chore(deps): upgrade dependencies

[backgroundagents]

Upgrades project dependencies. See details in workflow run.

---

Automatically created by the "upgrade-main" workflow

[scottschreckengaust]

Review: PR #590 chore(deps): upgrade dependencies

Verdict: REQUEST_CHANGES — this bot dep-bump is not mergeable as-is because it breaks the build. build (agentcore) is RED and the cause is a dependency in this very diff (the ty type-checker bump), not a pre-existing/flaky failure. For a dependency PR, CI-green is the load-bearing signal, so a bump that turns the build red must be fixed before merge — even for routine bot hygiene.

Everything else in the bump is safe (details below); the block is narrow and mechanical.

Vision alignment

Bounded blast radius, mostly. Lockfile-only change (agent/uv.lock + yarn.lock; no package.json / pyproject.toml edits), so every bump stays within existing semver ranges. No attack-surface widening, no new top-level deps. The one leak past the intended boundary is ty: it is pinned bare ("ty", no version bound) in agent/pyproject.toml, so "regenerate within pins" still walked the type-checker forward to a stricter engine (0.0.56 → 0.0.59) that rejects previously-accepted source.

Blocking

B1 — ty 0.0.56 → 0.0.59 breaks //agent:typecheck (build (agentcore) job is RED). agent/uv.lock (ty package block; +version = "0.0.59").

• //agent:typecheck runs uv run ty check (agent/mise.toml:44). ty 0.0.59 now emits 9 new diagnostics in agent/tests/test_models.py — the source is unchanged in this PR, so this is purely the engine getting stricter/regressing on the same code:
  • 6× invalid-assignment "Property … is read-only" at test_models.py:30, 63, 140, 170, 416, 447. Each is an intentional negative test asserting Pydantic immutability (e.g. c.author = "bob" inside with pytest.raises(ValidationError):) on models declared model_config = ConfigDict(frozen=True, …) (agent/src/models.py:20, 47, 62, 117, 294, 305).
  • 2× invalid-argument-type at test_models.py:237, 244: content_trust={"issue": "untrusted-external", …} is inferred as dict[str, str] and rejected against the declared dict[str, ContentTrustLevel] where ContentTrustLevel = Literal["trusted","untrusted-external","memory"] (agent/src/models.py:71, 130).
• Note this is a two-step jump vs main, which currently pins ty 0.0.50.
• Fix — pick one, none should be silent:
  1. Cleanest for a pure dep-bump: pin ty==0.0.56 (last known-green) in agent/pyproject.toml and revert only the ty block of agent/uv.lock; let the other 8 Python bumps + all yarn bumps land green.
  2. If keeping ty current is desired: that requires touching agent/tests/test_models.py source (per-line # ty: ignore[invalid-assignment] on the 6 deliberate frozen-write negative tests, and an explicit dict[str, ContentTrustLevel] annotation / cast for the 2 content_trust literals). Source changes fall outside bot dep-hygiene and need a governance issue per ADR-003 — so this should be split out, not ridden in on the auto-approve bump.
  • Do not globally relax [tool.ty.rules] to mask this — it would hide real future frozen-write / literal bugs.

Non-blocking observations

• Cedar parity: intact. Neither cedarpy (Python) nor @cedar-policy/cedar-wasm (TS) is touched — cedarpy==4.8.4 and cedar-wasm@4.8.2 are unchanged on both sides. The paired-engine rule (AGENTS.md "Common mistakes") is not triggered; no contracts/cedar-parity/ refresh needed.
• No downgrades. All 9 uv.lock and ~60 yarn.lock transitions move forward.
• No synth-affecting core CDK bump. aws-cdk-lib and constructs are not changed (the @@ aws-cdk-lib@^2.260.0 line is only a hunk-context header). @aws-cdk/cloud-assembly-schema 54.8.0→54.11.0 and the aws-cdk CLI 2.1129.0→2.1131.0 are the CLI/cxapi side, within the pinned major — CDK snapshot tests should not shift.
• AWS SDK v3 clients (@aws-sdk/client-bedrock-agentcore/-runtime/-dynamodb/-ecs/-lambda/-s3/-secrets-manager) 3.1081.0→3.1087.0: standard weekly patch/minor cadence, no majors.
• Python bumps anyio 4.14.1→4.14.2, asgiref 3.11.1→3.12.1, botocore 1.43.42→1.43.48, coverage 7.15.0→7.15.1, grpcio 1.81.1→1.82.1, ruff 0.15.20→0.15.21, s3transfer 0.19.0→0.19.1, websockets 16.0→16.1 — all patch/minor, none with a known advisory.

