[ulises-jeremias]

Description

AppSync Examples has been failing on main since 2026-10-25: npm audit reports GHSA-xjj6-f33q-929c (undici, DoS via excessive content-encodings) in both AppSync examples.

The vulnerable undici 6.28.1 is pinned exactly by serverless 4.43.0 (serverless depends on "undici": "6.28.1"), so npm update undici cannot move it. Upstream, serverless 4.45.0 depends on undici 6.29.1. The ^4.43.0 range already allows that version, so this updates serverless only, with no overrides.

• examples/serverless-appsync-python: serverless 4.43.0 → 4.45.0, undici 6.28.1 → 6.29.1
• examples/serverless-appsync-node-typescript: same

Refs #442

Found via agent-toolkit OSS maintenance loops.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation / chore

How Has This Been Tested?

• npm audit --audit-level=high in both examples: 0 vulnerabilities (before: undici advisory).
• Only the two package-lock.json files changed; package.json ranges are unchanged.

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• Any dependent changes have been merged and published in downstream modules
• I have checked my code and corrected any misspellings

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters: 2

• examples/serverless-appsync-node-typescript/package-lock.json is excluded by !**/package-lock.json
• examples/serverless-appsync-python/package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0d4c08b6-2150-4f51-b0c8-a7cc36448ce2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

	Messages
📖	Thanks! We ❤️ small PRs!

Generated by 🚫 dangerJS against 381f466