SST 2.49.8

Last reviewed Oct 11, 2026

Export as PDF

Prompt Details

Prompt Composition

4prompts
  1. JavaScript ES2026102 lines · 3.1K tokens
  2. Node.js 22114 lines · 3.7K tokens
  3. TypeScript 5.940 lines · 1.2K tokens
  4. SST 2.49.8143 lines · 7.1K tokens
Total399 lines · 15.2K tokens

CWE Coverage

  • 15
  • 20
  • 22
  • 59
  • 73
  • 78
  • 79
  • 89
  • 95
  • 113
  • 117
  • 200
  • 201
  • 208
  • 209
  • 214
  • 250
  • 294
  • 295
  • 297
  • 306
  • 307
  • 312
  • 319
  • 323
  • 327
  • 338
  • 345
  • 346
  • 347
  • 352
  • 354
  • 362
  • 367
  • 377
  • 426
  • 444
  • 459
  • 471
  • 488
  • 494
  • 502
  • 522
  • 524
  • 532
  • 552
  • 601
  • 602
  • 613
  • 639
  • 653
  • 732
  • 770
  • 778
  • 807
  • 829
  • 838
  • 862
  • 863
  • 908
  • 915
  • 916
  • 918
  • 922
  • 942
  • 943
  • 1004
  • 1321
  • 1333
  • 1385

Prompt Preview

Apply the Node.js 22 and TypeScript 5.9 prompts first. These rules cover SST v2.49.8. Apply operating-system process controls from the baseline where you control the process; use Lambda configuration and IAM for AWS-managed execution.

Version, runtimes, and dependency exposure

  • Lock sst in the lockfile and upgrade it only within v2, using the two dist-tag to find v2 releases; keep v2's CDK, resource binding, and stage model separate from newer SST component and linking APIs.
  • Run builds and the CLI on a patched Node.js 22 installation and test the locked toolchain there; this SST package declares no Node.js engines range. Set Function.runtime: "nodejs22.x" explicitly, which matches this release's default; selecting nodejs24.x requires the Node.js 24 baseline and compatibility tests for bundles, layers, and extensions.
  • Check every synthesized Lambda runtime, including custom resources, SSR functions, edge functions, and job helpers. A supported Function runtime does not update hard-coded helper runtimes, and accepting a runtime string does not establish AWS support in the deployment region.
  • Audit the resolved deployment and runtime dependency graphs: SST 2.49.8 declares exact aws-cdk-lib and esbuild dependencies (2.224.0 and 0.18.13), which updating other packages never moves, while several others use ranges or wildcards. A lockfile makes versions reproducible but doesn't fix their advisories; use a compatibility-tested patched toolchain or keep the affected feature from running in production.
  • If a stack uses CDK NodejsFunction, keep