Skip to content

Bump the npm group across 2 directories with 6 updates#826

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-17ae383f91
May 12, 2026
Merged

Bump the npm group across 2 directories with 6 updates#826
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-17ae383f91

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 12, 2026

Bumps the npm group with 6 updates in the / directory:

Package From To
@aws-sdk/client-cloudformation 3.1043.0 3.1045.0
@eslint/compat 2.0.5 2.1.0
@types/node 24.12.2 25.6.2
vite 8.0.10 8.0.11
aws-cdk-lib 2.252.0 2.253.1
aws-cdk 2.1120.0 2.1121.0

Bumps the npm group with 3 updates in the /test directory: @types/node, aws-cdk-lib and aws-cdk.

Updates @aws-sdk/client-cloudformation from 3.1043.0 to 3.1045.0

Release notes

Sourced from @​aws-sdk/client-cloudformation's releases.

v3.1045.0

3.1045.0(2026-05-07)

Documentation Changes
  • client-guardduty: This is a documentation update (1484574c)
New Features
  • clients: update client endpoints as of 2026-05-07 (81310767)
  • client-bcm-data-exports: With this release, customers can configure their data exports to generate additional integration artifacts for Athena and Redshift. (238da2c1)
  • client-invoicing: Updated ListInvoiceSummaries API to add new ReceiverRole filter in Request and Response (60a448cb)
  • client-bedrock-agentcore: Launching AgentCore payments - a capability that provides secure, instant microtransaction payments for AI agents to access paid APIs, MCP servers, and content. It handles payment processing for x402 protocol, payment limits, and 3P wallet integrations with Coinbase CDP and Stripe (Privy). (1e1031a7)
  • client-ec2: DescribeInstanceTypes now accepts an IncludeUnsupportedInRegion parameter. When set, the response also lists instance types that are not available in the current Region. Each instance type includes a SupportedInRegion field indicating its regional availability. (70262433)
  • client-bedrock-agentcore-control: Launching AgentCore payments - a capability that provides secure, instant microtransaction payments for AI agents to access paid APIs, MCP servers, and content. It handles payment processing for x402 protocol, payment limits, and 3P wallet integrations with Coinbase CDP and Stripe (Privy). (fe5861ae)
  • client-route53resolver: Adds supports for DNS64 on inbound endpoints and IPv6 forwarding through the internet gateway (IGW) on outbound endpoints, making it easier to manage hybrid DNS across IPv4 and IPv6 networks. (8e6e18c6)

For list of updated packages, view updated-packages.md in assets-3.1045.0.zip

v3.1044.0

3.1044.0(2026-05-06)

New Features
  • client-securityhub: Release GenerateRecommendedPolicyV2 and GetRecommendedPolicyV2 APIs. This supports generating and retrieving policy recommendations to remediate unused permissions findings that are now being supported on Security Hub. (772b8629)
  • client-sagemaker: Amazon SageMaker HyperPod now returns ImageVersionStatus in DescribeCluster, DescribeClusterNode, and ListClusterNodes responses, indicating whether cluster instances are running the latest available image version. (2be7e6b4)
  • client-glue: Adds support for a CustomLogGroupPrefix parameter in StartDataQualityRulesetEvaluationRun to specify custom CloudWatch log group paths, and a RulesetName filter in ListDataQualityRulesetEvaluationRuns to filter evaluation runs by ruleset name. (b95d850b)
  • client-lex-models-v2: Amazon Lex V2 introduces audio filler support for speech-to-speech bots. Configure melody or typing sounds that play during backend processing to reduce perceived latency and maintain a natural conversational experience for callers. (01426f8e)
  • client-bedrock-agentcore-control: Adds support for bring-your-own file system in AgentCore Runtime. Developers can mount Amazon S3 Files and Amazon EFS access points directly into agent sessions using filesystemConfigurations. (e20f24d9)
  • client-s3: Validate outpost access point resource name (bee88a56)
  • client-mwaa: Amazon MWAA now supports a PublicAndPrivate webserver access mode. The Airflow web server is accessible over both public and private endpoints, enabling workers in VPCs without internet access to reach the Task API privately while retaining public access to the Airflow UI. (3a6054ef)
  • client-imagebuilder: The ImportDiskImage API now enforces a maximum character limit of 128 characters on the image name field. (7fc2565c)
Tests
  • scripts: include type symbols in api snapshot test (#7985) (02f86176)

For list of updated packages, view updated-packages.md in assets-3.1044.0.zip

Changelog

Sourced from @​aws-sdk/client-cloudformation's changelog.

