From b76936100f9625ff970c2894252351bdf3e0456d Mon Sep 17 00:00:00 2001 From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com> Date: Fri, 5 Jun 2026 13:56:06 -0400 Subject: [PATCH 1/5] chore(deps): remove blanket aws-cdk-lib dependabot ignore (#47) Per handbook Pinning Principle: exact pins are kept current by Dependabot version updates gated by CI + dependency review. Blanket ignores let pins rot (see today's fast-uri incident). --- .github/dependabot.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index fe9cca8..bac63ec 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,8 +4,6 @@ updates: directory: "/" schedule: interval: "weekly" - ignore: - - dependency-name: aws-cdk-lib groups: minor-and-patch: update-types: From 3b381a6aeb1747bc9ce86104c107de3f96998fa8 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 5 Jun 2026 14:53:16 -0400 Subject: [PATCH 2/5] Bump aws-cdk-lib from 2.257.0 to 2.258.0 in the minor-and-patch group (#48) Bumps the minor-and-patch group with 1 update: [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib). Updates `aws-cdk-lib` from 2.257.0 to 2.258.0 - [Release notes](https://github.com/aws/aws-cdk/releases) - [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md) - [Commits](https://github.com/aws/aws-cdk/commits/v2.258.0/packages/aws-cdk-lib) --- updated-dependencies: - dependency-name: aws-cdk-lib dependency-version: 2.258.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 63 +++++++++++++++++++---------------------------- package.json | 2 +- 2 files changed, 27 insertions(+), 38 deletions(-) diff --git a/package-lock.json b/package-lock.json index 9df317b..3a5c628 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,7 +9,7 @@ "version": "0.1.0", "dependencies": { "@aws-cdk/aws-lambda-python-alpha": "^2.180.0-alpha.0", - "aws-cdk-lib": "2.257.0", + "aws-cdk-lib": "2.258.0", "constructs": "^10.4.2" }, "devDependencies": { @@ -20,9 +20,9 @@ } }, "node_modules/@aws-cdk/asset-awscli-v1": { - "version": "2.2.273", - "resolved": "https://registry.npmjs.org/@aws-cdk/asset-awscli-v1/-/asset-awscli-v1-2.2.273.tgz", - "integrity": "sha512-X57HYUtHt9BQrlrzUNcMyRsDUCoakYNnY6qh5lNwRCHPtQoTfXmuISkfLk0AjLkcbS5lw1LLTQFiQhTDXfiTvg==", + "version": "2.2.282", + "resolved": "https://registry.npmjs.org/@aws-cdk/asset-awscli-v1/-/asset-awscli-v1-2.2.282.tgz", + "integrity": "sha512-7hKMi5tTxDcKGIMIOq14PnY0GBcugW33Uh/2YHDZiEwSxLeFOCYBwhR+BFXONb/EJeVI3RETFgailNZbkcKF6g==", "license": "Apache-2.0" }, "node_modules/@aws-cdk/asset-node-proxy-agent-v6": { @@ -45,9 +45,9 @@ } }, "node_modules/@aws-cdk/cloud-assembly-schema": { - "version": "53.28.0", - "resolved": "https://registry.npmjs.org/@aws-cdk/cloud-assembly-schema/-/cloud-assembly-schema-53.28.0.tgz", - "integrity": "sha512-pZS+9bLGv2tCqcgxfA0WD3XjcqT3yE4ICvKeJEicw6aTdCxBl8FQ/AUsorY/6f2JrMS3kUQgvhXxA30MWcji0A==", + "version": "54.2.0", + "resolved": "https://registry.npmjs.org/@aws-cdk/cloud-assembly-schema/-/cloud-assembly-schema-54.2.0.tgz", + "integrity": "sha512-u3lFXmiXSBozxGBmKTCVD/2mTDsaXzLZH3KYiIQKcB+zPldXOeE5TnooBgKV9ih2jVTo8ML0HpkhfAq2eiv0eQ==", "bundleDependencies": [ "jsonschema", "semver" @@ -55,7 +55,7 @@ "license": "Apache-2.0", "dependencies": { "jsonschema": "^1.5.0", - "semver": "^7.8.0" + "semver": "^7.8.1" }, "engines": { "node": ">= 18.0.0" @@ -70,7 +70,7 @@ } }, "node_modules/@aws-cdk/cloud-assembly-schema/node_modules/semver": { - "version": "7.8.0", + "version": "7.8.1", "inBundle": true, "license": "ISC", "bin": { @@ -206,9 +206,9 @@ } }, "node_modules/aws-cdk-lib": { - "version": "2.257.0", - "resolved": "https://registry.npmjs.org/aws-cdk-lib/-/aws-cdk-lib-2.257.0.tgz", - "integrity": "sha512-GoHfWklrBJcMwLtDlY64pvaT7cD2KyDXC8sik89DR6jHl6nQsBtYTKSJCM+C/k4jgXaecbv8myNX75FySejq0A==", + "version": "2.258.0", + "resolved": "https://registry.npmjs.org/aws-cdk-lib/-/aws-cdk-lib-2.258.0.tgz", + "integrity": "sha512-OfFfg30ikBRJ3dimlzsWhPIrj6qug1p2XYsdB38CtMtcur7SufzoUczgI6kWjbQkOVcQgYzhzN29DErV0yZG7A==", "bundleDependencies": [ "@balena/dockerignore", "@aws-cdk/cloud-assembly-api", @@ -225,19 +225,19 @@ ], "license": "Apache-2.0", "dependencies": { - "@aws-cdk/asset-awscli-v1": "2.2.273", - "@aws-cdk/asset-node-proxy-agent-v6": "^2.1.1", - "@aws-cdk/cloud-assembly-api": "^2.2.4", - "@aws-cdk/cloud-assembly-schema": "^53.25.0", + "@aws-cdk/asset-awscli-v1": "2.2.282", + "@aws-cdk/asset-node-proxy-agent-v6": "^2.1.2", + "@aws-cdk/cloud-assembly-api": "^2.2.5", + "@aws-cdk/cloud-assembly-schema": "^54.0.0", "@balena/dockerignore": "^1.0.2", "case": "1.6.3", - "fs-extra": "^11.3.3", + "fs-extra": "^11.3.5", "ignore": "^5.3.2", "jsonschema": "^1.5.0", "mime-types": "^2.1.35", - "minimatch": "^10.2.3", + "minimatch": "^10.2.5", "punycode": "^2.3.1", - "semver": "^7.7.4", + "semver": "^7.8.1", "table": "^6.9.0", "yaml": "1.10.3" }, @@ -249,7 +249,7 @@ } }, "node_modules/aws-cdk-lib/node_modules/@aws-cdk/cloud-assembly-api": { - "version": "2.2.4", + "version": "2.2.5", "inBundle": true, "license": "Apache-2.0", "dependencies": { @@ -260,18 +260,7 @@ "node": ">= 18.0.0" }, "peerDependencies": { - "@aws-cdk/cloud-assembly-schema": ">=53.25.0" - } - }, - "node_modules/aws-cdk-lib/node_modules/@aws-cdk/cloud-assembly-api/node_modules/semver": { - "version": "7.8.0", - "inBundle": true, - "license": "ISC", - "bin": { - "semver": "bin/semver.js" - }, - "engines": { - "node": ">=10" + "@aws-cdk/cloud-assembly-schema": ">=53.28.0" } }, "node_modules/aws-cdk-lib/node_modules/@balena/dockerignore": { @@ -280,7 +269,7 @@ "license": "Apache-2.0" }, "node_modules/aws-cdk-lib/node_modules/ajv": { - "version": "8.18.0", + "version": "8.20.0", "inBundle": true, "license": "MIT", "dependencies": { @@ -333,7 +322,7 @@ } }, "node_modules/aws-cdk-lib/node_modules/brace-expansion": { - "version": "5.0.5", + "version": "5.0.6", "inBundle": true, "license": "MIT", "dependencies": { @@ -393,7 +382,7 @@ "license": "BSD-3-Clause" }, "node_modules/aws-cdk-lib/node_modules/fs-extra": { - "version": "11.3.3", + "version": "11.3.5", "inBundle": true, "license": "MIT", "dependencies": { @@ -432,7 +421,7 @@ "license": "MIT" }, "node_modules/aws-cdk-lib/node_modules/jsonfile": { - "version": "6.2.0", + "version": "6.2.1", "inBundle": true, "license": "MIT", "dependencies": { @@ -505,7 +494,7 @@ } }, "node_modules/aws-cdk-lib/node_modules/semver": { - "version": "7.7.4", + "version": "7.8.1", "inBundle": true, "license": "ISC", "bin": { diff --git a/package.json b/package.json index 945694d..d77207c 100644 --- a/package.json +++ b/package.json @@ -18,7 +18,7 @@ }, "dependencies": { "@aws-cdk/aws-lambda-python-alpha": "^2.180.0-alpha.0", - "aws-cdk-lib": "2.257.0", + "aws-cdk-lib": "2.258.0", "constructs": "^10.4.2" } } From 08fd2114a5c9a247d58d29c8b3e5b5eea2d92cb1 Mon Sep 17 00:00:00 2001 From: Adam Moussa <166072409+amoussa1229@users.noreply.github.com> Date: Fri, 5 Jun 2026 15:09:01 -0400 Subject: [PATCH 3/5] chore(ci): add aggregator job reporting the org-required 'ci / ci' context (#49) exec-aide's caller jobs are named python/typescript, so the org ruleset's required 'ci / ci' status check never reported here and every PR was merge-blocked for non-admins. The aggregator needs all real CI jobs and fails if any failed or was cancelled. --- .github/workflows/ci.