dependabot/npm_and_yarn/aws-cdk-lib-2.260.0

safe

8182b6e · fullPR #329reviewed 2026-07-21 23:09 UTC0H · 0M · 1L · 2I

The branch

Purpose

Keep the CDK infrastructure library current via automated dependabot updates

Goal

Bump aws-cdk-lib from 2.232.2 to 2.260.0 across 28 minor versions

Sub-goals

SG-1: Update infra/cdk/package.json dependency specifier
SG-2: Update pnpm-lock.yaml resolved version

The changes (whole branch)

What: infra/cdk/package.json: aws-cdk-lib ^2.213.0 → ^2.260.0. pnpm-lock.yaml: resolved version 2.232.2 → 2.260.0.
Why: Routine automated dependency maintenance from dependabot
Areas: infra/cdk/package.json+1−1pnpm-lock.yaml+20−20
Blast: 2 files, infra-only. No application code, domain logic, API contracts, or Lambda handlers changed.

dependabot infra-only no-app-code-changed

➖typecheck· pr-checks.yml runs typecheck+lint; CI result not readable via token scope➖cdk-synth· infra-cdk.yml is workflow_dispatch only — no synthesis check runs on PRs➖coderabbit· no .coderabbit.yaml in repo

Findings · 3

correctness1

info

v2.259.0 BREAKING — NODEJS_LATEST → nodejs24.x — NOT applicable here

infra/cdk/package.json

v2.259.0 promoted Runtime.NODEJS_LATEST to nodejs24.x (from nodejs22.x). Node.js 24 drops callback-style Lambda handlers. All NodejsFunction constructs in this codebase explicitly pin Runtime.NODEJS_20_X — zero risk.

conventions1

info

aws-cdk CLI specifier not updated alongside aws-cdk-lib

infra/cdk/package.json

Dependabot bumped aws-cdk-lib (^2.213.0 → ^2.260.0) but left aws-cdk CLI at ^2.213.0. Lockfile resolves CLI to 2.1034.0. No runtime risk with --frozen-lockfile. Minor stale specifier.

tests1

low

No cdk synth in PR CI — construct-level regressions only caught on deploy

.github/workflows/infra-cdk.yml

infra-cdk.yml runs synth/diff/deploy via workflow_dispatch only. A 28-version library bump merges without synthesis validation. TypeScript typecheck catches API surface changes but not invalid L1 resource definitions. Pre-existing gap.