cdk-common 2.1.54 → 2.1.56

package/node_modules/@types/concat-stream/node_modules/@types/node/README.md

@@ -8,7 +8,7 @@ This package contains type definitions for node (https://nodejs.org/).
 Files were exported from https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node.
 
 ### Additional Details
- * Last updated: Tue, 19 May 2026 17:48:56 GMT
+ * Last updated: Wed, 10 Jun 2026 22:15:09 GMT
  * Dependencies: [undici-types](https://npmjs.com/package/undici-types)
 
 # Credits

package/node_modules/@types/concat-stream/node_modules/@types/node/http2.d.ts

@@ -20,6 +20,7 @@ declare module "node:http2" {
         ":method"?: string | undefined;
         ":authority"?: string | undefined;
         ":scheme"?: string | undefined;
+        ":protocol"?: string | undefined;
     }
     // Http2Stream
     interface StreamState {
@@ -582,6 +583,7 @@ declare module "node:http2" {
         maxConcurrentStreams?: number | undefined;
         maxHeaderListSize?: number | undefined;
         enableConnectProtocol?: boolean | undefined;
+        customSettings?: { [key: number]: number };
     }
     interface ClientSessionRequestOptions {
         endStream?: boolean | undefined;
@@ -1240,6 +1242,8 @@ declare module "node:http2" {
         Http2Request extends typeof Http2ServerRequest = typeof Http2ServerRequest,
         Http2Response extends typeof Http2ServerResponse<InstanceType<Http2Request>> = typeof Http2ServerResponse,
     > extends SessionOptions {
+        maxSessionRejectedStreams?: number | undefined;
+        maxSessionInvalidFrames?: number | undefined;
         streamResetBurst?: number | undefined;
         streamResetRate?: number | undefined;
         /** @deprecated Use `http1Options.IncomingMessage` instead. */

package/node_modules/@types/concat-stream/node_modules/@types/node/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@types/node",
-    "version": "25.9.1",
+    "version": "25.9.3",
     "description": "TypeScript definitions for node",
     "homepage": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node",
     "license": "MIT",
@@ -150,6 +150,6 @@
         "undici-types": ">=7.24.0 <7.24.7"
     },
     "peerDependencies": {},
-    "typesPublisherContentHash": "2546f5f588e15fc9aa202a3005dab2859d006fd48a8448107741e5ce184e9098",
+    "typesPublisherContentHash": "b651099f0be23911446e6a283ee816760ef628511df23064b85b949a9ca68cf5",
     "typeScriptVersion": "5.3"
 }

package/node_modules/@types/form-data/node_modules/@types/node/README.md

@@ -8,7 +8,7 @@ This package contains type definitions for node (https://nodejs.org/).
 Files were exported from https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node.
 
 ### Additional Details
- * Last updated: Tue, 19 May 2026 17:48:56 GMT
+ * Last updated: Wed, 10 Jun 2026 22:15:09 GMT
  * Dependencies: [undici-types](https://npmjs.com/package/undici-types)
 
 # Credits

package/node_modules/@types/form-data/node_modules/@types/node/http2.d.ts

@@ -20,6 +20,7 @@ declare module "node:http2" {
         ":method"?: string | undefined;
         ":authority"?: string | undefined;
         ":scheme"?: string | undefined;
+        ":protocol"?: string | undefined;
     }
     // Http2Stream
     interface StreamState {
@@ -582,6 +583,7 @@ declare module "node:http2" {
         maxConcurrentStreams?: number | undefined;
         maxHeaderListSize?: number | undefined;
         enableConnectProtocol?: boolean | undefined;
+        customSettings?: { [key: number]: number };
     }
     interface ClientSessionRequestOptions {
         endStream?: boolean | undefined;
@@ -1240,6 +1242,8 @@ declare module "node:http2" {
         Http2Request extends typeof Http2ServerRequest = typeof Http2ServerRequest,
         Http2Response extends typeof Http2ServerResponse<InstanceType<Http2Request>> = typeof Http2ServerResponse,
     > extends SessionOptions {
+        maxSessionRejectedStreams?: number | undefined;
+        maxSessionInvalidFrames?: number | undefined;
         streamResetBurst?: number | undefined;
         streamResetRate?: number | undefined;
         /** @deprecated Use `http1Options.IncomingMessage` instead. */

