinned via overrides and regenerated package-lock.json:

• js-yaml → 4.3.0 (alerts Toggle suggestions #13, Deserialization support for AWS LSP extended InitializeResult #49)
• serialize-javascript → 7.0.7 (alerts Render Chat response in the webview #28, Adds line param to unsetVerticalIndent #41)
• postcss → 8.5.19 (alert Implement telemetry types generator #38)
• picomatch → 2.3.2 (alert Make command handling in Q chat webview async #35)
• flatted → 3.4.2 (alert Fix to allow only one radio button to be selected #32)
• immutable → 4.3.9 (alert Use project local Node and NPM for build #30)
• minimatch → 3.1.4 (alert Send chat prompt message to lsp #26)
• diff → 4.0.4 (alert Update CI Maven action #17)

Maven

• telemetry/pom.xml: jackson-databind 2.17.1 → 2.18.9 (alerts Update dependency manifest #45, Fix Chat webview rendering #46, Remove duplicate JavaPoet dependency #47, Trigger customization notifications on ide, stacking multiple notifications vertically and refactor/add support for more methods in PluginStore #48)
• plugin/pom.xml: nimbus-jose-jwt 9.41.2 → 10.0.2 (alert Refactored to add AmazonQView parent class containing common setup  #11)

Verification

• npm run webpack build passes with the upgraded dependencies (webpack 5.108.4).
• Resolved lockfile versions confirmed for every bumped package.
• Both POMs are XML well-formed; target versions confirmed present on Maven Central. Dependabot independently proposed nimbus-jose-jwt 10.0.2, corroborating compatibility.
• Note: a full Maven/Tycho build was not run in this environment (no local Maven + Eclipse p2 target platform). CI is expected to validate the Maven modules.

Notes

• The remaining npm audit moderates (ajv, brace-expansion, micromatch) correspond to alerts Dependabot auto-dismissed (not open), so they are intentionally out of scope.

Opened as a draft for review.