You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CHANGELOG.md
+20Lines changed: 20 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -214,6 +214,26 @@ All notable changes to this project will be documented in this file. See [standa
214
214
215
215
### Troubleshooting
216
216
217
+
## [2.5.3] (2026-08-03)
218
+
219
+
### Bug Fixes
220
+
221
+
-**Web** Fixed `npm install` failing in `web/` with `npm error code EOVERRIDE / Override for fast-xml-parser@5.10.1 conflicts with direct dependency` ([#297](https://github.com/awslabs/visual-asset-management-system/issues/297)). `fast-xml-parser` was declared twice in `web/package.json` — once as a direct dependency and once in `overrides` — which could deadlock resolution against a stale lockfile. Both entries were removed: VAMS does not import `fast-xml-parser` directly, the AWS SDK no longer depends on it, and `@aws-amplify/storage` now requires `^5.7.2`, so the v4 pin was holding the package below its dependents' supported range.
222
+
223
+
### Chores
224
+
225
+
- Updated package dependencies across all 11 npm packages (root, `web`, `infra`, documentation site, and the seven `web/customInstalls` viewer packages) to resolve npm audit findings. Root, `infra`, documentation site, and six of seven viewer packages are now clean; `web` went from 17 findings to 8 and no longer reports any high-severity findings.
226
+
-**Web** Upgraded `jodit-react` to `^5.3.21`, resolving high-severity mutation XSS and prototype pollution findings in the `jodit` editor used by the asset comments feature. The direct `jodit` pin was dropped in favor of the transitive version supplied by `jodit-react`.
227
+
-**Infra** Bumped the `aws-cdk` CLI floor to `^2.1134.0` to match `aws-cdk-lib` 2.263.0. The dependency update raised the cloud assembly schema to version 54, which the previously pinned CLI (`^2.1111.0`) could not read, causing `cdk synth` to fail.
228
+
-**Documentation** Aligned all `@docusaurus/*` packages to 3.10.2 so the core, preset, theme, and type packages remain on a single matching version.
229
+
- Bumped the base `package.json` version to 2.5.3 — it had remained at 2.1.0 across several releases and now tracks the VAMS release version.
230
+
- Bumped `VAMS_VERSION` (`infra/config/config.ts`) and VamsCLI version (`tools/VamsCLI/vamscli/version.py`) to 2.5.3 — these were not updated during the 2.5.2 hotfix and remained at 2.5.1
231
+
- Added the missing 2.5.2 entry to the documentation revision history
232
+
233
+
### Known Issues
234
+
235
+
- Pipelines that rely on the Amazon Linux 2 (AL2) image type for Amazon ECS/AWS Batch containers may not work, as AL2 reached end of support on July 31st. This will be fixed in v2.6.0.
|[2.6.0](#260)| 2026-05-08 | API Gateway migrated from HTTP API (v2) to REST API (v1) — **breaking**: clients registered directly against the old API endpoint must be re-setup (re-run `vamscli setup`); supports REGIONAL and PRIVATE endpoint types. Physna Sync add-on (Phase 1): one-way synchronization of supported VAMS files and metadata to a Physna tenant; geospatial search and map view across assets and files (new `geo_MD_location` field); OpenSearch index v3 + provisioned engine upgrade to 3.5 (OpenSearch 2.x in the AWS European Sovereign Cloud); next-generation OpenSearch Serverless upgrade (scale-to-zero, higher performance, better cost pricing); provisioned `r7g.large.search` default + automatic OpenSearch service-linked role creation; advanced IAM role customization for restricted environments; VAMS MCP server and agent skill for operating a deployment with AI agents |
12
-
|[2.5.2](#252)| 2026-06-19 | Security and validation fixes: Casbin policy injection hardening, createAsset S3 key validation, backend test framework update |
12
+
|[2.5.3](#253)| 2026-08-03 | Fixed web `npm install` dependency override conflict; npm dependency updates across all packages, rich text editor security upgrade, AWS CDK CLI version alignment |
@@ -63,21 +64,42 @@ This page tracks the version history of the Visual Asset Management System (VAMS
63
64
Run the reindex migration at `infra/deploymentDataMigration/v2.5_to_v2.6/upgrade` after deploying the v2.6 stack to repopulate `vams-assets-v3` and `vams-files-v3` from source data. For provisioned deployments, if the OpenSearch 2.7 → 3.5 in-place engine upgrade fails during `cdk deploy`, deploy first with OpenSearch disabled in `config.json` to delete the existing domain, then re-enable and redeploy to create a fresh 3.5 domain before running the migration. See the [v2.5 to v2.6 update guide](../deployment/update-the-solution.md#v25-to-v26).
