[gh-worker-campaigns-3e9aa4]

Warning

Shotclock auto-merge countdown

This PR may be automatically approved and merged on or after November 2, 2026 (UTC) if nobody acts and all required Shotclock eligibility checks pass.

To stop Shotclock, comment or review this PR, request changes, push a commit, or close the PR. Converting it to draft pauses automation.

⚠️ One or more lockfile regeneration steps failed. The updates listed below may not all have been applied — verify against the diff before merging. Package counts and totals reflect what was attempted, not what landed. See the engraver logs for details.

Summary: High-severity security update — 1 package upgraded (MINOR changes included)

Manifests changed:

• examples/typescript-stack/package.json (yarn)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
aws-cdk-lib	2.238.0	2.274.0	minor	Direct	4 HIGH, 2 LOW

---

Security Details

🚨 Critical & High Severity (4 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
aws-cdk-lib	GHSA-vcrf-j523-4mrf	HIGH	aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling	2.238.0	2.260.0	-
aws-cdk-lib	CVE-2026-13760	HIGH	OS Command Injection in aws-cdk-lib Docker Bundling	2.238.0	-	-
aws-cdk-lib	GHSA-999r-qq7v-r334	HIGH	aws-cdk-lib: OS Command Injection in NodejsFunction Bundling	2.238.0	2.246.0	-
aws-cdk-lib	CVE-2026-11417	HIGH	OS Command Injection in NodejsFunction Bundling in aws-cdk-lib	2.238.0	-	-

ℹ️ Other Vulnerabilities (2)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
aws-cdk-lib	GHSA-464c-974j-9xm6	LOW	AWS CDK CodeBuild S3 Log Encryption Boolean Inversion	2.238.0	2.253.0	-
aws-cdk-lib	GO-2026-6093	LOW	AWS CDK CodeBuild S3 Log Encryption Boolean Inversion in github.com/aws/aws-cdk-go/awscdk	2.238.0	-	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System