@aws/nx-plugin 1.0.3 → 1.0.4

package/LICENSE-THIRD-PARTY

@@ -108,7 +108,7 @@ THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: @astral-sh/ruff-wasm-nodejs (0.16.8)
+The following software may be included in this product: @astral-sh/ruff-wasm-nodejs (0.16.9)
 This software contains the following license and notice below:
 
 MIT License
@@ -3898,7 +3898,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @modelcontextprotocol/sdk (1.30.0)
+The following software may be included in this product: @modelcontextprotocol/sdk (1.30.1)
 This software contains the following license and notice below:
 
 MIT License
@@ -4274,7 +4274,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: @oxc-project/types (0.148.0)
+The following software may be included in this product: @oxc-project/types (0.150.0)
 This software contains the following license and notice below:
 
 MIT License
@@ -8757,7 +8757,7 @@ THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: fs-extra (11.4.0)
+The following software may be included in this product: fs-extra (11.4.1)
 This software contains the following license and notice below:
 
 (The MIT License)
@@ -9034,7 +9034,7 @@ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: hono (4.13.3)
+The following software may be included in this product: hono (4.13.8)
 This software contains the following license and notice below:
 
 MIT License
@@ -14165,7 +14165,7 @@ SOFTWARE.
 
 ---
 
-The following software may be included in this product: rolldown (1.2.7)
+The following software may be included in this product: rolldown (1.2.9)
 This software contains the following license and notice below:
 
 MIT License
@@ -16088,7 +16088,7 @@ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ---
 
-The following software may be included in this product: vite (8.3.0)
+The following software may be included in this product: vite (8.3.1)
 This software contains the following license and notice below:
 
 # Vite core license

package/migrations.json

@@ -2,11 +2,6 @@
   "$schema": "http://json-schema.org/schema",
   "name": "@aws/nx-plugin",
   "generators": {
-    "latest-terraform-init-target": {
-      "version": "1.0.3",
-      "description": "Add the terraform-init target to Terraform projects so the shared provider plugin cache has a single writer",
-      "implementation": "./src/migrations/latest/terraform-init-target/migration"
-    },
     "v1.0.0-rc.50-0001-modernize-function-props-cast": {
       "version": "1.0.0-rc.50",
       "description": "Replace the legacy angle-bracket FunctionProps type assertion with the modern as syntax in generated API constructs",
@@ -377,8 +372,13 @@
       "description": "Send an empty map rather than null for a vended Terraform AgentCore Harness module's environment_variables, so the first apply does not fail after creating the Harness",
       "implementation": "./src/migrations/v1.0.2/0001-terraform-harness-environment-variables/migration"
     },
-    "sync-vended-versions": {
+    "v1.0.3-0001-terraform-init-target": {
       "version": "1.0.3",
+      "description": "Add the terraform-init target to Terraform projects so the shared provider plugin cache has a single writer",
+      "implementation": "./src/migrations/v1.0.3/0001-terraform-init-target/migration"
+    },
+    "sync-vended-versions": {
+      "version": "1.0.4",
       "description": "Sync vended dependency versions and the tracked plugin version to those vended by this release",
       "implementation": "./src/utils/version-upgrade-migration/migration"
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aws/nx-plugin",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "repository": {
     "type": "git",
     "url": "https://github.com/awslabs/nx-plugin-for-aws.git",
@@ -40,12 +40,12 @@
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "12.1.0",
-    "@astral-sh/ruff-wasm-nodejs": "0.16.8",
+    "@astral-sh/ruff-wasm-nodejs": "0.16.9",
     "@biomejs/js-api": "6.0.0",
     "@biomejs/wasm-nodejs": "2.5.14",
     "@getgrit/gritql": "0.0.3",
     "@iarna/toml": "2.2.5",
-    "@modelcontextprotocol/sdk": "1.30.0",
+    "@modelcontextprotocol/sdk": "1.30.1",
     "@nx/devkit": "23.2.1",
     "@nx/js": "23.2.1",
     "@nx/react": "23.2.1",
@@ -79,7 +79,7 @@
     "typescript": "6.0.3",
     "unified": "11.0.5",
     "unist-util-visit": "5.1.0",
-    "vite": "8.3.0",
+    "vite": "8.3.1",
     "vitest": "4.1.11",
     "zod": "4.6.5"
   },

package/src/infra/app/__snapshots__/generator.spec.ts.snap

@@ -50,7 +50,7 @@ exports[`infra generator > should configure Checkov target correctly > checkov-t
     "default",
   ],
   "options": {
-    "command": "uvx --from checkov==3.3.19 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+    "command": "uvx --from checkov==3.3.20 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
   },
   "outputs": [
     "{workspaceRoot}/dist/{projectRoot}/checkov",
@@ -150,7 +150,7 @@ exports[`infra generator > should configure project.json with correct targets >
         "default",
       ],
       "options": {
-        "command": "uvx --from checkov==3.3.19 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+        "command": "uvx --from checkov==3.3.20 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
       },
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/checkov",
@@ -762,7 +762,7 @@ exports[`infra generator > should handle custom project names correctly > custom
         "default",
       ],
       "options": {
-        "command": "uvx --from checkov==3.3.19 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
+        "command": "uvx --from checkov==3.3.20 checkov --config-file {projectRoot}/checkov.yml --directory dist/{projectRoot}/cdk.out --framework cloudformation",
       },
       "outputs": [
         "{workspaceRoot}/dist/{projectRoot}/checkov",

package/src/license/dependency-check/collectors/npm-collector.d.ts

@@ -7,4 +7,18 @@ export interface NpmDependency {
 export interface NpmCollectorOptions {
     start: string;
 }
+/**
+ * Resolve a license that only names a file into the license that file grants.
+ *
+ * license-checker reads a package's license file only when the package declares
+ * no license, so a package declaring `SEE LICENSE IN LICENSE` is reported as
+ * `Custom: LICENSE` and evaluates to UNKNOWN even when the file grants a
+ * pre-approved license. Read the file license-checker already located and run
+ * its text detection over it, which returns an SPDX id with the trailing `*`
+ * marking a license guessed from text.
+ *
+ * The reference is kept when the file can't be read, or when detection can't
+ * name a license, so the dependency is still reported as UNKNOWN.
+ */
+export declare const resolveFileReferencedLicense: (rawLicense: string, licenseFile: string | undefined) => string;
 export declare const collectNpmDependencies: (options: NpmCollectorOptions) => Promise<NpmDependency[]>;

package/src/license/dependency-check/collectors/npm-collector.js

@@ -3,6 +3,10 @@
  * SPDX-License-Identifier: Apache-2.0
  */ import { existsSync, readFileSync } from "fs";
 import * as licenseChecker from "license-checker-rseidelsohn";
+// license-checker's own license-from-text detection, which it applies to
+// packages that declare no license. Reused here so a `SEE LICENSE IN <file>`
+// package resolves the same way, rather than through a second implementation.
+import { getLicenseTitle } from "license-checker-rseidelsohn/lib/getLicenseTitle.js";
 import { join } from "path";
 const NAME_VERSION_RE = /^(@?[^@]+)@(.+)$/;
 const splitNameVersion = (identifier)=>{
@@ -27,6 +31,36 @@ const flattenLicense = (raw)=>{
     }
     return raw;
 };
+/**
+ * A license that names a file instead of a license: the SPDX form
+ * `SEE LICENSE IN <file>`, or the `Custom: <file>` license-checker reports it
+ * as.
+ */ const FILE_REFERENCE_RE = /^(?:custom:|see\s+license\s+in)\s+(.+)$/i;
+/**
+ * Resolve a license that only names a file into the license that file grants.
+ *
+ * license-checker reads a package's license file only when the package declares
+ * no license, so a package declaring `SEE LICENSE IN LICENSE` is reported as
+ * `Custom: LICENSE` and evaluates to UNKNOWN even when the file grants a
+ * pre-approved license. Read the file license-checker already located and run
+ * its text detection over it, which returns an SPDX id with the trailing `*`
+ * marking a license guessed from text.
+ *
+ * The reference is kept when the file can't be read, or when detection can't
+ * name a license, so the dependency is still reported as UNKNOWN.
+ */ export const resolveFileReferencedLicense = (rawLicense, licenseFile)=>{
+    if (!licenseFile || !FILE_REFERENCE_RE.test(rawLicense.trim())) {
+        return rawLicense;
+    }
+    let detected = null;
+    try {
+        detected = getLicenseTitle(readFileSync(licenseFile, 'utf-8'));
+    } catch  {
+        return rawLicense;
+    }
+    if (!detected || detected === 'Undefined' || FILE_REFERENCE_RE.test(detected)) return rawLicense;
+    return detected;
+};
 export const collectNpmDependencies = async (options)=>{
     const nodeModules = join(options.start, 'node_modules');
     if (!existsSync(nodeModules)) {
@@ -58,7 +92,7 @@ export const collectNpmDependencies = async (options)=>{
         out.push({
             name,
             version,
-            rawLicense: flattenLicense(info.licenses),
+            rawLicense: resolveFileReferencedLicense(flattenLicense(info.licenses), info.licenseFile),
             path: info.path
         });
     }

