# What changed in aws-cdk-lib

> 3 changes in aws-cdk-lib 2 from its official release notes, upgrade guides and advisories: 3 security. Each one cited. Sources checked 2026-10-25. HTML: https://unstale.sh/npm/aws-cdk-lib/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## aws-cdk-lib 2

### Security

- aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling (2.260.0) — [security advisory](https://github.com/advisories/GHSA-VCRF-J523-4MRF)
- AWS CDK CodeBuild S3 Log Encryption Boolean Inversion (2.253.0) — [security advisory](https://github.com/advisories/GHSA-464C-974J-9XM6)
- aws-cdk-lib: OS Command Injection in NodejsFunction Bundling (2.246.0) — [security advisory](https://github.com/advisories/GHSA-999R-QQ7V-R334)