Release JavaScript AWS KMS Storage v1.0.0 by stas-schaller · Pull Request #875 · Keeper-Security/secrets-manager

stas-schaller · 2025-11-21T21:58:04Z

Release of @keeper-security/secrets-manager-aws v1.0.0

AWS Key Management Service integration for secure storage of Keeper Secrets Manager configuration.

Dependencies:

@keeper-security/secrets-manager-core v17.3.0
@aws-sdk/client-kms v3.758.0

Bug Fixes

KSM-836: Fix contains() — key in Object.keys(config) checked numeric array indices and always returned false for real config keys. Corrected to key in config. Add regression tests.
KSM-839: Fix delete() — truthy check if (config[key]) silently skipped keys holding falsy values ("", 0, false, null). Corrected to key in config. Add regression tests.
KSM-846: Fix encryption/decryption error propagation — encryptBuffer() and decryptBuffer() in utils.ts returned empty values (Buffer.alloc(0) / "") on AWS KMS failure instead of rethrowing, silently discarding authentication failures, invalid key IDs, and permission errors; saveConfig() also caught and discarded errors without rethrowing; both layers now rethrow, making saveString(), saveBytes(), saveObject(), and changeKey() propagate AWS KMS failures as expected; changeKey()'s rollback path (key and crypto client restoration) is now reachable; removed vestigial blob.length > 0 guards in saveConfig() and createConfigFileIfMissing().
KSM-851: Fix getBytes() — falsy check if (bytesString) treated an empty base64 string ("", produced by saving a zero-length Uint8Array) as absent, returning undefined instead of Uint8Array(0). Corrected to if (bytesString !== undefined). Add regression tests.
Normalize getKeyDetails() from implicit public to private, aligning with all other JS KMS storage packages (Azure, GCP, Oracle).

Maintenance

Resolve transitive dependency vulnerabilities via npm audit fix — fixed 1 critical (fast-xml-parser), 3 high (minimatch), 1 medium (ajv). Grype rescan: 0 findings.
Fix jest TypeScript configuration — add tsconfig.test.json with @types/jest types and update jest.config.js to pass the test tsconfig to ts-jest, resolving LSP errors in test files.

Closes https://keeper.atlassian.net/browse/KSM-703
Closes https://keeper.atlassian.net/browse/KSM-836
Closes https://keeper.atlassian.net/browse/KSM-839
Closes https://keeper.atlassian.net/browse/KSM-846
Closes https://keeper.atlassian.net/browse/KSM-851

.github/workflows/publish.npm.storage.aws.kms.yml

.github/workflows/test.javascript.storage.aws.kms.yml

+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: ./sdk/javascript/packages/aws
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js 20.x
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20.x'
+          cache: 'npm'
+          cache-dependency-path: sdk/javascript/packages/aws/package-lock.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run tests
+        run: npm test


To resolve the issue, an explicit permissions block should be added to limit the permissions granted to the workflow's jobs. The least-privilege starting point is typically contents: read, which allows jobs to clone and read the repository content but does not permit write operations. This block can be added either at the root level of the workflow, applying to all jobs, or just to the specific job. Since the workflow contains only one job (test), either location is acceptable, but best practice is to place it at the root for future extensibility. The modification involves editing .github/workflows/test.javascript.storage.aws.kms.yml by inserting the following block after the name: and before the on: section:

permissions: contents: read

No new imports, methods, or definitions are required beyond adding this block.

.github/workflows/publish.npm.storage.aws.kms.yml

socket-security · 2025-11-26T17:27:41Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	License
npm/@typescript-eslint/parser@8.23.0
npm/typescript-eslint@8.23.0
npm/@babel/preset-env@7.28.5
npm/@babel/core@7.28.5
npm/@typescript-eslint/eslint-plugin@8.23.0
npm/@types/node@14.14.41 ⏵ 22.12.0		⁺²
npm/rimraf@6.0.1
npm/pino-pretty@13.0.0
npm/eslint@9.39.1
npm/typescript@4.2.4 ⏵ 5.7.3	⁺¹	^-10	⁺¹⁰
npm/pino@10.1.0
npm/ts-jest@29.4.5
npm/@aws-sdk/client-kms@3.975.0

View full report

.github/workflows/publish.npm.storage.aws.kms.yml

socket-security · 2026-03-12T16:54:25Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

.github/workflows/publish.npm.storage.aws.kms.yml

.github/workflows/test.cli.yml

Initial release of the AWS KMS storage backend for the KSM JavaScript SDK with pre-publish bug fixes, CVE remediations, and workflow hardening. Bug fixes: - KSM-846: rethrow KMS errors in encryptBuffer/decryptBuffer and saveConfig - KSM-839: fix delete() skipping keys with falsy values - KSM-836: correct in operator usage in contains(); normalize method visibility - fix getBytes() returning undefined for zero-length Uint8Array Maintenance: - upgrade @aws-sdk/client-kms to 3.975.0 (GHSA-6475-r3vj-m8vf) - upgrade pino to v10 (CVE-2025-57319) - upgrade @isaacs/brace-expansion to 5.0.1 - update npm publish workflow: Node.js 24, Syft v1.32.0, new KSM config secret, ksm-action SHA 560d170b - harden CI: pin action SHAs, add permissions blocks, persist-credentials: false

github-advanced-security bot found potential problems Nov 21, 2025

View reviewed changes

stas-schaller marked this pull request as ready for review November 24, 2025 21:28

stas-schaller had a problem deploying to prod November 24, 2025 21:33 — with GitHub Actions Error

stas-schaller had a problem deploying to prod November 24, 2025 22:12 — with GitHub Actions Error

stas-schaller had a problem deploying to prod November 24, 2025 22:43 — with GitHub Actions Error

github-advanced-security bot found potential problems Nov 26, 2025

View reviewed changes

.github/workflows/publish.npm.storage.aws.kms.yml Fixed Show fixed Hide fixed

stas-schaller had a problem deploying to prod December 16, 2025 20:24 — with GitHub Actions Failure

github-advanced-security bot found potential problems Jan 27, 2026

View reviewed changes

.github/workflows/publish.npm.storage.aws.kms.yml Fixed Show fixed Hide fixed

stas-schaller force-pushed the release/storage/javascript/aws-kms/v1.0.0 branch from 2b0abbc to 3f9e401 Compare March 10, 2026 16:26

github-advanced-security bot found potential problems Mar 12, 2026

View reviewed changes

.github/workflows/publish.npm.storage.aws.kms.yml Fixed Show fixed Hide fixed

github-advanced-security bot found potential problems Mar 12, 2026

View reviewed changes

.github/workflows/publish.npm.storage.aws.kms.yml Fixed Show fixed Hide fixed

.github/workflows/publish.npm.storage.aws.kms.yml Fixed Show fixed Hide fixed

stas-schaller force-pushed the release/storage/javascript/aws-kms/v1.0.0 branch from bd1a395 to 13873ed Compare March 27, 2026 18:28

stas-schaller had a problem deploying to prod April 1, 2026 19:35 — with GitHub Actions Error

stas-schaller had a problem deploying to prod April 1, 2026 20:28 — with GitHub Actions Error

stas-schaller temporarily deployed to prod April 1, 2026 21:00 — with GitHub Actions Inactive

stas-schaller requested a review from maksimu April 2, 2026 03:55

maksimu approved these changes Apr 7, 2026

View reviewed changes

stas-schaller force-pushed the release/storage/javascript/aws-kms/v1.0.0 branch from 0c8b15e to fe77624 Compare April 7, 2026 18:31

github-advanced-security bot found potential problems Apr 7, 2026

View reviewed changes

.github/workflows/test.cli.yml Fixed Show fixed Hide fixed

stas-schaller force-pushed the release/storage/javascript/aws-kms/v1.0.0 branch from fe77624 to 03a4e75 Compare April 7, 2026 18:38

maksimu approved these changes Apr 7, 2026

View reviewed changes

maksimu merged commit b723066 into master Apr 7, 2026
31 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Release JavaScript AWS KMS Storage v1.0.0#875

Release JavaScript AWS KMS Storage v1.0.0#875
maksimu merged 1 commit intomasterfrom
release/storage/javascript/aws-kms/v1.0.0

stas-schaller commented Nov 21, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Check warning

Copilot Autofix

Uh oh!

socket-security bot commented Nov 26, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

socket-security bot commented Mar 12, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

@@ -1,4 +1,6 @@
             name: Test JavaScript Storage - AWS KMS
+            permissions:
+              contents: read
             on:
               push:

Conversation

stas-schaller commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bug Fixes

Maintenance

Uh oh!

Uh oh!

Uh oh!

Check warning

Copilot Autofix

Uh oh!

socket-security bot commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

socket-security bot commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

stas-schaller commented Nov 21, 2025 •

edited

Loading

socket-security bot commented Nov 26, 2025 •

edited

Loading

socket-security bot commented Mar 12, 2026 •

edited

Loading