Documentation

N/A — pure lockfile bump; no docs/guides/ or docs/design/ source touched, so no Starlight mirror sync required.

Tests & CI

• Secrets, deps, and workflow scan (OSV Scanner on yarn.lock + agent/uv.lock): pass — no advisories or vulnerable pulls introduced. CodeQL / Analyze (actions, js-ts, python): pass. Dead-code (advisory): pass. Validate PR title: pass.
• build (agentcore): FAIL — //agent:typecheck Found 9 diagnostics → exit 1 (B1). This is the sole failure and it is deterministic, not a flake.
• No new tests expected for a dep bump; the concern is that existing tests/typecheck must stay green, and they do not.

Review agents run

• pr-review-toolkit:code-reviewer — ran; independently reproduced the ty build-breaker mechanism and confirmed no downgrades / no synth-affecting core bump / Cedar untouched.
• silent-failure-hunter, type-design-analyzer — omitted (out of scope: lockfile-only diff, no error-handling or type-definition source changes).

Human heuristics

Base is fresh (PR head merge-base == origin/main @ 22705e83, single commit). Author is the backgroundagents bot; missing approved-issue is normal for pure dep hygiene and is not the basis for this block. The auto-approve label is present but must not auto-merge a red build — the failing agentcore job is a legitimate, self-caused gate failure. The narrowest green path is option (1): pin ty back and re-run.

_{🤖 Generated with Claude Code}

[scottschreckengaust]

Blocking: this ty bump (0.0.56 → 0.0.59) is what turns build (agentcore) red. ty is pinned bare ("ty") in agent/pyproject.toml, so the lockfile is its only bound and regenerating walked it to a stricter engine. uv run ty check (agent/mise.toml:44) now emits 9 new diagnostics in agent/tests/test_models.py (6 frozen-attribute negative tests + 2 content_trust Literal narrowings) even though that source is unchanged in this PR.

Cleanest fix to keep this a green, pure dep-bump: pin ty==0.0.56 in agent/pyproject.toml and revert just this ty block of the lockfile; let the other bumps land. Keeping ty current instead requires editing test_models.py (deliberate # ty: ignore + explicit dict[str, ContentTrustLevel] annotations), which is source work that should go through a governance issue rather than the auto-approve bot bump.

[scottschreckengaust]

Review: PR #590 chore(deps): upgrade dependencies (re-review @ 7413a94)

1. Verdict

REQUEST_CHANGES — one blocking issue, unchanged in kind from my prior review but now on a different commit and a further-advanced version: build (agentcore) is RED because the ty type-checker bump inside this very diff turns //agent:typecheck red. Everything else in the bump verified safe (below). For a bot dep-bump, CI-green is the load-bearing signal, so a bump that self-inflicts a red build cannot merge — even carrying auto-approve.

Status of my prior CHANGES_REQUESTED (on fee375be, 2026-07-16): the branch has since been force-updated to a fresh lockfile regeneration, so that review's commit is gone. I re-verified B1 against the current head rather than repeating it blind — it is still present and now worse (ty is at 0.0.66, not 0.0.59). The two invalid-argument-type content_trust diagnostics from that review are resolved — ty 0.0.66 no longer emits them; the current failure is 7 diagnostics, all invalid-assignment. I am not re-raising them.

2. Vision alignment

Bounded blast radius, with one leak. Lockfile-only (agent/uv.lock + yarn.lock; no package.json / pyproject.toml edit), so every transition stays inside an already-declared range — consistent with the upgrade-main contract (mise.toml [tasks.upgrade]: "exact pins … are never rewritten"). No new attack surface, no new top-level dep, no tenet traded. The leak is ty: it is declared bare ("ty", no bound) in agent/pyproject.toml:88, so the lockfile is its only bound and "regenerate within pins" walks the type-checker engine forward unboundedly. That is a structural gap in the dep-hygiene loop, not a one-off.

3. Blocking issues

B1 — ty 0.0.56 → 0.0.66 breaks //agent:typecheck; build (agentcore) is RED. agent/uv.lock:2123 (+version = "0.0.66").

• //agent:typecheck runs uv run ty check (agent/mise.toml:44). ty 0.0.66 emits 7 new invalid-assignment diagnostics on source this PR does not touch — a pure engine-strictness change:
  • agent/tests/test_attachments.py:46 — att.filename = "other.txt" (PreparedAttachment)
  • agent/tests/test_models.py:30 — c.author = "bob" (IssueComment, frozen at agent/src/models.py:20)
  • agent/tests/test_models.py:63 — issue.title = "Feature" (GitHubIssue, models.py:47)
  • agent/tests/test_models.py:140 — mc.repo_knowledge = ["new"] (MemoryContext, models.py:62)
  • agent/tests/test_models.py:170 — hc.user_prompt = "changed" (HydratedContext, models.py:117)
  • agent/tests/test_models.py:431 — setup.repo_dir = "/other" (RepoSetup, models.py:306)
  • agent/tests/test_models.py:462 — u.input_tokens = 200 (TokenUsage, models.py:341)
• Every one is a deliberate negative test — a frozen-write inside with pytest.raises(ValidationError): asserting Pydantic immutability on a ConfigDict(frozen=True) model. The tests are correct; ty 0.0.66 has simply started statically rejecting the write it is the test's whole job to attempt at runtime.
• Failure is deterministic, not a flake: Found 7 diagnostics → task failed → step exit 1 (job log). This is a two-hop jump past what main currently locks (ty 0.0.56, green).
• Because mise run build is a parallel DAG and //agent:typecheck fails early, the rest of the build never ran — //cdk:test, //cdk:synth:quiet, //cli:test completion, //docs:link-check, check:transitive-pin-sync, and the "Fail build on mutation" step were all skipped. So B1 also masks whether the other ~200 yarn transitions are green. That is a second, independent reason not to merge on the current signal.
• Fix — pick one; none should be silent:
  1. Narrowest, correct for a bot dep-bump: pin ty==0.0.56 (last known-green) in agent/pyproject.toml dev group and revert only the ty block of agent/uv.lock. The other 15 Python bumps and all yarn bumps then land green.
  2. If keeping ty current is wanted: that needs source edits — a per-line # ty: ignore[invalid-assignment] on each of the 7 deliberate frozen-write negative tests. Source changes are outside bot dep-hygiene and need their own approved issue per ADR-003; split it out rather than riding it in on auto-approve.
  • Do not globally relax [tool.ty.rules] (agent/pyproject.toml:179) to mask this — invalid-assignment is exactly the rule that would catch a real accidental frozen-model write in agent/src/.

4. Non-blocking suggestions / nits

• N1 (root cause, worth its own issue): ty and ruff are declared bare in agent/pyproject.toml:87-88. Every other dep in this repo is exact-pinned (==) with a deliberate rationale comment; these two dev tools are the only unbounded entries, and they are precisely the two whose output is a build gate. An unbounded gate-defining tool means the scheduled upgrade-main job can turn main-adjacent PRs red with zero source change — which is what happened here (and, per repo history, on #626 before it). Recommend pinning both == and bumping them deliberately, same treatment as the Cedar pair. No such issue exists today (searched); please file one with a priority label.
• N2 — 20 major-version-crossing transitives ride in. All verified reachable only via dev tooling, none via the agent/Lambda runtime: the proxy/network family (proxy-agent 8.0.2, socks-proxy-agent 10.1.0, http/https-proxy-agent 9.1.0, pac-resolver 9.0.1, pac-proxy-agent 9.1.0, degenerator 7.0.1, get-uri 8.0.1, agent-base 9.0.0, data-uri-to-buffer 8.0.0, proxy-from-env 2.1.0) plus chalk 6, commander 15, marked 18, node-email-verifier 4, yargs 18, cliui 9, string-width 7/8, wrap-ansi 9 — all enter through markdown-link-check@^3.13.6 → 3.15.0, a docs/ devDependency used only by mise //docs:link-check on repo-local Markdown (docs/scripts/link-check.sh). Also jsdoc-type-pratt-parser 8 and spdx-expression-parse 5 via eslint plugins. All within their declared ^/~ descriptor ranges, so the resolve is legitimate — but //docs:link-check never got to run in CI (see B1), so this specific tool's new major stack is unvalidated. Worth confirming on the re-run rather than assuming.
• N3 — Python websockets 16.0 → 17.0.1 and grpcio 1.81.1 → 1.83.0 are major/minor jumps under exact-pinned parents (bedrock-agentcore==1.18.1 and opentelemetry-exporter-otlp-proto-grpc respectively). No advisory and no manifest change, but these are the two Python transitives with real wire-protocol behavior in the agent runtime. //agent:test also did not run (B1), so runtime regression is unverified. Same ask: confirm on re-run.
• N4 — branch name github-actions/upgrade-main does not match (feat|fix|chore|docs)/<issue>-.... Automated branch, explicitly exempt. Noted only for completeness; not actionable.
• N5 — no approved backing issue. Correct and expected for scheduled dep hygiene (upgrade-main.yml, auto-approve label); ADR-003's gate is aimed at feature work. Not part of the block. The auto-approve label is present, but auto-approve.yml only fires on the labeled event and branch protection still requires build — so the red build is a legitimate gate, and the label does not and should not route around it.

