Skip to content

Bump the npm group across 2 directories with 2 updates#732

Merged
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-c3c92cb19a
Dec 8, 2025
Merged

Bump the npm group across 2 directories with 2 updates#732
github-actions[bot] merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-c3c92cb19a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Dec 8, 2025

Copy link
Copy Markdown
Contributor

Bumps the npm group with 2 updates in the / directory: pnpm and aws-cdk-lib.
Bumps the npm group with 1 update in the /test directory: aws-cdk-lib.

Updates pnpm from 10.24.0 to 10.25.0

Release notes

Sourced from pnpm's releases.

pnpm 10.25

Minor Changes

  • Allow loading certificates from cert, ca, and key for specific registry URLs. E.g., //registry.example.com/:ca=-----BEGIN CERTIFICATE-----.... Previously this was only working via certfile, cafile, and keyfile.

    These properties are supported in .npmrc, but were ignored by pnpm, this will make pnpm read and use them as well.

    Related PR: #10230.

  • Added a new flag called --bare to pnpm init for creating a package.json with the bare minimum of required fields #10226.

Patch Changes

  • Improved reporting of ignored dependency scripts #10276.
  • pnpm install should build any dependencies that were added to onlyBuiltDependencies and were not built yet #10256.
  • pnpm publish -r --force should allow to run publish over already existing versions in the registry #10272.
  • Don't fail with a ERR_PNPM_MISSING_TIME error if a package that is excluded from trust policy checks is missing the time field in the metadata.

Platinum Sponsors

Gold Sponsors

... (truncated)

Changelog

Sourced from pnpm's changelog.

10.25.0

Minor Changes

  • Allow loading certificates from cert, ca, and key for specific registry URLs. E.g., //registry.example.com/:ca=-----BEGIN CERTIFICATE-----.... Previously this was only working via certfile, cafile, and keyfile.

    These properties are supported in .npmrc, but were ignored by pnpm, this will make pnpm read and use them as well.

    Related PR: #10230.

  • Added a new flag called --bare to pnpm init for creating a package.json with the bare minimum of required fields #10226.

Patch Changes

  • Improved reporting of ignored dependency scripts #10276.
  • pnpm install should build any dependencies that were added to onlyBuiltDependencies and were not built yet #10256.
  • pnpm publish -r --force should allow to run publish over already existing versions in the registry #10272.
  • Don't fail with a ERR_PNPM_MISSING_TIME error if a package that is excluded from trust policy checks is missing the time field in the metadata.
Commits

Updates aws-cdk-lib from 2.231.0 to 2.232.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.232.0

Features

  • update L1 CloudFormation resource definitions (#36299) (0945692)
  • bedrock-agentcore: add fromImageUri method to AgentRuntimeArtifact (#36263) (ad25aba)
  • lambda: add support for durable functions (#36282) (599a1d3)
  • update L1 CloudFormation resource definitions (#36277) (c4fa99b)

Bug Fixes


Alpha modules (2.232.0-alpha.0)

Bug Fixes

  • bedrock-agentcore-alpha: use static construct ID for asset-based runtime artifacts (#36241) (e2bdddd), closes #35968
  • mixins-preview: service exports are different then in aws-cdk-lib (#36201) (5858006), closes #36210
  • mixins-preview: strongly-typed ConstructSelector interface (#36266) (1d2f473)
Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.232.1-alpha.0 (2025-12-05)

2.232.0-alpha.0 (2025-12-04)

Bug Fixes

  • bedrock-agentcore-alpha: use static construct ID for asset-based runtime artifacts (#36241) (e2bdddd), closes #35968
  • mixins-preview: service exports are different then in aws-cdk-lib (#36201) (5858006), closes #36210
  • mixins-preview: strongly-typed ConstructSelector interface (#36266) (1d2f473)

2.231.0-alpha.0 (2025-12-01)

Features

2.230.0-alpha.0 (2025-11-26)

Features

Bug Fixes

2.229.1-alpha.0 (2025-11-25)

2.229.0-alpha.0 (2025-11-24)

Features

... (truncated)

Commits
  • 31daec1 chore: update analytics metadata blueprints
  • 0945692 feat: update L1 CloudFormation resource definitions (#36299)
  • 7f47552 chore: fix codegen for new service modules (#36296)
  • b8560af docs: fix URIs in S3 tables and Firehose documentation (#36293)
  • 529b3a7 chore: fix Docker tests on SE Linux (#36284)
  • c911ad8 chore(rds): add MariaDB engine version 11.8.5 (#36279)
  • 617bcba chore: upgrade to new eslint and switch to flat config (#36272)
  • 3751930 chore: npm-check-updates && yarn upgrade (#36258)
  • 05b5a2b chore: turn on stripInternal everywhere (#36270)
  • c326388 chore(dynamodb): changing language for multi-attribute keys on GSI's (#36233)
  • Additional commits viewable in compare view

Updates aws-cdk-lib from 2.231.0 to 2.232.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.232.0