64
65
:::
65
66
67
+
### 2.5.3
68
+
69
+
**Release date:** 2026-08-03
70
+
71
+
**Key fixes:**
72
+
73
+
- Fixed `npm install` failing in the `web/` directory with an `EOVERRIDE` error reporting that an override for `fast-xml-parser` conflicted with the direct dependency. The package was declared both as a direct dependency and as an override, which could prevent dependency resolution from completing when an existing lock file was present. Both declarations were removed, because the web application does not use the package directly and its dependents now supply a compatible version.
74
+
75
+
**Other changes:**
76
+
77
+
- Updated package dependencies across all npm packages in the repository to resolve reported npm audit findings.
78
+
- Upgraded the rich text editor used by the asset comments feature to address high-severity cross-site scripting and prototype pollution findings.
79
+
- Raised the minimum AWS CDK command line interface version to match the AWS CDK library version, which is required for AWS CloudFormation template synthesis to succeed.
80
+
- Aligned all Docusaurus documentation packages to a single matching version.
81
+
82
+
**Known issues:**
83
+
84
+
- Pipelines that rely on the Amazon Linux 2 image type for Amazon Elastic Container Service and AWS Batch containers may not function correctly, because Amazon Linux 2 reached end of support on July 31, 2026. A fix is planned for version 2.6.0.
85
+
- Eight npm audit findings remain in the web application (six low severity and two moderate severity) that cannot be resolved without breaking changes. The available fixes for the routing library require React version 18 or later, and the web application currently targets React 17. These are development and build-time dependencies and will be revisited in version 2.6.0.
86
+
- Five npm audit findings remain in the VEERUM viewer installation package. Remediation requires authentication to the private package registry that hosts the viewer, and two findings have no fix available from the upstream maintainers. The VEERUM viewer is disabled by default.
87
+
66
88
### 2.5.2
67
89
68
90
**Release date:** 2026-06-19
69
91
70
92
**Key fixes:**
71
93
72
-
-Hardened the Casbin authorization implementation against a policy-injection path where field values that are regex-evaluated could inject additional policies. Low impact, since Casbin policies can only be set by administrators by default. Added backend tests covering this case.
73
-
- Fixed a `createAsset` API defect that allowed specifying an optional Amazon S3 bucket key location without verifying it belonged to the provided database's default bucket and prefix path, that no asset already existed at that key, and with weak validation on the supplied path.
74
-
- Fixed a latent defect where the backend test framework had not been updated with v2.5 changes, causing some test failures.
94
+
-Fixed a Casbin authorization implementation defect that allowed additional policies to be injected through field values that were evaluated as regular expressions. Impact is low because Casbin policies can only be set by administrators by default. Additional backend tests were added to cover this case.
95
+
- Fixed a `createAsset` API defect that allowed an optional Amazon S3 bucket key location to be specified without validating that the location belonged to the provided database identifier's default S3 bucket and prefix path, that no asset already existed at that S3 key path, and that the supplied path met validation requirements.
96
+
- Fixed a latent defect in which the backend test framework had not been updated for changes introduced in version 2.5, which caused test failures.
75
97
76
98
**Other changes:**
77
99
78
100
- Added default GitHub issue and pull request templates.
79
-
- Updated authorization documentation to reflect the bug fixes and clarifications.
80
-
- Updated several package dependency versions to address new npm audit findings.
101
+
- Updated the authorization documentation to reflect the preceding fixes and to clarify existing behavior.
102
+
- Updated several package dependency versions to address npm audit findings.
0 commit comments