fix(deps): pin aws-cdk-lib to ==2.257.0 #41

Merged

amoussa1229 merged 3 commits from chore/pin-cdk-2.253.1 into main

2026-06-05 16:55:53 +00:00

amoussa1229 commented

2026-06-05 15:44:02 +00:00

(Migrated from github.com)

Pins aws-cdk-lib to exactly 2.257.0 per the updated org standard.

Why the pin moved 2.253.1 -> 2.257.0: 2.253.1 bundles a vulnerable fast-uri@3.1.0 (2 high-severity GHSAs, unfixable because the dep is bundled inside aws-cdk-lib). 2.257.0 bundles the patched fast-uri@3.1.2. The old npm ci breakage that originally motivated the ==2.253.1 pin was specific to 2.254.0; 2.257.0 passes npm ci cleanly.

Set aws-cdk-lib to exactly 2.257.0 (no caret/range).
Restored @cdklabs/generative-ai-cdk-constructs 0.1.316 -> 0.1.317: 0.1.317 peers aws-cdk-lib@^2.254.0, satisfied by 2.257.0 (the 0.1.316 downgrade was only needed for the old 2.253.1 pin).
Regenerated package-lock.json: aws-cdk-lib locked at 2.257.0, bundled fast-uri 3.1.2. npm ci verified passing.
Retained the Dependabot ignore entry for aws-cdk-lib (we pin deliberately).

Note: branch name chore/pin-cdk-2.253.1 is retained from the original PR; the pin target is now 2.257.0.

Do not merge without review.

Pins `aws-cdk-lib` to exactly `2.257.0` per the updated org standard. **Why the pin moved 2.253.1 -> 2.257.0:** `2.253.1` bundles a vulnerable `fast-uri@3.1.0` (2 high-severity GHSAs, unfixable because the dep is bundled inside `aws-cdk-lib`). `2.257.0` bundles the patched `fast-uri@3.1.2`. The old `npm ci` breakage that originally motivated the `==2.253.1` pin was specific to `2.254.0`; `2.257.0` passes `npm ci` cleanly. - Set `aws-cdk-lib` to exactly `2.257.0` (no caret/range). - **Restored `@cdklabs/generative-ai-cdk-constructs` 0.1.316 -> 0.1.317**: 0.1.317 peers `aws-cdk-lib@^2.254.0`, satisfied by 2.257.0 (the 0.1.316 downgrade was only needed for the old 2.253.1 pin). - Regenerated `package-lock.json`: `aws-cdk-lib` locked at 2.257.0, bundled `fast-uri` 3.1.2. `npm ci` verified passing. - Retained the Dependabot `ignore` entry for `aws-cdk-lib` (we pin deliberately). Note: branch name `chore/pin-cdk-2.253.1` is retained from the original PR; the pin target is now 2.257.0. Do not merge without review.

This repo is archived. You cannot comment on pull requests.

No reviewers