fix(cedar): align cedarpy and cedar-wasm to Cedar Rust 4.8.2 (#168)

.github/dependabot.yml

@@ -44,6 +44,14 @@ updates:
     groups:
       all-python:
         patterns: ["*"]
+    ignore:
+      # Cedar engine parity — bump in lockstep with @cedar-policy/cedar-wasm via a
+      # dedicated coordinated PR. See docs/design/CEDAR_HITL_GATES.md §15.6 (decision #23).
+      - dependency-name: "cedarpy"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"
+          - "version-update:semver-patch"
 
   - package-ecosystem: "npm"
     directories:
@@ -59,3 +67,11 @@ updates:
     groups:
       all-npm:
         patterns: ["*"]
+    ignore:
+      # Cedar engine parity — bump in lockstep with cedarpy via a dedicated
+      # coordinated PR. See docs/design/CEDAR_HITL_GATES.md §15.6 (decision #23).
+      - dependency-name: "@cedar-policy/cedar-wasm"
+        update-types:
+          - "version-update:semver-major"
+          - "version-update:semver-minor"
+          - "version-update:semver-patch"

agent/pyproject.toml

@@ -33,7 +33,7 @@ dependencies = [
     # in cdk/package.json AND refresh the parity fixtures, in the same
     # commit. See docs/design/CEDAR_HITL_GATES.md §15.6 (decision #23) and
     # the parity-contract banner in mise.toml.
-    "cedarpy==4.8.0", #https://github.com/k9securityio/cedar-py — EXACT pin (no ^/~), parity with @cedar-policy/cedar-wasm@4.10.0
+    "cedarpy==4.8.3", #https://github.com/k9securityio/cedar-py — EXACT pin (no ^/~), parity with @cedar-policy/cedar-wasm@4.8.2 (both Cedar Rust 4.8.2)
 ]
 
 [tool.uv]

cdk/layers/cedar-wasm/package.json

@@ -4,6 +4,6 @@
   "private": true,
   "description": "Lambda layer bundling @cedar-policy/cedar-wasm for Cedar HITL policy handlers. Pinned version must match cdk/package.json.",
   "dependencies": {
-    "@cedar-policy/cedar-wasm": "4.10.0"
+    "@cedar-policy/cedar-wasm": "4.8.2"
   }
 }

cdk/package.json

@@ -28,7 +28,7 @@
     "@aws-sdk/s3-presigned-post": "^3.1021.0",
     "@aws-sdk/s3-request-presigner": "^3.1021.0",
     "@aws/durable-execution-sdk-js": "^1.1.0",
-    "@cedar-policy/cedar-wasm": "4.10.0",
+    "@cedar-policy/cedar-wasm": "4.8.2",
     "aws-cdk-lib": "^2.257.0",
     "cdk-nag": "^2.38.2",
     "constructs": "^10.3.0",

cdk/src/constructs/cedar-wasm-layer.ts

@@ -34,7 +34,7 @@ import { Construct } from 'constructs';
  * lets the tests assert we ship the right version without duplicating
  * the number across files.
  */
-export const CEDAR_WASM_VERSION = '4.10.0';
+export const CEDAR_WASM_VERSION = '4.8.2';
 
 /**
  * Minimum memory the Lambda attaching this layer should be configured