[GOOD FIRST ISSUE] Update jsonpath-plus to >= 10.2.0 to fix RCE vulnerability

[ulises-jeremias]

Task

Update the jsonpath-plus package to >= 10.2.0 in the three examples where it appears as a direct or near-direct dependency, to fix a critical Remote Code Execution (RCE) vulnerability.

This is a well-scoped, dependency-only change — no logic changes required.

---

Vulnerability

Advisory	Severity	Description
GHSA-h6q6-9hqw-whg9	Critical	Prototype pollution via __proto__ leading to RCE
GHSA-3wm4-qv3r-374m	High	Regex injection in path expressions

Open Dependabot alerts: 6 (3 critical, 3 high)

---

Affected Examples

Example	Manifest	Current version
examples/serverless-cognito-local	package-lock.json	< 10.2.0
examples/serverless-localstack-with-s3-and-dynamodb	pnpm-lock.yaml	< 10.2.0
examples/serverless-twilio-aws-lambdas-typescript	package-lock.json	< 10.2.0

---

Steps

1. Fork this repository
2. For each affected example, check if jsonpath-plus is a direct dependency:

   cd examples/<example>
   cat package.json | grep jsonpath-plus

3. If it is a direct dependency, update it:

   npm install jsonpath-plus@^10.3.0 --save

4. If it is only a transitive dependency, add an override in package.json:

   "overrides": {
     "jsonpath-plus": "^10.3.0"
   }

   Then run npm install (or pnpm install for the pnpm project)
5. Verify the fix:

   npm audit | grep jsonpath-plus   # should return 0 results

6. Commit and open a PR

---

Validation

# Run in each affected example directory:
npm audit --json | python3 -c "
import json, sys
d = json.load(sys.stdin)
vulns = {k: v for k, v in d.get('vulnerabilities', {}).items() if 'jsonpath-plus' in k}
print('jsonpath-plus vulnerabilities remaining:', len(vulns))
"

Expected output: jsonpath-plus vulnerabilities remaining: 0

---

Out of Scope

• Do not change any application logic
• Do not update other unrelated packages
• Do not update the Serverless Framework version (tracked in a separate issue)

---

References

• GHSA-h6q6-9hqw-whg9
• jsonpath-plus changelog
• npm overrides
• pnpm overrides
• Dependabot alert — serverless-cognito-local