From f512d695868e8224add82defaf0d15dfeb3ad1e5 Mon Sep 17 00:00:00 2001 From: Nikolay Vlasov Date: Mon, 6 Jul 2026 13:02:34 +1000 Subject: [PATCH 1/2] chore: group CDK deps in Dependabot and refresh tech.md versions Add a dedicated aws-cdk Dependabot group (aws-cdk, aws-cdk-lib, constructs) so routine version bumps land in one focused PR, and document that the CLI and library are version-coupled. Grouping only covers version updates; a security-only advisory can still bump one package alone, so the "Validate CDK synthesis" CI check remains the backstop against lib/CLI schema drift. Refresh the stale dependency list in .kiro/steering/tech.md to match the root package.json (aws-cdk-lib 2.261.0, aws-cdk 2.1129.0, constructs 10.4.3, dotenv 17.2.3, cdk-nag 2.37.55, etc.), add the previously-omitted build/test toolchain packages, and note that package.json is the source of truth. The ES2020 target and strict-null-checks claims were verified against tsconfig.json and left unchanged. Note: the aws-cdk-lib/aws-cdk versions here match the separate bump on chore/bump-aws-cdk-lib-and-cli. --- .github/dependabot.yml | 12 ++++++++++++ .kiro/steering/tech.md | 28 ++++++++++++++++++++++++---- 2 files changed, 36 insertions(+), 4 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index d16bd5c1..23459849 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -30,6 +30,18 @@ updates: interval: weekly open-pull-requests-limit: 10 groups: + # Keep the CDK CLI and library (plus constructs) in a single PR: they are + # version-coupled — aws-cdk-lib's cloud-assembly schema must be readable + # by the aws-cdk CLI. NOTE: grouping only batches *version* updates. A + # security advisory affecting just one of them can still bump it alone + # (Dependabot only touches packages with an update/advisory), so the + # "Validate CDK synthesis" CI check remains the real guard against + # lib/CLI schema drift. + aws-cdk: + patterns: + - "aws-cdk" + - "aws-cdk-lib" + - "constructs" npm: patterns: - "*" diff --git a/.kiro/steering/tech.md b/.kiro/steering/tech.md index 4a3b4928..c7ab9dfd 100644 --- a/.kiro/steering/tech.md +++ b/.kiro/steering/tech.md @@ -36,10 +36,30 @@ npx cdk destroy ``` ## Dependencies -- **aws-cdk-lib**: ^2.189.1 - Core CDK library -- **constructs**: ^10.3.0 - CDK constructs framework -- **dotenv**: ^16.4.5 - Environment variable management -- **cdk-nag**: ^2.36.18 - Security and compliance validation + +The root `package.json` (and `package-lock.json`) is the source of truth for +versions; the list below is a summary and may lag. Update it when the core +dependencies change. + +Runtime dependencies: +- **aws-cdk-lib**: ^2.261.0 - Core CDK v2 library +- **constructs**: ^10.4.3 - CDK constructs framework +- **dotenv**: ^17.2.3 - Environment variable management +- **source-map-support**: ^0.5.21 - Source maps for stack traces + +Build / test toolchain (devDependencies): +- **aws-cdk** (CLI): ^2.1129.0 - CDK CLI for synth/deploy +- **typescript**: ~6.0.3 - TypeScript compiler +- **ts-node**: ^10.9.2 - TypeScript execution for the CDK app entrypoint +- **cdk-nag**: ^2.37.55 - Security and compliance validation +- **jest**: ^30.2.0 / **ts-jest**: ^29.4.11 - Unit testing +- **@types/node**: ^24.10.1 / **@types/jest**: ^30.0.0 - Type definitions + +> The `aws-cdk` CLI and `aws-cdk-lib` are version-coupled: the CLI must be new +> enough to read the cloud-assembly schema emitted by the library. Bump them +> together (the "Validate CDK synthesis" CI check enforces this). Keep +> `@types/node`'s major aligned with the Node.js runtime you target rather than +> chasing its latest release. ## Development Standards - Strict TypeScript configuration with null checks From c2133ca8b2e5b9b51a2122f6c88b50db8b6f9dd8 Mon Sep 17 00:00:00 2001 From: Nikolay Vlasov Date: Mon, 6 Jul 2026 14:42:12 +1000 Subject: [PATCH 2/2] docs: stop duplicating dependency versions in tech.md tech.md restated pinned versions that also live in package.json, so it went stale on every dependency bump. Because tech.md is an always-included steering file, those stale numbers were injected into every session. Replace the version list with dependency names + roles and point to the package manifests (root package.json / package-lock.json for the CDK app, and website/package.json for the docs site) as the single source of truth, per the ci-workflows.md single-source-of-truth principle. The CDK lib/CLI coupling note is kept (it carries no specific versions). --- .kiro/steering/tech.md | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-) diff --git a/.kiro/steering/tech.md b/.kiro/steering/tech.md index c7ab9dfd..e1ae93bc 100644 --- a/.kiro/steering/tech.md +++ b/.kiro/steering/tech.md @@ -37,26 +37,28 @@ npx cdk destroy ## Dependencies -The root `package.json` (and `package-lock.json`) is the source of truth for -versions; the list below is a summary and may lag. Update it when the core -dependencies change. +Versions are intentionally **not** listed here — they are tracked in the package +manifests, which are the single source of truth. See the root `package.json` and +`package-lock.json` (CDK app) and `website/package.json` (docs site) for the +current, authoritative versions. This section only names the key dependencies and +their roles. -Runtime dependencies: -- **aws-cdk-lib**: ^2.261.0 - Core CDK v2 library -- **constructs**: ^10.4.3 - CDK constructs framework -- **dotenv**: ^17.2.3 - Environment variable management -- **source-map-support**: ^0.5.21 - Source maps for stack traces +Runtime dependencies (CDK app): +- **aws-cdk-lib** - Core CDK v2 library +- **constructs** - CDK constructs framework +- **dotenv** - Environment variable management +- **source-map-support** - Source maps for stack traces Build / test toolchain (devDependencies): -- **aws-cdk** (CLI): ^2.1129.0 - CDK CLI for synth/deploy -- **typescript**: ~6.0.3 - TypeScript compiler -- **ts-node**: ^10.9.2 - TypeScript execution for the CDK app entrypoint -- **cdk-nag**: ^2.37.55 - Security and compliance validation -- **jest**: ^30.2.0 / **ts-jest**: ^29.4.11 - Unit testing -- **@types/node**: ^24.10.1 / **@types/jest**: ^30.0.0 - Type definitions +- **aws-cdk** (CLI) - CDK CLI for synth/deploy +- **typescript** - TypeScript compiler +- **ts-node** - TypeScript execution for the CDK app entrypoint +- **cdk-nag** - Security and compliance validation +- **jest** / **ts-jest** - Unit testing +- **@types/node** / **@types/jest** - Type definitions > The `aws-cdk` CLI and `aws-cdk-lib` are version-coupled: the CLI must be new -> enough to read the cloud-assembly schema emitted by the library. Bump them +> enough to read the cloud-assembly schema emitted by the library, so bump them > together (the "Validate CDK synthesis" CI check enforces this). Keep > `@types/node`'s major aligned with the Node.js runtime you target rather than > chasing its latest release.