package/node_modules/@types/form-data/node_modules/@types/node/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@types/node",
-    "version": "25.9.1",
+    "version": "25.9.3",
     "description": "TypeScript definitions for node",
     "homepage": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node",
     "license": "MIT",
@@ -150,6 +150,6 @@
         "undici-types": ">=7.24.0 <7.24.7"
     },
     "peerDependencies": {},
-    "typesPublisherContentHash": "2546f5f588e15fc9aa202a3005dab2859d006fd48a8448107741e5ce184e9098",
+    "typesPublisherContentHash": "b651099f0be23911446e6a283ee816760ef628511df23064b85b949a9ca68cf5",
     "typeScriptVersion": "5.3"
 }

package/node_modules/form-data/CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [v4.0.5](https://github.com/form-data/form-data/compare/v4.0.4...v4.0.5) - 2025-11-17
+
+### Commits
+
+- [Tests] Switch to newer v8 prediction library; enable node 24 testing [`16e0076`](https://github.com/form-data/form-data/commit/16e00765342106876f98a1c9703314006c9e937a)
+- [Dev Deps] update `@ljharb/eslint-config`, `eslint` [`5822467`](https://github.com/form-data/form-data/commit/5822467f0ec21f6ad613c1c90856375e498793c7)
+- [Fix] set Symbol.toStringTag in the proper place [`76d0dee`](https://github.com/form-data/form-data/commit/76d0dee43933b5e167f7f09e5d9cbbd1cf911aa7)
+
 ## [v4.0.4](https://github.com/form-data/form-data/compare/v4.0.3...v4.0.4) - 2025-07-16
 
 ### Commits
@@ -158,7 +166,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - feat: add setBoundary method [`55d90ce`](https://github.com/form-data/form-data/commit/55d90ce4a4c22b0ea0647991d85cb946dfb7395b)
 
-## [v3.0.0](https://github.com/form-data/form-data/compare/v2.5.5...v3.0.0) - 2019-11-05
+## [v3.0.0](https://github.com/form-data/form-data/compare/v2.5.6...v3.0.0) - 2019-11-05
 
 ### Merged
 
@@ -182,6 +190,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Pass options to constructor if not used with new [`4bde68e`](https://github.com/form-data/form-data/commit/4bde68e12de1ba90fefad2e7e643f6375b902763)
 - Make userHeaders optional [`2b4e478`](https://github.com/form-data/form-data/commit/2b4e4787031490942f2d1ee55c56b85a250875a7)
 
+## [v2.5.6](https://github.com/form-data/form-data/compare/v2.5.5...v2.5.6) - 2026-06-12
+
+### Commits
+
+- [Fix] escape CR, LF, and `"` in field names and filenames [`b620316`](https://github.com/form-data/form-data/commit/b62031603c2d7c329b2a369b49466790f0ba6314)
+- [Dev Deps] update `@ljharb/eslint-config`, `auto-changelog`, `eslint`, `tape` [`12be578`](https://github.com/form-data/form-data/commit/12be578e936fd77eee75e2e656955f5343c4b80f)
+- [Dev Deps] update `js-randomness-predictor` [`46cfd23`](https://github.com/form-data/form-data/commit/46cfd23bd40be14cfa0391e1c5357c4d74098f23)
+- [Tests] use `safe-buffer` so the header-injection test runs on node < 4 [`633044a`](https://github.com/form-data/form-data/commit/633044a57a7b19f41cec2271ffd24afa2f6280af)
+- [Deps] update `hasown` [`e3b96ee`](https://github.com/form-data/form-data/commit/e3b96eef1661bca8ea4297de057b78bf2734e900)
+
 ## [v2.5.5](https://github.com/form-data/form-data/compare/v2.5.4...v2.5.5) - 2025-07-18
 
 ### Commits

package/node_modules/form-data/README.md

@@ -6,11 +6,11 @@ The API of this library is inspired by the [XMLHttpRequest-2 FormData Interface]
 
 [xhr2-fd]: http://dev.w3.org/2006/webapi/XMLHttpRequest-2/Overview.html#the-formdata-interface
 