Features

  • update L1 CloudFormation resource definitions (#36299) (0945692)
  • bedrock-agentcore: add fromImageUri method to AgentRuntimeArtifact (#36263) (ad25aba)
  • lambda: add support for durable functions (#36282) (599a1d3)
  • update L1 CloudFormation resource definitions (#36277) (c4fa99b)

Bug Fixes


Alpha modules (2.232.0-alpha.0)

Bug Fixes

  • bedrock-agentcore-alpha: use static construct ID for asset-based runtime artifacts (#36241) (e2bdddd), closes #35968
  • mixins-preview: service exports are different then in aws-cdk-lib (#36201) (5858006), closes #36210
  • mixins-preview: strongly-typed ConstructSelector interface (#36266) (1d2f473)
Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.232.1-alpha.0 (2025-12-05)

2.232.0-alpha.0 (2025-12-04)

Bug Fixes

  • bedrock-agentcore-alpha: use static construct ID for asset-based runtime artifacts (#36241) (e2bdddd), closes #35968
  • mixins-preview: service exports are different then in aws-cdk-lib (#36201) (5858006), closes #36210
  • mixins-preview: strongly-typed ConstructSelector interface (#36266) (1d2f473)

2.231.0-alpha.0 (2025-12-01)

Features

2.230.0-alpha.0 (2025-11-26)

Features

Bug Fixes

2.229.1-alpha.0 (2025-11-25)

2.229.0-alpha.0 (2025-11-24)

Features

... (truncated)

Commits
  • 31daec1 chore: update analytics metadata blueprints
  • 0945692 feat: update L1 CloudFormation resource definitions (#36299)
  • 7f47552 chore: fix codegen for new service modules (#36296)
  • b8560af docs: fix URIs in S3 tables and Firehose documentation (#36293)
  • 529b3a7 chore: fix Docker tests on SE Linux (#36284)
  • c911ad8 chore(rds): add MariaDB engine version 11.8.5 (#36279)
  • 617bcba chore: upgrade to new eslint and switch to flat config (#36272)
  • 3751930 chore: npm-check-updates && yarn upgrade (#36258)
  • 05b5a2b chore: turn on stripInternal everywhere (#36270)
  • c326388 chore(dynamodb): changing language for multi-attribute keys on GSI's (#36233)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the npm group with 2 updates in the / directory: [pnpm](https://github.com/pnpm/pnpm/tree/HEAD/pnpm) and [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib).
Bumps the npm group with 1 update in the /test directory: [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib).


Updates `pnpm` from 10.24.0 to 10.25.0
- [Release notes](https://github.com/pnpm/pnpm/releases)
- [Changelog](https://github.com/pnpm/pnpm/blob/v10.25.0/pnpm/CHANGELOG.md)
- [Commits](https://github.com/pnpm/pnpm/commits/v10.25.0/pnpm)

Updates `aws-cdk-lib` from 2.231.0 to 2.232.0
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/commits/v2.232.0/packages/aws-cdk-lib)

Updates `aws-cdk-lib` from 2.231.0 to 2.232.0
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/commits/v2.232.0/packages/aws-cdk-lib)

---
updated-dependencies:
- dependency-name: pnpm
  dependency-version: 10.25.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: aws-cdk-lib
  dependency-version: 2.232.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
- dependency-name: aws-cdk-lib
  dependency-version: 2.232.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Dec 8, 2025
@github-actions github-actions Bot enabled auto-merge (squash) December 8, 2025 21:13
@github-actions

github-actions Bot commented Dec 8, 2025

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
npm/aws-cdk-lib 2.232.0 🟢 5.1
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
License🟢 10license file detected
Dangerous-Workflow⚠️ 0dangerous workflow patterns detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ -1internal error: internal error: invalid Dockerfile
SAST🟢 9SAST tool detected but not run on all commits
Binary-Artifacts⚠️ 0binaries present in source code
Fuzzing🟢 10project is fuzzed
Vulnerabilities⚠️ 022 existing vulnerabilities detected
npm/pnpm 10.25.0 🟢 6.6
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Code-Review🟢 5Found 15/29 approved changesets -- score normalized to 5
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
License🟢 10license file detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Binary-Artifacts🟢 10no binaries found in the repo
SAST🟢 9SAST tool detected but not run on all commits
Pinned-Dependencies🟢 10all dependencies are pinned
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities⚠️ 0124 existing vulnerabilities detected
npm/aws-cdk-lib ^2.232.0 🟢 5.1
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
License🟢 10license file detected
Dangerous-Workflow⚠️ 0dangerous workflow patterns detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ -1internal error: internal error: invalid Dockerfile
SAST🟢 9SAST tool detected but not run on all commits
Binary-Artifacts⚠️ 0binaries present in source code
Fuzzing🟢 10project is fuzzed
Vulnerabilities⚠️ 022 existing vulnerabilities detected

Scanned Files

  • pnpm-lock.yaml
  • test/package.json

@github-actions github-actions Bot merged commit 7f0ca1d into main Dec 8, 2025
7 checks passed
@github-actions github-actions Bot deleted the dependabot/npm_and_yarn/npm-c3c92cb19a branch December 8, 2025 21:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants