@aws/nx-plugin 1.0.9 → 1.0.11

package/src/utils/version-lockstep/exact-dependency.js

@@ -0,0 +1,136 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { coerce, satisfies, valid } from "semver";
+/** The bare version in a pin, whatever range syntax it was written with. */ const bare = (version)=>coerce(version, {
+        includePrerelease: true
+    })?.version;
+const message = (error)=>error instanceof Error ? error.message : String(error);
+/**
+ * The versions the source's `dependencies` give its followers, and the version
+ * of the follower each group mate is grouped with, so the group stays in step.
+ */ const targetsFrom = ({ source, followers }, sourceVersion, dependencies, groups, current)=>{
+    const missing = followers.filter((name)=>!dependencies[name]);
+    if (missing.length > 0) {
+        return {
+            held: `${source} ${sourceVersion} does not depend on ${missing.join(', ')}`
+        };
+    }
+    // Releases so far declare exact versions. If one declares a range, take its
+    // bare version: our pins are exact, and a single copy needs that version.
+    const targets = new Map(followers.map((name)=>{
+        const declared = dependencies[name];
+        return [
+            name,
+            valid(declared) ?? bare(declared) ?? declared
+        ];
+    }));
+    for (const group of groups){
+        const inGroup = followers.filter((name)=>group.includes(name));
+        if (inGroup.length === 0) continue;
+        const version = targets.get(inGroup[0]);
+        const disagreeing = inGroup.find((name)=>targets.get(name) !== version);
+        if (disagreeing) {
+            return {
+                held: `${source} ${sourceVersion} depends on ${inGroup[0]} ${version} but ${disagreeing} ${targets.get(disagreeing)}, which must move in step`
+            };
+        }
+        for (const name of group){
+            if (!targets.has(name) && current[name] !== undefined) {
+                targets.set(name, version);
+            }
+        }
+    }
+    return targets;
+};
+/** Why the peers being written would reject the targets, if they would. */ const unmetPeers = async ({ source, peers }, sourceVersion, targets, written, lookup)=>{
+    const unmet = [];
+    for (const peer of peers){
+        const peerVersion = written(peer);
+        if (peerVersion === undefined) continue;
+        let ranges;
+        try {
+            ranges = await lookup(peer, peerVersion, 'peerDependencies');
+        } catch (error) {
+            return `could not read the peerDependencies of ${peer} ${peerVersion} (${message(error)})`;
+        }
+        for (const [name, version] of targets){
+            const range = ranges[name];
+            if (range && !satisfies(version, range, {
+                includePrerelease: true
+            })) {
+                unmet.push(`${peer} ${peerVersion} requires ${name} ${range}, but ${source} ${sourceVersion} needs ${version}`);
+            }
+        }
+    }
+    return unmet.length > 0 ? unmet.join('; ') : undefined;
+};
+/**
+ * Set each rule's followers, and their lockstep group mates, to the exact
+ * versions the source being written depends on. Runs after the lockstep, which
+ * can only hold a group back and so can't move one up to what the source needs.
+ *
+ * Mutates `proposed`, which holds versions not yet written anywhere. When a peer
+ * would reject the result, or a manifest can't be read, every pin the rule covers
+ * is put back to `current` for this run instead. Returns a note for each pin set
+ * and each rule held, so the reason reaches the update's PR.
+ */ export const pinToExactDependencies = async (rules, groups, current, proposed, lookup)=>{
+    const notes = [];
+    const written = (name)=>{
+        const version = proposed[name] ?? current[name];
+        return version === undefined ? undefined : bare(version);
+    };
+    for (const rule of rules){
+        const { source, followers, peers, reason } = rule;
+        const mates = groups.filter((group)=>followers.some((name)=>group.includes(name))).flat();
+        const covered = [
+            ...new Set([
+                source,
+                ...followers,
+                ...mates,
+                ...peers
+            ])
+        ].filter((name)=>current[name] !== undefined);
+        // Every pin the rule covers goes back to its current version, so nothing
+        // the rule could not check is written.
+        const hold = (why)=>{
+            const notTaken = covered.filter((name)=>proposed[name] !== undefined && proposed[name] !== current[name]);
+            notes.push({
+                name: source,
+                note: `${source} held at ${current[source]}, with ${covered.filter((name)=>name !== source).join(', ')} at their current versions` + (notTaken.length > 0 ? ` (not taken: ${notTaken.map((name)=>`${name} ${proposed[name]}`).join(', ')})` : '') + `: ${why}`
+            });
+            for (const name of covered)proposed[name] = current[name];
+        };
+        const sourceVersion = written(source);
+        if (sourceVersion === undefined) continue;
+        let dependencies;
+        try {
+            dependencies = await lookup(source, sourceVersion, 'dependencies');
+        } catch (error) {
+            hold(`could not read the dependencies of ${source} ${sourceVersion} (${message(error)})`);
+            continue;
+        }
+        const targets = targetsFrom(rule, sourceVersion, dependencies, groups, current);
+        if (!(targets instanceof Map)) {
+            hold(targets.held);
+            continue;
+        }
+        const unmet = await unmetPeers(rule, sourceVersion, targets, written, lookup);
+        if (unmet) {
+            hold(unmet);
+            continue;
+        }
+        for (const [name, version] of targets){
+            const before = proposed[name] ?? current[name];
+            if (before === version) continue;
+            proposed[name] = version;
+            notes.push({
+                name,
+                note: `${name} set to ${version} (${before} proposed) to match the exact dependencies of ${source} ${sourceVersion}: ${reason}`
+            });
+        }
+    }
+    return notes;
+};
+
+//# sourceMappingURL=exact-dependency.js.map

