Skip to content

chore(deps): npm: bump the all-npm group across 4 directories with 40 updates #716

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
+1,326 −1,021
Open

chore(deps): npm: bump the all-npm group across 4 directories with 40 updates #716

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions cdk/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,15 +33,15 @@
"@smithy/signature-v4": "^5.6.1",
"aws-cdk-lib": "^2.260.0",
"aws-jwt-verify": "^5.2.1",
"cdk-nag": "^2.38.2",
"cdk-nag": "^3.0.1",

@scottschreckengaust scottschreckengaust Aug 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Blocking (B3). cdk-nag 3.0.0 is an engine rewrite (IAspect -> IPolicyValidationPlugin), and this repo has not migrated.

Two concrete breaks, both verified against the published 3.0.1 tarball:

  1. NagSuppressions no longer exists. v3's lib/index.d.ts exports only nag-logger, nag-pack, nag-rules, the packs, and rules; NagSuppressions appears in no lib/**/*.d.ts. Its own MIGRATION.md lists it under "Removed APIs" -> Validations.of(construct).acknowledge(...). This repo has 21 import { NagSuppressions } from 'cdk-nag' sites and 50 NagSuppressions.add* calls across 22 files, and zero uses of Validations. //cdk:compile will fail with ~50+ errors — currently latent only because check:types-sync (B1) fails first.

  2. Registration silently no-ops. cdk/src/main.ts:32 uses Aspects.of(app).add(new AwsSolutionsChecks()). v3 requires Validations.of(app).addPlugins(new AwsSolutionsChecks(app)). The old form does not throw at synth — cdk-nag just stops evaluating, so the repo could ship with its security-rule engine silently disabled.

Also note v3 has no bulk-array suppression form, so each existing addResourceSuppressions([...]) fans out into N acknowledge() calls.

Suggested fix: revert to "cdk-nag": "^2.38.2" and file a dedicated approved issue for the v3 migration (all 50 call sites, main.ts registration, re-verification that every previously-suppressed rule is still acknowledged, plus writeSuppressionsToCloudFormation: true if the v2 cdk_nag template-metadata audit trail must be preserved).

"constructs": "^10.6.0",
"js-yaml": "^4.1.1",
"js-yaml": "^5.2.2",

@scottschreckengaust scottschreckengaust Aug 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Blocking (B4). This declaration is overridden and does not describe the installed tree.

  • here: "js-yaml": "^5.2.2"
  • root package.json:31 (unchanged by this PR): "resolutions": { "js-yaml": "^4.2.0" }
  • yarn.lock:5959 collapses everything into one v4 entry: js-yaml@^3.13.1, js-yaml@^4.1.1, js-yaml@^4.2.0, js-yaml@^4.3.0: version "4.3.1"

There is no js-yaml@5.x entry anywhere in the lockfile (grep js-yaml-5 yarn.lock is empty). So the manifest advertises v5 while 4.3.1 is installed, and this ^5.2.2 descriptor is not represented in the lock at all — actively misleading to the next reader, and liable to flip on any re-lock.

Separately, @types/js-yaml stays at ^4.0.9 (line 50), so if the resolution were ever lifted the typings would be a major behind the runtime.

FWIW the runtime risk is narrower than the major implies: v5's .d.ts is a rewritten tag/AST surface but load/dump survive, so the only consumers (cdk/test/handlers/shared/workflows.test.ts:160,180,244,278 and cdk/test/bootstrap/bootstrap-template.test.ts:29, all yaml.load) would likely still work. The blocker is the incoherence.

Suggested fix: revert to "^4.1.1" (or "^4.2.0" to match the resolution floor). A real v5 move must bump the root resolutions pin, @types/js-yaml, and the lockfile together in its own PR.

"pdf-parse": "2.4.5",
"ulid": "^3.0.2",
"ws": "^8.21.0"
},
"devDependencies": {
"@aws-cdk/integ-runner": "2.202.1",
"@aws-cdk/integ-runner": "2.203.2",
"@aws-cdk/integ-tests-alpha": "2.260.0-alpha.0",
"@cdklabs/eslint-plugin": "^2",
"@stylistic/eslint-plugin": "^5",
Expand All @@ -64,7 +64,7 @@
"jest-junit": "^17",
"ts-jest": "^29.4.11",
"ts-node": "^10.9.2",
"typescript": "^6.0.3"
"typescript": "^7.0.2"

@scottschreckengaust scottschreckengaust Aug 5, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Blocking (B1) — this is the live build (agentcore) failure.

TypeScript 7 is the native (Go) port and no longer ships the JS compiler API on the package main entry. From the published typescript@7.0.2 manifest, exports["."] is ./lib/version.cjs, whose entire contents are:

const { version } = require("../package.json");
exports.version = version;
exports.versionMajorMinor = "7.0";

So import * as ts from 'typescript' (scripts/check-types-sync.ts:47) yields an object with two properties, ts.ScriptTarget is undefined, and line 175 throws:

TypeError: Cannot read properties of undefined (reading 'Latest')
    at parseFile (scripts/check-types-sync.ts:175:76)

That is verbatim the CI failure. check:types-sync is in the drift-prevention DAG (mise.toml:118) that build depends on, so mise run build cannot pass. The script makes 44 ts.* compiler-API references — not a one-line fix.

Also (B2): TS 7.0.2 satisfies none of the declared peer ranges of the surrounding toolchain — @typescript-eslint/parser@8.65.0 and eslint-plugin@8.65.0 want >=4.8.4 <6.1.0, ts-jest@29.4.12 wants >=4.3 <7, @astrojs/check@0.9.10 wants ^5.0.0 || ^6.0.0. Yarn v1 only warns, so the type-aware ESLint rules would silently run against an unsupported compiler.

Suggested fix: revert to "^6.0.3" here and in cli/package.json:36 + docs/package.json:25. TS 7 needs its own approved issue (port the script to typescript/unstable/ast, or pin a separate typescript@6 just for it).

},
"resolutions": {},
"engines": {
Expand Down
18 changes: 9 additions & 9 deletions cli/package.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions docs/package.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions package.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading