cdktn-io/cdktn-provider-http

Review signals: 1 known vulnerability.

OSV reports a known vulnerability in this dependency version. deepmerge

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The repo provides prebuilt Terraform http provider bindings for CDK Terrain that can be used to synthesize Terraform code: Real input produced the expected result: Generated Terraform code for the stacks: http-stack

  Source: This repo builds and publishes the [Terraform http provider](https://registry.terraform.io/providers/hashicorp/http/3.6.3/docs) bindings for [CDK Terrain](https://cdktn.io).

  Input: consumer app with HttpProvider and DataHttp for https://example.com/coldpass-check.json, run via cdktn synth

  Expected: synth reports generated Terraform code for stack http-stack

  Command: npx cdktn synth --output <guest-path>

  Observed: Generated Terraform code for the stacks: http-stack

Examples

• Documented test command for the repo: The documented test script is 'jest --passWithNoTests', but the test/ directory contains only tsconfig.json and no test files, so there is no real test suite to run. Instead the packaged binding was exercised through the consumer synth probe and claim.

  Source: package.json scripts.test

  Expected: documented command completes successfully

  Observed: The documented test script is 'jest --passWithNoTests', but the test/ directory contains only tsconfig.json and no test files, so there is no real test suite to run. Instead the packaged binding was exercised through the consumer synth probe and claim.

Local or hosted: both

Generate Terraform JSON from the prebuilt http provider bindings: a CDK Terrain app that uses HttpProvider and DataHttp is synthesized with cdktn synth, which writes stacks/http-stack/cdk.tf.json.

cd <guest-path> && pwd && ls -la && id -u && python3 --version && cat README.md | head -c 6000
cd <guest-path> && curl -s -m 10 -i $CDP_URL/json/version; echo "exit=$?"; echo "CDP_URL=$CDP_URL"; ls <guest-path> /inputs 2>&1 | head
cd <guest-path> && cat package.json | head -c 4000; echo; which node npm pnpm uv 2>&1; node --version 2>&1; npm --version 2>&1; ls .coldpass docs scripts test | head -50
cd <guest-path> && grep -n '"engines"' -A4 package.json; grep -n '"packageManager"' package.json; cat pnpm-workspace.yaml; ls .github/workflows; grep -rn "node-version\|pnpm" .github/workflows/*.yml | head -20
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && timeout 900 pnpm i --no-frozen-lockfile > <guest-path> 2>&1; echo "exit=$?"; tail -c 1500 <guest-path>
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && pnpm --version && (timeout 900 pnpm i --no-frozen-lockfile --config.minimumReleaseAge=0 > <guest-path> 2>&1; echo "exit=$?"); tail -c 1200 <guest-path>
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && (timeout 1500 pnpm exec projen build > <guest-path> 2>&1; echo "exit=$?"); tail -c 2500 <guest-path>
mkdir -p <guest-path> && cd <guest-path> && export NODE_USE_ENV_PROXY=1 && npm install --prefix <guest-path> [email protected] > <guest-path> 2>&1; echo "exit=$?"; tail -c 600 <guest-path>; ls <guest-path> | grep pnpm; <guest-path> --version
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && P=<guest-path> && (timeout 900 $P i --no-frozen-lockfile --config.minimumReleaseAge=0 > <guest-path> 2>&1; echo "install exit=$?"); tail -c 400 <guest-path>; (timeout 1500 $P exec projen build > <guest-path> 2>&1; echo "build exit=$?"); tail -c 2000 <guest-path>
cd <guest-path> && git init -q && git remote add origin https://github.com/cdktn-io/cdktn-provider-http && (timeout 300 git fetch --depth 1 origin f14052e36f2f41bc5e948fb433b4e49704dff3e2 > <guest-path> 2>&1; echo "fetch exit=$?"); tail -c 500 <guest-path>; git reset --mixed FETCH_HEAD; echo "reset exit=$?"; git rev-parse HEAD; git status --short | head -20
cd <guest-path> && export NODE_USE_ENV_PROXY=1 CI=true && P=<guest-path> && (timeout 900 $P i --no-frozen-lockfile --config.minimumReleaseAge=0 > <guest-path> 2>&1; echo "install exit=$?"); tail -c 300 <guest-path>; (timeout 2400 $P exec projen build > <guest-path> 2>&1; echo "build exit=$?"); tail -c 2000 <guest-path>
cd <guest-path> && ls -la dist dist/js 2>&1 | head -30; ls test; grep -n "^## \|^### " docs/API.typescript.md | head -20; grep -rn "synth\|new DataHttp" docs/dataHttp.typescript.md | head -10; cat .coldpass/* 2>/dev/null | head -5; ls -la .coldpass
cd <guest-path> && sed -n 1,60p docs/dataHttp.typescript.md | cut -c1-300; grep -n "new DataHttp\|Example\|example" docs/dataHttp.typescript.md | head; grep -n "<a name=\"Initializer\"" -A3 docs/dataHttp.typescript.md | head
cd <guest-path> && ls lib 2>&1 | head -5; ls node_modules/.bin | grep -i "cdktn\|jsii" ; node_modules/.bin/cdktn --version 2>&1 | tail -3; node_modules/.bin/cdktn --help 2>&1 | head -30
mkdir -p <guest-path> && cd <guest-path> && export NODE_USE_ENV_PROXY=1 && (timeout 900 npm install --no-audit --no-fund <email> [email protected] [email protected] [email protected] > <guest-path> 2>&1; echo "exit=$?"); tail -c 800 <guest-path>; ls node_modules/@cdktn; node_modules/.bin/cdktn --version
cd <guest-path> && cat > main.js <<'EOF'
const { App, TerraformStack } = require("cdktn");
const { dataHttp } = require("@cdktn/provider-http");

