chore(deps): bump the infra/test toolchain (slice 1 of 3 from #19) - #21
Merged
Conversation
Slice 1 of 3 from dependabot PR #19, split by risk. This slice has no agent framework in it: CDK, boto3/botocore, pyyaml, requests, pytest, constructs. Nothing here reaches a container. - aws-cdk-lib 2.251.0 → 2.265.0, constructs 10.0.79 → 10.8.1 - boto3/botocore 1.34.0 → 1.43.72, requests 2.31.0 → 2.34.2, pyyaml 6.0.3 - pytest 8.0 → 9.1.1 (major; the actual risk in this slice) Verified: - pytest 9.1.1: 99 passed, no deprecation breakage in the suite. - cdk synth on the new aws-cdk-lib produces a BYTE-IDENTICAL gateway template to the old one (diff: 0 lines) — the bump changes no infrastructure. - cdk ls: 8 stacks as expected; validate_control_library.py clean. Deliberately NOT in this slice: everything under agent-code/. Those need container builds and live invokes, and PR #19's batch is unusable as-is — it pins mcp==2.0.0 while claude-agent-sdk 0.2.139, langchain-mcp-adapters 0.3.2 and strands-agents 1.52.0 all require mcp<2.0.0. Verified with pip: ResolutionImpossible. Slices 2 and 3 take the frameworks per-pattern, keeping mcp==1.29.0.
|
Commit: Security Scan Results
|
This was referenced Aug 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Slice 1 of 3 from #19, split by risk. This slice contains no agent framework — CDK, boto3, pyyaml, requests, pytest, constructs. Nothing here reaches a container.
Why #19 can't be merged as-is
It pins
mcp==2.0.0, but the same PR'sclaude-agent-sdk 0.2.139,langchain-mcp-adapters 0.3.2andstrands-agents 1.52.0all requiremcp<2.0.0. Verified with pip:So the grouped batch is uninstallable. The MCP 2.x ecosystem hasn't converged yet;
mcp==1.29.0stays pinned until it does.Changes
Verified
cdk ls8 stacks;validate_control_library.pyclean.Next
Slices 2–3 take the agent frameworks per-pattern (strands family, then langchain/langgraph + claude-sdk), each with an arm64 container build,
import agent, and a live invoke — the verification GitHub CI can't do.