Release 1.7.0 - #101
Merged
Merged
Conversation
pcholakov
marked this pull request as draft
June 18, 2026 19:15
pcholakov
added a commit
that referenced
this pull request
Jun 18, 2026
General dependency tidy-up: update CDK and the dev toolchain, and resolve the actionable `npm audit` advisories. ## Updates - `aws-cdk-lib` 2.236.0 -> 2.260.0, `aws-cdk` CLI -> 2.1128.0, `constructs` -> 10.6.0 - `@aws-sdk/client-secrets-manager` -> 3.1072.0, `@restatedev/restate-sdk` -> 1.14.5 - Dev toolchain to latest in-range: `@types/*`, `prettier`, `ts-jest`, `tsx`, `typescript`, `jest-cdk-snapshot` - `package.json` floors bumped to match; no major-version bumps ## Security (`npm audit`) Before: **30** (1 critical, 4 high, 24 moderate, 1 low) -> After: **21** (0 critical, 0 high, 20 moderate, 1 low) - Critical `fast-xml-parser` (DoS) cleared via the AWS SDK update - All 4 high cleared: `aws-cdk-lib` NodejsFunction command injection, `fast-uri`, `minimatch`, `picomatch` (ReDoS) The remaining 20 moderate + 1 low are **dev-only** and not installed by consumers of the published library (devDependencies): - 20 moderate root in `js-yaml@3`, pinned by `jest@29`'s coverage tooling (`@istanbuljs/load-nyc-config`) and by `jest-cdk-snapshot`. A jest 29->30 bump does **not** reduce the count (the `js-yaml@3` pins persist), and a blanket `js-yaml@4` override breaks `jest-cdk-snapshot` (it uses the removed v3 `safeLoad` API). These need upstream fixes. - 1 low is `esbuild`'s Windows dev-server file-read advisory; the dev server is not used here. ## Tests - `npm run build`, `npm run lint`, `npm test` all pass - Snapshots regenerated: the test fixture uses `Runtime.NODEJS_LATEST`, which resolves to `nodejs24.x` under CDK 2.260 (was `nodejs22.x`). Construct-owned handlers remain pinned at `NODEJS_22_X` - no consumer-facing change. ## Note Overlaps with #101 (Release 1.7.0) in `package.json` / `package-lock.json`. Whichever merges first, the other should be rebased.
These EC2/Fargate-based constructs are deprecated and will be removed in a future release. To run Restate on Kubernetes, use the Restate Helm chart or the restate-operator instead.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Default to Restate 1.7 and deprecate the self-managed deployment constructs.
Warning
Do not tag
v1.7.0until Restate 1.7 is GA. npm@restatedev/restateis stilllatest=1.6.2 /next=1.7.0-rc.6, and the docker:1.7tag 404s. Until 1.7.0 final is published, the single-node host'snpm install @restatedev/restate@1.7 @restatedev/restatectl@1.7will 404. Kept as a draft until then.Commits
@deprecatedJSDoc toSingleNodeRestateDeploymentandFargateRestateDeployment, pointing to the Restate Helm chart / restate-operator on Kubernetes as the replacement. To be removed in a future release.RESTATE_DOCKER_DEFAULT_TAG/RESTATE_NPM_DEFAULT_TAGto1.7(single-node) andRESTATE_DOCKER_DEFAULT_TAGto1.7(Fargate); set dev version1.7.0-SNAPSHOT; regenerate snapshots.Rebased onto #102 (dependency + CDK update), so this branch includes those updates.
Validation
npm run build,npm run lint,npm testpass (12 tests)docker.restate.dev/restatedev/restate:1.7.0-rc.6+restatectl@1.7.0-rc.6: stack deployed, service registered, Greeter returned200 "Hello <id>!". Confirms the 1.7 line is compatible with the construct (no config breakage). The temporary e2e image override was reverted; the e2e stack stays on:main.Release
Once 1.7.0 is GA, tag
v1.7.0-publish.ymlsetspackage.jsonto1.7.0, commits to main, runs tests, and publishes to npm.