package/src/utils/version-lockstep/exact-dependency.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-lockstep/exact-dependency.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { coerce, satisfies, valid } from 'semver';\nimport type {\n  IVersionedDep,\n  LockstepNote,\n  ProposedVersions,\n} from './lockstep.js';\n\n/**\n * Pins that must equal the exact `dependencies` a published release of another\n * pin declares, for packages that don't share a version line.\n */\nexport interface ExactDependencyPin {\n  /** The pin whose published `dependencies` the followers take. */\n  source: IVersionedDep;\n  /** Pins set to exactly the version `source` depends on. */\n  followers: readonly [IVersionedDep, ...IVersionedDep[]];\n  /** Pins whose published `peerDependencies` must accept the followers. */\n  peers: readonly IVersionedDep[];\n  /** Why the followers must match, for the update's PR. */\n  reason: string;\n}\n\n/** The manifest fields the rule reads. */\nexport type ManifestField = 'dependencies' | 'peerDependencies';\n\n/**\n * Reads one field of a published release's manifest, for example from\n * `https://registry.npmjs.org/<name>/<version>`. Resolves to `{}` when the\n * release has no such field, and rejects when the release can't be read.\n */\nexport type DependencyLookup = (\n  name: string,\n  version: string,\n  field: ManifestField,\n) => Promise<Record<string, string>>;\n\n/** Groups of pins held at one version, as in `LOCKSTEP_GROUPS`. */\ntype Groups = readonly (readonly string[])[];\n\n/** The version each pin must take, or why there isn't one. */\ntype Targets = Map<IVersionedDep, string> | { held: string };\n\n/** The bare version in a pin, whatever range syntax it was written with. */\nconst bare = (version: string): string | undefined =>\n  coerce(version, { includePrerelease: true })?.version;\n\nconst message = (error: unknown): string =>\n  error instanceof Error ? error.message : String(error);\n\n/**\n * The versions the source's `dependencies` give its followers, and the version\n * of the follower each group mate is grouped with, so the group stays in step.\n */\nconst targetsFrom = (\n  { source, followers }: ExactDependencyPin,\n  sourceVersion: string,\n  dependencies: Record<string, string>,\n  groups: Groups,\n  current: Readonly<ProposedVersions>,\n): Targets => {\n  const missing = followers.filter((name) => !dependencies[name]);\n  if (missing.length > 0) {\n    return {\n      held: `${source} ${sourceVersion} does not depend on ${missing.join(', ')}`,\n    };\n  }\n\n  // Releases so far declare exact versions. If one declares a range, take its\n  // bare version: our pins are exact, and a single copy needs that version.\n  const targets = new Map<IVersionedDep, string>(\n    followers.map((name) => {\n      const declared = dependencies[name];\n      return [name, valid(declared) ?? bare(declared) ?? declared];\n    }),\n  );\n\n  for (const group of groups) {\n    const inGroup = followers.filter((name) => group.includes(name));\n    if (inGroup.length === 0) continue;\n    const version = targets.get(inGroup[0]) as string;\n    const disagreeing = inGroup.find((name) => targets.get(name) !== version);\n    if (disagreeing) {\n      return {\n        held: `${source} ${sourceVersion} depends on ${inGroup[0]} ${version} but ${disagreeing} ${targets.get(disagreeing)}, which must move in step`,\n      };\n    }\n    for (const name of group as readonly IVersionedDep[]) {\n      if (!targets.has(name) && current[name] !== undefined) {\n        targets.set(name, version);\n      }\n    }\n  }\n\n  return targets;\n};\n\n/** Why the peers being written would reject the targets, if they would. */\nconst unmetPeers = async (\n  { source, peers }: ExactDependencyPin,\n  sourceVersion: string,\n  targets: Map<IVersionedDep, string>,\n  written: (name: IVersionedDep) => string | undefined,\n  lookup: DependencyLookup,\n): Promise<string | undefined> => {\n  const unmet: string[] = [];\n  for (const peer of peers) {\n    const peerVersion = written(peer);\n    if (peerVersion === undefined) continue;\n    let ranges: Record<string, string>;\n    try {\n      ranges = await lookup(peer, peerVersion, 'peerDependencies');\n    } catch (error) {\n      return `could not read the peerDependencies of ${peer} ${peerVersion} (${message(error)})`;\n    }\n    for (const [name, version] of targets) {\n      const range = ranges[name];\n      if (range && !satisfies(version, range, { includePrerelease: true })) {\n        unmet.push(\n          `${peer} ${peerVersion} requires ${name} ${range}, but ${source} ${sourceVersion} needs ${version}`,\n        );\n      }\n    }\n  }\n  return unmet.length > 0 ? unmet.join('; ') : undefined;\n};\n\n/**\n * Set each rule's followers, and their lockstep group mates, to the exact\n * versions the source being written depends on. Runs after the lockstep, which\n * can only hold a group back and so can't move one up to what the source needs.\n *\n * Mutates `proposed`, which holds versions not yet written anywhere. When a peer\n * would reject the result, or a manifest can't be read, every pin the rule covers\n * is put back to `current` for this run instead. Returns a note for each pin set\n * and each rule held, so the reason reaches the update's PR.\n */\nexport const pinToExactDependencies = async (\n  rules: readonly ExactDependencyPin[],\n  groups: Groups,\n  current: Readonly<ProposedVersions>,\n  proposed: ProposedVersions,\n  lookup: DependencyLookup,\n): Promise<LockstepNote[]> => {\n  const notes: LockstepNote[] = [];\n  const written = (name: IVersionedDep): string | undefined => {\n    const version = proposed[name] ?? current[name];\n    return version === undefined ? undefined : bare(version);\n  };\n\n  for (const rule of rules) {\n    const { source, followers, peers, reason } = rule;\n    const mates = groups\n      .filter((group) => followers.some((name) => group.includes(name)))\n      .flat() as IVersionedDep[];\n    const covered = [\n      ...new Set([source, ...followers, ...mates, ...peers]),\n    ].filter((name) => current[name] !== undefined);\n\n    // Every pin the rule covers goes back to its current version, so nothing\n    // the rule could not check is written.\n    const hold = (why: string) => {\n      const notTaken = covered.filter(\n        (name) =>\n          proposed[name] !== undefined && proposed[name] !== current[name],\n      );\n      notes.push({\n        name: source,\n        note:\n          `${source} held at ${current[source]}, with ${covered\n            .filter((name) => name !== source)\n            .join(', ')} at their current versions` +\n          (notTaken.length > 0\n            ? ` (not taken: ${notTaken\n                .map((name) => `${name} ${proposed[name]}`)\n                .join(', ')})`\n            : '') +\n          `: ${why}`,\n      });\n      for (const name of covered) proposed[name] = current[name];\n    };\n\n    const sourceVersion = written(source);\n    if (sourceVersion === undefined) continue;\n\n    let dependencies: Record<string, string>;\n    try {\n      dependencies = await lookup(source, sourceVersion, 'dependencies');\n    } catch (error) {\n      hold(\n        `could not read the dependencies of ${source} ${sourceVersion} (${message(error)})`,\n      );\n      continue;\n    }\n\n    const targets = targetsFrom(\n      rule,\n      sourceVersion,\n      dependencies,\n      groups,\n      current,\n    );\n    if (!(targets instanceof Map)) {\n      hold(targets.held);\n      continue;\n    }\n\n    const unmet = await unmetPeers(\n      rule,\n      sourceVersion,\n      targets,\n      written,\n      lookup,\n    );\n    if (unmet) {\n      hold(unmet);\n      continue;\n    }\n\n    for (const [name, version] of targets) {\n      const before = proposed[name] ?? current[name];\n      if (before === version) continue;\n      proposed[name] = version;\n      notes.push({\n        name,\n        note: `${name} set to ${version} (${before} proposed) to match the exact dependencies of ${source} ${sourceVersion}: ${reason}`,\n      });\n    }\n  }\n\n  return notes;\n};\n"],"names":["coerce","satisfies","valid","bare","version","includePrerelease","message","error","Error","String","targetsFrom","source","followers","sourceVersion","dependencies","groups","current","missing","filter","name","length","held","join","targets","Map","map","declared","group","inGroup","includes","get","disagreeing","find","has","undefined","set","unmetPeers","peers","written","lookup","unmet","peer","peerVersion","ranges","range","push","pinToExactDependencies","rules","proposed","notes","rule","reason","mates","some","flat","covered","Set","hold","why","notTaken","note","before"],"mappings":"AAAA;;;CAGC,GACD,SAASA,MAAM,EAAEC,SAAS,EAAEC,KAAK,QAAQ,SAAS;AA0ClD,0EAA0E,GAC1E,MAAMC,OAAO,CAACC,UACZJ,OAAOI,SAAS;QAAEC,mBAAmB;IAAK,IAAID;AAEhD,MAAME,UAAU,CAACC,QACfA,iBAAiBC,QAAQD,MAAMD,OAAO,GAAGG,OAAOF;AAElD;;;CAGC,GACD,MAAMG,cAAc,CAClB,EAAEC,MAAM,EAAEC,SAAS,EAAsB,EACzCC,eACAC,cACAC,QACAC;IAEA,MAAMC,UAAUL,UAAUM,MAAM,CAAC,CAACC,OAAS,CAACL,YAAY,CAACK,KAAK;IAC9D,IAAIF,QAAQG,MAAM,GAAG,GAAG;QACtB,OAAO;YACLC,MAAM,GAAGV,OAAO,CAAC,EAAEE,cAAc,oBAAoB,EAAEI,QAAQK,IAAI,CAAC,OAAO;QAC7E;IACF;IAEA,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAMC,UAAU,IAAIC,IAClBZ,UAAUa,GAAG,CAAC,CAACN;QACb,MAAMO,WAAWZ,YAAY,CAACK,KAAK;QACnC,OAAO;YAACA;YAAMjB,MAAMwB,aAAavB,KAAKuB,aAAaA;SAAS;IAC9D;IAGF,KAAK,MAAMC,SAASZ,OAAQ;QAC1B,MAAMa,UAAUhB,UAAUM,MAAM,CAAC,CAACC,OAASQ,MAAME,QAAQ,CAACV;QAC1D,IAAIS,QAAQR,MAAM,KAAK,GAAG;QAC1B,MAAMhB,UAAUmB,QAAQO,GAAG,CAACF,OAAO,CAAC,EAAE;QACtC,MAAMG,cAAcH,QAAQI,IAAI,CAAC,CAACb,OAASI,QAAQO,GAAG,CAACX,UAAUf;QACjE,IAAI2B,aAAa;YACf,OAAO;gBACLV,MAAM,GAAGV,OAAO,CAAC,EAAEE,cAAc,YAAY,EAAEe,OAAO,CAAC,EAAE,CAAC,CAAC,EAAExB,QAAQ,KAAK,EAAE2B,YAAY,CAAC,EAAER,QAAQO,GAAG,CAACC,aAAa,yBAAyB,CAAC;YAChJ;QACF;QACA,KAAK,MAAMZ,QAAQQ,MAAmC;YACpD,IAAI,CAACJ,QAAQU,GAAG,CAACd,SAASH,OAAO,CAACG,KAAK,KAAKe,WAAW;gBACrDX,QAAQY,GAAG,CAAChB,MAAMf;YACpB;QACF;IACF;IAEA,OAAOmB;AACT;AAEA,yEAAyE,GACzE,MAAMa,aAAa,OACjB,EAAEzB,MAAM,EAAE0B,KAAK,EAAsB,EACrCxB,eACAU,SACAe,SACAC;IAEA,MAAMC,QAAkB,EAAE;IAC1B,KAAK,MAAMC,QAAQJ,MAAO;QACxB,MAAMK,cAAcJ,QAAQG;QAC5B,IAAIC,gBAAgBR,WAAW;QAC/B,IAAIS;QACJ,IAAI;YACFA,SAAS,MAAMJ,OAAOE,MAAMC,aAAa;QAC3C,EAAE,OAAOnC,OAAO;YACd,OAAO,CAAC,uCAAuC,EAAEkC,KAAK,CAAC,EAAEC,YAAY,EAAE,EAAEpC,QAAQC,OAAO,CAAC,CAAC;QAC5F;QACA,KAAK,MAAM,CAACY,MAAMf,QAAQ,IAAImB,QAAS;YACrC,MAAMqB,QAAQD,MAAM,CAACxB,KAAK;YAC1B,IAAIyB,SAAS,CAAC3C,UAAUG,SAASwC,OAAO;gBAAEvC,mBAAmB;YAAK,IAAI;gBACpEmC,MAAMK,IAAI,CACR,GAAGJ,KAAK,CAAC,EAAEC,YAAY,UAAU,EAAEvB,KAAK,CAAC,EAAEyB,MAAM,MAAM,EAAEjC,OAAO,CAAC,EAAEE,cAAc,OAAO,EAAET,SAAS;YAEvG;QACF;IACF;IACA,OAAOoC,MAAMpB,MAAM,GAAG,IAAIoB,MAAMlB,IAAI,CAAC,QAAQY;AAC/C;AAEA;;;;;;;;;CASC,GACD,OAAO,MAAMY,yBAAyB,OACpCC,OACAhC,QACAC,SACAgC,UACAT;IAEA,MAAMU,QAAwB,EAAE;IAChC,MAAMX,UAAU,CAACnB;QACf,MAAMf,UAAU4C,QAAQ,CAAC7B,KAAK,IAAIH,OAAO,CAACG,KAAK;QAC/C,OAAOf,YAAY8B,YAAYA,YAAY/B,KAAKC;IAClD;IAEA,KAAK,MAAM8C,QAAQH,MAAO;QACxB,MAAM,EAAEpC,MAAM,EAAEC,SAAS,EAAEyB,KAAK,EAAEc,MAAM,EAAE,GAAGD;QAC7C,MAAME,QAAQrC,OACXG,MAAM,CAAC,CAACS,QAAUf,UAAUyC,IAAI,CAAC,CAAClC,OAASQ,MAAME,QAAQ,CAACV,QAC1DmC,IAAI;QACP,MAAMC,UAAU;eACX,IAAIC,IAAI;gBAAC7C;mBAAWC;mBAAcwC;mBAAUf;aAAM;SACtD,CAACnB,MAAM,CAAC,CAACC,OAASH,OAAO,CAACG,KAAK,KAAKe;QAErC,yEAAyE;QACzE,uCAAuC;QACvC,MAAMuB,OAAO,CAACC;YACZ,MAAMC,WAAWJ,QAAQrC,MAAM,CAC7B,CAACC,OACC6B,QAAQ,CAAC7B,KAAK,KAAKe,aAAac,QAAQ,CAAC7B,KAAK,KAAKH,OAAO,CAACG,KAAK;YAEpE8B,MAAMJ,IAAI,CAAC;gBACT1B,MAAMR;gBACNiD,MACE,GAAGjD,OAAO,SAAS,EAAEK,OAAO,CAACL,OAAO,CAAC,OAAO,EAAE4C,QAC3CrC,MAAM,CAAC,CAACC,OAASA,SAASR,QAC1BW,IAAI,CAAC,MAAM,0BAA0B,CAAC,GACxCqC,CAAAA,SAASvC,MAAM,GAAG,IACf,CAAC,aAAa,EAAEuC,SACblC,GAAG,CAAC,CAACN,OAAS,GAAGA,KAAK,CAAC,EAAE6B,QAAQ,CAAC7B,KAAK,EAAE,EACzCG,IAAI,CAAC,MAAM,CAAC,CAAC,GAChB,EAAC,IACL,CAAC,EAAE,EAAEoC,KAAK;YACd;YACA,KAAK,MAAMvC,QAAQoC,QAASP,QAAQ,CAAC7B,KAAK,GAAGH,OAAO,CAACG,KAAK;QAC5D;QAEA,MAAMN,gBAAgByB,QAAQ3B;QAC9B,IAAIE,kBAAkBqB,WAAW;QAEjC,IAAIpB;QACJ,IAAI;YACFA,eAAe,MAAMyB,OAAO5B,QAAQE,eAAe;QACrD,EAAE,OAAON,OAAO;YACdkD,KACE,CAAC,mCAAmC,EAAE9C,OAAO,CAAC,EAAEE,cAAc,EAAE,EAAEP,QAAQC,OAAO,CAAC,CAAC;YAErF;QACF;QAEA,MAAMgB,UAAUb,YACdwC,MACArC,eACAC,cACAC,QACAC;QAEF,IAAI,CAAEO,CAAAA,mBAAmBC,GAAE,GAAI;YAC7BiC,KAAKlC,QAAQF,IAAI;YACjB;QACF;QAEA,MAAMmB,QAAQ,MAAMJ,WAClBc,MACArC,eACAU,SACAe,SACAC;QAEF,IAAIC,OAAO;YACTiB,KAAKjB;YACL;QACF;QAEA,KAAK,MAAM,CAACrB,MAAMf,QAAQ,IAAImB,QAAS;YACrC,MAAMsC,SAASb,QAAQ,CAAC7B,KAAK,IAAIH,OAAO,CAACG,KAAK;YAC9C,IAAI0C,WAAWzD,SAAS;YACxB4C,QAAQ,CAAC7B,KAAK,GAAGf;YACjB6C,MAAMJ,IAAI,CAAC;gBACT1B;gBACAyC,MAAM,GAAGzC,KAAK,QAAQ,EAAEf,QAAQ,EAAE,EAAEyD,OAAO,8CAA8C,EAAElD,OAAO,CAAC,EAAEE,cAAc,EAAE,EAAEsC,QAAQ;YACjI;QACF;IACF;IAEA,OAAOF;AACT,EAAE"}

package/src/utils/version-lockstep/hold.d.ts

@@ -2,13 +2,14 @@
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-import type { IPyDepVersion } from '../versions.js';
+import type { IPyDepVersion, ITerraformProviderVersion } from '../versions.js';
 import type { IVersionedDep, LockstepNote } from './lockstep.js';
 /**
  * A pin the version update must not move, why, and what lets it move again.
  *
  * The npm equivalent is a `reject` entry in `.ncurc.cjs`. pip-check-updates
- * has no exclude option, so Python pins are held here instead.
+ * has no exclude option and Terraform providers are resolved from the
+ * registry, so Python and Terraform pins are held here instead.
  */
 export interface VersionHold<Name extends IVersionedDep = IVersionedDep> {
     name: Name;
@@ -17,6 +18,8 @@ export interface VersionHold<Name extends IVersionedDep = IVersionedDep> {
 }
 /** Python pins the version update keeps at their current version. */
 export declare const PY_VERSION_HOLDS: readonly VersionHold<IPyDepVersion>[];
+/** Terraform providers the version update keeps at their current version. */
+export declare const TERRAFORM_VERSION_HOLDS: readonly VersionHold<ITerraformProviderVersion>[];
 /**
  * Put each held pin the run proposed moving back to its current version.
  *

package/src/utils/version-lockstep/hold.js

@@ -8,6 +8,13 @@
         liftWhen: 'a newer ty has been checked against all vended Python templates (run the py-client, py#dynamodb and other Python-typecheck specs with it)'
     }
 ];
+/** Terraform providers the version update keeps at their current version. */ export const TERRAFORM_VERSION_HOLDS = [
+    {
+        name: 'aws',
+        reason: 'hashicorp/aws 6.69.0 moved to aws-sdk-go-base/v2 v2.0.0-beta.75, whose bufio.Scanner response logger fails reading aws_cognito_managed_login_branding with "token too long", so the vended Cognito user identity fails apply (terraform-provider-aws#50481)',
+        liftWhen: "a hashicorp/aws release includes aws-sdk-go-base#1539 (fixes terraform-provider-aws#50481); check the provider's go.mod for aws-sdk-go-base/v2 > beta.75 or the changelog"
+    }
+];
 /**
  * Put each held pin the run proposed moving back to its current version.
  *

package/src/utils/version-lockstep/hold.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-lockstep/hold.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { IPyDepVersion } from '../versions.js';\nimport type { IVersionedDep, LockstepNote } from './lockstep.js';\n\n/**\n * A pin the version update must not move, why, and what lets it move again.\n *\n * The npm equivalent is a `reject` entry in `.ncurc.cjs`. pip-check-updates\n * has no exclude option, so Python pins are held here instead.\n */\nexport interface VersionHold<Name extends IVersionedDep = IVersionedDep> {\n  name: Name;\n  reason: string;\n  liftWhen: string;\n}\n\n/** Python pins the version update keeps at their current version. */\nexport const PY_VERSION_HOLDS: readonly VersionHold<IPyDepVersion>[] = [\n  {\n    name: 'ty',\n    reason:\n      'ty is 0.x and its releases add diagnostics that fail the vended Python templates',\n    liftWhen:\n      'a newer ty has been checked against all vended Python templates (run the py-client, py#dynamodb and other Python-typecheck specs with it)',\n  },\n];\n\n/**\n * Put each held pin the run proposed moving back to its current version.\n *\n * Mutates `proposed`, which holds versions not yet written anywhere, and\n * returns a note for each pin it held so the reason reaches the update's PR.\n */\nexport const holdPinnedVersions = <Name extends IVersionedDep>(\n  holds: readonly VersionHold<Name>[],\n  current: Readonly<Partial<Record<Name, string>>>,\n  proposed: Partial<Record<Name, string>>,\n): LockstepNote[] => {\n  const notes: LockstepNote[] = [];\n\n  for (const { name, reason, liftWhen } of holds) {\n    const held = current[name];\n    const available = proposed[name];\n    if (held === undefined || available === undefined || available === held) {\n      continue;\n    }\n    proposed[name] = held;\n    notes.push({\n      name,\n      note: `${name} held at ${held} (${available} available): ${reason}. Lift when ${liftWhen}`,\n    });\n  }\n\n  return notes;\n};\n"],"names":["PY_VERSION_HOLDS","name","reason","liftWhen","holdPinnedVersions","holds","current","proposed","notes","held","available","undefined","push","note"],"mappings":"AAAA;;;CAGC,GAgBD,mEAAmE,GACnE,OAAO,MAAMA,mBAA0D;IACrE;QACEC,MAAM;QACNC,QACE;QACFC,UACE;IACJ;CACD,CAAC;AAEF;;;;;CAKC,GACD,OAAO,MAAMC,qBAAqB,CAChCC,OACAC,SACAC;IAEA,MAAMC,QAAwB,EAAE;IAEhC,KAAK,MAAM,EAAEP,IAAI,EAAEC,MAAM,EAAEC,QAAQ,EAAE,IAAIE,MAAO;QAC9C,MAAMI,OAAOH,OAAO,CAACL,KAAK;QAC1B,MAAMS,YAAYH,QAAQ,CAACN,KAAK;QAChC,IAAIQ,SAASE,aAAaD,cAAcC,aAAaD,cAAcD,MAAM;YACvE;QACF;QACAF,QAAQ,CAACN,KAAK,GAAGQ;QACjBD,MAAMI,IAAI,CAAC;YACTX;YACAY,MAAM,GAAGZ,KAAK,SAAS,EAAEQ,KAAK,EAAE,EAAEC,UAAU,aAAa,EAAER,OAAO,YAAY,EAAEC,UAAU;QAC5F;IACF;IAEA,OAAOK;AACT,EAAE"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-lockstep/hold.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport type { IPyDepVersion, ITerraformProviderVersion } from '../versions.js';\nimport type { IVersionedDep, LockstepNote } from './lockstep.js';\n\n/**\n * A pin the version update must not move, why, and what lets it move again.\n *\n * The npm equivalent is a `reject` entry in `.ncurc.cjs`. pip-check-updates\n * has no exclude option and Terraform providers are resolved from the\n * registry, so Python and Terraform pins are held here instead.\n */\nexport interface VersionHold<Name extends IVersionedDep = IVersionedDep> {\n  name: Name;\n  reason: string;\n  liftWhen: string;\n}\n\n/** Python pins the version update keeps at their current version. */\nexport const PY_VERSION_HOLDS: readonly VersionHold<IPyDepVersion>[] = [\n  {\n    name: 'ty',\n    reason:\n      'ty is 0.x and its releases add diagnostics that fail the vended Python templates',\n    liftWhen:\n      'a newer ty has been checked against all vended Python templates (run the py-client, py#dynamodb and other Python-typecheck specs with it)',\n  },\n];\n\n/** Terraform providers the version update keeps at their current version. */\nexport const TERRAFORM_VERSION_HOLDS: readonly VersionHold<ITerraformProviderVersion>[] =\n  [\n    {\n      name: 'aws',\n      reason:\n        'hashicorp/aws 6.69.0 moved to aws-sdk-go-base/v2 v2.0.0-beta.75, whose bufio.Scanner response logger fails reading aws_cognito_managed_login_branding with \"token too long\", so the vended Cognito user identity fails apply (terraform-provider-aws#50481)',\n      liftWhen:\n        \"a hashicorp/aws release includes aws-sdk-go-base#1539 (fixes terraform-provider-aws#50481); check the provider's go.mod for aws-sdk-go-base/v2 > beta.75 or the changelog\",\n    },\n  ];\n\n/**\n * Put each held pin the run proposed moving back to its current version.\n *\n * Mutates `proposed`, which holds versions not yet written anywhere, and\n * returns a note for each pin it held so the reason reaches the update's PR.\n */\nexport const holdPinnedVersions = <Name extends IVersionedDep>(\n  holds: readonly VersionHold<Name>[],\n  current: Readonly<Partial<Record<Name, string>>>,\n  proposed: Partial<Record<Name, string>>,\n): LockstepNote[] => {\n  const notes: LockstepNote[] = [];\n\n  for (const { name, reason, liftWhen } of holds) {\n    const held = current[name];\n    const available = proposed[name];\n    if (held === undefined || available === undefined || available === held) {\n      continue;\n    }\n    proposed[name] = held;\n    notes.push({\n      name,\n      note: `${name} held at ${held} (${available} available): ${reason}. Lift when ${liftWhen}`,\n    });\n  }\n\n  return notes;\n};\n"],"names":["PY_VERSION_HOLDS","name","reason","liftWhen","TERRAFORM_VERSION_HOLDS","holdPinnedVersions","holds","current","proposed","notes","held","available","undefined","push","note"],"mappings":"AAAA;;;CAGC,GAiBD,mEAAmE,GACnE,OAAO,MAAMA,mBAA0D;IACrE;QACEC,MAAM;QACNC,QACE;QACFC,UACE;IACJ;CACD,CAAC;AAEF,2EAA2E,GAC3E,OAAO,MAAMC,0BACX;IACE;QACEH,MAAM;QACNC,QACE;QACFC,UACE;IACJ;CACD,CAAC;AAEJ;;;;;CAKC,GACD,OAAO,MAAME,qBAAqB,CAChCC,OACAC,SACAC;IAEA,MAAMC,QAAwB,EAAE;IAEhC,KAAK,MAAM,EAAER,IAAI,EAAEC,MAAM,EAAEC,QAAQ,EAAE,IAAIG,MAAO;QAC9C,MAAMI,OAAOH,OAAO,CAACN,KAAK;QAC1B,MAAMU,YAAYH,QAAQ,CAACP,KAAK;QAChC,IAAIS,SAASE,aAAaD,cAAcC,aAAaD,cAAcD,MAAM;YACvE;QACF;QACAF,QAAQ,CAACP,KAAK,GAAGS;QACjBD,MAAMI,IAAI,CAAC;YACTZ;YACAa,MAAM,GAAGb,KAAK,SAAS,EAAES,KAAK,EAAE,EAAEC,UAAU,aAAa,EAAET,OAAO,YAAY,EAAEC,UAAU;QAC5F;IACF;IAEA,OAAOM;AACT,EAAE"}

package/src/utils/version-lockstep/lockstep.d.ts

@@ -1,6 +1,6 @@
-import type { IJavaVersion, IMiseVersion, IPyDepVersion, ITsDepVersion } from '../versions.js';
+import type { IJavaVersion, IMiseVersion, IPyDepVersion, ITerraformProviderVersion, ITsDepVersion } from '../versions.js';
 /** Any dependency a version table pins. */
-export type IVersionedDep = ITsDepVersion | IPyDepVersion | IJavaVersion | IMiseVersion;
+export type IVersionedDep = ITsDepVersion | IPyDepVersion | IJavaVersion | IMiseVersion | ITerraformProviderVersion;
 /** A pin the run deliberately did not take, and why. */
 export interface LockstepNote {
     name: IVersionedDep;

package/src/utils/version-lockstep/lockstep.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-lockstep/lockstep.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { coerce, compare } from 'semver';\nimport type {\n  IJavaVersion,\n  IMiseVersion,\n  IPyDepVersion,\n  ITsDepVersion,\n} from '../versions.js';\n\n/** Any dependency a version table pins. */\nexport type IVersionedDep =\n  | ITsDepVersion\n  | IPyDepVersion\n  | IJavaVersion\n  | IMiseVersion;\n\n/** A pin the run deliberately did not take, and why. */\nexport interface LockstepNote {\n  name: IVersionedDep;\n  note: string;\n}\n\n/** Proposed versions from a run, keyed by dependency name. */\nexport type ProposedVersions = Partial<Record<IVersionedDep, string>>;\n\n/**\n * Dependencies that must move as a unit. At least two, since one pin has nothing\n * to stay in step with.\n */\nexport type LockstepGroup = readonly [\n  IVersionedDep,\n  IVersionedDep,\n  ...IVersionedDep[],\n];\n\n/** The bare version in a pin, whatever range syntax it was written with. */\nconst bare = (version: string): string | undefined =>\n  coerce(version, { includePrerelease: true })?.version;\n\n/** The range prefix a pin was written with, so it is preserved. */\nconst prefixOf = (version: string, bareVersion: string): string =>\n  version.slice(0, version.indexOf(bareVersion));\n\n/**\n * Hold every member of each group at the lowest version proposed across it, so a\n * group only moves once all of its members can.\n *\n * Mutates the tables, which hold proposed versions not yet written anywhere.\n * Groups the run proposed fewer than two comparable versions for are left alone.\n */\nexport const holdGroupsInLockstep = (\n  groups: readonly LockstepGroup[],\n  ...tables: readonly ProposedVersions[]\n): LockstepNote[] => {\n  const notes: LockstepNote[] = [];\n\n  for (const group of groups) {\n    const members = group.flatMap((name) => {\n      const table = tables.find((candidate) => candidate[name] !== undefined);\n      const proposed = table?.[name];\n      const version = proposed && bare(proposed);\n      return table && proposed && version\n        ? [{ name, table, proposed, version }]\n        : [];\n    });\n    if (members.length < 2) continue;\n\n    const lowest = members\n      .map(({ version }) => version)\n      .reduce((min, version) => (compare(version, min) < 0 ? version : min));\n\n    for (const { name, table, proposed, version } of members) {\n      if (version === lowest) continue;\n      const held = `${prefixOf(proposed, version)}${lowest}`;\n      table[name] = held;\n      notes.push({\n        name,\n        note: `${name} held at ${held} (${proposed} available): must move in step with ${group\n          .filter((other) => other !== name)\n          .join(', ')}`,\n      });\n    }\n  }\n\n  return notes;\n};\n"],"names":["coerce","compare","bare","version","includePrerelease","prefixOf","bareVersion","slice","indexOf","holdGroupsInLockstep","groups","tables","notes","group","members","flatMap","name","table","find","candidate","undefined","proposed","length","lowest","map","reduce","min","held","push","note","filter","other","join"],"mappings":"AAAA;;;CAGC,GACD,SAASA,MAAM,EAAEC,OAAO,QAAQ,SAAS;AAkCzC,0EAA0E,GAC1E,MAAMC,OAAO,CAACC,UACZH,OAAOG,SAAS;QAAEC,mBAAmB;IAAK,IAAID;AAEhD,iEAAiE,GACjE,MAAME,WAAW,CAACF,SAAiBG,cACjCH,QAAQI,KAAK,CAAC,GAAGJ,QAAQK,OAAO,CAACF;AAEnC;;;;;;CAMC,GACD,OAAO,MAAMG,uBAAuB,CAClCC,QACA,GAAGC;IAEH,MAAMC,QAAwB,EAAE;IAEhC,KAAK,MAAMC,SAASH,OAAQ;QAC1B,MAAMI,UAAUD,MAAME,OAAO,CAAC,CAACC;YAC7B,MAAMC,QAAQN,OAAOO,IAAI,CAAC,CAACC,YAAcA,SAAS,CAACH,KAAK,KAAKI;YAC7D,MAAMC,WAAWJ,OAAO,CAACD,KAAK;YAC9B,MAAMb,UAAUkB,YAAYnB,KAAKmB;YACjC,OAAOJ,SAASI,YAAYlB,UACxB;gBAAC;oBAAEa;oBAAMC;oBAAOI;oBAAUlB;gBAAQ;aAAE,GACpC,EAAE;QACR;QACA,IAAIW,QAAQQ,MAAM,GAAG,GAAG;QAExB,MAAMC,SAAST,QACZU,GAAG,CAAC,CAAC,EAAErB,OAAO,EAAE,GAAKA,SACrBsB,MAAM,CAAC,CAACC,KAAKvB,UAAaF,QAAQE,SAASuB,OAAO,IAAIvB,UAAUuB;QAEnE,KAAK,MAAM,EAAEV,IAAI,EAAEC,KAAK,EAAEI,QAAQ,EAAElB,OAAO,EAAE,IAAIW,QAAS;YACxD,IAAIX,YAAYoB,QAAQ;YACxB,MAAMI,OAAO,GAAGtB,SAASgB,UAAUlB,WAAWoB,QAAQ;YACtDN,KAAK,CAACD,KAAK,GAAGW;YACdf,MAAMgB,IAAI,CAAC;gBACTZ;gBACAa,MAAM,GAAGb,KAAK,SAAS,EAAEW,KAAK,EAAE,EAAEN,SAAS,oCAAoC,EAAER,MAC9EiB,MAAM,CAAC,CAACC,QAAUA,UAAUf,MAC5BgB,IAAI,CAAC,OAAO;YACjB;QACF;IACF;IAEA,OAAOpB;AACT,EAAE"}
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/utils/version-lockstep/lockstep.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { coerce, compare } from 'semver';\nimport type {\n  IJavaVersion,\n  IMiseVersion,\n  IPyDepVersion,\n  ITerraformProviderVersion,\n  ITsDepVersion,\n} from '../versions.js';\n\n/** Any dependency a version table pins. */\nexport type IVersionedDep =\n  | ITsDepVersion\n  | IPyDepVersion\n  | IJavaVersion\n  | IMiseVersion\n  | ITerraformProviderVersion;\n\n/** A pin the run deliberately did not take, and why. */\nexport interface LockstepNote {\n  name: IVersionedDep;\n  note: string;\n}\n\n/** Proposed versions from a run, keyed by dependency name. */\nexport type ProposedVersions = Partial<Record<IVersionedDep, string>>;\n\n/**\n * Dependencies that must move as a unit. At least two, since one pin has nothing\n * to stay in step with.\n */\nexport type LockstepGroup = readonly [\n  IVersionedDep,\n  IVersionedDep,\n  ...IVersionedDep[],\n];\n\n/** The bare version in a pin, whatever range syntax it was written with. */\nconst bare = (version: string): string | undefined =>\n  coerce(version, { includePrerelease: true })?.version;\n\n/** The range prefix a pin was written with, so it is preserved. */\nconst prefixOf = (version: string, bareVersion: string): string =>\n  version.slice(0, version.indexOf(bareVersion));\n\n/**\n * Hold every member of each group at the lowest version proposed across it, so a\n * group only moves once all of its members can.\n *\n * Mutates the tables, which hold proposed versions not yet written anywhere.\n * Groups the run proposed fewer than two comparable versions for are left alone.\n */\nexport const holdGroupsInLockstep = (\n  groups: readonly LockstepGroup[],\n  ...tables: readonly ProposedVersions[]\n): LockstepNote[] => {\n  const notes: LockstepNote[] = [];\n\n  for (const group of groups) {\n    const members = group.flatMap((name) => {\n      const table = tables.find((candidate) => candidate[name] !== undefined);\n      const proposed = table?.[name];\n      const version = proposed && bare(proposed);\n      return table && proposed && version\n        ? [{ name, table, proposed, version }]\n        : [];\n    });\n    if (members.length < 2) continue;\n\n    const lowest = members\n      .map(({ version }) => version)\n      .reduce((min, version) => (compare(version, min) < 0 ? version : min));\n\n    for (const { name, table, proposed, version } of members) {\n      if (version === lowest) continue;\n      const held = `${prefixOf(proposed, version)}${lowest}`;\n      table[name] = held;\n      notes.push({\n        name,\n        note: `${name} held at ${held} (${proposed} available): must move in step with ${group\n          .filter((other) => other !== name)\n          .join(', ')}`,\n      });\n    }\n  }\n\n  return notes;\n};\n"],"names":["coerce","compare","bare","version","includePrerelease","prefixOf","bareVersion","slice","indexOf","holdGroupsInLockstep","groups","tables","notes","group","members","flatMap","name","table","find","candidate","undefined","proposed","length","lowest","map","reduce","min","held","push","note","filter","other","join"],"mappings":"AAAA;;;CAGC,GACD,SAASA,MAAM,EAAEC,OAAO,QAAQ,SAAS;AAoCzC,0EAA0E,GAC1E,MAAMC,OAAO,CAACC,UACZH,OAAOG,SAAS;QAAEC,mBAAmB;IAAK,IAAID;AAEhD,iEAAiE,GACjE,MAAME,WAAW,CAACF,SAAiBG,cACjCH,QAAQI,KAAK,CAAC,GAAGJ,QAAQK,OAAO,CAACF;AAEnC;;;;;;CAMC,GACD,OAAO,MAAMG,uBAAuB,CAClCC,QACA,GAAGC;IAEH,MAAMC,QAAwB,EAAE;IAEhC,KAAK,MAAMC,SAASH,OAAQ;QAC1B,MAAMI,UAAUD,MAAME,OAAO,CAAC,CAACC;YAC7B,MAAMC,QAAQN,OAAOO,IAAI,CAAC,CAACC,YAAcA,SAAS,CAACH,KAAK,KAAKI;YAC7D,MAAMC,WAAWJ,OAAO,CAACD,KAAK;YAC9B,MAAMb,UAAUkB,YAAYnB,KAAKmB;YACjC,OAAOJ,SAASI,YAAYlB,UACxB;gBAAC;oBAAEa;oBAAMC;oBAAOI;oBAAUlB;gBAAQ;aAAE,GACpC,EAAE;QACR;QACA,IAAIW,QAAQQ,MAAM,GAAG,GAAG;QAExB,MAAMC,SAAST,QACZU,GAAG,CAAC,CAAC,EAAErB,OAAO,EAAE,GAAKA,SACrBsB,MAAM,CAAC,CAACC,KAAKvB,UAAaF,QAAQE,SAASuB,OAAO,IAAIvB,UAAUuB;QAEnE,KAAK,MAAM,EAAEV,IAAI,EAAEC,KAAK,EAAEI,QAAQ,EAAElB,OAAO,EAAE,IAAIW,QAAS;YACxD,IAAIX,YAAYoB,QAAQ;YACxB,MAAMI,OAAO,GAAGtB,SAASgB,UAAUlB,WAAWoB,QAAQ;YACtDN,KAAK,CAACD,KAAK,GAAGW;YACdf,MAAMgB,IAAI,CAAC;gBACTZ;gBACAa,MAAM,GAAGb,KAAK,SAAS,EAAEW,KAAK,EAAE,EAAEN,SAAS,oCAAoC,EAAER,MAC9EiB,MAAM,CAAC,CAACC,QAAUA,UAAUf,MAC5BgB,IAAI,CAAC,OAAO;YACjB;QACF;IACF;IAEA,OAAOpB;AACT,EAAE"}

package/src/utils/versions.d.ts

@@ -9,69 +9,70 @@ import { type DeclaredPy, type DeclaredTs, type DependencyDeclaration } from './
 export declare const TS_VERSIONS: {
     readonly '@a2a-js/sdk': "0.3.14";
     readonly '@aws/aws-distro-opentelemetry-node-autoinstrumentation': "0.13.0";
-    readonly '@opentelemetry/propagator-jaeger': "2.11.0";
+    readonly '@opentelemetry/propagator-jaeger': "2.12.0";
     readonly minimatch: "10.2.6";
     readonly 'deepmerge-ts': "8.0.2";
-    readonly mysql2: "3.24.5";
-    readonly '@aws-sdk/client-dynamodb': "3.1146.0";
-    readonly '@aws-sdk/client-api-gateway': "3.1146.0";
-    readonly '@aws-sdk/client-iam': "3.1146.0";
-    readonly '@aws-sdk/client-bedrock-agentcore': "3.1146.0";
-    readonly '@aws-sdk/client-bedrock-runtime': "3.1146.0";
-    readonly '@aws-sdk/client-s3': "3.1146.0";
-    readonly '@aws-sdk/client-sts': "3.1146.0";
-    readonly '@aws-sdk/client-cognito-identity-provider': "3.1146.0";
-    readonly '@aws-sdk/credential-providers': "3.1146.0";
-    readonly '@aws-sdk/credential-provider-cognito-identity': "3.972.71";
-    readonly '@aws-sdk/client-secrets-manager': "3.1146.0";
-    readonly '@aws-sdk/rds-signer': "3.1146.0";
-    readonly '@smithy/server-apigateway': "0.3.3";
-    readonly '@smithy/server-node': "0.3.3";
-    readonly '@aws-lambda-powertools/logger': "2.35.0";
-    readonly '@aws-lambda-powertools/metrics': "2.35.0";
-    readonly '@aws-lambda-powertools/parameters': "2.35.0";
-    readonly '@aws-lambda-powertools/tracer': "2.35.0";
-    readonly '@aws-lambda-powertools/parser': "2.35.0";
-    readonly '@aws-sdk/client-appconfigdata': "3.1146.0";
+    readonly mysql2: "3.24.6";
+    readonly '@aws-sdk/client-dynamodb': "3.1151.0";
+    readonly '@aws-sdk/client-api-gateway': "3.1151.0";
+    readonly '@aws-sdk/client-iam': "3.1151.0";
+    readonly '@aws-sdk/client-bedrock-agentcore': "3.1151.0";
+    readonly '@aws-sdk/client-bedrock-runtime': "3.1151.0";
+    readonly '@aws-sdk/client-s3': "3.1151.0";
+    readonly '@aws-sdk/client-sts': "3.1151.0";
+    readonly '@aws-sdk/client-cognito-identity-provider': "3.1151.0";
+    readonly '@aws-sdk/credential-providers': "3.1151.0";
+    readonly '@aws-sdk/credential-provider-cognito-identity': "3.972.73";
+    readonly '@aws-sdk/client-secrets-manager': "3.1151.0";
+    readonly '@aws-sdk/rds-signer': "3.1151.0";
+    readonly '@smithy/server-apigateway': "0.3.4";
+    readonly '@smithy/server-node': "0.3.4";
+    readonly '@aws-lambda-powertools/logger': "2.36.0";
+    readonly '@aws-lambda-powertools/metrics': "2.36.0";
+    readonly '@aws-lambda-powertools/parameters': "2.36.0";
+    readonly '@aws-lambda-powertools/tracer': "2.36.0";
+    readonly '@aws-lambda-powertools/parser': "2.36.0";
+    readonly '@aws-sdk/client-appconfigdata': "3.1151.0";
     readonly '@middy/core': "7.9.2";
     readonly '@nxlv/python': "23.2.1";
     readonly '@nx-extend/terraform': "10.4.1";
-    readonly nx: "23.2.1";
-    readonly '@nx/devkit': "23.2.1";
-    readonly '@nx/js': "23.2.1";
-    readonly '@nx/react': "23.2.1";
-    readonly '@nx/vite': "23.2.1";
-    readonly '@nx/vitest': "23.2.1";
-    readonly '@nx/workspace': "23.2.1";
-    readonly 'create-nx-workspace': "23.2.1";
+    readonly nx: "23.3.0";
+    readonly '@nx/devkit': "23.3.0";
+    readonly '@nx/js': "23.3.0";
+    readonly '@nx/react': "23.3.0";
+    readonly '@nx/vite': "23.3.0";
+    readonly '@nx/vitest': "23.3.0";
+    readonly '@nx/workspace': "23.3.0";
+    readonly 'create-nx-workspace': "23.3.0";
     readonly '@swc-node/register': "1.12.1";
-    readonly '@swc/core': "1.16.13";
-    readonly '@modelcontextprotocol/sdk': "1.32.0";
-    readonly '@modelcontextprotocol/inspector': "2.9.0";
-    readonly '@ag-ui/a2ui-toolkit': "0.0.4";
-    readonly '@ag-ui/aws-strands': "0.3.0";
-    readonly '@ag-ui/client': "0.0.59";
-    readonly '@ag-ui/core': "0.0.59";
-    readonly '@ag-ui/encoder': "0.0.59";
+    readonly '@swc/core': "1.16.18";
+    readonly '@modelcontextprotocol/sdk': "1.32.1";
+    readonly '@modelcontextprotocol/client': "2.3.1";
+    readonly '@modelcontextprotocol/inspector': "2.10.1";
+    readonly '@ag-ui/a2ui-toolkit': "0.0.5";
+    readonly '@ag-ui/aws-strands': "1.0.0";
+    readonly '@ag-ui/client': "1.0.2";
+    readonly '@ag-ui/core': "1.0.2";
+    readonly '@ag-ui/encoder': "1.0.2";
     readonly 'agent-chat-cli': "0.3.0";
-    readonly '@copilotkit/react-core': "1.74.0";
+    readonly '@copilotkit/react-core': "1.79.0";
     readonly rxjs: "7.8.2";
-    readonly '@strands-agents/sdk': "1.19.0";
-    readonly '@tanstack/react-router': "1.170.41";
-    readonly '@tanstack/router-plugin': "1.168.42";
-    readonly '@tanstack/router-generator': "1.167.40";
+    readonly '@strands-agents/sdk': "1.20.0";
+    readonly '@tanstack/react-router': "1.170.44";
+    readonly '@tanstack/router-plugin': "1.168.45";
+    readonly '@tanstack/router-generator': "1.167.43";
     readonly '@tanstack/virtual-file-routes': "1.162.0";
     readonly '@tanstack/router-utils': "1.162.3";
-    readonly '@cloudscape-design/board-components': "3.0.236";
-    readonly '@cloudscape-design/chat-components': "1.0.177";
-    readonly '@cloudscape-design/components': "3.0.1391";
+    readonly '@cloudscape-design/board-components': "3.0.238";
+    readonly '@cloudscape-design/chat-components': "1.0.179";
+    readonly '@cloudscape-design/components': "3.0.1400";
     readonly '@cloudscape-design/global-styles': "1.0.71";
-    readonly '@tanstack/react-query': "5.104.1";
-    readonly '@tanstack/react-query-devtools': "5.104.1";
+    readonly '@tanstack/react-query': "5.104.2";
+    readonly '@tanstack/react-query-devtools': "5.104.2";
     readonly '@trpc/tanstack-react-query': "11.19.0";
     readonly '@trpc/client': "11.19.0";
     readonly '@trpc/server': "11.19.0";
-    readonly '@types/node': "26.6.4";
+    readonly '@types/node': "26.6.5";
     readonly '@types/aws-lambda': "8.10.164";
     readonly '@types/cors': "2.8.19";
     readonly '@types/pg': "8.23.1";
@@ -84,12 +85,12 @@ export declare const TS_VERSIONS: {
     readonly '@vitest/coverage-v8': "4.1.11";
     readonly '@vitest/ui': "4.1.11";
     readonly '@astrojs/react': "6.0.6";
-    readonly '@astrojs/starlight': "0.42.5";
-    readonly astro: "7.3.5";
+    readonly '@astrojs/starlight': "0.42.6";
+    readonly astro: "7.3.8";
     readonly cookie: "2.0.1";
     readonly aws4fetch: "1.0.20";
-    readonly 'aws-cdk': "2.1144.0";
-    readonly 'aws-cdk-lib': "2.272.0";
+    readonly 'aws-cdk': "2.1145.0";
+    readonly 'aws-cdk-lib': "2.273.0";
     readonly 'aws-xray-sdk-core': "3.12.0";
     readonly constructs: "10.8.1";
     readonly cors: "2.8.6";
@@ -107,39 +108,39 @@ export declare const TS_VERSIONS: {
     readonly '@prisma/client': "7.10.0";
     readonly ejs: "6.0.1";
     readonly '@types/ejs': "3.1.5";
-    readonly express: "5.2.1";
+    readonly express: "5.3.0";
     readonly 'fast-glob': "3.3.3";
     readonly husky: "9.1.7";
     readonly 'fs-extra': "11.4.1";
     readonly '@types/fs-extra': "11.0.4";
     readonly mariadb: "3.5.4";
-    readonly mise: "2026.10.1";
+    readonly mise: "2026.10.9";
     readonly npm: "12.2.0";
-    readonly 'npm-check-updates': "23.1.0";
+    readonly 'npm-check-updates': "23.1.1";
     readonly 'oidc-client-ts': "3.5.0";
     readonly pg: "8.23.1";
     readonly prisma: "7.10.0";
     readonly 'react-oidc-context': "3.3.1";
     readonly react: "19.3.0";
     readonly 'react-dom': "19.3.0";
-    readonly rolldown: "1.2.12";
-    readonly 'rolldown-plugin-dts': "0.28.6";
+    readonly rolldown: "1.2.13";
+    readonly 'rolldown-plugin-dts': "0.28.8";
     readonly shx: "0.4.0";
     readonly 'simple-git': "4.0.2";
     readonly 'source-map-support': "0.5.21";
-    readonly 'starlight-blog': "0.30.0";
+    readonly 'starlight-blog': "0.30.1";
     readonly tailwindcss: "4.3.3";
     readonly '@tailwindcss/vite': "4.3.3";
     readonly tsx: "4.23.15";
-    readonly 'lucide-react': "1.51.0";
-    readonly 'radix-ui': "1.6.7";
-    readonly shadcn: "4.21.1";
+    readonly 'lucide-react': "1.56.0";
+    readonly 'radix-ui': "1.8.1";
+    readonly shadcn: "4.21.4";
     readonly 'tw-animate-css': "1.4.0";
-    readonly vite: "8.3.2";
+    readonly vite: "8.3.4";
     readonly typescript: "6.0.3";
     readonly vitest: "4.1.11";
     readonly jsdom: "29.1.1";
-    readonly zod: "4.6.5";
+    readonly zod: "4.6.7";
     readonly ws: "8.22.0";
 };
 export type ITsDepVersion = keyof typeof TS_VERSIONS;
@@ -151,6 +152,21 @@ export type ITsDepVersion = keyof typeof TS_VERSIONS;
  * pins, so they are named here but versioned in the manifests.
  */
 export declare const LOCKSTEP_GROUPS: readonly [readonly ["@ag-ui/client", "@ag-ui/core", "@ag-ui/encoder"], readonly ["@biomejs/wasm-nodejs", "@biomejs/biome"], readonly ["@astral-sh/ruff-wasm-nodejs", "ruff"]];
+/**
+ * Pins the version update sets to the exact `dependencies` of another vended
+ * package, as published for the version of it being written. Followers' lockstep
+ * group mates move with them. If a peer's published `peerDependencies` reject the
+ * result, or a manifest can't be read, all of these pins stay where they are.
+ *
+ * Use this rather than a lockstep group when the packages don't share a version
+ * line.
+ */
+export declare const EXACT_DEPENDENCY_PINS: readonly [{
+    readonly source: "@copilotkit/react-core";
+    readonly followers: readonly ["@ag-ui/client", "@ag-ui/core"];
+    readonly peers: readonly ["@ag-ui/aws-strands", "@ag-ui/a2ui-toolkit"];
+    readonly reason: "a second @ag-ui/client copy fails every generated website with TS2322";
+}];
 /**
  * Add versions to the given dependencies, which the declaration must own.
  *
@@ -170,13 +186,13 @@ export declare const NX_PACKAGES: readonly ["nx", "@nx/devkit", "@nx/js", "@nx/r
  * The nx version the plugin is built against, and the single source of truth
  * for every place a workspace's nx is pinned.
  */
-export declare const NX_VERSION: "23.2.1";
+export declare const NX_VERSION: "23.3.0";
 /**
  * Versions for Python dependencies added by generators
  */
 export declare const PY_VERSIONS: {
     readonly 'a2a-sdk': "==0.3.26";
-    readonly 'ag-ui-langgraph': "==0.0.46";
+    readonly 'ag-ui-langgraph': "==0.0.47";
     readonly 'ag-ui-protocol': "==0.1.22";
     readonly 'ag-ui-strands': "==0.4.1";
     readonly aiosqlite: "==0.22.1";
@@ -184,33 +200,33 @@ export declare const PY_VERSIONS: {
     readonly 'aws-lambda-powertools[tracer]': "==3.35.0";
     readonly 'aws-lambda-powertools[parser]': "==3.35.0";
     readonly 'aws-opentelemetry-distro': "==0.21.0";
-    readonly 'bedrock-agentcore': "==1.24.0";
-    readonly boto3: "==1.43.108";
-    readonly checkov: "==3.3.22";
-    readonly fastapi: "==0.142.2";
-    readonly 'fastapi[standard]': "==0.142.2";
+    readonly 'bedrock-agentcore': "==1.24.1";
+    readonly boto3: "==1.43.113";
+    readonly checkov: "==3.3.29";
+    readonly fastapi: "==0.143.1";
+    readonly 'fastapi[standard]': "==0.143.1";
     readonly httpx: "==0.28.1";
-    readonly langchain: "==1.4.3";
-    readonly 'langchain-aws': "==1.8.0";
+    readonly langchain: "==1.4.6";
+    readonly 'langchain-aws': "==1.8.2";
     readonly 'langchain-mcp-adapters': "==0.3.2";
-    readonly langgraph: "==1.2.12";
-    readonly 'langgraph-checkpoint-aws': "==1.2.4";
-    readonly 'langgraph-checkpoint-sqlite': "==3.1.1";
+    readonly langgraph: "==1.2.15";
+    readonly 'langgraph-checkpoint-aws': "==1.2.5";
+    readonly 'langgraph-checkpoint-sqlite': "==3.1.2";
     readonly mcp: "==1.28.1";
     readonly 'pip-check-updates': "==0.29.0";
     readonly 'pip-licenses': "==5.5.5";
-    readonly pydantic: "==2.13.5";
-    readonly ruff: "==0.16.10";
-    readonly 'strands-agents': "==1.57.2";
-    readonly 'strands-agents[a2a]': "==1.57.2";
+    readonly pydantic: "==2.14.1";
+    readonly ruff: "==0.17.0";
+    readonly 'strands-agents': "==1.60.0";
+    readonly 'strands-agents[a2a]': "==1.60.0";
     readonly 'strands-agents-tools': "==0.8.9";
     readonly ty: "==0.0.87";
     readonly pynamodb: "==6.1.0";
     readonly uvicorn: "==0.54.0";
-    readonly sqlmodel: "==0.0.47";
+    readonly sqlmodel: "==0.0.48";
     readonly alembic: "==1.20.0";
     readonly aiomysql: "==0.3.2";
-    readonly asyncpg: "==0.31.0";
+    readonly asyncpg: "==0.32.0";
     readonly greenlet: "==3.5.6";
 };
 export type IPyDepVersion = keyof typeof PY_VERSIONS;
@@ -363,7 +379,7 @@ export declare const terraformLambdaRuntimeVars: () => {
  * Pinned exactly (no range operator) so generated infrastructure is reproducible.
  */
 export declare const TERRAFORM_VERSIONS: {
-    readonly aws: "6.67.0";
+    readonly aws: "6.68.0";
     readonly random: "3.9.1";
     readonly null: "3.3.2";
     readonly archive: "2.8.1";
@@ -377,7 +393,7 @@ export type ITerraformProviderVersion = keyof typeof TERRAFORM_VERSIONS;
  * generated `.tf` templates (e.g. `version = "<%- awsProviderVersion %>"`)
  */
 export declare const terraformProviderVersions: () => {
-    awsProviderVersion: "6.67.0";
+    awsProviderVersion: "6.68.0";
     randomProviderVersion: "3.9.1";
     nullProviderVersion: "3.3.2";
     archiveProviderVersion: "2.8.1";