cli: cdk init does not generate package.json with the latest aws-cdk-lib

[tmokmss]

Describe the bug

Hi, I noticed the package.json generated by the latest CDK CLI uses some old aws-cdk-lib version.

  "devDependencies": {
    "@types/jest": "^29.5.14",
    "@types/node": "22.7.9",
    "aws-cdk": "2.1031.1",
    // ...
  },
  "dependencies": {
    "aws-cdk-lib": "2.215.0",  // the latest is 2.221.1 at the moment
    "constructs": "^10.0.0",

Is it an expected behavior? I feel it should be the latest aws-cdk-lib version.

In addition, it specifies a pinned version (e.g. "2.215.0"), making it impossible to update it with single npm update command.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Library Version

No response

Expected Behavior

A project generated by cdk init with the latest CDK CLI uses the latest supported aws-cdk-lib version.

Current Behavior

It uses some old aws-cdk-lib version.

Reproduction Steps

Run npx cdk@latest init --language=typescript.

Possible Solution

As far as I understand, a aws-cdk package version has a range of supported aws-cdk-lib versions (ref). It should point to the latest supported version by default.

Additional Information/Context

No response

AWS CDK Library version (aws-cdk-lib)

N/A

AWS CDK CLI version

2.1031.1

Node.js Version

22

OS

macOS

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

Hi @tmokmss,

Thank you for bringing this to our attention. This appears to be a valid concern regarding how cdk init generates the package.json file with aws-cdk-lib dependencies.

You're correct that the generated project uses an outdated version of aws-cdk-lib. The init templates currently contain static version numbers that aren't automatically updated when new library versions are released. Since the CLI and library are now decoupled (as mentioned in the blog post), the init command should ideally resolve to the latest compatible aws-cdk-lib version dynamically.

Regarding the pinned version format, this is intentional to ensure reproducible builds, but it does prevent npm update from working. A potential improvement would be to use caret ranges (e.g., "^2.221.1") to allow minor and patch updates while maintaining compatibility.

Workaround: After running cdk init, you can manually update the aws-cdk-lib version in your package.json to the latest version and run npm install.

Requesting the maintainer for review and inputs.

[rix0rrr]

Like Pahud said, should have added ^, we need to check the update workflow.

[mrgrain]

To summarise, we should do the following:

• change init templates to include caret ^
• pull aws-cdk-lib updates out into their own update workflow that runs more often and is independent of other updates so it is less likely to be blocked