package/src/license/dependency-check/collectors/npm-collector.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/license/dependency-check/collectors/npm-collector.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { existsSync, readFileSync } from 'fs';\nimport * as licenseChecker from 'license-checker-rseidelsohn';\nimport { join } from 'path';\n\nexport interface NpmDependency {\n  name: string;\n  version: string;\n  rawLicense: string;\n  path?: string;\n}\n\nexport interface NpmCollectorOptions {\n  start: string;\n}\n\nconst NAME_VERSION_RE = /^(@?[^@]+)@(.+)$/;\n\nconst splitNameVersion = (\n  identifier: string,\n): { name: string; version: string } => {\n  const match = identifier.match(NAME_VERSION_RE);\n  if (!match) {\n    return { name: identifier, version: '0.0.0' };\n  }\n  return { name: match[1], version: match[2] };\n};\n\nconst flattenLicense = (raw: string | string[] | undefined | null): string => {\n  if (!raw) return '';\n  if (Array.isArray(raw)) {\n    if (raw.length === 0) return '';\n    if (raw.length === 1) return raw[0];\n    return `(${raw.join(' OR ')})`;\n  }\n  return raw;\n};\n\nexport const collectNpmDependencies = async (\n  options: NpmCollectorOptions,\n): Promise<NpmDependency[]> => {\n  const nodeModules = join(options.start, 'node_modules');\n  if (!existsSync(nodeModules)) {\n    return [];\n  }\n\n  const exclude = new Set<string>();\n\n  const projectPackageJson = join(options.start, 'package.json');\n  if (existsSync(projectPackageJson)) {\n    try {\n      const pkg = JSON.parse(readFileSync(projectPackageJson, 'utf-8')) as {\n        name?: string;\n      };\n      if (pkg.name) exclude.add(pkg.name);\n    } catch {\n      // ignore\n    }\n  }\n\n  const packages = await new Promise<licenseChecker.ModuleInfos>(\n    (resolve, reject) => {\n      licenseChecker.init(\n        {\n          start: options.start,\n          excludePrivatePackages: true,\n        },\n        (err, results) => {\n          if (err) reject(err);\n          else resolve(results);\n        },\n      );\n    },\n  );\n\n  const out: NpmDependency[] = [];\n  for (const [identifier, info] of Object.entries(packages)) {\n    const { name, version } = splitNameVersion(identifier);\n    if (exclude.has(name)) continue;\n    out.push({\n      name,\n      version,\n      rawLicense: flattenLicense(info.licenses),\n      path: info.path,\n    });\n  }\n  return out;\n};\n"],"names":["existsSync","readFileSync","licenseChecker","join","NAME_VERSION_RE","splitNameVersion","identifier","match","name","version","flattenLicense","raw","Array","isArray","length","collectNpmDependencies","options","nodeModules","start","exclude","Set","projectPackageJson","pkg","JSON","parse","add","packages","Promise","resolve","reject","init","excludePrivatePackages","err","results","out","info","Object","entries","has","push","rawLicense","licenses","path"],"mappings":"AAAA;;;CAGC,GACD,SAASA,UAAU,EAAEC,YAAY,QAAQ,KAAK;AAC9C,YAAYC,oBAAoB,8BAA8B;AAC9D,SAASC,IAAI,QAAQ,OAAO;AAa5B,MAAMC,kBAAkB;AAExB,MAAMC,mBAAmB,CACvBC;IAEA,MAAMC,QAAQD,WAAWC,KAAK,CAACH;IAC/B,IAAI,CAACG,OAAO;QACV,OAAO;YAAEC,MAAMF;YAAYG,SAAS;QAAQ;IAC9C;IACA,OAAO;QAAED,MAAMD,KAAK,CAAC,EAAE;QAAEE,SAASF,KAAK,CAAC,EAAE;IAAC;AAC7C;AAEA,MAAMG,iBAAiB,CAACC;IACtB,IAAI,CAACA,KAAK,OAAO;IACjB,IAAIC,MAAMC,OAAO,CAACF,MAAM;QACtB,IAAIA,IAAIG,MAAM,KAAK,GAAG,OAAO;QAC7B,IAAIH,IAAIG,MAAM,KAAK,GAAG,OAAOH,GAAG,CAAC,EAAE;QACnC,OAAO,CAAC,CAAC,EAAEA,IAAIR,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC;IACA,OAAOQ;AACT;AAEA,OAAO,MAAMI,yBAAyB,OACpCC;IAEA,MAAMC,cAAcd,KAAKa,QAAQE,KAAK,EAAE;IACxC,IAAI,CAAClB,WAAWiB,cAAc;QAC5B,OAAO,EAAE;IACX;IAEA,MAAME,UAAU,IAAIC;IAEpB,MAAMC,qBAAqBlB,KAAKa,QAAQE,KAAK,EAAE;IAC/C,IAAIlB,WAAWqB,qBAAqB;QAClC,IAAI;YACF,MAAMC,MAAMC,KAAKC,KAAK,CAACvB,aAAaoB,oBAAoB;YAGxD,IAAIC,IAAId,IAAI,EAAEW,QAAQM,GAAG,CAACH,IAAId,IAAI;QACpC,EAAE,OAAM;QACN,SAAS;QACX;IACF;IAEA,MAAMkB,WAAW,MAAM,IAAIC,QACzB,CAACC,SAASC;QACR3B,eAAe4B,IAAI,CACjB;YACEZ,OAAOF,QAAQE,KAAK;YACpBa,wBAAwB;QAC1B,GACA,CAACC,KAAKC;YACJ,IAAID,KAAKH,OAAOG;iBACXJ,QAAQK;QACf;IAEJ;IAGF,MAAMC,MAAuB,EAAE;IAC/B,KAAK,MAAM,CAAC5B,YAAY6B,KAAK,IAAIC,OAAOC,OAAO,CAACX,UAAW;QACzD,MAAM,EAAElB,IAAI,EAAEC,OAAO,EAAE,GAAGJ,iBAAiBC;QAC3C,IAAIa,QAAQmB,GAAG,CAAC9B,OAAO;QACvB0B,IAAIK,IAAI,CAAC;YACP/B;YACAC;YACA+B,YAAY9B,eAAeyB,KAAKM,QAAQ;YACxCC,MAAMP,KAAKO,IAAI;QACjB;IACF;IACA,OAAOR;AACT,EAAE"}
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/license/dependency-check/collectors/npm-collector.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { existsSync, readFileSync } from 'fs';\nimport * as licenseChecker from 'license-checker-rseidelsohn';\n// license-checker's own license-from-text detection, which it applies to\n// packages that declare no license. Reused here so a `SEE LICENSE IN <file>`\n// package resolves the same way, rather than through a second implementation.\nimport { getLicenseTitle } from 'license-checker-rseidelsohn/lib/getLicenseTitle.js';\nimport { join } from 'path';\n\nexport interface NpmDependency {\n  name: string;\n  version: string;\n  rawLicense: string;\n  path?: string;\n}\n\nexport interface NpmCollectorOptions {\n  start: string;\n}\n\nconst NAME_VERSION_RE = /^(@?[^@]+)@(.+)$/;\n\nconst splitNameVersion = (\n  identifier: string,\n): { name: string; version: string } => {\n  const match = identifier.match(NAME_VERSION_RE);\n  if (!match) {\n    return { name: identifier, version: '0.0.0' };\n  }\n  return { name: match[1], version: match[2] };\n};\n\nconst flattenLicense = (raw: string | string[] | undefined | null): string => {\n  if (!raw) return '';\n  if (Array.isArray(raw)) {\n    if (raw.length === 0) return '';\n    if (raw.length === 1) return raw[0];\n    return `(${raw.join(' OR ')})`;\n  }\n  return raw;\n};\n\n/**\n * A license that names a file instead of a license: the SPDX form\n * `SEE LICENSE IN <file>`, or the `Custom: <file>` license-checker reports it\n * as.\n */\nconst FILE_REFERENCE_RE = /^(?:custom:|see\\s+license\\s+in)\\s+(.+)$/i;\n\n/**\n * Resolve a license that only names a file into the license that file grants.\n *\n * license-checker reads a package's license file only when the package declares\n * no license, so a package declaring `SEE LICENSE IN LICENSE` is reported as\n * `Custom: LICENSE` and evaluates to UNKNOWN even when the file grants a\n * pre-approved license. Read the file license-checker already located and run\n * its text detection over it, which returns an SPDX id with the trailing `*`\n * marking a license guessed from text.\n *\n * The reference is kept when the file can't be read, or when detection can't\n * name a license, so the dependency is still reported as UNKNOWN.\n */\nexport const resolveFileReferencedLicense = (\n  rawLicense: string,\n  licenseFile: string | undefined,\n): string => {\n  if (!licenseFile || !FILE_REFERENCE_RE.test(rawLicense.trim())) {\n    return rawLicense;\n  }\n  let detected: string | null = null;\n  try {\n    detected = getLicenseTitle(readFileSync(licenseFile, 'utf-8'));\n  } catch {\n    return rawLicense;\n  }\n  if (!detected || detected === 'Undefined' || FILE_REFERENCE_RE.test(detected))\n    return rawLicense;\n  return detected;\n};\n\nexport const collectNpmDependencies = async (\n  options: NpmCollectorOptions,\n): Promise<NpmDependency[]> => {\n  const nodeModules = join(options.start, 'node_modules');\n  if (!existsSync(nodeModules)) {\n    return [];\n  }\n\n  const exclude = new Set<string>();\n\n  const projectPackageJson = join(options.start, 'package.json');\n  if (existsSync(projectPackageJson)) {\n    try {\n      const pkg = JSON.parse(readFileSync(projectPackageJson, 'utf-8')) as {\n        name?: string;\n      };\n      if (pkg.name) exclude.add(pkg.name);\n    } catch {\n      // ignore\n    }\n  }\n\n  const packages = await new Promise<licenseChecker.ModuleInfos>(\n    (resolve, reject) => {\n      licenseChecker.init(\n        {\n          start: options.start,\n          excludePrivatePackages: true,\n        },\n        (err, results) => {\n          if (err) reject(err);\n          else resolve(results);\n        },\n      );\n    },\n  );\n\n  const out: NpmDependency[] = [];\n  for (const [identifier, info] of Object.entries(packages)) {\n    const { name, version } = splitNameVersion(identifier);\n    if (exclude.has(name)) continue;\n    out.push({\n      name,\n      version,\n      rawLicense: resolveFileReferencedLicense(\n        flattenLicense(info.licenses),\n        info.licenseFile,\n      ),\n      path: info.path,\n    });\n  }\n  return out;\n};\n"],"names":["existsSync","readFileSync","licenseChecker","getLicenseTitle","join","NAME_VERSION_RE","splitNameVersion","identifier","match","name","version","flattenLicense","raw","Array","isArray","length","FILE_REFERENCE_RE","resolveFileReferencedLicense","rawLicense","licenseFile","test","trim","detected","collectNpmDependencies","options","nodeModules","start","exclude","Set","projectPackageJson","pkg","JSON","parse","add","packages","Promise","resolve","reject","init","excludePrivatePackages","err","results","out","info","Object","entries","has","push","licenses","path"],"mappings":"AAAA;;;CAGC,GACD,SAASA,UAAU,EAAEC,YAAY,QAAQ,KAAK;AAC9C,YAAYC,oBAAoB,8BAA8B;AAC9D,yEAAyE;AACzE,6EAA6E;AAC7E,8EAA8E;AAC9E,SAASC,eAAe,QAAQ,qDAAqD;AACrF,SAASC,IAAI,QAAQ,OAAO;AAa5B,MAAMC,kBAAkB;AAExB,MAAMC,mBAAmB,CACvBC;IAEA,MAAMC,QAAQD,WAAWC,KAAK,CAACH;IAC/B,IAAI,CAACG,OAAO;QACV,OAAO;YAAEC,MAAMF;YAAYG,SAAS;QAAQ;IAC9C;IACA,OAAO;QAAED,MAAMD,KAAK,CAAC,EAAE;QAAEE,SAASF,KAAK,CAAC,EAAE;IAAC;AAC7C;AAEA,MAAMG,iBAAiB,CAACC;IACtB,IAAI,CAACA,KAAK,OAAO;IACjB,IAAIC,MAAMC,OAAO,CAACF,MAAM;QACtB,IAAIA,IAAIG,MAAM,KAAK,GAAG,OAAO;QAC7B,IAAIH,IAAIG,MAAM,KAAK,GAAG,OAAOH,GAAG,CAAC,EAAE;QACnC,OAAO,CAAC,CAAC,EAAEA,IAAIR,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC;IACA,OAAOQ;AACT;AAEA;;;;CAIC,GACD,MAAMI,oBAAoB;AAE1B;;;;;;;;;;;;CAYC,GACD,OAAO,MAAMC,+BAA+B,CAC1CC,YACAC;IAEA,IAAI,CAACA,eAAe,CAACH,kBAAkBI,IAAI,CAACF,WAAWG,IAAI,KAAK;QAC9D,OAAOH;IACT;IACA,IAAII,WAA0B;IAC9B,IAAI;QACFA,WAAWnB,gBAAgBF,aAAakB,aAAa;IACvD,EAAE,OAAM;QACN,OAAOD;IACT;IACA,IAAI,CAACI,YAAYA,aAAa,eAAeN,kBAAkBI,IAAI,CAACE,WAClE,OAAOJ;IACT,OAAOI;AACT,EAAE;AAEF,OAAO,MAAMC,yBAAyB,OACpCC;IAEA,MAAMC,cAAcrB,KAAKoB,QAAQE,KAAK,EAAE;IACxC,IAAI,CAAC1B,WAAWyB,cAAc;QAC5B,OAAO,EAAE;IACX;IAEA,MAAME,UAAU,IAAIC;IAEpB,MAAMC,qBAAqBzB,KAAKoB,QAAQE,KAAK,EAAE;IAC/C,IAAI1B,WAAW6B,qBAAqB;QAClC,IAAI;YACF,MAAMC,MAAMC,KAAKC,KAAK,CAAC/B,aAAa4B,oBAAoB;YAGxD,IAAIC,IAAIrB,IAAI,EAAEkB,QAAQM,GAAG,CAACH,IAAIrB,IAAI;QACpC,EAAE,OAAM;QACN,SAAS;QACX;IACF;IAEA,MAAMyB,WAAW,MAAM,IAAIC,QACzB,CAACC,SAASC;QACRnC,eAAeoC,IAAI,CACjB;YACEZ,OAAOF,QAAQE,KAAK;YACpBa,wBAAwB;QAC1B,GACA,CAACC,KAAKC;YACJ,IAAID,KAAKH,OAAOG;iBACXJ,QAAQK;QACf;IAEJ;IAGF,MAAMC,MAAuB,EAAE;IAC/B,KAAK,MAAM,CAACnC,YAAYoC,KAAK,IAAIC,OAAOC,OAAO,CAACX,UAAW;QACzD,MAAM,EAAEzB,IAAI,EAAEC,OAAO,EAAE,GAAGJ,iBAAiBC;QAC3C,IAAIoB,QAAQmB,GAAG,CAACrC,OAAO;QACvBiC,IAAIK,IAAI,CAAC;YACPtC;YACAC;YACAQ,YAAYD,6BACVN,eAAegC,KAAKK,QAAQ,GAC5BL,KAAKxB,WAAW;YAElB8B,MAAMN,KAAKM,IAAI;QACjB;IACF;IACA,OAAOP;AACT,EAAE"}

package/src/migrations/v1.0.3/0001-terraform-init-target/migration.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../packages/nx-plugin/src/migrations/v1.0.3/0001-terraform-init-target/migration.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport {\n  getProjects,\n  joinPathFragments,\n  type MigrationReturnObject,\n  type TargetConfiguration,\n  type Tree,\n  updateProjectConfiguration,\n} from '@nx/devkit';\nimport { relative } from 'path';\nimport { TERRAFORM_PROJECT_GENERATOR_INFO } from '../../../terraform/project/generator.js';\nimport { formatFilesInSubtree } from '../../../utils/format.js';\nimport { sortObjectKeys } from '../../../utils/object.js';\n\n/**\n * Give the shared Terraform provider plugin cache a single writer.\n *\n * `init`, `test` and `validate` each ran their own `terraform init` against one\n * per-project cache, and Nx schedules them concurrently — `plan` depends on both\n * `init` and `validate`. Two `terraform init` runs filling the cache at once each\n * compute a different hash for the same provider, because the hash covers a\n * directory the other is still writing, and terraform then rejects the mismatch\n * against the lock file: \"the cached package ... does not match any of the\n * checksums recorded in the dependency lock file\".\n *\n * The new `terraform-init` target runs that init once, and `test`, `validate` and\n * `init` depend on it — `test` and `validate` now run against the `TF_DATA_DIR`\n * it prepared rather than initialising their own.\n */\n\nconst TERRAFORM_INIT = 'terraform-init';\n\n/** `terraform init` as the pre-fix `test` and `validate` targets ran it. */\nconst BACKENDLESS_INIT = 'terraform init -backend=false';\n\nconst divergedStep = (projectName: string, targetName: string) =>\n  `${projectName}: its '${targetName}' target no longer matches the shape the generator produced - left untouched. Point it at the \\`TF_DATA_DIR\\` of the new \\`${TERRAFORM_INIT}\\` target and add \\`\"dependsOn\": [\"${TERRAFORM_INIT}\"]\\`, so its \\`terraform init\\` no longer races the other targets over the provider cache.`;\n\n/** Path from a target running in `{projectRoot}/src` back to the workspace root. */\nconst rootRelativePath = (projectRoot: string) =>\n  relative(joinPathFragments(projectRoot, 'src'), '.').replace(/\\\\/g, '/');\n\nconst pluginCacheDirFor = (toRoot: string) =>\n  joinPathFragments(toRoot, '.terraform', 'plugin-cache', '{projectRoot}');\n\nconst dataDirFor = (toRoot: string, name: string) =>\n  joinPathFragments(toRoot, 'dist', '{projectRoot}', name);\n\n/**\n * The target as the generator vends it: `-backend=false` needs no credentials,\n * so this runs on a fresh workspace before `bootstrap`, and its `TF_DATA_DIR`\n * keeps the `.terraform` it initialises out of `src`.\n */\nconst terraformInitTarget = (projectRoot: string): TargetConfiguration => {\n  const toRoot = rootRelativePath(projectRoot);\n  const pluginCacheDir = pluginCacheDirFor(toRoot);\n  return {\n    executor: 'nx:run-commands',\n    options: {\n      commands: [\n        { command: `shx mkdir -p ${pluginCacheDir}`, forwardAllArgs: false },\n        BACKENDLESS_INIT,\n      ],\n      forwardAllArgs: true,\n      cwd: '{projectRoot}/src',\n      parallel: false,\n      env: {\n        TF_DATA_DIR: dataDirFor(toRoot, TERRAFORM_INIT),\n        TF_PLUGIN_CACHE_DIR: pluginCacheDir,\n      },\n    },\n  };\n};\n\n/** Every command a target runs, across its options and its configurations. */\nconst commandsOf = (target: TargetConfiguration): string[] =>\n  [target.options, ...Object.values(target.configurations ?? {})]\n    .flatMap(\n      (holder: { command?: unknown; commands?: unknown } | undefined) => [\n        holder?.command,\n        ...(Array.isArray(holder?.commands) ? holder.commands : []),\n      ],\n    )\n    .map((command) =>\n      typeof command === 'string'\n        ? command\n        : (command as { command?: unknown } | undefined)?.command,\n    )\n    .filter((command): command is string => typeof command === 'string');\n\n/**\n * Whether the target still runs the `terraform init` this migration orders. A\n * library's `init` runs it directly and an application's delegates to the vended\n * script.\n */\nconst runsTerraformInit = (target: TargetConfiguration): boolean =>\n  commandsOf(target).some(\n    (command) =>\n      command.includes('terraform init') || command.includes('scripts/init.ts'),\n  );\n\n/** Creating the plugin cache directory, which `terraform-init` now does. */\nconst isMakeCacheDir = (command: string) =>\n  /^(shx mkdir -p|make-dir)\\s/.test(command) &&\n  command.includes('plugin-cache');\n\n/**\n * Rewrites `test` or `validate` to run against the `TF_DATA_DIR` `terraform-init`\n * prepared. Only the exact shape the generator produced is rewritten: its own\n * `terraform init` (with the cache directory the plugin-cache fix added ahead of\n * it), then the one terraform command the target exists to run. Anything else is\n * the user's, and is reported instead.\n */\nconst migrateInitlessTarget = (\n  target: TargetConfiguration,\n  verb: 'test' | 'validate',\n  toRoot: string,\n): boolean => {\n  const commands = commandsOf(target).filter(\n    (command) => !isMakeCacheDir(command),\n  );\n  if (\n    commands.length !== 2 ||\n    commands[0] !== BACKENDLESS_INIT ||\n    commands[1] !== `terraform ${verb}`\n  ) {\n    return false;\n  }\n  const options = target.options ?? {};\n  const env: Record<string, string> = options.env ?? {};\n  if (env.TF_DATA_DIR !== dataDirFor(toRoot, `terraform-${verb}`)) {\n    return false;\n  }\n\n  const {\n    TF_DATA_DIR: _dataDir,\n    TF_PLUGIN_CACHE_DIR: _cacheDir,\n    ...rest\n  } = env;\n  delete options.commands;\n  // `parallel: false` sequenced the init ahead of the command; one command left.\n  delete options.parallel;\n  target.options = {\n    ...options,\n    command: `terraform ${verb}`,\n    env: { ...rest, TF_DATA_DIR: dataDirFor(toRoot, TERRAFORM_INIT) },\n  };\n  return true;\n};\n\nexport default async function migration(\n  tree: Tree,\n): Promise<MigrationReturnObject> {\n  const nextSteps: string[] = [];\n\n  for (const [projectName, project] of getProjects(tree)) {\n    const generator = (project.metadata as { generator?: string } | undefined)\n      ?.generator;\n    if (generator !== TERRAFORM_PROJECT_GENERATOR_INFO.id) continue;\n\n    let targets = project.targets ?? {};\n    const toRoot = rootRelativePath(project.root);\n    let changed = false;\n\n    // Guarded on the target being absent, so a re-run — and a project generated\n    // with it — is a no-op.\n    if (!targets[TERRAFORM_INIT]) {\n      targets = sortObjectKeys({\n        ...targets,\n        [TERRAFORM_INIT]: terraformInitTarget(project.root),\n      });\n      changed = true;\n    }\n\n    for (const targetName of ['init', 'test', 'validate'] as const) {\n      const target = targets[targetName];\n      if (!target) continue;\n      if (target.dependsOn?.includes(TERRAFORM_INIT)) continue;\n\n      // `init` keeps its own backend-configured `terraform init`; `test` and\n      // `validate` hand theirs over to `terraform-init`, so nothing is ordered\n      // after a target whose shape is no longer recognised.\n      const migrated =\n        targetName === 'init'\n          ? runsTerraformInit(target)\n          : migrateInitlessTarget(target, targetName, toRoot);\n      if (!migrated) {\n        nextSteps.push(divergedStep(projectName, targetName));\n        continue;\n      }\n\n      // Prepended rather than appended, so a migrated workspace matches a\n      // freshly generated one.\n      target.dependsOn = [TERRAFORM_INIT, ...(target.dependsOn ?? [])];\n      changed = true;\n    }\n\n    if (changed) {\n      updateProjectConfiguration(tree, projectName, { ...project, targets });\n    }\n  }\n\n  await formatFilesInSubtree(tree);\n\n  return { nextSteps };\n}\n"],"names":["getProjects","joinPathFragments","updateProjectConfiguration","relative","TERRAFORM_PROJECT_GENERATOR_INFO","formatFilesInSubtree","sortObjectKeys","TERRAFORM_INIT","BACKENDLESS_INIT","divergedStep","projectName","targetName","rootRelativePath","projectRoot","replace","pluginCacheDirFor","toRoot","dataDirFor","name","terraformInitTarget","pluginCacheDir","executor","options","commands","command","forwardAllArgs","cwd","parallel","env","TF_DATA_DIR","TF_PLUGIN_CACHE_DIR","commandsOf","target","Object","values","configurations","flatMap","holder","Array","isArray","map","filter","runsTerraformInit","some","includes","isMakeCacheDir","test","migrateInitlessTarget","verb","length","_dataDir","_cacheDir","rest","migration","tree","nextSteps","project","generator","metadata","id","targets","root","changed","dependsOn","migrated","push"],"mappings":"AAAA;;;CAGC,GACD,SACEA,WAAW,EACXC,iBAAiB,EAIjBC,0BAA0B,QACrB,aAAa;AACpB,SAASC,QAAQ,QAAQ,OAAO;AAChC,SAASC,gCAAgC,QAAQ,0CAA0C;AAC3F,SAASC,oBAAoB,QAAQ,2BAA2B;AAChE,SAASC,cAAc,QAAQ,2BAA2B;AAE1D;;;;;;;;;;;;;;CAcC,GAED,MAAMC,iBAAiB;AAEvB,0EAA0E,GAC1E,MAAMC,mBAAmB;AAEzB,MAAMC,eAAe,CAACC,aAAqBC,aACzC,GAAGD,YAAY,OAAO,EAAEC,WAAW,2HAA2H,EAAEJ,eAAe,mCAAmC,EAAEA,eAAe,0FAA0F,CAAC;AAEhU,kFAAkF,GAClF,MAAMK,mBAAmB,CAACC,cACxBV,SAASF,kBAAkBY,aAAa,QAAQ,KAAKC,OAAO,CAAC,OAAO;AAEtE,MAAMC,oBAAoB,CAACC,SACzBf,kBAAkBe,QAAQ,cAAc,gBAAgB;AAE1D,MAAMC,aAAa,CAACD,QAAgBE,OAClCjB,kBAAkBe,QAAQ,QAAQ,iBAAiBE;AAErD;;;;CAIC,GACD,MAAMC,sBAAsB,CAACN;IAC3B,MAAMG,SAASJ,iBAAiBC;IAChC,MAAMO,iBAAiBL,kBAAkBC;IACzC,OAAO;QACLK,UAAU;QACVC,SAAS;YACPC,UAAU;gBACR;oBAAEC,SAAS,CAAC,aAAa,EAAEJ,gBAAgB;oBAAEK,gBAAgB;gBAAM;gBACnEjB;aACD;YACDiB,gBAAgB;YAChBC,KAAK;YACLC,UAAU;YACVC,KAAK;gBACHC,aAAaZ,WAAWD,QAAQT;gBAChCuB,qBAAqBV;YACvB;QACF;IACF;AACF;AAEA,4EAA4E,GAC5E,MAAMW,aAAa,CAACC,SAClB;QAACA,OAAOV,OAAO;WAAKW,OAAOC,MAAM,CAACF,OAAOG,cAAc,IAAI,CAAC;KAAG,CAC5DC,OAAO,CACN,CAACC,SAAkE;YACjEA,QAAQb;eACJc,MAAMC,OAAO,CAACF,QAAQd,YAAYc,OAAOd,QAAQ,GAAG,EAAE;SAC3D,EAEFiB,GAAG,CAAC,CAAChB,UACJ,OAAOA,YAAY,WACfA,UACCA,SAA+CA,SAErDiB,MAAM,CAAC,CAACjB,UAA+B,OAAOA,YAAY;AAE/D;;;;CAIC,GACD,MAAMkB,oBAAoB,CAACV,SACzBD,WAAWC,QAAQW,IAAI,CACrB,CAACnB,UACCA,QAAQoB,QAAQ,CAAC,qBAAqBpB,QAAQoB,QAAQ,CAAC;AAG7D,0EAA0E,GAC1E,MAAMC,iBAAiB,CAACrB,UACtB,6BAA6BsB,IAAI,CAACtB,YAClCA,QAAQoB,QAAQ,CAAC;AAEnB;;;;;;CAMC,GACD,MAAMG,wBAAwB,CAC5Bf,QACAgB,MACAhC;IAEA,MAAMO,WAAWQ,WAAWC,QAAQS,MAAM,CACxC,CAACjB,UAAY,CAACqB,eAAerB;IAE/B,IACED,SAAS0B,MAAM,KAAK,KACpB1B,QAAQ,CAAC,EAAE,KAAKf,oBAChBe,QAAQ,CAAC,EAAE,KAAK,CAAC,UAAU,EAAEyB,MAAM,EACnC;QACA,OAAO;IACT;IACA,MAAM1B,UAAUU,OAAOV,OAAO,IAAI,CAAC;IACnC,MAAMM,MAA8BN,QAAQM,GAAG,IAAI,CAAC;IACpD,IAAIA,IAAIC,WAAW,KAAKZ,WAAWD,QAAQ,CAAC,UAAU,EAAEgC,MAAM,GAAG;QAC/D,OAAO;IACT;IAEA,MAAM,EACJnB,aAAaqB,QAAQ,EACrBpB,qBAAqBqB,SAAS,EAC9B,GAAGC,MACJ,GAAGxB;IACJ,OAAON,QAAQC,QAAQ;IACvB,+EAA+E;IAC/E,OAAOD,QAAQK,QAAQ;IACvBK,OAAOV,OAAO,GAAG;QACf,GAAGA,OAAO;QACVE,SAAS,CAAC,UAAU,EAAEwB,MAAM;QAC5BpB,KAAK;YAAE,GAAGwB,IAAI;YAAEvB,aAAaZ,WAAWD,QAAQT;QAAgB;IAClE;IACA,OAAO;AACT;AAEA,eAAe,eAAe8C,UAC5BC,IAAU;IAEV,MAAMC,YAAsB,EAAE;IAE9B,KAAK,MAAM,CAAC7C,aAAa8C,QAAQ,IAAIxD,YAAYsD,MAAO;QACtD,MAAMG,YAAaD,QAAQE,QAAQ,EAC/BD;QACJ,IAAIA,cAAcrD,iCAAiCuD,EAAE,EAAE;QAEvD,IAAIC,UAAUJ,QAAQI,OAAO,IAAI,CAAC;QAClC,MAAM5C,SAASJ,iBAAiB4C,QAAQK,IAAI;QAC5C,IAAIC,UAAU;QAEd,4EAA4E;QAC5E,wBAAwB;QACxB,IAAI,CAACF,OAAO,CAACrD,eAAe,EAAE;YAC5BqD,UAAUtD,eAAe;gBACvB,GAAGsD,OAAO;gBACV,CAACrD,eAAe,EAAEY,oBAAoBqC,QAAQK,IAAI;YACpD;YACAC,UAAU;QACZ;QAEA,KAAK,MAAMnD,cAAc;YAAC;YAAQ;YAAQ;SAAW,CAAW;YAC9D,MAAMqB,SAAS4B,OAAO,CAACjD,WAAW;YAClC,IAAI,CAACqB,QAAQ;YACb,IAAIA,OAAO+B,SAAS,EAAEnB,SAASrC,iBAAiB;YAEhD,uEAAuE;YACvE,yEAAyE;YACzE,sDAAsD;YACtD,MAAMyD,WACJrD,eAAe,SACX+B,kBAAkBV,UAClBe,sBAAsBf,QAAQrB,YAAYK;YAChD,IAAI,CAACgD,UAAU;gBACbT,UAAUU,IAAI,CAACxD,aAAaC,aAAaC;gBACzC;YACF;YAEA,oEAAoE;YACpE,yBAAyB;YACzBqB,OAAO+B,SAAS,GAAG;gBAACxD;mBAAoByB,OAAO+B,SAAS,IAAI,EAAE;aAAE;YAChED,UAAU;QACZ;QAEA,IAAIA,SAAS;YACX5D,2BAA2BoD,MAAM5C,aAAa;gBAAE,GAAG8C,OAAO;gBAAEI;YAAQ;QACtE;IACF;IAEA,MAAMvD,qBAAqBiD;IAE3B,OAAO;QAAEC;IAAU;AACrB"}

package/src/py/agent/__snapshots__/generator.constructs.spec.ts.snap

@@ -766,12 +766,12 @@ dependencies = [
   "aws-lambda-powertools==3.35.0",
   "aws-opentelemetry-distro==0.20.0",
   "bedrock-agentcore==1.23.1",
-  "boto3==1.43.98",
+  "boto3==1.43.103",
   "fastapi==0.141.1",
   "mcp==1.28.1",
-  "strands-agents==1.56.0",
+  "strands-agents==1.57.1",
   "strands-agents-tools==0.8.9",
-  "uvicorn==0.53.0"
+  "uvicorn==0.54.0"
 ]
 
 [dependency-groups]

package/src/py/agent/__snapshots__/generator.frameworks.spec.ts.snap

@@ -704,17 +704,17 @@ dependencies = [
   "aws-lambda-powertools==3.35.0",
   "aws-opentelemetry-distro==0.20.0",
   "bedrock-agentcore==1.23.1",
-  "boto3==1.43.98",
+  "boto3==1.43.103",
   "fastapi==0.141.1",
   "mcp==1.28.1",
   "langchain==1.4.2",
-  "langchain-aws==1.7.8",
+  "langchain-aws==1.7.9",
   "langgraph==1.2.12",
   "langgraph-checkpoint-sqlite==3.1.1",
   "aiosqlite==0.22.1",
   "ag-ui-protocol==0.1.22",
   "ag-ui-langgraph==0.0.45",
-  "uvicorn==0.53.0"
+  "uvicorn==0.54.0"
 ]
 
 [dependency-groups]

package/src/py/agent/__snapshots__/generator.protocols.spec.ts.snap

@@ -1063,7 +1063,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.98 python -c "
+      uv run --with boto3==1.43.103 python -c "
 import boto3
 import json
 import os

package/src/py/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -514,7 +514,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.98 python -c "
+      uv run --with boto3==1.43.103 python -c "
 import boto3
 import json
 import os
@@ -803,8 +803,8 @@ version = "0.1.0"
 dependencies = [
   "aws-lambda-powertools==3.35.0",
   "mcp==1.28.1",
-  "uvicorn==0.53.0",
-  "boto3==1.43.98",
+  "uvicorn==0.54.0",
+  "boto3==1.43.103",
   "aws-opentelemetry-distro==0.20.0"
 ]
 

package/src/py/rdb/__snapshots__/generator.spec.ts.snap

@@ -1491,11 +1491,11 @@ description = "Automatically generated by Nx."
 requires-python = ">=3.14"
 readme = "README.md"
 dependencies = [
-  "sqlmodel==0.0.42",
+  "sqlmodel==0.0.47",
   "alembic==1.20.0",
   "greenlet==3.5.6",
   "asyncpg==0.31.0",
-  "boto3==1.43.98",
+  "boto3==1.43.103",
   "aws-lambda-powertools==3.35.0"
 ]
 

package/src/smithy/project/__snapshots__/generator.spec.ts.snap

@@ -45,7 +45,7 @@ exports[`smithyProjectGenerator > shape libraries > should generate a shape libr
           "shx rm -rf dist/{projectRoot}/build",
           "shx rm -rf dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build",
-          "npx -y mise@2026.9.12 exec smithy@1.73.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
+          "npx -y mise@2026.9.14 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
           "shx cp dist/{projectRoot}/smithy/source/model/model.json dist/{projectRoot}/build/model.json"
         ],
         "parallel": false,
@@ -62,7 +62,7 @@ exports[`smithyProjectGenerator > shape libraries > should generate a shape libr
   "version": "1.0",
   "sources": ["src/"],
   "maven": {
-    "dependencies": ["software.amazon.smithy:smithy-model:1.73.0"]
+    "dependencies": ["software.amazon.smithy:smithy-model:1.74.0"]
   }
 }
 "
@@ -122,7 +122,7 @@ exports[`smithyProjectGenerator > should generate smithy project with all custom
           "shx rm -rf dist/{projectRoot}/build",
           "shx rm -rf dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build",
-          "npx -y mise@2026.9.12 exec smithy@1.73.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
+          "npx -y mise@2026.9.14 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build/openapi",
           "shx cp \\"dist/{projectRoot}/smithy/source/openapi/*.openapi.json\\" dist/{projectRoot}/build/openapi/openapi.json"
         ],
@@ -180,7 +180,7 @@ exports[`smithyProjectGenerator > should generate smithy project with custom dir
           "shx rm -rf dist/{projectRoot}/build",
           "shx rm -rf dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build",
-          "npx -y mise@2026.9.12 exec smithy@1.73.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
+          "npx -y mise@2026.9.14 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build/openapi",
           "shx cp \\"dist/{projectRoot}/smithy/source/openapi/*.openapi.json\\" dist/{projectRoot}/build/openapi/openapi.json"
         ],
@@ -330,7 +330,7 @@ exports[`smithyProjectGenerator > should generate smithy project with default op
           "shx rm -rf dist/{projectRoot}/build",
           "shx rm -rf dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build",
-          "npx -y mise@2026.9.12 exec smithy@1.73.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
+          "npx -y mise@2026.9.14 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build/openapi",
           "shx cp \\"dist/{projectRoot}/smithy/source/openapi/*.openapi.json\\" dist/{projectRoot}/build/openapi/openapi.json"
         ],
@@ -375,11 +375,11 @@ exports[`smithyProjectGenerator > should generate smithy project with default op
   },
   "maven": {
     "dependencies": [
-      "software.amazon.smithy:smithy-model:1.73.0",
-      "software.amazon.smithy:smithy-aws-traits:1.73.0",
-      "software.amazon.smithy:smithy-validation-model:1.73.0",
-      "software.amazon.smithy:smithy-openapi:1.73.0",
-      "software.amazon.smithy.typescript:smithy-aws-typescript-codegen:0.53.0"
+      "software.amazon.smithy:smithy-model:1.74.0",
+      "software.amazon.smithy:smithy-aws-traits:1.74.0",
+      "software.amazon.smithy:smithy-validation-model:1.74.0",
+      "software.amazon.smithy:smithy-openapi:1.74.0",
+      "software.amazon.smithy.typescript:smithy-aws-typescript-codegen:0.54.0"
     ]
   }
 }
@@ -474,7 +474,7 @@ exports[`smithyProjectGenerator > should generate smithy project with subdirecto
           "shx rm -rf dist/{projectRoot}/build",
           "shx rm -rf dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build",
-          "npx -y mise@2026.9.12 exec smithy@1.73.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
+          "npx -y mise@2026.9.14 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build/openapi",
           "shx cp \\"dist/{projectRoot}/smithy/source/openapi/*.openapi.json\\" dist/{projectRoot}/build/openapi/openapi.json"
         ],
@@ -565,11 +565,11 @@ exports[`smithyProjectGenerator > should handle kebab-case conversion for servic
   },
   "maven": {
     "dependencies": [
-      "software.amazon.smithy:smithy-model:1.73.0",
-      "software.amazon.smithy:smithy-aws-traits:1.73.0",
-      "software.amazon.smithy:smithy-validation-model:1.73.0",
-      "software.amazon.smithy:smithy-openapi:1.73.0",
-      "software.amazon.smithy.typescript:smithy-aws-typescript-codegen:0.53.0"
+      "software.amazon.smithy:smithy-model:1.74.0",
+      "software.amazon.smithy:smithy-aws-traits:1.74.0",
+      "software.amazon.smithy:smithy-validation-model:1.74.0",
+      "software.amazon.smithy:smithy-openapi:1.74.0",
+      "software.amazon.smithy.typescript:smithy-aws-typescript-codegen:0.54.0"
     ]
   }
 }

package/src/smithy/ts/api/__snapshots__/generator.spec.ts.snap

@@ -2113,7 +2113,7 @@ exports[`tsSmithyApiGenerator > should generate smithy ts api with default optio
           "shx rm -rf dist/{projectRoot}/build",
           "shx rm -rf dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build",
-          "npx -y mise@2026.9.12 exec smithy@1.73.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
+          "npx -y mise@2026.9.14 exec smithy@1.74.0 -- smithy build -c {projectRoot}/smithy-build.json --output dist/{projectRoot}/smithy",
           "shx mkdir -p dist/{projectRoot}/build/openapi",
           "shx cp \\"dist/{projectRoot}/smithy/source/openapi/*.openapi.json\\" dist/{projectRoot}/build/openapi/openapi.json"
         ],

package/src/ts/agent/__snapshots__/generator.spec.ts.snap

@@ -650,7 +650,7 @@ RUN apt-get update && \\
     rm -rf /var/lib/apt/lists/*
 
 # Upgrade npm to a version free of known HIGH/CRITICAL vulnerabilities
-RUN npm install -g npm@12.0.2
+RUN npm install -g npm@12.1.0
 
 WORKDIR /app
 
@@ -1666,7 +1666,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.98 python -c "
+      uv run --with boto3==1.43.103 python -c "
 import boto3
 import json
 import os

package/src/ts/mcp-server/__snapshots__/generator.spec.ts.snap

@@ -514,7 +514,7 @@ resource "null_resource" "runtime_ready" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.98 python -c "
+      uv run --with boto3==1.43.103 python -c "
 import boto3
 import json
 import os

package/src/ts/rdb/__snapshots__/generator.spec.ts.snap

@@ -4520,7 +4520,7 @@ exports[`ts#rdb generator > should generate the aurora shared construct 4`] = `
 "FROM public.ecr.aws/lambda/nodejs:24
 
 # Upgrade npm to a version free of known HIGH/CRITICAL vulnerabilities
-RUN npm install -g npm@12.0.2
+RUN npm install -g npm@12.1.0
 
 # Patch OS packages beyond the base image's pinned release, and drop the
 # runtime's convenience copy of the AWS SDK (the handler bundle inlines its

package/src/ts/react-website/app/__snapshots__/generator.spec.ts.snap

@@ -745,7 +745,7 @@ resource "null_resource" "upload_website_files" {
   provisioner "local-exec" {
     command = <<-EOT
       cd "$ROOT_PATH"
-      uv run --with boto3==1.43.98 python3 -c "
+      uv run --with boto3==1.43.103 python3 -c "
 import os
 import sys
 import boto3
@@ -868,7 +868,7 @@ resource "null_resource" "cloudfront_invalidation" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.98 python3 -c "
+      uv run --with boto3==1.43.103 python3 -c "
 import boto3
 import os
 import sys
@@ -2325,18 +2325,18 @@ exports[`react-website generator > Tanstack router integration > should generate
   - test-app
   - packages/common/*
 catalog:
-  '@types/node': 26.6.2
-  vite: 8.3.0
+  '@types/node': 26.6.3
+  vite: 8.3.1
   vitest: 4.1.11
   '@vitest/coverage-v8': 4.1.11
   jsdom: 29.1.1
   '@nx/vitest': 23.2.1
   constructs: 10.8.1
-  aws-cdk-lib: 2.270.0
+  aws-cdk-lib: 2.271.0
   react: 19.3.0
   react-dom: 19.3.0
-  '@cloudscape-design/components': 3.0.1382
-  '@cloudscape-design/board-components': 3.0.232
+  '@cloudscape-design/components': 3.0.1387
+  '@cloudscape-design/board-components': 3.0.234
   '@cloudscape-design/global-styles': 1.0.70
   tailwindcss: 4.3.3
   '@nx/react': 23.2.1
@@ -4205,21 +4205,21 @@ exports[`react-website generator > Tanstack router integration > should generate
   - test-app
   - packages/common/*
 catalog:
-  '@types/node': 26.6.2
-  vite: 8.3.0
+  '@types/node': 26.6.3
+  vite: 8.3.1
   vitest: 4.1.11
   '@vitest/coverage-v8': 4.1.11
   jsdom: 29.1.1
   '@nx/vitest': 23.2.1
   constructs: 10.8.1
-  aws-cdk-lib: 2.270.0
+  aws-cdk-lib: 2.271.0
   react: 19.3.0
   react-dom: 19.3.0
-  '@cloudscape-design/components': 3.0.1382
-  '@cloudscape-design/board-components': 3.0.232
+  '@cloudscape-design/components': 3.0.1387
+  '@cloudscape-design/board-components': 3.0.234
   '@cloudscape-design/global-styles': 1.0.70
   tailwindcss: 4.3.3
-  '@tanstack/react-router': 1.170.38
+  '@tanstack/react-router': 1.170.39
   '@nx/react': 23.2.1
   '@vitest/ui': 4.1.11
   '@tailwindcss/vite': 4.3.3

package/src/ts/react-website/cognito-auth/__snapshots__/generator.terraform.spec.ts.snap

@@ -67,7 +67,7 @@ resource "null_resource" "add_callback_url" {
 
   provisioner "local-exec" {
     command = <<-EOT
-      uv run --with boto3==1.43.98 python -c "
+      uv run --with boto3==1.43.103 python -c "
 import boto3
 import os
 import sys

package/src/utils/docker.d.ts

@@ -25,7 +25,7 @@ export declare const IMAGE_BUILD_CACHE = false;
  * version to install globally, and the versions its dependency overrides pin.
  */
 export declare const nodeImageVersions: () => {
-    npmVersion: "12.0.2";
+    npmVersion: "12.1.0";
     minimatchVersion: "10.2.6";
 };
 /**