Skip to content

chore(deps): npm: bump the all-npm group across 4 directories with 44 updates #838

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 2 commits into
base: main
Choose a base branch
from
Open

chore(deps): npm: bump the all-npm group across 4 directories with 44 updates #838

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8938a7d
chore(deps): npm: bump the all-npm group across 4 directories with 44…
dependabot[bot] Sep 1, 2026
0ee449d
Merge branch 'main' into dependabot/npm_and_yarn/all-npm-ad163dcf0a
isadeks Sep 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions cdk/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,15 +37,15 @@
"@smithy/signature-v4": "^5.6.1",
"aws-cdk-lib": "^2.260.0",
"aws-jwt-verify": "^5.2.1",
"cdk-nag": "^2.38.2",
"cdk-nag": "^3.0.2",

@scottschreckengaust scottschreckengaust Sep 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Blocking (B1). cdk-nag 3.x is not API-compatible with this repo on aws-cdk-lib 2.x. CI on this head (//cdk:compile) reports 27 errors: Module '"cdk-nag"' has no exported member 'NagSuppressions' across 26 files, plus src/main.ts(66,23): error TS2741: Property 'visit' is missing in type 'AwsSolutionsChecks' but required in type 'IAspect'.

Static scope check: 86 NagSuppressions call sites across 47 cdk-nag imports in cdk/src + cdk/test. The IAspect/visit mismatch suggests cdk-nag 3 targets a newer CDK aspect API (inference, unverified) — so this is not a mechanical rename.

Suggested fix: revert to "cdk-nag": "^2.38.2" and add a major ignore to .github/dependabot.yml mirroring the existing Cedar stanza:

      - dependency-name: "cdk-nag"
        update-types: ["version-update:semver-major"]

Then land the 2→3 migration behind its own tracked issue.

"constructs": "^10.6.0",
"js-yaml": "^4.1.1",
"js-yaml": "^5.3.0",

@scottschreckengaust scottschreckengaust Sep 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Blocking (B3). This bump is inert, and it makes the manifest wrong.

Root package.json:30 resolutions pins "js-yaml": "^4.3.1", and yarn v1 resolutions apply tree-wide including workspace direct deps. yarn.lock on this head contains no js-yaml@^5.x descriptor at all — only js-yaml@^3.13.1, js-yaml@^4.1.1, js-yaml@^4.3.0, js-yaml@^4.3.1: version "4.3.2". (The surviving ^4.1.1 is requested by @astrojs/internal-helpers / @astrojs/starlight / xmlbuilder2, not by cdk/.) So the installed version is 4.3.2 while this line advertises 5.

Three consequences:

  1. The manifest misleads anyone reasoning about js-yaml's API surface here.
  2. The next lockfile-only OSV re-resolve that touches that pin (cf. fix(deps): re-resolve browserslist to clear two HIGH OSV advisories (#845) #844, fix(deps): bump astro to 7.1.3 + re-resolve brace-expansion to clear osv-scanner (#636) #637) silently lands js-yaml 5's breaking API on cdk/src/handlers/shared/registry/agent-registry-client.ts:45 and cdk/scripts/generate-bootstrap-template.ts:32 — the latter generates the committed bootstrap IAM artifacts.
  3. @types/js-yaml two lines below is still ^4.0.9.

Suggested fix: revert to ^4.1.1 (or set ^4.3.1 to match the resolution floor). A genuine v5 upgrade needs its own PR moving the manifest, the root resolutions floor, and @types/js-yaml together.

"pdf-parse": "2.4.5",
"ulid": "^3.0.2",
"ws": "^8.21.0"
},
"devDependencies": {
"@aws-cdk/integ-runner": "2.202.1",
"@aws-cdk/integ-runner": "2.204.5",
"@aws-cdk/integ-tests-alpha": "2.260.0-alpha.0",
"@cdklabs/eslint-plugin": "^2",
"@stylistic/eslint-plugin": "^5",
Expand All @@ -62,13 +62,13 @@
"eslint-import-resolver-typescript": "^4",
"eslint-plugin-import-x": "^4",
"eslint-plugin-jest": "^29.15.4",
"eslint-plugin-jsdoc": "^63.0.10",
"eslint-plugin-jsdoc": "^64.2.1",
"eslint-plugin-license-header": "^0.9.0",
"jest": "^30.4.2",
"jest-junit": "^17",
"ts-jest": "^29.4.11",
"ts-node": "^10.9.2",
"typescript": "^6.0.3"
"typescript": "^7.0.2"

@scottschreckengaust scottschreckengaust Sep 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Blocking (B2) — same for cli/package.json:36 and docs/package.json:25.

typescript@^7.0.2 resolves to the native/platform-binary distribution (yarn.lock optionalDeps: @typescript/typescript-linux-arm64 7.0.2, -darwin-arm64, …), whose JS compiler-API surface differs from TS 6's. CI on this head:

[//:check:types-sync] TypeError: Cannot read properties of undefined (reading 'Latest')
    at parseFile (scripts/check-types-sync.ts:175:76)

That is the drift-prevention guard keeping cdk/src/handlers/shared/types.ts in sync with cli/src/types.ts, and it now dies on ts.ScriptTarget being undefined.

The build aborted at 2.1s, so the other TS-API consumers are unverified but at risk: ts-jest ^29.4.11 (drives //cdk:test / //cli:test; peer range historically >=4.3 <6), typescript-eslint via @cdklabs/eslint-plugin, and @astrojs/check + volar-service-typescript for the docs typecheck.

Suggested fix: keep ^6.0.3 in all three manifests, add a typescript major ignore to .github/dependabot.yml, and file a tracked migration issue in the shape of #169 (ESLint 9→10) — which must also update AGENTS.md:76 (**TypeScript** 6.x).

},
"resolutions": {},
"engines": {
Expand Down
20 changes: 10 additions & 10 deletions cli/package.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions docs/package.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading