feat: update dependencies

[nx-plugin-for-aws]

Dependency Updates

Raised by hand because the weekly Update Versions run failed before it could open a PR. The script fix for that failure is separate, in #1143 — this PR is only the version bumps, so it can land independently.

Produced by running the workflow's own sequence locally (npm-check-updates → backfill-migration-versions → update-versions → nx test nx-plugin -u → lint → generate-3p-license → lint-staged).

TypeScript Dependencies

• @aws-sdk/* 3.1116.0 -> 3.1119.0 (dynamodb, api-gateway, iam, bedrock-agentcore, bedrock-runtime, s3, sts, credential-providers, secrets-manager, rds-signer, appconfigdata)
• @modelcontextprotocol/inspector 2.3.0 -> 2.4.0
• @copilotkit/react-core 1.69.0 -> 1.69.2
• @tanstack/react-router 1.170.31 -> 1.170.32
• @tanstack/router-plugin 1.168.34 -> 1.168.35
• @tanstack/router-generator 1.167.32 -> 1.167.33
• @cloudscape-design/components 3.0.1352 -> 3.0.1354
• @tanstack/react-query, @tanstack/react-query-devtools 5.102.0 -> 5.102.6
• @types/node 26.2.0 -> 26.4.0
• @astrojs/starlight 0.41.7 -> 0.41.9
• astro 7.2.4 -> 7.2.8
• aws-cdk 2.1138.0 -> 2.1139.0
• @prisma/adapter-mariadb, @prisma/adapter-pg, @prisma/client, prisma 7.9.1 -> 7.10.0
• mise 2026.8.10 -> 2026.8.14
• npm-check-updates 23.0.2 -> 23.1.0
• rolldown 1.2.5 -> 1.2.6
• lucide-react 1.33.0 -> 1.34.0

Python Dependencies

• ag-ui-langgraph ==0.0.43 -> ==0.0.44
• ag-ui-protocol ==0.1.20 -> ==0.1.21
• boto3 ==1.43.78 -> ==1.43.82
• checkov ==3.3.13 -> ==3.3.15
• langchain ==1.3.16 -> ==1.3.18
• langchain-aws ==1.7.3 -> ==1.7.4
• strands-agents, strands-agents[a2a] ==1.53.0 -> ==1.54.0
• ty ==0.0.74 -> ==0.0.75

Terraform Providers

• aws 6.61.0 -> 6.62.0

Java Dependencies

• software.amazon.smithy.typescript:smithy-aws-typescript-codegen 0.52.0 -> 0.53.0

Held back

Each hold was re-checked against current upstream metadata rather than carried over blindly — .ncurc.cjs's reject is empty, so npm-check-updates re-proposes these every week.

Package	Held at	Available	Why
nx, @nx/devkit, @nx/js, @nx/react, @nx/vite, @nx/vitest, @nx/workspace, create-nx-workspace	23.1.1	23.1.2	@nx/react 23.1.2 adds an express: ^4.21.2 peer that 23.1.1 did not declare, which cannot be satisfied alongside the vended express 5.2.1 (@strands-agents/sdk peers on express: ^5.1.0). npm fails the install outright — details below.
@ag-ui/client, @ag-ui/core, @ag-ui/encoder	0.0.57	0.0.58	@copilotkit/react-core 1.69.2 still depends on @ag-ui/core and @ag-ui/client at exactly 0.0.57. Any other version installs a second copy and generated websites fail to compile, because the AbstractAgent passed to CopilotKitProvider comes from a different module instance than the prop is typed against (see #1110).
agent-chat-cli	0.3.0	0.4.0	0.4.0 still depends on @a2a-js/sdk ^1.0.1, while the generated A2A server is on the pinned @a2a-js/sdk 0.3.14. The 1.x client calls SendStreamingMessage, which the 0.3.x server does not implement, so the generated chat target dies on the first message (see #1110). Bump together with @a2a-js/sdk.
ruff	==0.16.4	==0.16.5	Must match the ruff @astral-sh/ruff-wasm-nodejs is built from, which npm-check-updates is still holding at 0.16.4 under its cooldown. This mismatch is what broke the workflow run; #1143 makes the script apply this hold automatically.

cookie stays at 2.0.1, which still satisfies astro 7.2.8's ^2.0.1 — no change needed there.

The nx hold

The nx bump was taken first and broke Smoke Tests - npm:

npm error ERESOLVE could not resolve
npm error Found: express@4.22.2
npm error   peerOptional express@"^4.21.2" from @nx/react@23.1.2
npm error Conflicting peer dependency: express@5.2.1
npm error   peerOptional express@"^5.1.0" from @strands-agents/sdk@1.14.0

@nx/react gained express, @nx/module-federation and http-proxy-middleware peers in 23.1.2:

$ npm view @nx/react@23.1.1 peerDependencies   # react, react-dom, babel-plugin-react-compiler
$ npm view @nx/react@23.1.2 peerDependencies   # ...plus express ^4.21.2, @nx/module-federation, http-proxy-middleware

pnpm and bun stayed green because neither fails an install on an unsatisfiable optional peer; npm does. 23.1.2 is the latest release, so there is nothing to move forward to. All of NX_PACKAGES is held together, since they must share a version — a workspace nx even a patch apart hoists a second nested nx and the two deadlock nx sync. The nx-23.1.2-nx-packages packageJsonUpdates entry is dropped too, so no existing workspace is migrated onto a version it then cannot install.

Description of how you validated changes

• pnpm nx test nx-plugin -u — 3926 tests pass across 217 files.
• pnpm lint passes; pnpm nx generate-3p-license nx-plugin regenerated LICENSE-THIRD-PARTY.
• Reproduced the npm conflict in isolation, minimally: a package.json with express@5.2.1 + @strands-agents/sdk@1.14.0 + @nx/react resolves cleanly on 23.1.1 and fails ERESOLVE on 23.1.2. This confirms the nx peer change is the cause rather than something else in the bump.
• Verified upstream metadata for each held package (npm view @copilotkit/react-core@1.69.2 dependencies, npm view agent-chat-cli@0.4.0 dependencies, npm view astro@7.2.8 dependencies) to confirm the holds are still required and that cookie is not.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.51%. Comparing base (f02dc86) to head (f5c1919).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1145   +/-   ##
=======================================
  Coverage   88.51%   88.51%           
=======================================
  Files         245      245           
  Lines       10464    10464           
  Branches     2476     2476           
=======================================
  Hits         9262     9262           
  Misses        524      524           
  Partials      678      678           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.