From 49ee0e7fc3609f1646ea687b397023405a41a573 Mon Sep 17 00:00:00 2001 From: Saee Barve Date: Fri, 5 Jun 2026 11:47:46 +0530 Subject: [PATCH 1/7] Clone templates for safe normalization Clone templates before normalization to prevent mutation of originals. --- .../@aws-cdk/cloudformation-diff/lib/diff-template.ts | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/packages/@aws-cdk/cloudformation-diff/lib/diff-template.ts b/packages/@aws-cdk/cloudformation-diff/lib/diff-template.ts index b93365840..56a5f444c 100644 --- a/packages/@aws-cdk/cloudformation-diff/lib/diff-template.ts +++ b/packages/@aws-cdk/cloudformation-diff/lib/diff-template.ts @@ -51,8 +51,12 @@ export function fullDiff( changeSet?: DescribeChangeSetOutput, isImport?: boolean, ): types.TemplateDiff { - normalize(currentTemplate); - normalize(newTemplate); + // AFTER — work on clones, originals stay untouched + const currentCopy = JSON.parse(JSON.stringify(currentTemplate)); + const newCopy = JSON.parse(JSON.stringify(newTemplate)); + normalize(currentCopy); + normalize(newCopy); + // use currentCopy / newCopy everywhere below instead const theDiff = diffTemplate(currentTemplate, newTemplate); if (changeSet) { // These methods mutate the state of theDiff, using the changeSet. From f6314a60c4f463636ca43308447eaae5ed1b8a48 Mon Sep 17 00:00:00 2001 From: Saee Barve Date: Fri, 5 Jun 2026 12:02:04 +0530 Subject: [PATCH 2/7] fix(toolkit-lib): deep clone cached template in ResourceImporter --- .../toolkit-lib/lib/api/resource-import/importer.ts | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/resource-import/importer.ts b/packages/@aws-cdk/toolkit-lib/lib/api/resource-import/importer.ts index e59f5b9cf..3b7d0a505 100644 --- a/packages/@aws-cdk/toolkit-lib/lib/api/resource-import/importer.ts +++ b/packages/@aws-cdk/toolkit-lib/lib/api/resource-import/importer.ts @@ -296,27 +296,23 @@ export class ResourceImporter { */ private async currentTemplate(): Promise { if (!this._currentTemplate) { - this._currentTemplate = await this.cfn.readCurrentTemplate(this.stack); + this._currentTemplate = JSON.parse(JSON.stringify(await this.cfn.readCurrentTemplate(this.stack))); } return this._currentTemplate; } - /** * Return the current template, with the given resources added to it */ private async currentTemplateWithAdditions(additions: ImportableResource[]): Promise { - const template = await this.currentTemplate(); + const template = JSON.parse(JSON.stringify(await this.currentTemplate())); if (!template.Resources) { template.Resources = {}; } - for (const add of additions) { template.Resources[add.logicalId] = add.resourceDefinition; } - return template; } - /** * Get a list of import identifiers for all resource types used in the given * template that do support the import operation (SINGLETON) From 9e626e9e46e9acf9e91ed5716afafeb02f88b712 Mon Sep 17 00:00:00 2001 From: Saee Barve Date: Wed, 10 Jun 2026 23:14:22 +0530 Subject: [PATCH 3/7] Replace deep copy with structuredClone for templates --- packages/@aws-cdk/cloudformation-diff/lib/diff-template.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/@aws-cdk/cloudformation-diff/lib/diff-template.ts b/packages/@aws-cdk/cloudformation-diff/lib/diff-template.ts index 56a5f444c..6284a834b 100644 --- a/packages/@aws-cdk/cloudformation-diff/lib/diff-template.ts +++ b/packages/@aws-cdk/cloudformation-diff/lib/diff-template.ts @@ -52,8 +52,8 @@ export function fullDiff( isImport?: boolean, ): types.TemplateDiff { // AFTER — work on clones, originals stay untouched - const currentCopy = JSON.parse(JSON.stringify(currentTemplate)); - const newCopy = JSON.parse(JSON.stringify(newTemplate)); + const currentCopy = structuredClone(currentTemplate); + const newCopy = structuredClone(newTemplate); normalize(currentCopy); normalize(newCopy); // use currentCopy / newCopy everywhere below instead From 5741ac0f64fd3adea71f9c6064babe237b8a9525 Mon Sep 17 00:00:00 2001 From: Saee Barve Date: Wed, 10 Jun 2026 23:19:10 +0530 Subject: [PATCH 4/7] Use structuredClone for currentTemplate method --- .../@aws-cdk/toolkit-lib/lib/api/resource-import/importer.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/resource-import/importer.ts b/packages/@aws-cdk/toolkit-lib/lib/api/resource-import/importer.ts index 3b7d0a505..1a42270f3 100644 --- a/packages/@aws-cdk/toolkit-lib/lib/api/resource-import/importer.ts +++ b/packages/@aws-cdk/toolkit-lib/lib/api/resource-import/importer.ts @@ -296,7 +296,7 @@ export class ResourceImporter { */ private async currentTemplate(): Promise { if (!this._currentTemplate) { - this._currentTemplate = JSON.parse(JSON.stringify(await this.cfn.readCurrentTemplate(this.stack))); + this._currentTemplate = Object.freeze(structuredClone(await this.cfn.readCurrentTemplate(this.stack))); } return this._currentTemplate; } From 4a7486e023ad73941e22668b88dc0ea1fc18495b Mon Sep 17 00:00:00 2001 From: Saee Barve Date: Wed, 10 Jun 2026 23:22:15 +0530 Subject: [PATCH 5/7] Replace JSON.parse with structuredClone for template --- .../@aws-cdk/toolkit-lib/lib/api/resource-import/importer.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/@aws-cdk/toolkit-lib/lib/api/resource-import/importer.ts b/packages/@aws-cdk/toolkit-lib/lib/api/resource-import/importer.ts index 1a42270f3..d2e500ce2 100644 --- a/packages/@aws-cdk/toolkit-lib/lib/api/resource-import/importer.ts +++ b/packages/@aws-cdk/toolkit-lib/lib/api/resource-import/importer.ts @@ -304,7 +304,7 @@ export class ResourceImporter { * Return the current template, with the given resources added to it */ private async currentTemplateWithAdditions(additions: ImportableResource[]): Promise { - const template = JSON.parse(JSON.stringify(await this.currentTemplate())); + const template = structuredClone(await this.currentTemplate()); if (!template.Resources) { template.Resources = {}; } From 60d879a587d8dfbb36644e4b1ab46ec73d0b771f Mon Sep 17 00:00:00 2001 From: Saee Barve Date: Thu, 11 Jun 2026 23:48:56 +0530 Subject: [PATCH 6/7] Update dependabot.yml From 1439d6125b57dd56cc4ac0174055d288be20cf65 Mon Sep 17 00:00:00 2001 From: Saee Barve Date: Thu, 11 Jun 2026 23:53:03 +0530 Subject: [PATCH 7/7] Update SelfMutationOnForks.ts