3.1045.0 (2026-05-07)

Note: Version bump only for package @​aws-sdk/client-cloudformation

3.1044.0 (2026-05-06)

Note: Version bump only for package @​aws-sdk/client-cloudformation

Commits

Updates @eslint/compat from 2.0.5 to 2.1.0

Release notes

Sourced from @​eslint/compat's releases.

compat: v2.1.0

2.1.0 (2026-05-08)

Features

  • Add new includeIgnoreFile() to config-helpers (#430) (9b51352)

migrate-config: v2.1.0

2.1.0 (2026-05-08)

Features

  • Add new includeIgnoreFile() to config-helpers (#430) (9b51352)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​eslint/config-helpers bumped from ^0.5.5 to ^0.6.0

migrate-config: v2.0.7

2.0.7 (2026-05-01)

Bug Fixes

migrate-config: v2.0.6

2.0.6 (2026-04-08)

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • @​eslint/compat bumped from ^2.0.4 to ^2.0.5
    • devDependencies
      • @​eslint/core bumped from ^1.2.0 to ^1.2.1
Changelog

Sourced from @​eslint/compat's changelog.

2.1.0 (2026-05-08)

Features

  • Add new includeIgnoreFile() to config-helpers (#430) (9b51352)
Commits

Updates @types/node from 24.12.2 to 25.6.2

Commits

Updates vite from 8.0.10 to 8.0.11

Release notes

Sourced from vite's releases.

v8.0.11

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.0.11 (2026-05-07)

Features

Bug Fixes

  • deps: update all non-major dependencies (#22334) (672c962)
  • deps: update all non-major dependencies (#22382) (5c0cfcb)
  • glob: align hmr matcher options with glob enumeration (#22306) (30028f9)
  • make separate object instance for each environment (#22276) (7c2aa3b)

Documentation

Miscellaneous Chores

  • deps: update dependency tsdown to ^0.21.10 (#22333) (3b51e05)
  • deps: update rolldown-related dependencies (#22383) (555ff36)
  • deps: update transitive packages to fix npm audit alerts (#22316) (86aee62)

Code Refactoring

Tests

Commits

Updates aws-cdk-lib from 2.252.0 to 2.253.1

Release notes

Sourced from aws-cdk-lib's releases.

v2.253.1

Bug Fixes

  • core: "exports cannot be updated" for cross-region references (#37790) (b0c00e2)
  • s3deploy: empty sources leads to deployment error (#37786) (f61656a)

Alpha modules (2.253.1-alpha.0)

v2.253.0

Features

Bug Fixes

  • cloudfront: skip cachePolicyName length validation for unresolved tokens (#37751) (3b96e97), closes #23567 #34102
  • cloudwatch: remove false positive warning for CDK tokens in MathExpression (#36882) (c29dc17), closes #34977
  • codebuild: correct S3 log encryption boolean inversion (#37761) (4031918)
  • ecs: enabling the circuitBreaker is not recommended loudly enough (#37755) (a52af7d)
  • eks: add dependency from HelmChart custom resource to s3 chartAsset IAM policy (#37731) (99d0a5b), closes #19880

Alpha modules (2.253.0-alpha.0)

Features

  • bedrock-agentcore-alpha: add OnlineEvaluationConfig and Evaluator L2 constructs (#37615) (c13de04), closes #37614
  • glue-alpha: add extraPythonFiles support to PythonShellJob (#37130) (c9c6f9c), closes #34448

Bug Fixes

  • bedrock-agentcore-alpha: self-managed memory strategy validation throws on unresolved tokens (#37691) (7956537), closes #37197
Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.253.1-alpha.0 (2026-05-08)

2.253.0-alpha.0 (2026-05-06)

Features

  • bedrock-agentcore-alpha: add OnlineEvaluationConfig and Evaluator L2 constructs (#37615) (c13de04), closes #37614
  • glue-alpha: add extraPythonFiles support to PythonShellJob (#37130) (c9c6f9c), closes #34448

Bug Fixes

  • bedrock-agentcore-alpha: self-managed memory strategy validation throws on unresolved tokens (#37691) (7956537), closes #37197

2.252.0-alpha.0 (2026-04-29)

2.251.0-alpha.0 (2026-04-24)

Features

  • bedrock-agentcore-alpha: add L2 constructs for policy and policy engine (#37238) (1e89e7e)
  • bedrock-agentcore-alpha: add observability configuration for Runtime (#36689) (34b43aa), closes #36596
  • bedrock-agentcore-alpha: support No Authorization for AgentCore Gateway (#36610) (f20bd8e)
  • dsql-alpha: initial L2 construct (#34599) (be1a458), closes #34593

2.250.0-alpha.0 (2026-04-14)

2.249.0-alpha.0 (2026-04-10)

2.248.0-alpha.0 (2026-04-02)

2.247.0-alpha.0 (2026-04-02)

Features

2.246.0-alpha.0 (2026-03-31)

2.245.0-alpha.0 (2026-03-27)

Features

... (truncated)

Commits
  • b0c00e2 fix(core): "exports cannot be updated" for cross-region references (#37790)
  • f61656a fix(s3deploy): empty sources leads to deployment error (#37786)
  • 55a4299 chore: update analytics metadata blueprints
  • e9c0b5a chore(release): 2.253.0
  • a52af7d fix(ecs): enabling the circuitBreaker is not recommended loudly enough (#37755)
  • a661c2d feat: update L1 CloudFormation resource definitions (#37753)
  • c29dc17 fix(cloudwatch): remove false positive warning for CDK tokens in MathExpressi...
  • dedf99b chore: replace Lazy with IBox (#37739)
  • 4031918 fix(codebuild): correct S3 log encryption boolean inversion (#37761)
  • 99d0a5b fix(eks): add dependency from HelmChart custom resource to s3 chartAsset IAM ...
  • Additional commits viewable in compare view

Updates aws-cdk from 2.1120.0 to 2.1121.0

Release notes

Sourced from aws-cdk's releases.

aws-cdk@v2.1121.0

2.1121.0 (2026-05-06)

Features

Bug Fixes

  • update version includes a spurious newline (#1477) (1f09294)
Commits
  • 7abdd4e chore(deps): bump ip-address from 10.1.0 to 10.2.0 (#1479)
  • ab82d61 chore(deps): bump @​aws-sdk/client-ssm from 3.1036.0 to 3.1037.0 (#1470)
  • 1f09294 fix: update version includes a spurious newline (#1477)
  • 63db541 chore(deps): bump @​aws-sdk/client-ecr from 3.1036.0 to 3.1037.0 (#1473)
  • 04c27f2 chore(deps): bump @​aws-sdk/client-appsync from 3.1036.0 to 3.1037.0 (#1471)
  • 68540cc chore(deps): bump @​aws-sdk/client-cloudformation from 3.1036.0 to 3.1037.0 (#...
  • 158daf3 chore(deps): bump @​aws-sdk/client-kms from 3.1036.0 to 3.1037.0 (#1469)
  • 0f86332 chore(deps): upgrade dependencies (#1468)
  • 09b7f15 chore: Remove package-lock.json from template.gitignore (#1466)
  • 9f872c9 feat(deps): upgrade aws-cdk-lib (#1465)
  • See full diff in compare view

Updates @types/node from 24.12.2 to 25.6.2

Commits

Updates aws-cdk-lib from 2.252.0 to 2.253.1

Release notes

Sourced from aws-cdk-lib's releases.

v2.253.1

Bug Fixes

  • core: "exports cannot be updated" for cross-region references (#37790) (b0c00e2)
  • s3deploy: empty sources leads to deployment error (#37786) (f61656a)

Alpha modules (2.253.1-alpha.0)

v2.253.0

Features

Bug Fixes

  • cloudfront: skip cachePolicyName length validation for unresolved tokens (#37751) (3b96e97), closes #23567 #34102
  • cloudwatch: remove false positive warning for CDK tokens in MathExpression (#36882) (c29dc17), closes #34977
  • codebuild: correct S3 log encryption boolean inversion (#37761) (4031918)
  • ecs: enabling the circuitBreaker is not recommended loudly enough (#37755) (a52af7d)
  • eks: add dependency from HelmChart custom resource to s3 chartAsset IAM policy (#37731) (99d0a5b), closes #19880

Alpha modules (2.253.0-alpha.0)

Features

  • bedrock-agentcore-alpha: add OnlineEvaluationConfig and Evaluator L2 constructs (#37615) (c13de04), closes #37614
  • glue-alpha: add extraPythonFiles support to PythonShellJob (#37130) (c9c6f9c), closes #34448

Bug Fixes

  • bedrock-agentcore-alpha: self-managed memory strategy validation throws on unresolved tokens (#37691) (7956537), closes #37197
Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.253.1-alpha.0 (2026-05-08)

2.253.0-alpha.0 (2026-05-06)

Features

  • bedrock-agentcore-alpha: add OnlineEvaluationConfig and Evaluator L2 constructs (#37615) (c13de04), closes #37614
  • glue-alpha: add extraPythonFiles support to PythonShellJob (#37130) (c9c6f9c), closes #34448

Bug Fixes

  • bedrock-agentcore-alpha: self-managed memory strategy validation throws on unresolved tokens (#37691) (7956537), closes #37197

2.252.0-alpha.0 (2026-04-29)

2.251.0-alpha.0 (2026-04-24)

Features

  • bedrock-agentcore-alpha: add L2 constructs for policy and policy engine (#37238) (1e89e7e)
  • bedrock-agentcore-alpha: add observability configuration for Runtime (#36689) (34b43aa), closes #36596
  • bedrock-agentcore-alpha: support No Authorization for AgentCore Gateway (#36610) (f20bd8e)
  • dsql-alpha: initial L2 construct (#34599) (be1a458), closes #34593

2.250.0-alpha.0 (2026-04-14)

2.249.0-alpha.0 (2026-04-10)

2.248.0-alpha.0 (2026-04-02)

2.247.0-alpha.0 (2026-04-02)

Features

2.246.0-alpha.0 (2026-03-31)

2.245.0-alpha.0 (2026-03-27)

Features

... (truncated)

Commits
  • b0c00e2 fix(core): "exports cannot be updated" for cross-region references (#37790)
  • f61656a fix(s3deploy): empty sources leads to deployment error (#37786)
  • 55a4299 chore: update analytics metadata blueprints
  • e9c0b5a chore(release): 2.253.0
  • a52af7d fix(ecs): enabling the circuitBreaker is not recommended loudly enough (#37755)
  • a661c2d feat: update L1 CloudFormation resource definitions (#37753)
  • c29dc17 fix(cloudwatch): remove false positive warning for CDK tokens in MathExpressi...
  • dedf99b chore: replace Lazy with IBox (#37739)
  • 4031918 fix(codebuild): correct S3 log encryption boolean inversion (#37761)
  • 99d0a5b fix(eks): add dependency from HelmChart custom resource to s3 chartAsset IAM ...
  • Additional commits viewable in compare view

Updates aws-cdk from 2.1120.0 to 2.1121.0

Release notes

Sourced from aws-cdk's releases.

aws-cdk@v2.1121.0

2.1121.0 (2026-05-06)

Features

Bug Fixes

  • update version includes a spurious newline (#1477) (1f09294)
Commits
  • 7abdd4e chore(deps): bump ip-address from 10.1.0 to 10.2.0 (#1479)
  • ab82d61 chore(deps): bump @​aws-sdk/client-ssm from 3.1036.0 to 3.1037.0 (#1470)
  • 1f09294 fix: update version includes a spurious newline (#1477)
  • 63db541 chore(deps): bump @​aws-sdk/client-ecr from 3.1036.0 to 3.1037.0 (#1473)
  • 04c27f2 chore(deps): bump @​aws-sdk/client-appsync from 3.1036.0 to 3.1037.0 (#1471)
  • 68540cc chore(deps): bump @​aws-sdk/client-cloudformation from 3.1036.0 to 3.1037.0 (#...
  • 158daf3 chore(deps): bump @​aws-sdk/client-kms from 3.1036.0 to 3.1037.0 (#1469)
  • 0f86332 chore(deps): upgrade dependencies (#1468)
  • 09b7f15 chore: Remove package-lock.json from template.gitignore (#1466)
  • 9f872c9 feat(deps): upgrade aws-cdk-lib (#1465)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the npm group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@aws-sdk/client-cloudformation](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-cloudformation) | `3.1043.0` | `3.1045.0` |
| [@eslint/compat](https://github.com/eslint/rewrite/tree/HEAD/packages/compat) | `2.0.5` | `2.1.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `24.12.2` | `25.6.2` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.10` | `8.0.11` |
| [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib) | `2.252.0` | `2.253.1` |
| [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk) | `2.1120.0` | `2.1121.0` |

Bumps the npm group with 3 updates in the /test directory: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib) and [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk).


