chore(deps): clear 24 Dependabot alerts across aws/cdk, docs, examples

[kylehounslow]

What

Clears 24 open Dependabot alerts across four manifests, plus a Dependabot coverage-gap fix. One commit per manifest group, all DCO-signed.

Alerts cleared (24)

aws/cdk (fix(aws/cdk))

• aws-cdk-lib -> ^2.262.1: drops the vulnerable fast-uri transitive out of the tree entirely (chore(deps): bump js-yaml from 4.1.1 to 4.3.0 in /docs/starlight-docs #319, chore(release): bump CLI to 0.2.0 for GA #321)
• esbuild override ^0.28.1: GHSA-67mh-4wv8-2f99 (Add Astronomy Shop dashboard to init flow #180, range >=0.27.3 <0.28.1)

docs (fix(docs))

• sharp override ^0.35.0 (resolves 0.35.3): GHSA-f88m-g3jw-g9cj (chore(deps): bump mcp from 1.26.0 to 1.28.1 in /examples/agent-evals/genai-sdk #324, range <0.35.0). astro is already 7.x on main; no other docs deps changed.

docs/starlight-docs (fix(docs/starlight-docs))

• astro ^6.4.8: GHSA-2pvr-wf23-7pc7, GHSA-jrpj-wcv7-9fh9 (Add PPL for SPL Users guide #207, feat: add insecure option for Prometheus remote write #208)
• overrides: sharp 0.35.3 (chore(deps): bump astro from 6.3.7 to 7.1.0 in /docs #327), svgo 4.0.2 (chore(deps): update dependency astro to v6.4.6 - autoclosed #326), postcss 8.5.24 ([FEATURE] Support Optimized Engine (AWS Deploy) #332), vite 7.3.6 (Add PPL for DQL/Lucene Users guide and fix playground links #198, chore(deps): bump @astrojs/react in /docs #199), esbuild 0.28.1 (Switch to prod docker images for OpenSearch, Dashboards, and Data Prepper #179)

examples (fix(examples), 3 sample apps)

• starlette >=1.3.1 (bump cli to v0.1.1 and fix npm #176, chore(deps): update dependency astro to v6 - autoclosed #222, docs: Update architecture diagram image #223, chore(deps): bump python-multipart from 0.0.22 to 0.0.27 in /examples/strands/code-assistant #228, chore(deps): bump python-multipart from 0.0.22 to 0.0.27 in /examples/agent-evals/genai-sdk #229, chore(deps): bump fast-xml-builder from 1.1.4 to 1.2.0 in /aws/cli-installer #231, Feat/splunk distribution poc #232, chore(deps): bump langchain-core from 1.2.28 to 1.3.3 in /examples/langchain/bedrock-financial-assistant #233, [deps] Upgrade Data Prepper version from 2.15.0-SNAPSHOT-rc2 to 2.15.1 #234)
• idna >=3.15 (resolves 3.18) (chore(deps): bump vite from 6.4.1 to 6.4.2 in /docs/starlight-docs #164, Add APM setup and telemetry ingestion docs  #165, Fix spans-per-trace slider not affecting storage calculations #169)

Coverage gap (chore(deps))

.github/dependabot.yml: add aws/cdk, aws/cli-installer, examples/agent-evals/genai-sdk, docker-compose/agent-eval-canary. These manifests held open alerts with no bot PR.

Validation

• aws/cdk: tsc --noEmit clean; fast-uri absent from lockfile; esbuild 0.28.1
• docs: 557/557 vitest, 135-page build, links validator clean; sharp 0.35.3
• docs/starlight-docs: 135-page build, links validator clean; astro 6.4.8, vite 7.3.6, all overrides applied
• examples: all 3 uv lock --check pass; idna 3.18, starlette 1.3.1 in every lock

Vulnerable ranges confirmed absent from each regenerated lockfile, not from a green Dependabot check.

Deferred (5)

• brace-expansion starlight-0.38.5.tgz: 3 vulnerabilities (highest severity is: 7.5) #278, chore(deps): bump pillow from 12.2.0 to 12.3.0 in /examples/strands/code-assistant #329 (aws/cdk): bundled inside aws-cdk-lib, not reachable by an npm override. Clears when aws-cdk-lib ships a fixed bundle.
• astro chore(deps): update dependency aws-cdk-lib to v2.250.0 #281, aws-cdk-lib-2.251.0.tgz: 8 vulnerabilities (highest severity is: 7.5) #293, vite-4.3.0.tgz: 2 vulnerabilities (highest severity is: 8.3) - autoclosed #294 (docs/starlight-docs): 7.x-only fixes requiring a breaking major upgrade of the starlight docs; out of scope for a routine dependency sweep.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 55.62%. Comparing base (53be4f5) to head (649ae8b).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #370   +/-   ##
=======================================
  Coverage   55.62%   55.62%           
=======================================
  Files           4        4           
  Lines         169      169           
  Branches       47       47           
=======================================
  Hits           94       94           
  Misses         74       74           
  Partials        1        1           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[joshuali925]

@joshuali925-osdbot check if there's any unnecessary change in the CVE fix PR, if so send a revert PR

[joshuali925-osdbot]

On it — reviewing the merged CVE fix PR for any unnecessary changes. Will report back and open a revert PR if I find any.

[joshuali925-osdbot]

Reviewed all changes in #370 against the alerts it set out to clear. Found one unnecessary change, and opened a revert: #382.

Unnecessary — reverted in #382

• aws/cdk/package.json: aws-cdk (CLI) floor bumped ^2.1132.0 → ^2.1133.0. Not tied to any alert — fast-uri (chore(deps): bump js-yaml from 4.1.1 to 4.3.0 in /docs/starlight-docs #319/chore(release): bump CLI to 0.2.0 for GA #321) is a transitive of aws-cdk-lib (cleared by the aws-cdk-lib ^2.262.1 bump), and esbuild (Add Astronomy Shop dashboard to init flow #180) is cleared by its own bump. It's also a no-op for the resolved tree: both the pre- and post-PR lockfiles already resolve aws-cdk to 2.1133.0, and ^2.1132.0 still permits it.

Checked and kept (necessary / intended)

• requires-python >=3.9 → >=3.10 in weather-agent: necessary — I verified reverting it makes uv lock unsatisfiable, since starlette>=1.3.1 forces fastapi>=0.129.0 which requires Python >=3.10. (Under-documented in the PR, but correct.)
• .github/dependabot.yml additions: the intended coverage-gap fix.
• All astro/sharp/svgo/postcss/vite/esbuild version bumps and overrides: each maps to a listed advisory.

Revert PR: #382