class HttpStack extends TerraformStack {
  constructor(scope, id) {
    super(scope, id);
    new dataHttp.DataHttp(this, "example", {
      url: "https://example.com/coldpass-check.json",
    });
  }
}

const app = new App();
new HttpStack(app, "http-stack");
app.synth();
EOF
cat > cdktn.json <<'EOF'
{
  "language": "javascript",
  "app": "node main.js",
  "output": "cdktf.out"
}
EOF
ls -la; mkdir -p <guest-path> && ls <guest-path>
cd <guest-path> && export CDKTF_DISABLE_PLUGIN_CACHE_ENV=1 && (timeout 300 node_modules/.bin/cdktn synth --output <guest-path> > <guest-path> 2>&1; echo "exit=$?"); tail -c 1500 <guest-path>; ls -R <guest-path> 2>&1 | head -20
cd <guest-path> && mv cdktn.json cdktf.json && export CDKTF_DISABLE_PLUGIN_CACHE_ENV=1 && (timeout 300 node_modules/.bin/cdktn synth --output <guest-path> > <guest-path> 2>&1; echo "exit=$?"); tail -c 1500 <guest-path>; ls -R <guest-path> 2>&1 | head -20
cd <guest-path> && grep -n "^export\|class " node_modules/@cdktn/provider-http/lib/index.d.ts | head -20; grep -rln "class HttpProvider" node_modules/@cdktn/provider-http/lib/ | head -3; grep -n "new provider.HttpProvider\|HttpProvider(" <guest-path> | head -3
cd <guest-path> && cat > main.js <<'EOF'
const { App, TerraformStack } = require("cdktn");
const { dataHttp, provider } = require("@cdktn/provider-http");

class HttpStack extends TerraformStack {
  constructor(scope, id) {
    super(scope, id);
    new provider.HttpProvider(this, "http");
    new dataHttp.DataHttp(this, "example", {
      url: "https://example.com/coldpass-check.json",
    });
  }
}

const app = new App();
new HttpStack(app, "http-stack");
app.synth();
EOF
export CDKTF_DISABLE_PLUGIN_CACHE_ENV=1 && (timeout 300 node_modules/.bin/cdktn synth --output <guest-path> > <guest-path> 2>&1; echo "exit=$?"); tail -c 800 <guest-path>; find <guest-path> -type f | head; cat <guest-path> 2>/dev/null
cd <guest-path> && grep -rniE "cron|--once|--now|setInterval|webhook|schedule" src scripts .projenrc.js 2>/dev/null | head -10; echo ---; grep -n "test\|jest" .projenrc.js | head; ls test; echo ---; grep -n "Generated Terraform\|stacks:" <guest-path> | head -3; cat <guest-path> | head -c 300
cd <guest-path> && grep -c "This repo builds and publishes the \[Terraform http provider\](https://registry.terraform.io/providers/hashicorp/http/3.6.3/docs) bindings for \[CDK Terrain\](https://cdktn.io)." README.md; cat > .coldpass/claims.json <<'EOF'
[
  {
    "kind": "claim",
    "claim": "The repo provides prebuilt Terraform http provider bindings for CDK Terrain that can be used to synthesize Terraform code",
    "source": "This repo builds and publishes the [Terraform http provider](https://registry.terraform.io/providers/hashicorp/http/3.6.3/docs) bindings for [CDK Terrain](https://cdktn.io).",
    "input": "consumer app with HttpProvider and DataHttp for https://example.com/coldpass-check.json, run via cdktn synth",
    "expected": "synth reports generated Terraform code for stack http-stack",
    "probe_kind": "cli",
    "argv": ["npx", "cdktn", "synth", "--output", "<guest-path>"],
    "env": {"CDKTF_DISABLE_PLUGIN_CACHE_ENV": "1"},
    "output_directory": "<guest-path>",
    "expected_text": "Generated Terraform code for the stacks: http-stack",
    "cwd": "<guest-path>"
  }
]
EOF
cat > .coldpass/probe.json <<'EOF'
{
  "kind": "cli",
  "argv": ["npx", "cdktn", "synth", "--output", "<guest-path>"],
  "cwd": "<guest-path>",
  "env": {"CDKTF_DISABLE_PLUGIN_CACHE_ENV": "1"},
  "output_directory": "<guest-path>",
  "expected_text": "Generated Terraform code for the stacks: http-stack"
}
EOF
python3 -I -m json.tool .coldpass/claims.json >/dev/null && python3 -I -m json.tool .coldpass/probe.json > /dev/null && echo OK
cd <guest-path> && cat > .coldpass/cycles.json <<'EOF'
{"detected": false, "reason": "Entry points inspected (README.md, package.json scripts, src/, scripts/, .projenrc.js): this package is a generated library of Terraform provider bindings with no cron, scheduler, loop, --once/--now, or webhook entry point. The only schedules are CI workflows under .github/workflows, which are not product cycles.", "checks": []}
EOF
cat > .coldpass/examples.json <<'EOF'
[
  {
    "kind": "example",
    "claim": "Documented test command for the repo",
    "source": "package.json scripts.test",
    "reason": "The documented test script is 'jest --passWithNoTests', but the test/ directory contains only tsconfig.json and no test files, so there is no real test suite to run. Instead the packaged binding was exercised through the consumer synth probe and claim."
  }
]
EOF
python3 -I -m json.tool .coldpass/cycles.json >/dev/null && python3 -I -m json.tool .coldpass/examples.json >/dev/null && echo OK; rm -rf <guest-path> <guest-path>; ls <guest-path>
cd <guest-path> && <env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "exit=$?"; tail -c 3000 <guest-path>
cd <guest-path> && grep -o '"valid": [a-z]*' <guest-path> | head; grep -o '"ok": [a-z]*\|"status": "[a-z]*"\|"errors": \[[^]]*\]' <guest-path> | head -5; head -c 600 <guest-path>
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{
  "outcome": "working",
  "fault_owner": null,
  "operation": "Generate Terraform JSON from the prebuilt http provider bindings: a CDK Terrain app that uses HttpProvider and DataHttp is synthesized with cdktn synth, which writes stacks/http-stack/cdk.tf.json.",
  "operation_scope": "Linux guest, Node v22.23.4, Python 3.12.3. Packages built with the repo's projen build (jsii compile, docgen, package:js). The Python, Go, Java, and C# packages were not built or tested. No Terraform CLI is installed; synth does not need it. The consumer app lives outside the checkout in <guest-path>",
  "steps": [
    "curl $CDP_URL/json/version (HTTP 200, not needed by this repo)",
    "pnpm i (README/CI install, deviation: see deviations)",
    "pnpm exec projen build (CI build command)",
    "npm install <<email>> [email protected] [email protected] [email protected] (npm install path from README, using the local tarball)",
    "npx cdktn synth --output <guest-path> (product operation, returned 0 and reported Generated Terraform code for the stacks: http-stack)",
    "<env-var>=<guest-path> python3 -I <guest-path> --validate --replay (valid: true, replay PASS)"
  ],
  "deviations": [
    "The global pnpm 12.15.0 refused the lockfile under the minimumReleaseAge policy (six @cdktn/* 0.25.0 packages published within the cutoff). Fixed per command with --config.minimumReleaseAge=0, with no file edits.",
    "pnpm 12.15.0 also refused this repo's package.json pnpm field (ERR_PNPM_VERIFY_DEPS_BEFORE_RUN). Switched to the repo-pinned [email protected] (packageManager), installed user-local in <guest-path> with npm install --prefix.",
    "pnpm needed CI=true to purge node_modules non-interactively (ERR_PNPM_ABORTED_REMOVE_MODULES_DIR_NO_TTY).",
    "projen build needs git metadata. Ran git init, git remote add origin https://github.com/cdktn-io/cdktn-provider-http, git fetch --depth 1 origin f14052e36f2f41bc5e948fb433b4e49704dff3e2, and git reset --mixed FETCH_HEAD, as the task specified. The first build failed on the missing git tags before this step.",
    "pnpm i --no-frozen-lockfile modified pnpm-lock.yaml. projen build also bumped package.json version from 0.0.0 to 1.0.0 and regenerated docs/ and dist/. These are build side effects, not hand edits.",
    "The README has no runnable command beyond npm/pip install lines, so the operation uses the CDKTN CLI with a small consumer app written for this check. It is not a repo-provided example.",
    "/inputs/coldpass-preflight.py does not exist in this VM. Used <guest-path> as the checker.",
    "The repo's test script (jest --passWithNoTests) has no tests, so it was recorded as a reason-only example rather than run as evidence."
  ],
  "stuck_step": null,
  "main_blocker": null,
  "plain_failure": null,
  "suggested_fix": "Pin the global pnpm to the repo's packageManager (10.33.0) and allow newly published @cdktn packages through the minimumReleaseAge policy, or add them to minimumReleaseAgeExclude. Add a runnable example or test suite so the package has a repo-provided check."
}
EOF
python3 -I -m json.tool .coldpass/report.json > /dev/null && echo REPORT_OK; ls -la .coldpass; ls report.json 2>&1