[hoegertn]

Summary

Upgraded the projen toolchain and all compatible dependencies of cdk-serverless, and cleared every fixable advisory. npm audit drops from 10 to 8, with the 1 high and 1 moderate both fixed. The 8 remaining are all low severity with no forward (non-downgrade) fix. No major was applied.

Majors applied

Package	Workspace package	From	To	Reason
none

projen moved 0.104.5 to 0.104.19, which is a patch within the 0.104.x line, not a major.

Toolchain

Item	From	To
pnpm	n/a (repo uses npm)	n/a
CDK_VERSION (aws-cdk-lib and derived alpha modules)	2.273.0	2.273.0 (unchanged, see Held back)
CONSTRUCTS_VERSION	n/a (constructs ^10.0.0, not a pinned literal)	n/a
projen	0.104.5	0.104.19
@taimos/projen	n/a (not used)	n/a

projen regeneration changes

• Peer and dev pin for projen raised to >=0.104.19 <1.0.0 / 0.104.19 in package.json and .projen/deps.json.
• No workflow, task, tsconfig, or eslint shape changes. Two consecutive npx projen runs are drift-free.

Upgraded dependencies

Workspace package	Dependency	From	To
cdk-serverless	projen (dev + peer floor)	0.104.5	0.104.19
cdk-serverless	@aws-sdk/client-cognito-identity-provider (dev + peer floor)	3.1150.0	^3.1159.0
cdk-serverless	@aws-sdk/client-dynamodb (dev + peer floor)	3.1150.0	^3.1159.0
cdk-serverless	@aws-sdk/client-s3 (dev + peer floor)	3.1150.0	^3.1159.0
cdk-serverless	@aws-sdk/lib-dynamodb (dev + peer floor)	3.1150.0	^3.1159.0
cdk-serverless	@typescript-eslint/parser (resolved)	8.71.2	8.72.1
cdk-serverless	@typescript-eslint/eslint-plugin (resolved)	8.71.2	8.72.1
cdk-serverless	commit-and-tag-version (resolved)	13.2.2	13.3.0
cdk-serverless	ts-jest (resolved)	29.4.14	29.4.15
cdk-serverless	markdown-it (transitive, via typedoc)	14.3.2	14.3.3
cdk-serverless	fast-uri (transitive, via openapi-typescript)	3.1.8	3.1.9

markdown-it and fast-uri moved within their parents' existing ranges. No overrides were added.

Vulnerabilities

Before: 0 critical, 1 high, 1 moderate, 8 low
After: 0 critical, 0 high, 0 moderate, 8 low

Fixed

Advisory	Severity	Package	Fixed by
Quadratic-time DoS in inline HTML / link reference parsing	high	markdown-it	14.3.2 to 14.3.3 (within typedoc range)
URI scheme spoofing, path-equivalence, host-confusion, scheme injection	moderate	fast-uri	3.1.8 to 3.1.9 (within @redocly/ajv range)

Still open

Advisory	Severity	Package	Path	Reason
deepmerge prototype poisoning	low	deepmerge	jest > @jest/core > jest-config > deepmerge	deepmerge 4.3.1 is latest 4.x with no patch; npm's only fix is jest@25 (major downgrade)
jest test-tooling (via deepmerge)	low	@jest/core, jest, jest-cli, jest-config	jest 30 chain	same deepmerge root; fix is jest@25 major downgrade, which reintroduces the jest 29 highs already cleared
ts-jest (via jest)	low	ts-jest	ts-jest > jest	fix is ts-jest@25 major downgrade
Risky crypto primitive	low	elliptic	jwk-to-pem > elliptic	no published fix (fixAvailable: false)
depends on elliptic	low	jwk-to-pem	direct dep > elliptic	no published fix (fixAvailable: false)

No remaining advisory has a non-breaking, non-downgrade fix. Per the skill's rule 3, low advisories are fixed only when a compatible update clears them and the gate stays green. A major downgrade of jest or ts-jest is neither compatible nor safe, so these are reported rather than applied.

Overrides removed

Override	Floor	Resolved versions without it
none

The repo had no existing overrides.

Held back

Package	Workspace package	Current	Newest	Reason
aws-cdk-lib	cdk-serverless	2.273.0	2.275.0	peer floor is the declared minimum supported version; no advisory forces a bump, and raising the floor narrows consumer compatibility for no gain
@stylistic/eslint-plugin	cdk-serverless	2.13.0	5.10.0	major; out of scope (^2 range)
@types/lambda-log	cdk-serverless	2.2.1	3.0.3	major; out of scope (^2 range)
@types/node	cdk-serverless	18.19.130	26.6.6	major; pinned to ^18 to match the supported Node baseline
eslint	cdk-serverless	9.39.5	10.13.0	major; out of scope (^9 range)
js-yaml	cdk-serverless	4.3.2	5.5.0	major; out of scope (^4 range)
typescript	cdk-serverless	5.9.3	7.0.2	major; out of scope (^5 range)

Release-age gate bypasses

Package@version	Advisory	Severity
none

The repo has no minimum-release-age gate.

Rolled back

Package	Attempted version	Error (excerpt)	Fix attempts
none

Code changes

No source changes were needed. The build and all 151 tests passed with the upgraded dependencies. No CDK snapshot changes.

Verification

Check	Result
npm ci (frozen install)	pass (exit 0)
projen regenerate is stable	pass (two consecutive npx projen runs, no drift)
npm run build	pass (exit 0, compile + docgen + test + package)
npm run test	pass (14 suites, 151 tests)
npm run eslint	pass (exit 0, 0 errors)
expo install --check	n/a (no Expo app)
cdk synth	n/a (construct library, no CDK app)
npm audit	8 low, 0 moderate, 0 high, 0 critical

No pre-existing baseline failures. The untouched main tree built green with 10 advisories (1 high, 1 moderate, 8 low) before this change.