Changes for release/v4.0.3 (#274)

* Changes for release/v4.0.3

Author: JimTharioAmazon

CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.0.3] - 2025-12-18
+
+### Changed
+
+- Allow parenthesis in test scenario names
+
+### Security
+
+- Update to address vulnerability in [CVE-2025-66221](https://nvd.nist.gov/vuln/detail/CVE-2025-66221)
+- Update rhino to v1.7.14.1 to address vulnerability in [CVE-2025-66453](https://nvd.nist.gov/vuln/detail/CVE-2025-66453)
+
 ## [4.0.2] - 2025-12-09
 
 ### Changed

VERSION.txt

@@ -1 +1 @@
-4.0.2
+4.0.3

architecture.png

@@ -42,6 +42,10 @@ main() {
     local source_dir="$project_root"/source
     local cdk_out_dir="$source_dir"/infrastructure/cdk.out
 
+    # Launch Wizard directory
+    version_without_v="${3#v}"
+    local launch_wizard_dist_dir="$deployment_dir/launch-wizard-assets/Default/${version_without_v}"
+
     header "[Init] Remove any old dist files from previous runs"
 
     rm -rf "$global_dist_dir"
@@ -116,6 +120,11 @@ main() {
       fi
     done
     popd
+
+    header "[Packing] Launch Wizard Assets"
+    cd "${launch_wizard_dist_dir}/helpPanels"
+    zip -q -r9 "${launch_wizard_dist_dir}/helpPanels.zip" .
+    cd "${deployment_dir}"
 }
 
-main "$@"
+main "$@"

deployment/build-s3-dist.sh

@@ -41,5 +41,9 @@ RUN mkdir -p /etc/bzt.d && echo '{"settings": {"artifacts-dir": "/tmp/artifacts"
 # https://github.com/Blazemeter/taurus/blob/647dd34ab318b5d3060a8c6ce2e5b047a0efddd2/requirements.txt
 RUN $PIP_INSTALL 'urllib3>=2.6.0'
 
+# Temporary fix for CVE-2025-66221 in Werkzeug < 3.1.4
+# This must be upgraded after bzt setup to satisfy bzt requirements.txt
+RUN $PIP_INSTALL 'werkzeug>=3.1.4'
+
 WORKDIR /bzt-configs
 ENTRYPOINT ["./load-test.sh"]

deployment/ecr/distributed-load-testing-on-aws-load-tester/Dockerfile

@@ -24,6 +24,7 @@
     * http2-common will be replaced with v11.0.26
     * kotlin-stdlib will be replaced with v2.1.0
     * commons-lang3 will be replaced with v3.18.0
+    * rhino v1.7.14 will be replaced with v1.7.14.1 (fixes CVE-2025-66453)
     * commons-lang v2.5 - no fix available for CVE-2025-48924
 
 Also jmeter plugins manager will be updated to v1.11 to address CVEs and 
@@ -72,6 +73,7 @@
     "http2-common": "org/eclipse/jetty/http2/http2-common/11.0.26/http2-common-11.0.26.jar",
     "kotlin-stdlib": "org/jetbrains/kotlin/kotlin-stdlib/2.1.0/kotlin-stdlib-2.1.0.jar",
     "commons-lang3": "org/apache/commons/commons-lang3/3.18.0/commons-lang3-3.18.0.jar",
+    "rhino": "org/mozilla/rhino/1.7.14.1/rhino-1.7.14.1.jar", # NOSONAR
 }
 
 # Jars to remove from the container

deployment/ecr/distributed-load-testing-on-aws-load-tester/jar_updater.py

@@ -76,13 +76,18 @@ if [ "$TEST_TYPE" != "simple" ]; then
     echo "UNZIPPED to temp directory"
     ls -l $TEMP_DIR
 
-    # Find the parent folder and copy its contents
-    PARENT_FOLDER=$(find $TEMP_DIR -mindepth 1 -maxdepth 1 -type d | head -n 1)
-    if [ -n "$PARENT_FOLDER" ]; then
-      echo "Copying contents from parent folder: $PARENT_FOLDER"
+    # Check if there's exactly one directory and no files at root level
+    ROOT_DIRS=$(find $TEMP_DIR -mindepth 1 -maxdepth 1 -type d)
+    ROOT_FILES=$(find $TEMP_DIR -mindepth 1 -maxdepth 1 -type f)
+    
+    # Only unwrap if there's exactly one directory and zero files at root
+    if [ $(echo "$ROOT_DIRS" | wc -l) -eq 1 ] && [ -z "$ROOT_FILES" ]; then
+      PARENT_FOLDER=$(echo "$ROOT_DIRS")
+      echo "Single parent folder detected with no sibling files: $PARENT_FOLDER"
+      echo "Unwrapping contents from parent folder"
       cp -r $PARENT_FOLDER/* ./
     else
-      echo "No parent folder found, copying all contents from temp directory"
+      echo "Multiple items or files at root level detected, copying all contents from temp directory"
       cp -r $TEMP_DIR/* ./
     fi
 

deployment/ecr/distributed-load-testing-on-aws-load-tester/load-test.sh

@@ -1,6 +1,6 @@
 id: SO0062 
 name: distributed-load-testing-on-aws
-version: v4.0.2
+version: v4.0.3
 cloudformation_templates:
   - template: distributed-load-testing-on-aws.template
     main_template: true 

solution-manifest.yaml

@@ -1,6 +1,6 @@
 {
   "name": "api-services",
-  "version": "4.0.2",
+  "version": "4.0.3",
   "description": "REST API micro services",
   "repository": {
     "type": "git",