[notgitika]

Description

Fixes the failing security job in Quality and Safety Checks (https://github.com/aws/agentcore-cli/actions/runs/40372130144/job/121746156229).

• GHSA-mrhx-c7xc-m3w5 (high): zod <4.6.6 can exhaust memory validating oversized constrained collections. Bumped the direct dep to ^4.6.6 (resolves 4.6.7) and added a "zod": "$zod" override. The override also replaces the zod@3.25.76 that @aws/agent-inspector pulls in through @ag-ui/core@^0.0.52, since zod 3 has no patched release. That copy is never loaded at runtime: agent-inspector ships only a prebuilt browser bundle (dist-assets/).
• fast-uri (GHSA-w74x-v6f9-j3xg, GHSA-xhq7-xmqj-769h, GHSA-wjr9-j795-jxcr, GHSA-333x-w4r6-6crp): raised the existing override from ^3.1.8 to ^3.1.9.
• Stale braces exception: the audit no longer reports GHSA-vfj7-8cjw-p6xm, and the script fails on unused exceptions, so I removed it. evaluateAuditReport now takes the exception map as an option, so the tests still cover the time-boxed exception logic with a fixture.

Companion PR for refactor: #2709

Type of Change

• Bug fix

Testing

• npm run security:audit: 0 vulnerabilities, exit 0
• node --test scripts/security-audit.test.mjs: 9/9 pass
• npm run typecheck, npm run build
• npm test: 6379 passed. One TUI timing test (AddGatewayJwtConfig.test.tsx) failed under full-suite load and passed 3/3 in isolation.

[github-actions]

Package Tarball

aws-agentcore-0.31.1.tgz

How to install

gh release download pr-2708-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.31.1.tgz

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

I verified the substance of the change and found no blocking issues.

What I checked

• zod override: "$zod" resolves from the root dependencies spec (^4.6.6), and @ag-ui/core@0.0.52 is the only package in the tree that constrains zod to ^3 — @modelcontextprotocol/sdk, zod-to-json-schema, zod-validation-error, and eslint-plugin-react-hooks all already accept ^4. So the override's blast radius is exactly the one package described in the PR body.
• The "never loaded at runtime" claim holds: src/cli/operations/dev/web-ui/web-server.ts (resolveUIDistDir) and scripts/copy-assets.mjs consume @aws/agent-inspector only as static files from dist-assets/, so no @ag-ui/core JS is imported in Node.
• Advisory data matches: GHSA-mrhx-c7xc-m3w5 is first patched in 4.6.6 (hence no zod-3 fix), and the fast-uri 3.x line is patched at 3.1.9.
• npm-shrinkwrap.json is internally consistent — one node_modules/zod@4.6.7, one node_modules/fast-uri@3.1.9, no leftover nested copies, root dependencies.zod updated. Since the shrinkwrap is published (files includes it), the dedupe also reaches consumers.
• Injecting exceptions into evaluateAuditReport keeps the time-boxed logic covered via a fixture while the production map is empty, and scripts/security-audit.mjs still lines up with the new default parameter (its decision.allowed branch is simply unreachable while the map is empty).
• I specifically looked for schema drift from the zod 4.4.3 → 4.6.7 jump, since 4.5/4.6 changed toJSONSchema output (type-only anyOf compaction, closed-tuple length, chained-check folding, new z.email() pattern). src/schema/ uses no z.email(), tuples, or multipleOf, all z.record keys are z.string(), and every .int() precedes its .min()/.max(), so schemas/agentcore.schema.v1.json should be byte-identical. Worth a quick npm run build:lib && npm run build:schema to confirm no diff before merging, since nothing in CI enforces that file's freshness.

Non-blocking follow-ups (out of scope for this PR)

• The override removes vulnerable zod 3 from the installed tree, but @aws/agent-inspector's prebuilt browser bundle in dist-assets/ still contains its own copy of zod 3 code, so for that path the change silences the audit rather than removing the vulnerable code. Low practical risk (local dev UI), and the real fix is the upstream @ag-ui/core bump already noted in overridesComments.
• The vended template src/assets/typescript/http/vercelai/base/package.json still pins "zod": "^3.24.0", so generated user projects install a version affected by this same advisory with no patched 3.x release. The template already uses ai@^6, which supports zod 4, so bumping it in a follow-up looks viable.