[Snyk] Security upgrade com.amazonaws:aws-java-sdk from 1.11.505 to 1.12.720

[juhisingh-qait]

User description

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `maven` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • localstack/ext/java/pom.xml

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Upgrade	Breaking Change	Exploit Maturity	Reachability
	84/1000 Why? Confidentiality impact: High, Integrity impact: Low, Availability impact: None, Scope: Changed, Exploit Maturity: No data, User Interaction (UI): Required, Privileges Required (PR): Low, Attack Complexity: High, Attack Vector: Network, EPSS: 0.0005, Social Trends: No, Days since published: 664, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 7.86, Likelihood: 1.06, Score Version: V5	Directory Traversal SNYK-JAVA-COMAMAZONAWS-2952700	com.amazonaws:aws-java-sdk: 1.11.505 -> 1.12.720	No	No Known Exploit	No Path Found

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Directory Traversal

---

PR Type

Enhancement

---

Description

• This PR updates the AWS Java SDK version in localstack/ext/java/pom.xml to address security vulnerabilities.
• The version has been upgraded from 1.11.505 to 1.12.720 in two dependency declarations to mitigate the identified risks.

---

Changes walkthrough 📝

	Relevant files
Dependencies	pom.xml Update AWS Java SDK Version to Resolve Vulnerabilities      localstack/ext/java/pom.xml Updated the version of aws-java-sdk from 1.11.505 to 1.12.720 in two places within the file. +2/-2

---

💡 PR-Agent usage:
Comment /help on the PR to get a list of all available PR-Agent tools and their descriptions

[codiumai-pr-agent-pro]

PR Description updated to latest commit (5d5b406)

• Copy walkthrough table to "Files Changed" Tab

[codiumai-pr-agent-pro]

PR Review 🔍

⏱️ Estimated effort to review [1-5]	1, because the PR involves a straightforward version update of a dependency in the Maven pom.xml file. The changes are minimal and only involve updating the version number of the aws-java-sdk from 1.11.505 to 1.12.720 in two places.
🧪 Relevant tests	No
⚡ Possible issues	Possible Compatibility Issue: Upgrading a library can introduce compatibility issues if the new version contains breaking changes that affect the current project's implementation.
🔒 Security concerns	No

[codiumai-pr-agent-pro]

PR Code Suggestions ✨

Category	Suggestions
Best practice	Add the element to the AWS SDK dependency. Consider specifying the element for the AWS SDK dependency to ensure the correct packaging is used, especially if you are using a specific type of the library (like a jar or a bundle). This can help avoid classpath issues at runtime. localstack/ext/java/pom.xml [85-88] <dependency> <groupId>com.amazonaws</groupId> <artifactId>aws-java-sdk</artifactId> <version>1.12.720</version> + <type>jar</type> <scope>provided</scope> </dependency>
Maintainability	Review and adjust the scope of the AWS SDK dependency if necessary. Ensure that the scope of the dependency aligns with the project's needs. The provided scope means that the dependency is required for compilation but not for runtime. If the AWS SDK is needed at runtime, consider changing the scope to compile. localstack/ext/java/pom.xml [85-88] <dependency> <groupId>com.amazonaws</groupId> <artifactId>aws-java-sdk</artifactId> <version>1.12.720</version> - <scope>provided</scope> + <scope>compile</scope> </dependency>