Skip to content

Bump Amazon.CDK.Lib and 13 others #425

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Sep 2, 2025
Merged

Bump Amazon.CDK.Lib and 13 others #425

merged 2 commits into from
Sep 2, 2025

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Aug 1, 2025 •
edited
Loading

Updated Amazon.CDK.Lib from 2.203.0 to 2.208.0.

Release notes

Sourced from Amazon.CDK.Lib's releases.

2.208.0

Features

  • update L1 CloudFormation resource definitions (#​35054) (a2b3e78)
  • region-info: add support for region ap-southeast-6 (#​35036)

Bug Fixes

Alpha modules (2.208.0-alpha.0)

Features

2.207.0

Features

Bug Fixes

Alpha modules (2.207.0-alpha.0)

2.206.0

Features

  • custom-resource: Added async custom resource provider framework logging off by default (1302e3d)
  • ecs: add L1 native blue/green deployment support for ECS services (3ef87e4)

Alpha modules (2.206.0-alpha.0)

2.205.0

Features

Bug Fixes

⚠ CHANGES TO L1 RESOURCES

L1 resources are automatically generated from public CloudFormation Resource Schemas. They are build to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

  • aws-cdk-lib.aws_ec2.CfnTrafficMirrorFilterRule: Id attribute was removed
  • aws-cdk-lib.aws_kinesis.StreamConsumer: Id attribute was removed
  • aws-cdk-lib.aws_neptune.DBInstance: Id attribute was removed

Alpha modules (2.205.0-alpha.0)

2.204.0

Features

Bug Fixes

Alpha modules (2.204.0-alpha.0)

Features

2.203.1

Bug Fixes

Alpha modules (2.203.1-alpha.0)

Commits viewable in compare view.

Updated Amazon.Lambda.Core from 2.6.0 to 2.7.0.

Release notes

Sourced from Amazon.Lambda.Core's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Aspire.Hosting.Testing from 9.3.1 to 9.4.0.

Release notes

Sourced from Aspire.Hosting.Testing's releases.

9.4.0

We are excited to share that our 9.4.0 release of Aspire has shipped! All of the packages are available in NuGet.org now. Head over to https://learn.microsoft.com/en-us/dotnet/aspire/whats-new/dotnet-aspire-9.4 to find what's new in 9.4.0!

What's Changed

9.3.2

What's Changed

Full Changelog: dotnet/aspire@v9.3.1...v9.3.2

Commits viewable in compare view.

Updated AWS.Lambda.Powertools.Logging from 2.0.0 to 2.0.1.

Release notes

Sourced from AWS.Lambda.Powertools.Logging's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated AWSSDK.DynamoDBv2 from 3.7.408.1 to 4.0.3.1.

Release notes

Sourced from AWSSDK.DynamoDBv2's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated AWSSDK.EventBridge from 3.7.406.1 to 4.0.3.1.

Release notes

Sourced from AWSSDK.EventBridge's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated AWSSDK.SimpleNotificationService from 3.7.400.172 to 4.0.0.15.

Release notes

Sourced from AWSSDK.SimpleNotificationService's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated AWSSDK.SimpleSystemsManagement from 3.7.406.1 to 4.0.2.5.

Release notes

Sourced from AWSSDK.SimpleSystemsManagement's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated AWSSDK.StepFunctions from 3.7.403.115 to 4.0.0.17.

Release notes

Sourced from AWSSDK.StepFunctions's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Datadog.Trace from 3.20.0 to 3.22.0.

Release notes

Sourced from Datadog.Trace's releases.

3.22.0

Summary

  • [Azure Functions] Support for Azure Functions is GA
  • [Azure Functions] Optimized support for Azure Functions with the Datadog.AzureFunctions NuGet package
  • [TestOptimization] Add support for pr.number and additional CI variables
  • [TestOptimization] Add support for xunit.v3 version 3.x.x
  • [Data Streams Monitoring] Initial support for the default experience

Changes

Tracer

  • Integrations: Disable AWS Kinesis injection when the integration is disabled (#​7239)
  • Refactor SpanContextInjector and SpanContextExtractor and improve tests (#​7258)

CI Visibility

  • [TestOptimization] Update the CI Environment Values parser (#​7242)
  • Add support for xunit.v3 v3 (#​7245)
  • [Test Optimization] Add pr.number tag to Github provider (#​7262)

ASM

  • [AAP] Update WAF to V1.26 (#​7216)

Continuous Profiler

  • [Profiler] Add ringbuffer (#​7025)

Debugger

  • Reduce log level for ConcurrentAdaptiveCache capacity (#​7213)

Serverless

  • [Serverless] Remove "preview" version suffix from Datadog.AzureFunctions (#​7229)
  • [Azure Functions] Bump Datadog.Serverless.Compat package reference version (#​7238)
  • [Azure Functions] Fixes, refactoring, and clean-up (#​7256)
  • [Azure Functions] Ignore additional URLs in outgoing HTTP client requests (#​7271)
  • [Azure Functions] Fix operation name (#​7272)
  • [Serverless] add serverless teams as co-owners on additional files (#​7273)
  • [Serverless] GA nuget package Datadog.AzureFunctions (#​7283)

Miscellaneous

  • Add documentation on how to perform a major version update (#​7152)
  • [IAST] Added compatibility for stable config (#​7164)
  • