From cba0601f0535a202079fa4469dcd7c2af2a192a7 Mon Sep 17 00:00:00 2001 From: Sanjay Shukla Date: Mon, 29 Jun 2026 14:34:43 -0700 Subject: [PATCH] chore(deps): upgrade aws-cdk-lib, cdk-nag, constructs in lockstep MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Supersedes the failing aws-cdk group bump (#5). Bumping aws-cdk-lib without cdk-nag made the installed cdk-nag type-incompatible; upgrade them together: - aws-cdk-lib ^2.202.0 -> ^2.260.0 - cdk-nag ^2.37.x -> ^2.38.2 (last v2; keeps the IAspect gate model) - constructs ^10.4.5 -> ^10.5.1 (required by cdk-nag 2.38.2) - aws-cdk CLI 2.1030.0 -> 2.1128.1 Stayed on cdk-nag v2 deliberately: v3 rewrites the engine from IAspect to a policy-validation plugin, which would rewrite the gate wiring and the test assertions — a separate, larger migration. Compliance gate still green (0 AwsSolutions findings). Snapshots re-baselined for benign upstream drift: the VPC flow-log role dropped an unnecessary iam:PassRole, and CDK custom-resource handlers moved nodejs22.x -> nodejs24.x. Co-Authored-By: Claude Opus 4.8 (1M context) --- package-lock.json | 153 +++++++++++++---------- package.json | 14 +-- test/__snapshots__/snapshot.test.ts.snap | 12 +- 3 files changed, 96 insertions(+), 83 deletions(-) diff --git a/package-lock.json b/package-lock.json index 56510d8..59692fd 100644 --- a/package-lock.json +++ b/package-lock.json @@ -12,39 +12,42 @@ "@biomejs/biome": "2.2.6", "@types/jest": "^29.5.14", "@types/node": "22.7.9", - "aws-cdk": "2.1030.0", - "aws-cdk-lib": "^2.202.0", - "cdk-nag": "^2.37.51", - "constructs": "^10.4.5", + "aws-cdk": "2.1128.1", + "aws-cdk-lib": "^2.260.0", + "cdk-nag": "^2.38.2", + "constructs": "^10.5.1", "jest": "^29.7.0", "ts-jest": "^29.2.5", "ts-node": "^10.9.2", "typescript": "~5.6.3" }, + "engines": { + "node": ">=18" + }, "peerDependencies": { - "aws-cdk-lib": "^2.202.0", - "cdk-nag": "^2.37.0", - "constructs": "^10.4.5" + "aws-cdk-lib": "^2.257.0", + "cdk-nag": "^2.38.2", + "constructs": "^10.5.1" } }, "node_modules/@aws-cdk/asset-awscli-v1": { - "version": "2.2.242", - "resolved": "https://registry.npmjs.org/@aws-cdk/asset-awscli-v1/-/asset-awscli-v1-2.2.242.tgz", - "integrity": "sha512-4c1bAy2ISzcdKXYS1k4HYZsNrgiwbiDzj36ybwFVxEWZXVAP0dimQTCaB9fxu7sWzEjw3d+eaw6Fon+QTfTIpQ==", + "version": "2.2.282", + "resolved": "https://registry.npmjs.org/@aws-cdk/asset-awscli-v1/-/asset-awscli-v1-2.2.282.tgz", + "integrity": "sha512-7hKMi5tTxDcKGIMIOq14PnY0GBcugW33Uh/2YHDZiEwSxLeFOCYBwhR+BFXONb/EJeVI3RETFgailNZbkcKF6g==", "dev": true, "license": "Apache-2.0" }, "node_modules/@aws-cdk/asset-node-proxy-agent-v6": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/@aws-cdk/asset-node-proxy-agent-v6/-/asset-node-proxy-agent-v6-2.1.0.tgz", - "integrity": "sha512-7bY3J8GCVxLupn/kNmpPc5VJz8grx+4RKfnnJiO1LG+uxkZfANZG3RMHhE+qQxxwkyQ9/MfPtTpf748UhR425A==", + "version": "2.1.2", + "resolved": "https://registry.npmjs.org/@aws-cdk/asset-node-proxy-agent-v6/-/asset-node-proxy-agent-v6-2.1.2.tgz", + "integrity": "sha512-pDiuqH+qY3zM9lhhLjbKJ1tnKOHzQ2V4Wr/3qsxyKeKAkuPMI/BVGvZG1PbrikUw949cGVTfVEt4ETKKYnrj0Q==", "dev": true, "license": "Apache-2.0" }, "node_modules/@aws-cdk/cloud-assembly-schema": { - "version": "48.15.0", - "resolved": "https://registry.npmjs.org/@aws-cdk/cloud-assembly-schema/-/cloud-assembly-schema-48.15.0.tgz", - "integrity": "sha512-hHs3Z5Nh0tUxHjk6myEv5mHqLuHnDcZlM19c01g1W75O24oBOiZjssRGIz/T0QOpxcY0Zu6mFrFCdwDWbZrc6A==", + "version": "54.5.0", + "resolved": "https://registry.npmjs.org/@aws-cdk/cloud-assembly-schema/-/cloud-assembly-schema-54.5.0.tgz", + "integrity": "sha512-X37oRfMQYO/wXBBDotbW8msJ6AgrcMio/W6TpDR/9To9TUWld1KtY/jveHpU58nZyLVPTYEhDgFP548w3JJGsQ==", "bundleDependencies": [ "jsonschema", "semver" @@ -52,15 +55,15 @@ "dev": true, "license": "Apache-2.0", "dependencies": { - "jsonschema": "~1.4.1", - "semver": "^7.7.2" + "jsonschema": "^1.5.0", + "semver": "^7.8.4" }, "engines": { "node": ">= 18.0.0" } }, "node_modules/@aws-cdk/cloud-assembly-schema/node_modules/jsonschema": { - "version": "1.4.1", + "version": "1.5.0", "dev": true, "inBundle": true, "license": "MIT", @@ -69,7 +72,7 @@ } }, "node_modules/@aws-cdk/cloud-assembly-schema/node_modules/semver": { - "version": "7.7.2", + "version": "7.8.4", "dev": true, "inBundle": true, "license": "ISC", @@ -1414,9 +1417,9 @@ } }, "node_modules/aws-cdk": { - "version": "2.1030.0", - "resolved": "https://registry.npmjs.org/aws-cdk/-/aws-cdk-2.1030.0.tgz", - "integrity": "sha512-jYgOy1Hqx8cOTWW9On9xpypXLecjOqSZ4X2q5U0Gzd14xI+HLmpaRJV5ILJ8vYrLKVbqjhiog0pdxAC7vwF9uQ==", + "version": "2.1128.1", + "resolved": "https://registry.npmjs.org/aws-cdk/-/aws-cdk-2.1128.1.tgz", + "integrity": "sha512-y9OHn5/BOcIiq409vPvpypMIr7/8M1ScFe8IkFMSCN1/GI/5c73fQ4pfzNq+VDkj86T5zxs7BQ1qU2lQQytdXA==", "dev": true, "license": "Apache-2.0", "bin": { @@ -1424,17 +1427,15 @@ }, "engines": { "node": ">= 18.0.0" - }, - "optionalDependencies": { - "fsevents": "2.3.2" } }, "node_modules/aws-cdk-lib": { - "version": "2.220.0", - "resolved": "https://registry.npmjs.org/aws-cdk-lib/-/aws-cdk-lib-2.220.0.tgz", - "integrity": "sha512-mOEyPP1ymWiLnSE0xFxWjG00E1DQ5wtbcgKUmtGjxyNdoG/Qret1nDLqE43YGZEbwca43WO/a2LDuSL6+hN7Lg==", + "version": "2.260.0", + "resolved": "https://registry.npmjs.org/aws-cdk-lib/-/aws-cdk-lib-2.260.0.tgz", + "integrity": "sha512-2PPG+hbPDot8+ibkb5Jl9y3OY5rBE6TFwjzOi+yEyU4ZG6u8bM4DDKhhBi/S20NqqSFDso9rH1txVJAdwXNiuQ==", "bundleDependencies": [ "@balena/dockerignore", + "@aws-cdk/cloud-assembly-api", "case", "fs-extra", "ignore", @@ -1449,26 +1450,43 @@ "dev": true, "license": "Apache-2.0", "dependencies": { - "@aws-cdk/asset-awscli-v1": "2.2.242", - "@aws-cdk/asset-node-proxy-agent-v6": "^2.1.0", - "@aws-cdk/cloud-assembly-schema": "^48.6.0", + "@aws-cdk/asset-awscli-v1": "2.2.282", + "@aws-cdk/asset-node-proxy-agent-v6": "^2.1.2", + "@aws-cdk/cloud-assembly-api": "^2.2.5", + "@aws-cdk/cloud-assembly-schema": "^54.0.0", "@balena/dockerignore": "^1.0.2", "case": "1.6.3", - "fs-extra": "^11.3.1", + "fs-extra": "^11.3.5", "ignore": "^5.3.2", "jsonschema": "^1.5.0", "mime-types": "^2.1.35", - "minimatch": "^3.1.2", + "minimatch": "^10.2.5", "punycode": "^2.3.1", - "semver": "^7.7.2", + "semver": "^7.8.1", "table": "^6.9.0", - "yaml": "1.10.2" + "yaml": "1.10.3" + }, + "engines": { + "node": ">= 20.0.0" + }, + "peerDependencies": { + "constructs": "^10.5.0" + } + }, + "node_modules/aws-cdk-lib/node_modules/@aws-cdk/cloud-assembly-api": { + "version": "2.2.5", + "dev": true, + "inBundle": true, + "license": "Apache-2.0", + "dependencies": { + "jsonschema": "^1.5.0", + "semver": "^7.8.0" }, "engines": { "node": ">= 18.0.0" }, "peerDependencies": { - "constructs": "^10.0.0" + "@aws-cdk/cloud-assembly-schema": ">=53.28.0" } }, "node_modules/aws-cdk-lib/node_modules/@balena/dockerignore": { @@ -1478,7 +1496,7 @@ "license": "Apache-2.0" }, "node_modules/aws-cdk-lib/node_modules/ajv": { - "version": "8.17.1", + "version": "8.20.0", "dev": true, "inBundle": true, "license": "MIT", @@ -1527,19 +1545,24 @@ } }, "node_modules/aws-cdk-lib/node_modules/balanced-match": { - "version": "1.0.2", + "version": "4.0.4", "dev": true, "inBundle": true, - "license": "MIT" + "license": "MIT", + "engines": { + "node": "18 || 20 || >=22" + } }, "node_modules/aws-cdk-lib/node_modules/brace-expansion": { - "version": "1.1.12", + "version": "5.0.6", "dev": true, "inBundle": true, "license": "MIT", "dependencies": { - "balanced-match": "^1.0.0", - "concat-map": "0.0.1" + "balanced-match": "^4.0.2" + }, + "engines": { + "node": "18 || 20 || >=22" } }, "node_modules/aws-cdk-lib/node_modules/case": { @@ -1569,12 +1592,6 @@ "inBundle": true, "license": "MIT" }, - "node_modules/aws-cdk-lib/node_modules/concat-map": { - "version": "0.0.1", - "dev": true, - "inBundle": true, - "license": "MIT" - }, "node_modules/aws-cdk-lib/node_modules/emoji-regex": { "version": "8.0.0", "dev": true, @@ -1588,7 +1605,7 @@ "license": "MIT" }, "node_modules/aws-cdk-lib/node_modules/fast-uri": { - "version": "3.1.0", + "version": "3.1.2", "dev": true, "funding": [ { @@ -1604,7 +1621,7 @@ "license": "BSD-3-Clause" }, "node_modules/aws-cdk-lib/node_modules/fs-extra": { - "version": "11.3.1", + "version": "11.3.5", "dev": true, "inBundle": true, "license": "MIT", @@ -1648,7 +1665,7 @@ "license": "MIT" }, "node_modules/aws-cdk-lib/node_modules/jsonfile": { - "version": "6.2.0", + "version": "6.2.1", "dev": true, "inBundle": true, "license": "MIT", @@ -1696,15 +1713,18 @@ } }, "node_modules/aws-cdk-lib/node_modules/minimatch": { - "version": "3.1.2", + "version": "10.2.5", "dev": true, "inBundle": true, - "license": "ISC", + "license": "BlueOak-1.0.0", "dependencies": { - "brace-expansion": "^1.1.7" + "brace-expansion": "^5.0.5" }, "engines": { - "node": "*" + "node": "18 || 20 || >=22" + }, + "funding": { + "url": "https://github.com/sponsors/isaacs" } }, "node_modules/aws-cdk-lib/node_modules/punycode": { @@ -1726,7 +1746,7 @@ } }, "node_modules/aws-cdk-lib/node_modules/semver": { - "version": "7.7.2", + "version": "7.8.1", "dev": true, "inBundle": true, "license": "ISC", @@ -1806,7 +1826,7 @@ } }, "node_modules/aws-cdk-lib/node_modules/yaml": { - "version": "1.10.2", + "version": "1.10.3", "dev": true, "inBundle": true, "license": "ISC", @@ -2077,14 +2097,17 @@ "license": "CC-BY-4.0" }, "node_modules/cdk-nag": { - "version": "2.37.55", - "resolved": "https://registry.npmjs.org/cdk-nag/-/cdk-nag-2.37.55.tgz", - "integrity": "sha512-xcAkygwbph3pp7N0UEzJBmXUH/MIsluV7DYJSeZ/V3yCr0Y0QaRGO298WyD6mi4K+Rmnpl+EJoWUxcOblOqLKA==", + "version": "2.38.2", + "resolved": "https://registry.npmjs.org/cdk-nag/-/cdk-nag-2.38.2.tgz", + "integrity": "sha512-Ddim1r8IwAPQn95KB2owbHoU4YHveHg4PfM+k7TdcANqfVmoHem6cTFMpcIuoDM16BkQQ+xshxYxZgcAoeVKGw==", "dev": true, "license": "Apache-2.0", + "engines": { + "node": ">= 18.12.0" + }, "peerDependencies": { "aws-cdk-lib": "^2.176.0", - "constructs": "^10.0.5" + "constructs": "^10.5.1" } }, "node_modules/chalk": { @@ -2198,9 +2221,9 @@ "license": "MIT" }, "node_modules/constructs": { - "version": "10.4.5", - "resolved": "https://registry.npmjs.org/constructs/-/constructs-10.4.5.tgz", - "integrity": "sha512-fOoP70YLevMZr5avJHx2DU3LNYmC6wM8OwdrNewMZou1kZnPGOeVzBrRjZNgFDHUlulYUjkpFRSpTE3D+n+ZSg==", + "version": "10.6.0", + "resolved": "https://registry.npmjs.org/constructs/-/constructs-10.6.0.tgz", + "integrity": "sha512-TxHOnBO5zMo/G76ykzGF/wMpEHu257TbWiIxP9K0Yv/+t70UzgBQiTqjkAsWOPC6jW91DzJI0+ehQV6xDRNBuQ==", "dev": true, "license": "Apache-2.0" }, diff --git a/package.json b/package.json index 63cfae4..e7c7576 100644 --- a/package.json +++ b/package.json @@ -51,18 +51,18 @@ "prepublishOnly": "npm run build" }, "peerDependencies": { - "aws-cdk-lib": "^2.202.0", - "cdk-nag": "^2.37.0", - "constructs": "^10.4.5" + "aws-cdk-lib": "^2.257.0", + "cdk-nag": "^2.38.2", + "constructs": "^10.5.1" }, "devDependencies": { "@biomejs/biome": "2.2.6", "@types/jest": "^29.5.14", "@types/node": "22.7.9", - "aws-cdk": "2.1030.0", - "aws-cdk-lib": "^2.202.0", - "cdk-nag": "^2.37.51", - "constructs": "^10.4.5", + "aws-cdk": "2.1128.1", + "aws-cdk-lib": "^2.260.0", + "cdk-nag": "^2.38.2", + "constructs": "^10.5.1", "jest": "^29.7.0", "ts-jest": "^29.2.5", "ts-node": "^10.9.2", diff --git a/test/__snapshots__/snapshot.test.ts.snap b/test/__snapshots__/snapshot.test.ts.snap index 8b0dacc..43e94bf 100644 --- a/test/__snapshots__/snapshot.test.ts.snap +++ b/test/__snapshots__/snapshot.test.ts.snap @@ -1389,16 +1389,6 @@ exports[`example stage CloudFormation snapshots test-network matches snapshot 1` ], }, }, - { - "Action": "iam:PassRole", - "Effect": "Allow", - "Resource": { - "Fn::GetAtt": [ - "compliantvpccloudwatchflowlogIAMRole45E9009F", - "Arn", - ], - }, - }, ], "Version": "2012-10-17", }, @@ -1797,7 +1787,7 @@ exports[`example stage CloudFormation snapshots test-storage matches snapshot 1` "Arn", ], }, - "Runtime": "nodejs22.x", + "Runtime": "nodejs24.x", "Timeout": 900, }, "Type": "AWS::Lambda::Function",