-[![Linux Build](https://img.shields.io/travis/form-data/form-data/v2.5.5.svg?label=linux:4.x-12.x)](https://travis-ci.org/form-data/form-data)
-[![MacOS Build](https://img.shields.io/travis/form-data/form-data/v2.5.5.svg?label=macos:4.x-12.x)](https://travis-ci.org/form-data/form-data)
-[![Windows Build](https://img.shields.io/travis/form-data/form-data/v2.5.5.svg?label=windows:4.x-12.x)](https://travis-ci.org/form-data/form-data)
+[![Linux Build](https://img.shields.io/travis/form-data/form-data/v2.5.6.svg?label=linux:4.x-12.x)](https://travis-ci.org/form-data/form-data)
+[![MacOS Build](https://img.shields.io/travis/form-data/form-data/v2.5.6.svg?label=macos:4.x-12.x)](https://travis-ci.org/form-data/form-data)
+[![Windows Build](https://img.shields.io/travis/form-data/form-data/v2.5.6.svg?label=windows:4.x-12.x)](https://travis-ci.org/form-data/form-data)
 
-[![Coverage Status](https://img.shields.io/coveralls/form-data/form-data/v2.5.5.svg?label=code+coverage)](https://coveralls.io/github/form-data/form-data?branch=master)
+[![Coverage Status](https://img.shields.io/coveralls/form-data/form-data/v2.5.6.svg?label=code+coverage)](https://coveralls.io/github/form-data/form-data?branch=master)
 [![Dependency Status](https://img.shields.io/david/form-data/form-data.svg)](https://david-dm.org/form-data/form-data)
 
 ## Install

package/node_modules/form-data/lib/form_data.js

@@ -15,6 +15,11 @@ var setToStringTag = require('es-set-tostringtag');
 var populate = require('./populate.js');
 var Buffer = require('safe-buffer').Buffer;
 
+// escape CR/LF/`"` so a name/filename can't inject headers or smuggle parts; matches the WHATWG HTML multipart/form-data encoding
+function escapeHeaderParam(str) {
+  return String(str).replace(/\r/g, '%0D').replace(/\n/g, '%0A').replace(/"/g, '%22');
+}
+
 /**
  * Create readable "multipart/form-data" streams.
  * Can be used to submit forms
@@ -190,7 +195,7 @@ FormData.prototype._multiPartHeader = function (field, value, options) {
   var contents = '';
   var headers = {
     // add custom disposition as third element or keep it two elements if not
-    'Content-Disposition': ['form-data', 'name="' + field + '"'].concat(contentDisposition || []),
+    'Content-Disposition': ['form-data', 'name="' + escapeHeaderParam(field) + '"'].concat(contentDisposition || []),
     // if no content type. allow it to be empty array
     'Content-Type': [].concat(contentType || []),
   };
@@ -245,7 +250,7 @@ FormData.prototype._getContentDisposition = function (value, options) {
   }
 
   if (filename) {
-    contentDisposition = 'filename="' + filename + '"';
+    contentDisposition = 'filename="' + escapeHeaderParam(filename) + '"';
   }
 
   return contentDisposition;

package/node_modules/form-data/package.json

@@ -2,7 +2,7 @@
   "author": "Felix Geisendörfer <felix@debuggable.com> (http://debuggable.com/)",
   "name": "form-data",
   "description": "A library to create readable \"multipart/form-data\" streams. Can be used to submit forms and file uploads to other web applications.",
-  "version": "2.5.5",
+  "version": "2.5.6",
   "repository": {
     "type": "git",
     "url": "git://github.com/form-data/form-data.git"
@@ -42,25 +42,25 @@
     "asynckit": "^0.4.0",
     "combined-stream": "^1.0.8",
     "es-set-tostringtag": "^2.1.0",
-    "hasown": "^2.0.2",
+    "hasown": "^2.0.4",
     "mime-types": "^2.1.35",
     "safe-buffer": "^5.2.1"
   },
   "devDependencies": {
-    "@ljharb/eslint-config": "^21.2.0",
-    "auto-changelog": "^2.5.0",
+    "@ljharb/eslint-config": "^22.2.3",
+    "auto-changelog": "^2.6.0",
     "browserify": "^13.3.0",
     "browserify-istanbul": "^2.0.0",
     "coveralls": "^3.1.1",
     "cross-spawn": "^4.0.2",
     "encoding": "^0.1.13",
-    "eslint": "=8.8.0",
+    "eslint": "^8.57.1",
     "fake": "^0.2.2",
     "far": "^0.0.7",
     "formidable": "^1.2.6",
     "in-publish": "^2.0.1",
     "istanbul": "^0.4.5",
-    "js-randomness-predictor": "^1.5.5",
+    "js-randomness-predictor": "^3.6.0",
     "obake": "^0.1.2",
     "phantomjs-prebuilt": "^2.1.16",
     "pkgfiles": "^2.3.2",
@@ -69,7 +69,7 @@
     "request": "~2.87.0",
     "rimraf": "^2.7.1",
     "semver": "^6.3.1",
-    "tape": "^5.9.0"
+    "tape": "^5.10.1"
   },
   "license": "MIT",
   "auto-changelog": {

