fix(deps): pin aws-cdk-lib to ==2.257.0 #44

Merged

amoussa1229 merged 3 commits from chore/pin-cdk-2.253.1 into main

2026-06-05 17:06:17 +00:00

amoussa1229 commented

2026-06-05 15:44:16 +00:00

(Migrated from github.com)

Pins aws-cdk-lib to exactly 2.257.0 per the updated org standard.

Why the pin moved 2.253.1 -> 2.257.0: 2.253.1 bundles a vulnerable fast-uri@3.1.0 (2 high-severity GHSAs, unfixable because the dep is bundled inside aws-cdk-lib). 2.257.0 bundles the patched fast-uri@3.1.2. The old npm ci breakage that originally motivated the ==2.253.1 pin was specific to 2.254.0; 2.257.0 passes npm ci cleanly.

Set aws-cdk-lib to exactly 2.257.0 (no caret/range).
Regenerated package-lock.json: aws-cdk-lib locked at 2.257.0, bundled fast-uri 3.1.2. npm ci verified passing.
Retained the Dependabot ignore entry for aws-cdk-lib (we pin deliberately).

Note: branch name chore/pin-cdk-2.253.1 is retained from the original PR; the pin target is now 2.257.0.

Do not merge without review.

Pins `aws-cdk-lib` to exactly `2.257.0` per the updated org standard. **Why the pin moved 2.253.1 -> 2.257.0:** `2.253.1` bundles a vulnerable `fast-uri@3.1.0` (2 high-severity GHSAs, unfixable because the dep is bundled inside `aws-cdk-lib`). `2.257.0` bundles the patched `fast-uri@3.1.2`. The old `npm ci` breakage that originally motivated the `==2.253.1` pin was specific to `2.254.0`; `2.257.0` passes `npm ci` cleanly. - Set `aws-cdk-lib` to exactly `2.257.0` (no caret/range). - Regenerated `package-lock.json`: `aws-cdk-lib` locked at 2.257.0, bundled `fast-uri` 3.1.2. `npm ci` verified passing. - Retained the Dependabot `ignore` entry for `aws-cdk-lib` (we pin deliberately). Note: branch name `chore/pin-cdk-2.253.1` is retained from the original PR; the pin target is now 2.257.0. Do not merge without review.

This repo is archived. You cannot comment on pull requests.

No reviewers