5. Documentation

N/A, correctly. Pure lockfile bump; no docs/guides/, docs/design/, docs/decisions/, or CONTRIBUTING.md source touched, so no Starlight mirror regeneration is owed and docs/src/content/docs/ is untouched. //docs:sync ran clean in CI (97.9ms, no mutation). No env var, contract, command, or AGENTS.md routing change. See N1 for the one doc-adjacent follow-up (a tracking issue for the bare dev-tool pins).

6. Tests & CI

• build (agentcore): FAIL — sole failure, self-caused, deterministic (B1). Tasks that completed before the abort: //:install, //:test:jira-forge-app (13 ok), //:check:constants-sync, //:check:types-sync, //:sync:abca-commands, //docs:sync, //agent:lint:fix, //agent:format. Tasks that never ran: //cdk:test, //cdk:synth:quiet, //docs:link-check, //:check:coverage-thresholds-sync, //:check:transitive-pin-sync, //agent:test, and "Fail build on mutation".
• All other checks pass: Secrets, deps, and workflow scan (OSV on both lockfiles), CodeQL / Analyze (actions, js-ts, python), Dead-code detection (advisory), Validate PR title.
• No new tests expected for a dep bump; the bar is that existing gates stay green, and one does not.
• Bootstrap synth-coverage: not applicable. No construct, stack, or handler changed; cdk/src/bootstrap/** untouched; BOOTSTRAP_VERSION (1.2.0) and BOOTSTRAP_HASH correctly unchanged. aws-cdk-lib 2.261.0 → 2.263.0 and constructs 10.6.0 → 10.8.1 are within ^2.260.0 / ^10.6.0, and both alpha modules (aws-bedrock-alpha, integ-tests-alpha @ 2.260.0-alpha.0) declare peers aws-cdk-lib ^2.260.0 / constructs ^10.5.0 — satisfied, so no peer break. cdk-nag unmoved at 2.38.2. The one snapshot test in the tree (cdk/test/bootstrap/version.test.ts) is version-string-based, not synth-based, so no snapshot churn expected — but //cdk:test and //cdk:synth:quiet did not execute, so "expected" is inference, not evidence. Re-run needed.

7. Review agents run

The repo's pr-review-toolkit agents (code-reviewer, silent-failure-hunter, type-design-analyzer, comment-analyzer, pr-test-analyzer) were not invocable in this session — no subagent-dispatch tool was exposed to the harness (verified by tool search; the plugin cache exists on disk at ~/.claude/plugins/cache/claude-plugins-official/pr-review-toolkit but has no reachable agent entrypoint). Stating that plainly rather than claiming a run I did not perform. What I ran instead:

