[8.1.3] - 2026-10-29
Changed
- The CDK
BucketDeploymenthelper Lambda that copies the demo UI (Lambda) and admin UI (ECS) assets during stack create, update and delete now runs on arm64 with 1024 MB of memory (was x86_64 with 128 MB), following theaws-cdk-libdefaults. Existing stacks replace this function on their next update - ECS invalid content type errors now log the resolved origin URL
- ECS unsupported image type errors no longer log the userinfo or query string of the origin URL
Fixed
stripExif(and Thumborstrip_exif()) now removes EXIF, XMP and IPTC metadata, keeping only the ICC color profile and the orientation tag, on both Lambda and ECS. Image pixels and dimensions are unchanged, and the DITSoftwareEXIF tag is no longer added. Invalidate your CloudFront distribution to apply the fix to images already cached #636- ECS now applies the input pixel limit before checking a source image for transparency, so an oversized image is rejected without being decoded first
- The management API now rejects creating or renaming an origin, transformation policy or mapping to a name or pattern that is already in use. Names and patterns compare case-insensitively, path patterns also ignore leading, trailing and repeated slashes, and mapping names must be unique across path and host mappings. Previously these duplicates were accepted, and duplicate mapping patterns made request routing depend on load order. Existing duplicates are not changed and remain editable
- ECS stacks whose creation is cancelled or rolled back while the Admin UI CSP is being applied can now be deleted (previously the delete failed on
CSPUpdaterCustomResource) - ECS stacks whose Admin UI CloudFront distribution was already deleted outside CloudFormation can now be deleted
Security
- Lambda demo UI responses now send
X-Frame-Options: DENY, so other sites can no longer embed the demo UI in a frame - ECS now stops reading an origin image once it exceeds half of the task's memory, and rejects it up front when its declared size is already larger. The request returns a 502 instead of exhausting container memory. Origin files above that size could previously succeed when most of their bytes were not decoded (for example trailing padding or large embedded data) and now fail; use a larger DeploymentSize if you serve them. A watermark overlay gets whatever part of that limit the source image leaves
- Bump
aws-cdk-libto 2.273.0 to update its bundledbrace-expansioncopy to 5.0.12, mitigating CVE-2026-102276, CVE-2026-102277, and CVE-2026-102278 - Bump
handlebarsto 4.7.10 to mitigate CVE-2026-106444, CVE-2026-106445, and CVE-2026-106446 - Bump
viteto 6.4.5 to mitigate CVE-2026-112942, CVE-2026-112943, CVE-2026-112944, CVE-2026-112945, and CVE-2026-112946 - Bump
vitestto 4.1.12 to mitigate CVE-2026-112949 and CVE-2026-112950 - Bump
body-parserto 1.20.9 to mitigate CVE-2026-111181 - Bump
qsto 6.16.1 to mitigate CVE-2026-110816 - Bump
zodto 4.6.7 to mitigate CVE-2023-54404. The management API now also rejects transformation policies and origins whose lists exceed these limits, so one request can no longer make validation report an error for every list entry: 100 content moderation labels of at most 100 characters each, 2 smart crop priorities, 50 condition values, 20 autosize widths, 20 quality DPR rows, 3 output optimizations and 20 origin headers. A policy over 10 KB now reports only the size error. A URL edit with more than 100 moderation labels, a label over 100 characters or more than 2 smart crop priorities is ignored like any other invalid edit. Existing policies and origins are unchanged and keep serving images; a stored policy over a limit must be brought within it before it can be saved from the admin UI or updated through an API request that includespolicyJSON