chore(deps): bump agent Python and all-npm workspaces to latest compatible

Refresh uv.lock and yarn.lock across cdk, cli, and docs (Astro 7, AWS SDK
3.1078, TypeScript 6) with compatibility fixes for Starlight, Vite 8, and
Jest/TS6; keep cedar, cdk-nag v2, commander v14, and js-yaml v4 pinned.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: bgagent

agent/pyproject.toml

@@ -4,7 +4,7 @@ version = "0.1.0"
 description = "Background coding agent — runs tasks in isolated cloud environments and produces pull requests"
 requires-python = ">=3.13"
 dependencies = [
-    "boto3==1.43.9", #https://pypi.org/project/boto3/
+    "boto3==1.43.38", #https://pypi.org/project/boto3/
     # Vestigial from the parked AgentCore Identity flow (Phase 2.0a).
     # Phase 2.0b reads per-workspace Linear OAuth tokens directly from
     # Secrets Manager because AgentCore Identity's USER_FEDERATION
@@ -15,13 +15,13 @@ dependencies = [
     # try/except (ImportError, AttributeError), so removing this dep
     # would degrade gracefully — but for now we keep the dep to
     # preserve the clean code path.
-    "bedrock-agentcore==1.9.1", #https://pypi.org/project/bedrock-agentcore/
+    "bedrock-agentcore==1.16.0", #https://pypi.org/project/bedrock-agentcore/
     "claude-agent-sdk==0.2.110", #https://github.com/anthropics/claude-agent-sdk-python/releases/tag/v0.2.110 (bundles claude CLI 2.1.191; kept in lockstep with the npm CLI pin in the Dockerfile, #215)
     "requests==2.34.2", #https://pypi.org/project/requests/
-    "fastapi==0.136.1", #https://pypi.org/project/fastapi/
-    "uvicorn==0.47.0", #https://pypi.org/project/uvicorn/
-    "aws-opentelemetry-distro==0.17.0", #https://pypi.org/project/aws-opentelemetry-distro/
-    "mcp==1.27.1", #https://pypi.org/project/mcp/
+    "fastapi==0.139.0", #https://pypi.org/project/fastapi/
+    "uvicorn==0.49.0", #https://pypi.org/project/uvicorn/
+    "aws-opentelemetry-distro==0.18.0", #https://pypi.org/project/aws-opentelemetry-distro/
+    "mcp==1.28.1", #https://pypi.org/project/mcp/
     # CEDAR ENGINE PARITY — DO NOT BUMP IN ISOLATION.
     # cedarpy (Python, agent runtime) and @cedar-policy/cedar-wasm (TypeScript,
     # CDK Lambdas) are two language bindings over the same Cedar Rust core.