• /security-review — ran. In scope: the bump introduces 5 new npm packages and a proxy/PAC-evaluation family. Result: no HIGH or MEDIUM findings. Provenance verified via registry (@aws/cloudformation-validate → maintainer aws-cfn-dev-ex-npm, repo aws-cloudformation/cloudformation-validate, first-party AWS, pinned dep of aws-cdk-lib 2.263.0; json-source-map → esp/ajv author, via @aws-cdk/cloud-assembly-api 2.3.0; get-east-asian-width → sindresorhus; quickjs-wasi → vercel-labs; proxy-agent-negotiate → TooTallNate/proxy-agents). The pac-resolver/degenerator/quickjs-wasi PAC-eval surface engages only when a proxy env var names a PAC URL, is confined to a docs/ devDependency, and has no untrusted-input path in this repo.
• Manual verification standing in for the toolkit agents (recorded so the gap is auditable): full version-delta extraction on both lockfiles (16 Python, 203 npm changed, 5 added, 1 removed — zero downgrades); OSV queries on all 16 Python and 21 npm majors/new packages (all CLEAN); reproduced the ty failure locally at 0.0.66; confirmed ruff 0.16.1 is clean on agent/ (check + format --check both pass — so the ruff half of the bump is safe); ran scripts/check-transitive-pin-sync.mjs (OK, 4 shared pins in sync); confirmed root resolutions floors all honored in the regenerated lock; confirmed astro still pinned 7.1.3 (the poisoned 7.1.0 / MAL-2026-10726 is unreachable).
• silent-failure-hunter, type-design-analyzer, comment-analyzer, pr-test-analyzer — out of scope regardless: the diff contains no error-handling code, no type definitions, no comments, and no tests. Even had they been invocable, there is nothing in a two-lockfile diff for them to read.

8. Human heuristics

• Proportionality — pass. Two lockfiles, no manifest edits; the mechanism is the minimum needed for dep hygiene. The fix for B1 should be equally proportionate: pin ty back (option 1), not 7 scattered ignore comments smuggled into an auto-approve PR.
• Coherence — concern, agent/pyproject.toml:87-88. The repo's stated convention is exact pins with a rationale comment (see the Cedar banner at pyproject.toml:26-43, and the [tool.uv] note deliberately declining a cooldown "because deps are exact-pinned"). ruff and ty are the only bare entries and the only two whose output gates the build — the convention's own justification does not hold for them. That inconsistency is the mechanism of this failure, not bad luck. See N1.
• Clarity — pass. The failure is loud and specific (Found 7 diagnostics, file:line each) rather than a silent degradation, which is the behavior you want from a gate.
• Appropriateness — concern. Base is slightly stale: merge-base is 3a5b4cb6, while origin/main is now df1ebac6 (#345, solution UA). I verified df1ebac6 touches no package.json / pyproject.toml / lockfile, so there is no lock conflict and no rebase is required for correctness — the staleness is inert. Separately: a scheduled bot PR that can go red from an unbounded dev-tool pin, while carrying auto-approve, is a loop that will keep costing review cycles until N1 is fixed. Fixing the pin is the durable fix; pinning ty back is the fix for this PR.

---

Narrowest path to green: pin ty==0.0.56 in agent/pyproject.toml, revert only the ty block of agent/uv.lock, re-run build. That lets the remaining 15 Python + ~200 npm transitions land, and — importantly — lets //cdk:test, //cdk:synth:quiet, //agent:test, and //docs:link-check actually execute so N2/N3 stop being inferences. Then file N1 so the next scheduled run cannot repeat this.

_{Reviewed as Principal AWS Solutions Architect against .abca/commands/review_pr.md Stages 1-5. Head 7413a94; base merge-base 3a5b4cb6; origin/main df1ebac6.}

[scottschreckengaust]

Blocking (B1). This is the single line that turns build (agentcore) red.

ty 0.0.56 → 0.0.66 (a two-hop jump past main, which locks 0.0.56 and is green). //agent:typecheck = uv run ty check (agent/mise.toml:44) now emits 7 invalid-assignment diagnostics on source this PR does not touch:

• tests/test_attachments.py:46, tests/test_models.py:30, 63, 140, 170, 431, 462

Every one is a deliberate negative test — a frozen-field write inside with pytest.raises(ValidationError): asserting Pydantic immutability on a ConfigDict(frozen=True) model (agent/src/models.py:20, 47, 62, 117, 306, 341). The tests are correct; the engine has just started statically rejecting the assignment the test exists to attempt at runtime. Found 7 diagnostics → exit 1, deterministic, not a flake.

Root cause: ty is declared bare ("ty", no version bound) at agent/pyproject.toml:88, so this lockfile is its only bound and uv lock --upgrade walks the gate-defining type-checker forward unboundedly.

Second-order damage: mise run build is a parallel DAG, so this early abort meant //cdk:test, //cdk:synth:quiet, //agent:test, //docs:link-check, check:transitive-pin-sync, and "Fail build on mutation" never ran — the rest of the bump is unvalidated, not proven green.

Fix (narrowest): pin ty==0.0.56 in agent/pyproject.toml and revert only this ty block; the other 15 Python bumps and all yarn bumps then land green. If you'd rather keep ty current, that requires per-line # ty: ignore[invalid-assignment] on the 7 negative tests — source edits, which need their own approved issue per ADR-003 and should not ride in on an auto-approve bump. Please do not relax [tool.ty.rules] globally (pyproject.toml:179) — invalid-assignment is exactly the rule that would catch a real accidental frozen-model write in agent/src/.

[scottschreckengaust]

Non-blocking, verified safe — recording the check so it isn't re-litigated.

aws-cdk-lib 2.261.0 → 2.263.0 (and constructs 10.6.0 → 10.8.1 below) are inside the declared ^2.260.0 / ^10.6.0 ranges in cdk/package.json, so this is a legitimate in-range resolve, not a range widening. Both alpha modules pinned at 2.260.0-alpha.0 (@aws-cdk/aws-bedrock-alpha, @aws-cdk/integ-tests-alpha) declare peers aws-cdk-lib ^2.260.0 / constructs ^10.5.0 — satisfied, no peer break. cdk-nag unmoved at 2.38.2. OSV: both CLEAN.

This also drags in the new first-party AWS transitive @aws/cloudformation-validate@1.6.0-beta (maintainer aws-cfn-dev-ex-npm, repo aws-cloudformation/cloudformation-validate) — provenance verified, OSV clean. The -beta dist-tag is upstream's own pinned choice inside aws-cdk-lib, not something this repo selected.

Caveat: //cdk:test and //cdk:synth:quiet never executed in this run (aborted by the ty failure in agent/uv.lock), so "no synth/snapshot churn" is inference from the version ranges, not evidence. Please confirm on the re-run after B1 is fixed. Bootstrap artifacts are correctly untouched (BOOTSTRAP_VERSION 1.2.0, BOOTSTRAP_HASH unchanged) — no construct or CFN resource type changed, so ADR-002 does not apply here.

[scottschreckengaust]

Non-blocking (N2), but flagging where the 20 major-version-crossing transitives come from.

markdown-link-check ^3.13.6 → 3.15.0 is the single entry point for nearly the whole major-bump list: chalk 6, commander 15 (this line), marked 18, node-email-verifier 4, and — via link-check@5.6.0 → proxy-agent@^8.0.2 — the entire proxy/network family: proxy-agent 8.0.2, socks-proxy-agent 10.1.0, http/https-proxy-agent 9.1.0, pac-proxy-agent 9.1.0, pac-resolver 9.0.1, degenerator 7.0.1, get-uri 8.0.1, agent-base 9.0.0, data-uri-to-buffer 8.0.0, plus the new quickjs-wasi@2.2.0 and proxy-agent-negotiate@1.1.0.

All in-range for the declared ^3.13.6, all CLEAN in OSV, and all provenance-verified (quickjs-wasi → vercel-labs, proxy-agent-negotiate → TooTallNate/proxy-agents). Blast radius is genuinely small: this is a docs/ devDependency, reached only by mise //docs:link-check → docs/scripts/link-check.sh against repo-local Markdown. It is not bundled into the agent image, any Lambda, or the CLI, so the PAC-evaluation surface in pac-resolver/degenerator/quickjs-wasi is not on any untrusted-input path. Upstream 3.15.0 release notes are "improve code block removal + update dependencies" — no behavioral change to link resolution.

The real gap: //docs:link-check never ran in this build (aborted by the ty failure). So this new major stack is unvalidated rather than known-good. Once B1 is fixed and the build completes, this resolves itself — just don't assume it's green before then.