package/node_modules/hasown/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [v2.0.4](https://github.com/inspect-js/hasOwn/compare/v2.0.3...v2.0.4) - 2026-05-28
+
+### Commits
+
+- [types] drop the dead key-narrowing overload [`fdab00e`](https://github.com/inspect-js/hasOwn/commit/fdab00e2703e65411424e19bf86a7e72a8f10da9)
+- [Dev Deps] update `@ljharb/eslint-config`, `auto-changelog`, `eslint` [`91f6247`](https://github.com/inspect-js/hasOwn/commit/91f624768dd0f7db0d019b89d4d86bd66e20ec30)
+
 ## [v2.0.3](https://github.com/inspect-js/hasOwn/compare/v2.0.2...v2.0.3) - 2026-04-17
 
 ### Commits

package/node_modules/hasown/index.d.ts

@@ -1,4 +1,3 @@
-declare function hasOwn<O, K extends PropertyKey>(o: O, p: K): p is K & keyof O;
 declare function hasOwn<O, K extends PropertyKey, V = unknown>(o: O, p: K): o is O & Record<K, V>;
 
 export = hasOwn;

package/node_modules/hasown/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "hasown",
-	"version": "2.0.3",
+	"version": "2.0.4",
 	"description": "A robust, ES3 compatible, \"has own property\" predicate.",
 	"main": "index.js",
 	"exports": {
@@ -52,13 +52,12 @@
 	},
 	"devDependencies": {
 		"@arethetypeswrong/cli": "^0.18.2",
-		"@ljharb/eslint-config": "^22.2.2",
+		"@ljharb/eslint-config": "^22.2.3",
 		"@ljharb/tsconfig": "^0.3.2",
 		"@types/function-bind": "^1.1.10",
 		"@types/tape": "^5.8.1",
-		"auto-changelog": "^2.5.0",
-		"encoding": "^0.1.13",
-		"eslint": "^10.2.0",
+		"auto-changelog": "^2.5.1",
+		"eslint": "^10.4.0",
 		"evalmd": "^0.0.19",
 		"in-publish": "^2.0.1",
 		"jiti": "^0.0.0",

package/node_modules/side-channel/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [v1.1.1](https://github.com/ljharb/side-channel/compare/v1.1.0...v1.1.1) - 2026-06-08
+
+### Commits
+
+- [Fix] `assert`: do not observably access object keys when throwing [`fc17361`](https://github.com/ljharb/side-channel/commit/fc173615136e6a6c3194656e6088afbc0bd6f9b8)
+- [actions] update workflows [`35b18c0`](https://github.com/ljharb/side-channel/commit/35b18c0bced5769d59226cd44a7e4003ad0aee81)
+- [Dev Deps] update `@arethetypeswrong/cli`, `@ljharb/eslint-config`, `@ljharb/tsconfig`, `@types/tape`, `auto-changelog`, `eslint`, `npmignore` [`b456a01`](https://github.com/ljharb/side-channel/commit/b456a01396cfdd028e5d39ea84885fe9178a72cf)
+- [Deps] update `object-inspect`, `side-channel-list` [`accf1a1`](https://github.com/ljharb/side-channel/commit/accf1a1a2767a22b1f5eeb5769a1db4c35a78090)
+- [readme] replace runkit CI badge with shields.io check-runs badge [`7e0c956`](https://github.com/ljharb/side-channel/commit/7e0c956411cc29267197a49a155a3d9bd01bacac)
+
 ## [v1.1.0](https://github.com/ljharb/side-channel/compare/v1.0.6...v1.1.0) - 2024-12-11
 
 ### Commits

package/node_modules/side-channel/README.md

@@ -57,5 +57,5 @@ Clone the repo, `npm install`, and run `npm test`
 [downloads-url]: https://npm-stat.com/charts.html?package=side-channel
 [codecov-image]: https://codecov.io/gh/ljharb/side-channel/branch/main/graphs/badge.svg
 [codecov-url]: https://app.codecov.io/gh/ljharb/side-channel/
-[actions-image]: https://img.shields.io/endpoint?url=https://github-actions-badge-u3jn4tfpocch.runkit.sh/ljharb/side-channel
+[actions-image]: https://img.shields.io/github/check-runs/ljharb/side-channel/main
 [actions-url]: https://github.com/ljharb/side-channel/actions

package/node_modules/side-channel/index.js

@@ -18,7 +18,10 @@ module.exports = function getSideChannel() {
 	var channel = {
 		assert: function (key) {
 			if (!channel.has(key)) {
-				throw new $TypeError('Side channel does not contain ' + inspect(key));
+				var keyDesc = key && Object(key) === key
+					? 'the given object key'
+					: inspect(key);
+				throw new $TypeError('Side channel does not contain ' + keyDesc);
 			}
 		},
 		'delete': function (key) {
@@ -38,6 +41,6 @@ module.exports = function getSideChannel() {
 			$channelData.set(key, value);
 		}
 	};
-	// @ts-expect-error TODO: figure out why this is erroring
+
 	return channel;
 };

package/node_modules/side-channel/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "side-channel",
-	"version": "1.1.0",
+	"version": "1.1.1",
 	"description": "Store information about any JS value in a side channel. Uses WeakMap if available.",
 	"main": "index.js",
 	"exports": {
@@ -44,23 +44,23 @@
 	"homepage": "https://github.com/ljharb/side-channel#readme",
 	"dependencies": {
 		"es-errors": "^1.3.0",
-		"object-inspect": "^1.13.3",
-		"side-channel-list": "^1.0.0",
+		"object-inspect": "^1.13.4",
+		"side-channel-list": "^1.0.1",
 		"side-channel-map": "^1.0.1",
 		"side-channel-weakmap": "^1.0.2"
 	},
 	"devDependencies": {
-		"@arethetypeswrong/cli": "^0.17.1",
-		"@ljharb/eslint-config": "^21.1.1",
-		"@ljharb/tsconfig": "^0.2.2",
+		"@arethetypeswrong/cli": "^0.18.3",
+		"@ljharb/eslint-config": "^22.2.3",
+		"@ljharb/tsconfig": "^0.3.2",
 		"@types/object-inspect": "^1.13.0",
-		"@types/tape": "^5.6.5",
-		"auto-changelog": "^2.5.0",
+		"@types/tape": "^5.8.1",
+		"auto-changelog": "^2.6.0",
 		"eclint": "^2.8.1",
 		"encoding": "^0.1.13",
-		"eslint": "=8.8.0",
+		"eslint": "^8.57.1",
 		"in-publish": "^2.0.1",
-		"npmignore": "^0.3.1",
+		"npmignore": "^0.3.5",
 		"nyc": "^10.3.2",
 		"safe-publish-latest": "^2.0.0",
 		"tape": "^5.9.0",

package/node_modules/side-channel/test/index.js

@@ -28,6 +28,22 @@ test('getSideChannel', function (t) {
 		channel.set(o, 'data');
 		st.doesNotThrow(function () { channel.assert(o); }, 'existent value noops');
 
+		var accessed = false;
+		var trap = {};
+		Object.defineProperty(trap, 'foo', {
+			enumerable: true,
+			get: function () {
+				accessed = true;
+				return 1;
+			}
+		});
+		st['throws'](
+			function () { channel.assert(trap); },
+			TypeError,
+			'missing object key throws'
+		);
+		st.equal(accessed, false, 'a missing object key is not observably accessed');
+
 		st.end();
 	});
 

package/package.json

@@ -50,11 +50,11 @@
     "jest": "^27",
     "jest-junit": "^17",
     "jsii": "5.9.x",
-    "jsii-diff": "^1.132.0",
+    "jsii-diff": "^1.135.0",
     "jsii-docgen": "^10.5.0",
-    "jsii-pacmak": "^1.132.0",
+    "jsii-pacmak": "^1.135.0",
     "jsii-rosetta": "5.9.x",
-    "projen": "0.99.65",
+    "projen": "0.99.74",
     "ts-jest": "^27",
     "typescript": "^5"
   },
@@ -88,7 +88,7 @@
     "access": "public",
     "provenance": true
   },
-  "version": "2.1.54",
+  "version": "2.1.56",
   "jest": {
     "coverageProvider": "v8",
     "testMatch": [