agent/uv.lock

@@ -14,57 +14,57 @@
     "synth:quiet": "npx cdk synth -q"
   },
   "dependencies": {
-    "@aws-cdk/aws-bedrock-alpha": "2.257.0-alpha.0",
+    "@aws-cdk/aws-bedrock-alpha": "2.260.0-alpha.0",
     "@aws-crypto/sha256-js": "^5.2.0",
-    "@aws-sdk/client-bedrock-agentcore": "^3.1046.0",
-    "@aws-sdk/client-bedrock-runtime": "^3.1021.0",
-    "@aws-sdk/client-dynamodb": "^3.1021.0",
-    "@aws-sdk/client-ecs": "^3.1021.0",
-    "@aws-sdk/client-lambda": "^3.1021.0",
-    "@aws-sdk/client-s3": "^3.1021.0",
-    "@aws-sdk/client-secrets-manager": "^3.1021.0",
-    "@aws-sdk/credential-provider-node": "^3.972.29",
-    "@aws-sdk/lib-dynamodb": "^3.1021.0",
-    "@aws-sdk/s3-presigned-post": "^3.1021.0",
-    "@aws-sdk/s3-request-presigner": "^3.1021.0",
-    "@aws/durable-execution-sdk-js": "^1.1.0",
+    "@aws-sdk/client-bedrock-agentcore": "^3.1078.0",
+    "@aws-sdk/client-bedrock-runtime": "^3.1078.0",
+    "@aws-sdk/client-dynamodb": "^3.1078.0",
+    "@aws-sdk/client-ecs": "^3.1078.0",
+    "@aws-sdk/client-lambda": "^3.1078.0",
+    "@aws-sdk/client-s3": "^3.1078.0",
+    "@aws-sdk/client-secrets-manager": "^3.1078.0",
+    "@aws-sdk/credential-provider-node": "^3.972.61",
+    "@aws-sdk/lib-dynamodb": "^3.1078.0",
+    "@aws-sdk/s3-presigned-post": "^3.1078.0",
+    "@aws-sdk/s3-request-presigner": "^3.1078.0",
+    "@aws/durable-execution-sdk-js": "^2.0.0",
     "@cedar-policy/cedar-wasm": "4.8.2",
-    "@smithy/protocol-http": "^5.3.12",
-    "@smithy/signature-v4": "^5.3.14",
-    "aws-cdk-lib": "^2.257.0",
+    "@smithy/protocol-http": "^5.5.5",
+    "@smithy/signature-v4": "^5.6.1",
+    "aws-cdk-lib": "^2.260.0",
     "cdk-nag": "^2.38.2",
-    "constructs": "^10.3.0",
+    "constructs": "^10.6.0",
     "js-yaml": "^4.1.1",
-    "pdf-parse": "^1.1.1",
+    "pdf-parse": "^2.4.5",
     "ulid": "^3.0.2",
-    "ws": "^8.18.0"
+    "ws": "^8.21.0"
   },
   "devDependencies": {
-    "@aws-cdk/integ-runner": "2.199.0",
-    "@aws-cdk/integ-tests-alpha": "2.257.0-alpha.0",
+    "@aws-cdk/integ-runner": "2.202.1",
+    "@aws-cdk/integ-tests-alpha": "2.260.0-alpha.0",
     "@cdklabs/eslint-plugin": "^2",
-    "@stylistic/eslint-plugin": "^2",
-    "@types/aws-lambda": "^8.10.161",
+    "@stylistic/eslint-plugin": "^5",
+    "@types/aws-lambda": "^8.10.162",
     "@types/jest": "^30.0.0",
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^20",
-    "@types/pdf-parse": "^1.1.4",
-    "@types/ws": "^8.5.13",
+    "@types/node": "^26",
+    "@types/pdf-parse": "^1.1.5",
+    "@types/ws": "^8.18.1",
     "@typescript-eslint/eslint-plugin": "^8",
     "@typescript-eslint/parser": "^8",
     "aws-cdk": "^2",
     "esbuild": "^0.28.1",
     "eslint": "^10",
     "eslint-import-resolver-typescript": "^4",
     "eslint-plugin-import-x": "^4",
-    "eslint-plugin-jest": "^29.15.1",
-    "eslint-plugin-jsdoc": "^62.8.1",
+    "eslint-plugin-jest": "^29.15.4",
+    "eslint-plugin-jsdoc": "^63.0.10",
     "eslint-plugin-license-header": "^0.9.0",
-    "jest": "^30.3.0",
-    "jest-junit": "^16",
-    "ts-jest": "^29.4.6",
+    "jest": "^30.4.2",
+    "jest-junit": "^17",
+    "ts-jest": "^29.4.11",
     "ts-node": "^10.9.2",
-    "typescript": "^5.9.3"
+    "typescript": "^6.0.3"
   },
   "resolutions": {},
   "engines": {

cdk/package.json

@@ -17,7 +17,7 @@
     "noImplicitThis": true,
     "noUnusedLocals": false,
     "noUnusedParameters": false,
-    "resolveJsonModule": true,
+    "skipLibCheck": true,
     "strict": true,
     "strictNullChecks": true,
     "strictPropertyInitialization": false,

cdk/tsconfig.dev.json

@@ -2,7 +2,8 @@
   "extends": "./tsconfig.dev.json",
   "compilerOptions": {
     "isolatedModules": true,
+    "ignoreDeprecations": "6.0",
     "module": "CommonJS",
-    "moduleResolution": "Node"
+    "moduleResolution": "node16"
   }
 }

cdk/tsconfig.jest.json

@@ -21,6 +21,7 @@
     "noUnusedLocals": true,
     "noUnusedParameters": true,
     "resolveJsonModule": true,
+    "skipLibCheck": true,
     "strict": true,
     "strictNullChecks": true,
     "strictPropertyInitialization": false,

cdk/tsconfig.json

@@ -1,6 +1,8 @@
 {
   "extends": "./tsconfig.dev.json",
   "compilerOptions": {
-    "isolatedModules": true
+    "isolatedModules": true,
+    "ignoreDeprecations": "6.0",
+    "moduleResolution": "node16"
   }
 }