Updates `@aws-sdk/client-cloudformation` from 3.1043.0 to 3.1045.0
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-cloudformation/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1045.0/clients/client-cloudformation)

Updates `@eslint/compat` from 2.0.5 to 2.1.0
- [Release notes](https://github.com/eslint/rewrite/releases)
- [Changelog](https://github.com/eslint/rewrite/blob/main/packages/compat/CHANGELOG.md)
- [Commits](https://github.com/eslint/rewrite/commits/compat-v2.1.0/packages/compat)

Updates `@types/node` from 24.12.2 to 25.6.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `vite` from 8.0.10 to 8.0.11
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.0.11/packages/vite)

Updates `aws-cdk-lib` from 2.252.0 to 2.253.1
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/commits/v2.253.1/packages/aws-cdk-lib)

Updates `aws-cdk` from 2.1120.0 to 2.1121.0
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1121.0/packages/aws-cdk)

Updates `@types/node` from 24.12.2 to 25.6.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `aws-cdk-lib` from 2.252.0 to 2.253.1
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/commits/v2.253.1/packages/aws-cdk-lib)

Updates `aws-cdk` from 2.1120.0 to 2.1121.0
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1121.0/packages/aws-cdk)

---
updated-dependencies:
- dependency-name: "@aws-sdk/client-cloudformation"
  dependency-version: 3.1045.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@eslint/compat"
  dependency-version: 2.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@types/node"
  dependency-version: 25.6.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm
- dependency-name: vite
  dependency-version: 8.0.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: aws-cdk-lib
  dependency-version: 2.253.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: aws-cdk
  dependency-version: 2.1121.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: "@types/node"
  dependency-version: 25.6.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: npm
- dependency-name: aws-cdk-lib
  dependency-version: 2.253.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: aws-cdk
  dependency-version: 2.1121.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels May 12, 2026
@github-actions github-actions Bot enabled auto-merge (squash) May 12, 2026 03:40
@github-actions
Copy link
Copy Markdown

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 1 package(s) with unknown licenses.
See the Details below.

