[gh-worker-campaigns-3e9aa4]

Warning

Shotclock auto-merge countdown

This PR may be automatically approved and merged on or after November 2, 2026 (UTC) if nobody acts and all required Shotclock eligibility checks pass.

To stop Shotclock, comment or review this PR, request changes, push a commit, or close the PR. Converting it to draft pauses automation.

⚠️ One or more lockfile regeneration steps failed. The updates listed below may not all have been applied — verify against the diff before merging. Package counts and totals reflect what was attempted, not what landed. See the engraver logs for details.

Summary: High-severity security update — 2 packages upgraded (MINOR changes included)

Manifests changed:

• examples/step-functions-typescript-stack/package.json (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
aws-cdk-lib	2.189.1	2.274.0	minor	Direct	4 HIGH, 2 LOW
fast-uri	3.1.8	3.1.9	patch	Transitive	4 MEDIUM, 4 LOW

---

Security Details

🚨 Critical & High Severity (4 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
aws-cdk-lib	GHSA-vcrf-j523-4mrf	HIGH	aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling	2.189.1	2.260.0	-
aws-cdk-lib	CVE-2026-11417	HIGH	OS Command Injection in NodejsFunction Bundling in aws-cdk-lib	2.189.1	-	-
aws-cdk-lib	GHSA-999r-qq7v-r334	HIGH	aws-cdk-lib: OS Command Injection in NodejsFunction Bundling	2.189.1	2.246.0	-
aws-cdk-lib	CVE-2026-13760	HIGH	OS Command Injection in aws-cdk-lib Docker Bundling	2.189.1	-	-

ℹ️ Other Vulnerabilities (10)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
fast-uri	CVE-2026-110306	MODERATE	fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding	3.1.8	-	-
fast-uri	GHSA-wjr9-j795-jxcr	MODERATE	fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization	3.1.8	2.4.8	-
fast-uri	CVE-2026-110180	MODERATE	fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization	3.1.8	-	-
fast-uri	GHSA-w74x-v6f9-j3xg	MODERATE	fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding	3.1.8	2.4.8	-
aws-cdk-lib	GO-2026-6093	LOW	AWS CDK CodeBuild S3 Log Encryption Boolean Inversion in github.com/aws/aws-cdk-go/awscdk	2.189.1	-	-
aws-cdk-lib	GHSA-464c-974j-9xm6	LOW	AWS CDK CodeBuild S3 Log Encryption Boolean Inversion	2.189.1	2.253.0	-
fast-uri	GHSA-333x-w4r6-6crp	LOW	fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references	3.1.8	2.4.8	-
fast-uri	CVE-2026-110725	LOW	fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references	3.1.8	-	-
fast-uri	GHSA-xhq7-xmqj-769h	LOW	fast-uri vulnerable to improper path equivalence in relative reference normalization	3.1.8	2.4.8	-
fast-uri	CVE-2026-110095	LOW	fast-uri vulnerable to improper path equivalence in relative reference normalization	3.1.8	-	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System