fix(security): bump aws-cdk-lib to 2.260.0 (resolves OS command injection alerts #219-224)

[osama-rizk]

Problem

Six open Dependabot alerts (#219–#224, all high severity) for aws-cdk-lib — OS Command Injection in NodejsFunction (Docker/esbuild bundling path), fixed in 2.260.0. The vulnerable 2.257.0 is pinned as a devDependency in all five packages/e2e-tests/* workspaces.

Issue number, if available: Dependabot alerts #219, #220, #221, #222, #223, #224

Changes

• aws-cdk-lib 2.257.0 → 2.260.0 in all five e2e-test manifests: node, sandbox, vite, webpack, exports-test.
• Regenerated yarn.lock (Yarn 4) — picks up the transitive updates 2.260.0 requires: @aws-cdk/asset-awscli-v1 2.2.273 → 2.2.282, @aws-cdk/cloud-assembly-api → 2.3.0 (adds json-source-map), and a widened semver range.
• Empty changeset (no release): only private e2e-tests devDependencies changed; no published package's source, runtime deps, or public API is affected.

This supersedes the two stalled Dependabot PRs: #758 (updated only exports-test/package.json without the lockfile, so CI's immutable install failed with "The lockfile would have been modified by this install, which is explicitly forbidden"), and #760 (equivalent full change). Consolidates all six alerts into one PR with a correctly regenerated lockfile.

Validation

Ran locally with aws-cdk-lib@2.260.0 installed:

• yarn install — clean, lockfile immutable-safe (no "would be modified" error, which is exactly what chore(deps-dev): bump aws-cdk-lib from 2.257.0 to 2.260.0 in /packages/e2e-tests/exports-test #758 hit).
• yarn build — all packages build, including the vite/webpack e2e bundles. ✅
• yarn turbo run test --filter='!./packages/e2e-tests/*' — 556 passed / 9 skipped, 118 snapshots. ✅
• yarn e2e-exports (fresh install + rollup ESM/CJS build + declaration check) — passes. ✅

No source in the repo imports aws-cdk-lib directly; CDK is only reached transitively via @aws-amplify/backend's defineBackend (peer range aws-cdk-lib@^2.234.1, which 2.260.0 satisfies). The deploy-based e2e tests (node, sandbox) require AWS credentials and run in the repo's own e2e workflows rather than locally.

Checklist

• PR description included
• Changeset added (empty — no release)
• Deploy-based e2e workflows (node/sandbox) run in CI

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[changeset-bot]

🦋 Changeset detected

Latest commit: bfe182b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR