@aws/nx-plugin 1.0.10 → 1.0.12

package/LICENSE-THIRD-PARTY

@@ -108,7 +108,7 @@ THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: @astral-sh/ruff-wasm-nodejs (0.17.0)
+The following software may be included in this product: @astral-sh/ruff-wasm-nodejs (0.17.1)
 This software contains the following license and notice below:
 
 MIT License
@@ -4193,7 +4193,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @oxc-project/types (0.152.0)
+The following software may be included in this product: @oxc-project/types (0.154.0)
 This software contains the following license and notice below:
 
 MIT License
@@ -4731,7 +4731,7 @@ SOFTWARE
 
 ---
 
-The following software may be included in this product: @vitest/expect (4.1.11)
+The following software may be included in this product: @vitest/expect (4.1.12)
 This software contains the following license and notice below:
 
 MIT License
@@ -4758,7 +4758,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @vitest/mocker (4.1.11)
+The following software may be included in this product: @vitest/mocker (4.1.12)
 This software contains the following license and notice below:
 
 MIT License
@@ -4785,7 +4785,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @vitest/pretty-format (4.1.11)
+The following software may be included in this product: @vitest/pretty-format (4.1.12)
 This software contains the following license and notice below:
 
 MIT License
@@ -4812,7 +4812,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @vitest/runner (4.1.11)
+The following software may be included in this product: @vitest/runner (4.1.12)
 This software contains the following license and notice below:
 
 MIT License
@@ -4839,7 +4839,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @vitest/snapshot (4.1.11)
+The following software may be included in this product: @vitest/snapshot (4.1.12)
 This software contains the following license and notice below:
 
 MIT License
@@ -4866,7 +4866,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @vitest/spy (4.1.11)
+The following software may be included in this product: @vitest/spy (4.1.12)
 This software contains the following license and notice below:
 
 MIT License
@@ -4893,7 +4893,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @vitest/utils (4.1.11)
+The following software may be included in this product: @vitest/utils (4.1.12)
 This software contains the following license and notice below:
 
 MIT License
@@ -12820,33 +12820,6 @@ THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: picomatch (4.0.5)
-This software contains the following license and notice below:
-
-The MIT License (MIT)
-
-Copyright (c) 2017-present, Jon Schlinkert.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-
----
-
 The following software may be included in this product: picomatch (4.0.7)
 This software contains the following license and notice below:
 
@@ -13173,7 +13146,7 @@ THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: react (19.3.0)
+The following software may be included in this product: react (19.3.1)
 This software contains the following license and notice below:
 
 MIT License
@@ -13200,7 +13173,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: react-dom (19.3.0)
+The following software may be included in this product: react-dom (19.3.1)
 This software contains the following license and notice below:
 
 MIT License
@@ -13794,7 +13767,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: rolldown (1.2.12)
+The following software may be included in this product: rolldown (1.2.14)
 This software contains the following license and notice below:
 
 MIT License
@@ -14896,7 +14869,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: tinyexec (1.2.4)
+The following software may be included in this product: tinyexec (1.3.1)
 This software contains the following license and notice below:
 
 MIT License
@@ -18000,7 +17973,7 @@ Repository: https://github.com/sveltejs/zimmerframe
 
 ---
 
-The following software may be included in this product: vitest (4.1.11)
+The following software may be included in this product: vitest (4.1.12)
 This software contains the following license and notice below:
 
 # Vitest core license

package/migrations.json

@@ -2,16 +2,6 @@
   "$schema": "http://json-schema.org/schema",
   "name": "@aws/nx-plugin",
   "generators": {
-    "latest-py-dynamodb-bind-base-model-meta": {
-      "version": "1.0.9",
-      "description": "Bind the py#dynamodb BaseModel Meta that 1.0.8 declared as a nested MetaProtocol subclass with the inherited MetaProtocol type, so the generated project type checks with ty 0.0.87",
-      "implementation": "./src/migrations/latest/py-dynamodb-bind-base-model-meta/migration"
-    },
-    "latest-pin-strands-mcp-client-peer": {
-      "version": "1.0.10",
-      "description": "Declare @modelcontextprotocol/client in every project that declares @strands-agents/sdk without it so the required peer resolves to the vended pin",
-      "implementation": "./src/migrations/latest/pin-strands-mcp-client-peer/migration"
-    },
     "v1.0.0-rc.50-0001-modernize-function-props-cast": {
       "version": "1.0.0-rc.50",
       "description": "Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs",
@@ -377,6 +367,11 @@
       "description": "Move the shared shadcn package's components onto the cn package the shadcn registry now depends on",
       "implementation": "./src/migrations/v1.0.0-rc.98/0002-shadcn-cn-package/migration"
     },
+    "v1.0.10-0001-pin-strands-mcp-client-peer": {
+      "version": "1.0.10",
+      "description": "Declare @modelcontextprotocol/client in every project that declares @strands-agents/sdk without it so the required peer resolves to the vended pin",
+      "implementation": "./src/migrations/v1.0.10/0001-pin-strands-mcp-client-peer/migration"
+    },
     "v1.0.2-0001-terraform-harness-environment-variables": {
       "version": "1.0.2",
       "description": "Send an empty map rather than null for a vended Terraform AgentCore Harness module's environment_variables, so the first apply does not fail after creating the Harness",
@@ -417,8 +412,13 @@
       "description": "Keep checkov reports and vitest coverage out of downstream task hashes, declare Smithy build inputs, cache ts#rdb Prisma client generation and stop caching Terraform output",
       "implementation": "./src/migrations/v1.0.8/0003-cache-inputs-outputs/migration"
     },
+    "v1.0.9-0001-py-dynamodb-bind-base-model-meta": {
+      "version": "1.0.9",
+      "description": "Bind the py#dynamodb BaseModel Meta that 1.0.8 declared as a nested MetaProtocol subclass with the inherited MetaProtocol type, so the generated project type checks with ty 0.0.87",
+      "implementation": "./src/migrations/v1.0.9/0001-py-dynamodb-bind-base-model-meta/migration"
+    },
     "sync-vended-versions": {
-      "version": "1.0.10",
+      "version": "1.0.12",
       "description": "Sync vended dependency versions and the tracked plugin version to those vended by this release",
       "implementation": "./src/utils/version-upgrade-migration/migration"
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.10",
+  "version": "1.0.12",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",
@@ -33,14 +33,14 @@
     "migrations": "./migrations.json"
   },
   "engines": {
-    "node": ">=20.19.0"
+    "node": "^22.13.0 || ^24.0.0 || >=26.0.0"
   },
   "peerDependencies": {
     "nx": "23.3.0"
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "12.1.0",
-    "@astral-sh/ruff-wasm-nodejs": "0.17.0",
+    "@astral-sh/ruff-wasm-nodejs": "0.17.1",
     "@biomejs/js-api": "6.0.0",
     "@biomejs/wasm-nodejs": "2.5.15",
     "@getgrit/gritql": "0.0.3",
@@ -80,7 +80,7 @@
     "unified": "11.0.5",
     "unist-util-visit": "5.1.0",
     "vite": "8.3.4",
-    "vitest": "4.1.11",
+    "vitest": "4.1.12",
     "zod": "4.6.7"
   },
   "devDependencies": {

package/src/migrations/v1.0.10/0001-pin-strands-mcp-client-peer/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.10/0001-pin-strands-mcp-client-peer/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type Tree,\n} from '@nx/devkit';\nimport { AGENT_CONNECTION_PROJECT_DIR } from '../../../utils/agent-connection/agent-connection.js';\nimport { addDependenciesToPackageJson } from '../../../utils/dependencies.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { TS_VERSIONS } from '../../../utils/versions.js';\n\nconst MCP_CLIENT = '@modelcontextprotocol/client';\nconst STRANDS_SDK = '@strands-agents/sdk';\nconst ROOT_PACKAGE_JSON = 'package.json';\n\n/**\n * `@strands-agents/sdk` 1.20.0 replaced its required peer\n * `@modelcontextprotocol/sdk` with `@modelcontextprotocol/client`. Nothing in\n * a generated workspace declared that package, so pnpm auto-installs whatever\n * its `latest` is, while the vended `@modelcontextprotocol/inspector` pulls\n * its own exact version into the same graph. The generators now declare it\n * at the vended pin wherever they declare strands; this carries an existing\n * workspace to the same shape.\n *\n * Detection is generic, as in the earlier express peer migration: the\n * workspace root, the shared agent-connection project (checked explicitly in\n * case its project.json isn't registered) and every project's\n * `package.json`, each checked for \"declares @strands-agents/sdk\".\n */\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  pinIfNeeded(tree, ROOT_PACKAGE_JSON);\n  pinIfNeeded(\n    tree,\n    joinPathFragments(AGENT_CONNECTION_PROJECT_DIR, 'package.json'),\n  );\n\n  for (const project of getProjects(tree).values()) {\n    pinIfNeeded(tree, joinPathFragments(project.root, 'package.json'));\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps: [] };\n}\n\n/** Declare the MCP client on the given manifest, if it declares strands. */\nfunction pinIfNeeded(tree: Tree, packageJsonPath: string): void {\n  if (!tree.exists(packageJsonPath)) {\n    return;\n  }\n\n  const packageJson = JSON.parse(tree.read(packageJsonPath, 'utf-8') ?? '{}');\n  if (!packageJson.dependencies?.[STRANDS_SDK]) {\n    return;\n  }\n\n  // An already-declared client (even a stale range) is left to\n  // addDependenciesToPackageJson, which resolves it onto the catalog.\n  addDependenciesToPackageJson(\n    tree,\n    { [MCP_CLIENT]: TS_VERSIONS[MCP_CLIENT] },\n    {},\n    packageJsonPath,\n  );\n}\n"],"names":["getProjects","joinPathFragments","AGENT_CONNECTION_PROJECT_DIR","addDependenciesToPackageJson","formatFilesInSubtree","TS_VERSIONS","MCP_CLIENT","STRANDS_SDK","ROOT_PACKAGE_JSON","migration","tree","pinIfNeeded","project","values","root","nextSteps","packageJsonPath","exists","packageJson","JSON","parse","read","dependencies"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,QAGZ,aAAa;AACpB,SAASC,4BAA4B,QAAQ,sDAAsD;AACnG,SAASC,4BAA4B,QAAQ,iCAAiC;AAC9E,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,WAAW,QAAQ,6BAA6B;AAEzD,MAAMC,aAAa;AACnB,MAAMC,cAAc;AACpB,MAAMC,oBAAoB;AAE1B;;;;;;;;;;;;;CAaC,GACD,eAAe,eAAeC,UAC5BC,IAAU;IAEVC,YAAYD,MAAMF;IAClBG,YACED,MACAT,kBAAkBC,8BAA8B;IAGlD,KAAK,MAAMU,WAAWZ,YAAYU,MAAMG,MAAM,GAAI;QAChDF,YAAYD,MAAMT,kBAAkBW,QAAQE,IAAI,EAAE;IACpD;IAEA,MAAMV,qBAAqBM;IAE3B,OAAO;QAAEK,WAAW,EAAE;IAAC;AACzB;AAEA,0EAA0E,GAC1E,SAASJ,YAAYD,IAAU,EAAEM,eAAuB;IACtD,IAAI,CAACN,KAAKO,MAAM,CAACD,kBAAkB;QACjC;IACF;IAEA,MAAME,cAAcC,KAAKC,KAAK,CAACV,KAAKW,IAAI,CAACL,iBAAiB,YAAY;IACtE,IAAI,CAACE,YAAYI,YAAY,EAAE,CAACf,YAAY,EAAE;QAC5C;IACF;IAEA,6DAA6D;IAC7D,oEAAoE;IACpEJ,6BACEO,MACA;QAAE,CAACJ,WAAW,EAAED,WAAW,CAACC,WAAW;IAAC,GACxC,CAAC,GACDU;AAEJ"}

package/src/migrations/v1.0.9/0001-py-dynamodb-bind-base-model-meta/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.9/0001-py-dynamodb-bind-base-model-meta/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { MigrationReturnObject, Tree } from '@nx/devkit';\nimport {\n  bindMetaBlock,\n  divergedMetaNextStep,\n  findMetaBlockShape,\n  META_BINDING,\n  NESTED_PROTOCOL_META_HEADER,\n  pyDynamoDbBasePyPaths,\n  TYPED_IMPORT,\n  UNTYPED_IMPORT,\n  UNTYPED_META_HEADER,\n} from '../../../py/dynamodb/base-model-meta.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\n\n/**\n * Bind the `Meta` of the `BaseModel` that py#dynamodb vends in\n * `<module>/entities/base.py` with pynamodb's declared `MetaProtocol` type.\n *\n * Release 1.0.8 vends, and its `py-dynamodb-type-base-model-meta` migration\n * writes, a nested `class Meta(MetaProtocol):`. pynamodb declares\n * `Model.Meta: MetaProtocol`, a mutable attribute, and the nested class\n * narrows it to the class's own type, which ty 0.0.87 reports as\n * `invalid-mutable-override`. This declares the block as\n * `class _Meta(MetaProtocol):` and binds it with `Meta: MetaProtocol = _Meta`.\n * `Meta` is the same class object, so pynamodb's runtime defaults apply as\n * before.\n *\n * A base.py is edited only where its import line and `Meta` block still have\n * the exact shape the generator wrote. One already bound is left alone, as is\n * an untyped `class Meta:` in the generated shape, which\n * `py-dynamodb-type-base-model-meta` converges on the bound shape before this\n * runs. Any other base.py is left untouched and reported via `nextSteps`.\n */\n\n/**\n * Rewrite a base.py still in the 1.0.8 shape. Already bound, untyped and\n * missing files are left alone; a diverged one is reported via nextSteps.\n */\nconst migrateBasePy = (\n  tree: Tree,\n  filePath: string,\n  nextSteps: string[],\n): void => {\n  if (!tree.exists(filePath)) {\n    return;\n  }\n\n  const content = tree.read(filePath, 'utf-8') ?? '';\n  if (content.includes(META_BINDING)) {\n    return; // Already migrated (or user-added).\n  }\n\n  if (\n    content.includes(UNTYPED_IMPORT) &&\n    findMetaBlockShape(content, UNTYPED_META_HEADER)\n  ) {\n    return; // Left to py-dynamodb-type-base-model-meta.\n  }\n\n  const shape = findMetaBlockShape(content, NESTED_PROTOCOL_META_HEADER);\n  if (!shape || !content.includes(TYPED_IMPORT)) {\n    nextSteps.push(divergedMetaNextStep(filePath));\n    return;\n  }\n\n  tree.write(\n    filePath,\n    bindMetaBlock(content, NESTED_PROTOCOL_META_HEADER, shape),\n  );\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const filePath of pyDynamoDbBasePyPaths(tree)) {\n    migrateBasePy(tree, filePath, nextSteps);\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["bindMetaBlock","divergedMetaNextStep","findMetaBlockShape","META_BINDING","NESTED_PROTOCOL_META_HEADER","pyDynamoDbBasePyPaths","TYPED_IMPORT","UNTYPED_IMPORT","UNTYPED_META_HEADER","formatFilesInSubtree","migrateBasePy","tree","filePath","nextSteps","exists","content","read","includes","shape","push","write","migration"],"mappings":"AAAA;;;CAGC,GAED,SACEA,aAAa,EACbC,oBAAoB,EACpBC,kBAAkB,EAClBC,YAAY,EACZC,2BAA2B,EAC3BC,qBAAqB,EACrBC,YAAY,EACZC,cAAc,EACdC,mBAAmB,QACd,0CAA0C;AACjD,SAASC,oBAAoB,QAAQ,2BAA2B;AAEhE;;;;;;;;;;;;;;;;;;CAkBC,GAED;;;CAGC,GACD,MAAMC,gBAAgB,CACpBC,MACAC,UACAC;IAEA,IAAI,CAACF,KAAKG,MAAM,CAACF,WAAW;QAC1B;IACF;IAEA,MAAMG,UAAUJ,KAAKK,IAAI,CAACJ,UAAU,YAAY;IAChD,IAAIG,QAAQE,QAAQ,CAACd,eAAe;QAClC,QAAQ,oCAAoC;IAC9C;IAEA,IACEY,QAAQE,QAAQ,CAACV,mBACjBL,mBAAmBa,SAASP,sBAC5B;QACA,QAAQ,4CAA4C;IACtD;IAEA,MAAMU,QAAQhB,mBAAmBa,SAASX;IAC1C,IAAI,CAACc,SAAS,CAACH,QAAQE,QAAQ,CAACX,eAAe;QAC7CO,UAAUM,IAAI,CAAClB,qBAAqBW;QACpC;IACF;IAEAD,KAAKS,KAAK,CACRR,UACAZ,cAAce,SAASX,6BAA6Bc;AAExD;AAEA,eAAe,eAAeG,UAC5BV,IAAU;IAEV,MAAME,YAAsB,EAAE;IAE9B,KAAK,MAAMD,YAAYP,sBAAsBM,MAAO;QAClDD,cAAcC,MAAMC,UAAUC;IAChC;IAEA,MAAMJ,qBAAqBE;IAE3B,OAAO;QAAEE;IAAU;AACrB"}

package/src/py/agent/__snapshots__/generator.constructs.spec.ts.snap

@@ -763,19 +763,19 @@ name = "proj.test_project"
 version = "0.1.0"
 dependencies = [
   "proj-agent-connection",
-  "aws-lambda-powertools==3.35.0",
+  "aws-lambda-powertools==3.36.0",
   "aws-opentelemetry-distro==0.21.0",
-  "bedrock-agentcore==1.24.1",
-  "boto3==1.43.113",
-  "fastapi==0.143.1",
+  "bedrock-agentcore==1.24.2",
+  "boto3==1.43.115",
+  "fastapi==0.150.0",
   "mcp==1.28.1",
-  "strands-agents==1.60.0",
+  "strands-agents==1.61.1",
   "strands-agents-tools==0.8.9",
   "uvicorn==0.54.0"
 ]
 
 [dependency-groups]
-dev = [ "fastapi[standard]==0.143.1" ]
+dev = [ "fastapi[standard]==0.150.0" ]
 
 [tool.uv]
 dev-dependencies = [ ]

package/src/py/agent/__snapshots__/generator.frameworks.spec.ts.snap

@@ -701,15 +701,15 @@ name = "proj.test_project"
 version = "0.1.0"
 dependencies = [
   "proj-agent-connection",
-  "aws-lambda-powertools==3.35.0",
+  "aws-lambda-powertools==3.36.0",
   "aws-opentelemetry-distro==0.21.0",
-  "bedrock-agentcore==1.24.1",
-  "boto3==1.43.113",
-  "fastapi==0.143.1",
+  "bedrock-agentcore==1.24.2",
+  "boto3==1.43.115",
+  "fastapi==0.150.0",
   "mcp==1.28.1",
   "langchain==1.4.6",
-  "langchain-aws==1.8.2",
-  "langgraph==1.2.15",
+  "langchain-aws==1.9.0",
+  "langgraph==1.2.16",
   "langgraph-checkpoint-sqlite==3.1.2",
   "aiosqlite==0.22.1",
   "ag-ui-protocol==0.1.22",
@@ -718,7 +718,7 @@ dependencies = [
 ]
 
 [dependency-groups]
-dev = [ "fastapi[standard]==0.143.1" ]
+dev = [ "fastapi[standard]==0.150.0" ]
 
 [tool.uv]
 dev-dependencies = [ ]

package/src/py/agent/__snapshots__/generator.protocols.spec.ts.snap

@@ -1063,7 +1063,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.113 python -c "
+      uv run --with boto3==1.43.115 python -c "
 import boto3
 import json
 import os

package/src/py/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -514,7 +514,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.113 python -c "
+      uv run --with boto3==1.43.115 python -c "
 import boto3
 import json
 import os
@@ -801,10 +801,10 @@ exports[`py#mcp-server generator > should match snapshot for generated files > u
 name = "proj.test_project"
 version = "0.1.0"
 dependencies = [
-  "aws-lambda-powertools==3.35.0",
+  "aws-lambda-powertools==3.36.0",
   "mcp==1.28.1",
   "uvicorn==0.54.0",
-  "boto3==1.43.113",
+  "boto3==1.43.115",
   "aws-opentelemetry-distro==0.21.0"
 ]
 

package/src/py/rdb/__snapshots__/generator.spec.ts.snap

@@ -1507,8 +1507,8 @@ dependencies = [
   "alembic==1.20.0",
   "greenlet==3.5.6",
   "asyncpg==0.32.0",
-  "boto3==1.43.113",
-  "aws-lambda-powertools==3.35.0"
+  "boto3==1.43.115",
+  "aws-lambda-powertools==3.36.0"
 ]
 
 [build-system]

package/src/smithy/project/__snapshots__/generator.spec.ts.snap

@@ -46,7 +46,7 @@ exports[`smithyProjectGenerator > shape libraries > should generate a shape libr
           "shx rm -rf dist/{projectRoot}/build",
           "shx rm -rf dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build",
-          "npx -y mise@2026.10.9 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
+          "npx -y mise@2026.10.14 exec smithy@1.74.1 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
           "shx cp dist/{projectRoot}/smithy/source/model/model.json dist/{projectRoot}/build/model.json"
         ],
         "parallel": false,
@@ -63,7 +63,7 @@ exports[`smithyProjectGenerator > shape libraries > should generate a shape libr
   "version": "1.0",
   "sources": ["src/"],
   "maven": {
-    "dependencies": ["software.amazon.smithy:smithy-model:1.74.0"]
+    "dependencies": ["software.amazon.smithy:smithy-model:1.74.1"]
   }
 }
 "
@@ -124,7 +124,7 @@ exports[`smithyProjectGenerator > should generate smithy project with all custom
           "shx rm -rf dist/{projectRoot}/build",
           "shx rm -rf dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build",
-          "npx -y mise@2026.10.9 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
+          "npx -y mise@2026.10.14 exec smithy@1.74.1 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build/openapi",
           "shx cp \\"dist/{projectRoot}/smithy/source/openapi/*.openapi.json\\" dist/{projectRoot}/build/openapi/openapi.json"
         ],
@@ -184,7 +184,7 @@ exports[`smithyProjectGenerator > should generate smithy project with custom dir
           "shx rm -rf dist/{projectRoot}/build",
           "shx rm -rf dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build",
-          "npx -y mise@2026.10.9 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
+          "npx -y mise@2026.10.14 exec smithy@1.74.1 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build/openapi",
           "shx cp \\"dist/{projectRoot}/smithy/source/openapi/*.openapi.json\\" dist/{projectRoot}/build/openapi/openapi.json"
         ],
@@ -336,7 +336,7 @@ exports[`smithyProjectGenerator > should generate smithy project with default op
           "shx rm -rf dist/{projectRoot}/build",
           "shx rm -rf dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build",
-          "npx -y mise@2026.10.9 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
+          "npx -y mise@2026.10.14 exec smithy@1.74.1 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build/openapi",
           "shx cp \\"dist/{projectRoot}/smithy/source/openapi/*.openapi.json\\" dist/{projectRoot}/build/openapi/openapi.json"
         ],
@@ -382,10 +382,10 @@ exports[`smithyProjectGenerator > should generate smithy project with default op
   },
   "maven": {
     "dependencies": [
-      "software.amazon.smithy:smithy-model:1.74.0",
-      "software.amazon.smithy:smithy-aws-traits:1.74.0",
-      "software.amazon.smithy:smithy-validation-model:1.74.0",
-      "software.amazon.smithy:smithy-openapi:1.74.0",
+      "software.amazon.smithy:smithy-model:1.74.1",
+      "software.amazon.smithy:smithy-aws-traits:1.74.1",
+      "software.amazon.smithy:smithy-validation-model:1.74.1",
+      "software.amazon.smithy:smithy-openapi:1.74.1",
       "software.amazon.smithy.typescript:smithy-aws-typescript-codegen:0.54.0"
     ]
   }
@@ -482,7 +482,7 @@ exports[`smithyProjectGenerator > should generate smithy project with subdirecto
           "shx rm -rf dist/{projectRoot}/build",
           "shx rm -rf dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build",
-          "npx -y mise@2026.10.9 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
+          "npx -y mise@2026.10.14 exec smithy@1.74.1 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build/openapi",
           "shx cp \\"dist/{projectRoot}/smithy/source/openapi/*.openapi.json\\" dist/{projectRoot}/build/openapi/openapi.json"
         ],
@@ -574,10 +574,10 @@ exports[`smithyProjectGenerator > should handle kebab-case conversion for servic
   },
   "maven": {
     "dependencies": [
-      "software.amazon.smithy:smithy-model:1.74.0",
-      "software.amazon.smithy:smithy-aws-traits:1.74.0",
-      "software.amazon.smithy:smithy-validation-model:1.74.0",
-      "software.amazon.smithy:smithy-openapi:1.74.0",
+      "software.amazon.smithy:smithy-model:1.74.1",
+      "software.amazon.smithy:smithy-aws-traits:1.74.1",
+      "software.amazon.smithy:smithy-validation-model:1.74.1",
+      "software.amazon.smithy:smithy-openapi:1.74.1",
       "software.amazon.smithy.typescript:smithy-aws-typescript-codegen:0.54.0"
     ]
   }

package/src/smithy/ts/api/__snapshots__/generator.spec.ts.snap

@@ -2176,7 +2176,7 @@ exports[`tsSmithyApiGenerator > should generate smithy ts api with default optio
           "shx rm -rf dist/{projectRoot}/build",
           "shx rm -rf dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build",
-          "npx -y mise@2026.10.9 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
+          "npx -y mise@2026.10.14 exec smithy@1.74.1 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build/openapi",
           "shx cp \\"dist/{projectRoot}/smithy/source/openapi/*.openapi.json\\" dist/{projectRoot}/build/openapi/openapi.json"
         ],

package/src/ts/agent/__snapshots__/generator.spec.ts.snap

@@ -650,7 +650,7 @@ RUN apt-get update && \\
     rm -rf /var/lib/apt/lists/*
 
 # Upgrade npm to a version free of known HIGH/CRITICAL vulnerabilities
-RUN npm install -g npm@12.2.0
+RUN npm install -g npm@12.2.1
 
 WORKDIR /app
 
@@ -1666,7 +1666,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.113 python -c "
+      uv run --with boto3==1.43.115 python -c "
 import boto3
 import json
 import os

package/src/ts/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -514,7 +514,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.113 python -c "
+      uv run --with boto3==1.43.115 python -c "
 import boto3
 import json
 import os

package/src/ts/rdb/__snapshots__/generator.spec.ts.snap

@@ -4520,7 +4520,7 @@ exports[`ts#rdb generator > should generate the aurora shared construct 4`] = `
 "FROM public.ecr.aws/lambda/nodejs:24
 
 # Upgrade npm to a version free of known HIGH/CRITICAL vulnerabilities
-RUN npm install -g npm@12.2.0
+RUN npm install -g npm@12.2.1
 
 # Patch OS packages beyond the base image's pinned release, and drop the
 # runtime's convenience copy of the AWS SDK (the handler bundle inlines its
@@ -4544,7 +4544,7 @@ RUN printf 'allow-scripts[]=prisma\\nallow-scripts[]=@prisma/engines\\n' > .npmr
     && npm init -y \\
     && npm pkg set "overrides.deepmerge-ts=8.0.2" \\
     && npm pkg set "overrides.mysql2=3.24.6" \\
-    && npm install prisma@7.10.0 \\
+    && npm install prisma@7.10.1 \\
     && rm .npmrc \\
     && npm uninstall -g npm
 

package/src/ts/react-website/app/__snapshots__/generator.spec.ts.snap

@@ -745,7 +745,7 @@ resource "null_resource" "upload_website_files" {
   provisioner "local-exec" {
     command = <<-EOT
       cd "$ROOT_PATH"
-      uv run --with boto3==1.43.113 python3 -c "
+      uv run --with boto3==1.43.115 python3 -c "
 import os
 import sys
 import boto3
@@ -868,7 +868,7 @@ resource "null_resource" "cloudfront_invalidation" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.113 python3 -c "
+      uv run --with boto3==1.43.115 python3 -c "
 import boto3
 import os
 import sys
@@ -2384,9 +2384,9 @@ catalog:
   '@nx/vitest': 23.3.0
   constructs: 10.8.1
   aws-cdk-lib: 2.273.0
-  react: 19.3.0
-  react-dom: 19.3.0
-  '@cloudscape-design/components': 3.0.1400
+  react: 19.3.1
+  react-dom: 19.3.1
+  '@cloudscape-design/components': 3.0.1401
   '@cloudscape-design/board-components': 3.0.238
   '@cloudscape-design/global-styles': 1.0.71
   tailwindcss: 4.3.3
@@ -4315,20 +4315,20 @@ catalog:
   '@nx/vitest': 23.3.0
   constructs: 10.8.1
   aws-cdk-lib: 2.273.0
-  react: 19.3.0
-  react-dom: 19.3.0
-  '@cloudscape-design/components': 3.0.1400
+  react: 19.3.1
+  react-dom: 19.3.1
+  '@cloudscape-design/components': 3.0.1401
   '@cloudscape-design/board-components': 3.0.238
   '@cloudscape-design/global-styles': 1.0.71
   tailwindcss: 4.3.3
-  '@tanstack/react-router': 1.170.44
+  '@tanstack/react-router': 1.170.45
   '@nx/react': 23.3.0
   '@vitest/ui': ~5.0.1
   '@tailwindcss/vite': 4.3.3
-  '@tanstack/router-plugin': 1.168.45
-  '@tanstack/router-generator': 1.167.43
+  '@tanstack/router-plugin': 1.168.47
+  '@tanstack/router-generator': 1.167.45
   '@tanstack/virtual-file-routes': 1.162.0
-  '@tanstack/router-utils': 1.162.3
+  '@tanstack/router-utils': 1.162.4
 "
 `;
 

package/src/ts/react-website/cognito-auth/__snapshots__/generator.terraform.spec.ts.snap