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index f5d488d..2612e0c 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -13,3 +13,15 @@ jobs: uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@main with: run-cdk-synth: false + # Aggregator producing the org-required "ci / ci" status context. + # Caller jobs here have distinct names (python, typescript), so the + # org ruleset's required check would otherwise never report. + ci: + name: ci / ci + needs: [python, typescript] + if: always() + runs-on: ubuntu-latest + steps: + - name: All CI jobs passed + run: | + [ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" = "false" ] From c8912c5a0fa3beca80934e9767fa366ae84a7b49 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 8 Jun 2026 18:30:31 -0400 Subject: [PATCH 4/5] Bump @types/node from 25.9.1 to 25.9.2 in the minor-and-patch group (#50) Bumps the minor-and-patch group with 1 update: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node). Updates `@types/node` from 25.9.1 to 25.9.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 25.9.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 8 ++++---- package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package-lock.json b/package-lock.json index 3a5c628..d13ade0 100644 --- a/package-lock.json +++ b/package-lock.json @@ -13,7 +13,7 @@ "constructs": "^10.4.2" }, "devDependencies": { - "@types/node": "^25.9.1", + "@types/node": "^25.9.2", "aws-cdk": "^2.1125.0", "ts-node": "^10.9.2", "typescript": "~6.0.3" @@ -150,9 +150,9 @@ "license": "MIT" }, "node_modules/@types/node": { - "version": "25.9.1", - "resolved": "https://registry.npmjs.org/@types/node/-/node-25.9.1.tgz", - "integrity": "sha512-xfrlY7UD5rMJk3ZVJP8BNzS28J36YJg+xp+LPXV1TdWxr8uMH5A860QNxYDGQe/ylDSgjxE52Q9VnO7p75tJxg==", + "version": "25.9.2", + "resolved": "https://registry.npmjs.org/@types/node/-/node-25.9.2.tgz", + "integrity": "sha512-G05zqtJhcDLb8uslf5EjCxXg9G1KQxiV8OS0R26IC//Eoyitzqe8z37I7cqvnZlrlSfgocQRfSn/AHBZJJFyGw==", "dev": true, "license": "MIT", "dependencies": { diff --git a/package.json b/package.json index d77207c..100fc77 100644 --- a/package.json +++ b/package.json @@ -11,7 +11,7 @@ "synth": "cdk synth" }, "devDependencies": { - "@types/node": "^25.9.1", + "@types/node": "^25.9.2", "aws-cdk": "^2.1125.0", "ts-node": "^10.9.2", "typescript": "~6.0.3" From 6c240576b9c9e39b0e73d17c1d5bff07859306f6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 8 Jun 2026 18:30:35 -0400 Subject: [PATCH 5/5] Update boto3 requirement from >=1.43.18 to >=1.43.24 in /listener (#51) Updates the requirements on [boto3](https://github.com/boto/boto3) to permit the latest version. - [Release notes](https://github.com/boto/boto3/releases) - [Commits](https://github.com/boto/boto3/compare/1.43.18...1.43.24) --- updated-dependencies: - dependency-name: boto3 dependency-version: 1.43.24 dependency-type: direct:production ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- listener/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/listener/requirements.txt b/listener/requirements.txt index 387b6c5..70b58b7 100644 --- a/listener/requirements.txt +++ b/listener/requirements.txt @@ -1,3 +1,3 @@ slack-bolt>=1.28.0 slack-sdk>=3.42.0 -boto3>=1.43.18 +boto3>=1.43.24