revert(aws/cdk): drop unnecessary aws-cdk CLI floor bump from #370 - #382
Closed
joshuali925-osdbot wants to merge 1 commit into
Closed
Conversation
…rch-project#370 PR opensearch-project#370 bumped the aws-cdk (CLI) devDependency floor from ^2.1132.0 to ^2.1133.0. This change is not tied to any Dependabot alert: - fast-uri (opensearch-project#319, opensearch-project#321) was a transitive of aws-cdk-lib and is cleared by the aws-cdk-lib ^2.262.1 bump, not the CLI. - esbuild GHSA-67mh-4wv8-2f99 (opensearch-project#180) is cleared by the esbuild ^0.28.1 bump. The bump is also a no-op for the resolved tree: both the pre-PR and post-PR lockfiles resolve aws-cdk to 2.1133.0 under either floor (^2.1132.0 already permits 2.1133.0). Reverting keeps the CVE PR scoped to the changes that actually clear alerts. Signed-off-by: joshuali925-osdbot <joshuali925-osdbot@users.noreply.github.com>
joshuali925-osdbot
requested review from
anirudha,
goyamegh,
joshuali925,
kylehounslow,
ps48 and
vamsimanohar
as code owners
July 29, 2026 16:53
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Reverts one change from #370 that is not tied to any Dependabot alert: the
aws-cdk(CLI) devDependency floor bump^2.1132.0→^2.1133.0inaws/cdk.Why it's unnecessary
Requested in #370 review — check the CVE PR for unnecessary changes.
The aws/cdk alerts #370 set out to clear were:
aws-cdk-lib, dropped by theaws-cdk-lib ^2.262.1bump (confirmed: pre-PR it sat atnode_modules/aws-cdk-lib/node_modules/fast-uri; it's absent from the lockfile now).esbuild ^0.28.1bump.The
aws-cdkCLI floor bump clears neither. It's also a no-op for the resolved tree: both the pre-PR and post-PR lockfiles already resolveaws-cdkto2.1133.0, and^2.1132.0continues to permit2.1133.0. So this only narrows the manifest floor without changing what gets installed.Change
"devDependencies": { "@types/node": "^25.5.0", - "aws-cdk": "^2.1133.0", + "aws-cdk": "^2.1132.0", "esbuild": "^0.28.1",Lockfile mirrors the same range; resolved
aws-cdkstays2.1133.0(matches base), so no install/CI behavior changes.Not reverted (verified necessary / intended)
requires-python>=3.9→>=3.10inexamples/plain-agents/weather-agent: necessary. Reverting it makesuv lockunsatisfiable — the CVE constraintstarlette>=1.3.1forcesfastapi>=0.129.0, which requires Python>=3.10..github/dependabot.ymlcoverage-gap additions: intended part of chore(deps): clear 24 Dependabot alerts across aws/cdk, docs, examples #370 (documented as the "coverage gap" fix).astro/sharp/svgo/postcss/vite/esbuildbumps and overrides: each maps to a listed advisory.