@@ -67,7 +67,7 @@ resource "null_resource" "add_callback_url" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.113 python -c "
+      uv run --with boto3==1.43.115 python -c "
 import boto3
 import os
 import sys

package/src/utils/docker.d.ts

@@ -25,7 +25,7 @@ export declare const IMAGE_BUILD_CACHE = false;
  * version to install globally, and the versions its dependency overrides pin.
  */
 export declare const nodeImageVersions: () => {
-    npmVersion: "12.2.0";
+    npmVersion: "12.2.1";
     minimatchVersion: "10.2.6";
 };
 /**

package/src/utils/version-lockstep/exact-dependency.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type Tree } from '@nx/devkit';
+import type { IVersionedDep, LockstepNote, ProposedVersions } from './lockstep.js';
+/**
+ * Pins that must equal the exact `dependencies` a published release of another
+ * pin declares, for packages that don't share a version line.
+ */
+export interface ExactDependencyPin {
+    /** The pin whose published `dependencies` the followers take. */
+    source: IVersionedDep;
+    /** Pins set to exactly the version `source` depends on. */
+    followers: readonly [IVersionedDep, ...IVersionedDep[]];
+    /** Pins whose published `peerDependencies` must accept the followers. */
+    peers: readonly IVersionedDep[];
+    /** Why the followers must match, for the update's PR. */
+    reason: string;
+}
+/** The manifest fields the rule reads. */
+export type ManifestField = 'dependencies' | 'peerDependencies';
+/**
+ * Reads one field of a published release's manifest, for example from
+ * `https://registry.npmjs.org/<name>/<version>`. Resolves to `{}` when the
+ * release has no such field, and rejects when the release can't be read.
+ */
+export type DependencyLookup = (name: string, version: string, field: ManifestField) => Promise<Record<string, string>>;
+/** Groups of pins held at one version, as in `LOCKSTEP_GROUPS`. */
+type Groups = readonly (readonly string[])[];
+/**
+ * Set each rule's followers, and their lockstep group mates, to the exact
+ * versions the source being written depends on. Runs after the lockstep, which
+ * can only hold a group back and so can't move one up to what the source needs.
+ *
+ * Mutates `proposed`, which holds versions not yet written anywhere. When a peer
+ * would reject the result, or a manifest can't be read, every pin the rule covers
+ * is put back to `current` for this run instead. Returns a note for each pin set
+ * and each rule held, so the reason reaches the update's PR.
+ */
+export declare const pinToExactDependencies: (rules: readonly ExactDependencyPin[], groups: Groups, current: Readonly<ProposedVersions>, proposed: ProposedVersions, lookup: DependencyLookup) => Promise<LockstepNote[]>;
+/** Reads each release's field once; a failed read fails the same way when repeated. */
+export declare const memoizeLookup: (lookup: DependencyLookup) => DependencyLookup;
+/** Where the update records what each rule's source release depends on. */
+export declare const EXACT_DEPENDENCY_SOURCES_PATH = "packages/nx-plugin/exact-dependency-sources.json";
+/** Per rule source: the version pinned and the exact versions it depends on for its followers. */
+export type ExactDependencySources = Record<string, {
+    version: string;
+    dependencies: Record<string, string>;
+}>;
+/**
+ * What each rule's source, at the version being written, depends on for its
+ * followers. Reuses `recorded` for a source that did not move and reads the
+ * registry otherwise. Throws when a follower being written is not that version,
+ * or when the source's dependencies can't be read or omit a follower.
+ */
+export declare const verifyExactDependencies: (rules: readonly ExactDependencyPin[], versions: Readonly<ProposedVersions>, recorded: Readonly<ExactDependencySources>, lookup: DependencyLookup) => Promise<ExactDependencySources>;
+/**
+ * Record in `EXACT_DEPENDENCY_SOURCES_PATH` what the sources being written depend
+ * on, which `versions.spec.ts` checks the pins against. Throws as
+ * `verifyExactDependencies` does, before anything is written.
+ * @returns paths written, for the update report
+ */
+export declare const writeExactDependencySources: (tree: Tree, rules: readonly ExactDependencyPin[], versions: Readonly<ProposedVersions>, lookup: DependencyLookup) => Promise<string[]>;
+export {};