License Issues

test/package.json

PackageVersionLicenseIssue Type
aws-cdk-lib^2.253.1NullUnknown License

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/@aws-cdk/cloud-assembly-schema 53.22.0 UnknownUnknown
npm/@aws-crypto/crc32 5.2.0 🟢 5.6
Details
CheckScoreReason
Code-Review🟢 8Found 24/28 approved changesets -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained⚠️ 12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 5dependency not pinned by hash detected -- score normalized to 5
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
SAST⚠️ 1SAST tool is not run on all commits -- score normalized to 1
npm/@aws-sdk/client-cloudformation 3.1045.0 🟢 5.2
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 1Found 4/30 approved changesets -- score normalized to 1
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
License🟢 10license file detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
SAST🟢 7SAST tool is not run on all commits -- score normalized to 7
Binary-Artifacts🟢 8binaries present in source code
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
npm/@eslint/compat 2.1.0 UnknownUnknown
npm/@oxc-project/types 0.128.0 UnknownUnknown
npm/@rolldown/binding-android-arm64 1.0.0-rc.18 UnknownUnknown
npm/@rolldown/binding-darwin-arm64 1.0.0-rc.18 UnknownUnknown
npm/@rolldown/binding-darwin-x64 1.0.0-rc.18 UnknownUnknown
npm/@rolldown/binding-freebsd-x64 1.0.0-rc.18 UnknownUnknown
npm/@rolldown/binding-linux-arm-gnueabihf 1.0.0-rc.18 UnknownUnknown
npm/@rolldown/binding-linux-arm64-gnu 1.0.0-rc.18 UnknownUnknown
npm/@rolldown/binding-linux-arm64-musl 1.0.0-rc.18 UnknownUnknown
npm/@rolldown/binding-linux-ppc64-gnu 1.0.0-rc.18 UnknownUnknown
npm/@rolldown/binding-linux-s390x-gnu 1.0.0-rc.18 UnknownUnknown
npm/@rolldown/binding-linux-x64-gnu 1.0.0-rc.18 UnknownUnknown
npm/@rolldown/binding-linux-x64-musl 1.0.0-rc.18 UnknownUnknown
npm/@rolldown/binding-openharmony-arm64 1.0.0-rc.18 UnknownUnknown
npm/@rolldown/binding-wasm32-wasi 1.0.0-rc.18 UnknownUnknown
npm/@rolldown/binding-win32-arm64-msvc 1.0.0-rc.18 UnknownUnknown
npm/@rolldown/binding-win32-x64-msvc 1.0.0-rc.18 UnknownUnknown
npm/@rolldown/pluginutils 1.0.0-rc.18 UnknownUnknown
npm/@smithy/config-resolver 4.5.0 UnknownUnknown
npm/@smithy/core 3.24.0 UnknownUnknown
npm/@smithy/credential-provider-imds 4.3.0 UnknownUnknown
npm/@smithy/fetch-http-handler 5.4.0 UnknownUnknown
npm/@smithy/hash-node 4.3.0 UnknownUnknown
npm/@smithy/invalid-dependency 4.3.0 UnknownUnknown
npm/@smithy/middleware-content-length 4.3.0 UnknownUnknown
npm/@smithy/middleware-endpoint 4.5.0 UnknownUnknown
npm/@smithy/middleware-retry 4.6.0 UnknownUnknown
npm/@smithy/middleware-serde 4.3.0 UnknownUnknown
npm/@smithy/middleware-stack 4.3.0 UnknownUnknown
npm/@smithy/node-config-provider 4.4.0 UnknownUnknown
npm/@smithy/node-http-handler 4.7.0 UnknownUnknown
npm/@smithy/property-provider 4.3.0 UnknownUnknown
npm/@smithy/protocol-http 5.4.0 UnknownUnknown
npm/@smithy/shared-ini-file-loader 4.5.0 UnknownUnknown
npm/@smithy/signature-v4 5.4.0 UnknownUnknown
npm/@smithy/smithy-client 4.13.0 UnknownUnknown
npm/@smithy/url-parser 4.3.0 UnknownUnknown
npm/@smithy/util-base64 4.4.0 UnknownUnknown
npm/@smithy/util-body-length-browser 4.3.0 UnknownUnknown
npm/@smithy/util-body-length-node 4.3.0 UnknownUnknown
npm/@smithy/util-config-provider 4.3.0 UnknownUnknown
npm/@smithy/util-defaults-mode-browser 4.4.0 UnknownUnknown
npm/@smithy/util-defaults-mode-node 4.3.0 UnknownUnknown
npm/@smithy/util-endpoints 3.5.0 UnknownUnknown
npm/@smithy/util-middleware 4.3.0 UnknownUnknown
npm/@smithy/util-retry 4.4.0 UnknownUnknown
npm/@smithy/util-stream 4.6.0 UnknownUnknown
npm/@smithy/util-utf8 4.3.0 UnknownUnknown
npm/@smithy/util-waiter 4.4.0 UnknownUnknown
npm/@tybys/wasm-util 0.10.2 UnknownUnknown
npm/@types/node 24.12.3 🟢 6.6
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 9Found 27/29 approved changesets -- score normalized to 9
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
Fuzzing⚠️ 0project is not fuzzed
npm/aws-cdk 2.1121.0 UnknownUnknown
npm/aws-cdk-lib 2.253.1 🟢 5.9
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow⚠️ 0dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ -1internal error: internal error: invalid Dockerfile
License🟢 10license file detected
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Security-Policy🟢 10security policy file detected
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Binary-Artifacts⚠️ 0binaries present in source code
SAST🟢 9SAST tool detected but not run on all commits
Fuzzing🟢 10project is fuzzed
npm/fast-xml-builder 1.2.0 UnknownUnknown
npm/postcss 8.5.14 🟢 6
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Code-Review⚠️ 1Found 3/29 approved changesets -- score normalized to 1
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST🟢 6SAST tool is not run on all commits -- score normalized to 6
npm/rolldown 1.0.0-rc.18 UnknownUnknown
npm/vite 8.0.11 🟢 6.8
Details
CheckScoreReason
Code-Review🟢 8Found 20/25 approved changesets -- score normalized to 8
Maintained🟢 1030 commit(s) and 19 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 5detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 5binaries present in source code
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 5SAST tool is not run on all commits -- score normalized to 5
npm/xml-naming 0.1.0 UnknownUnknown
npm/@types/node ^25.6.2 UnknownUnknown
npm/aws-cdk ^2.1121.0 UnknownUnknown
npm/aws-cdk-lib ^2.253.1 UnknownUnknown

Scanned Files

  • pnpm-lock.yaml
  • test/package.json

@github-actions github-actions Bot merged commit 4ade804 into main May 12, 2026
8 checks passed
@github-actions github-actions Bot deleted the dependabot/npm_and_yarn/npm-17ae383f91 branch May 12, 2026 03:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants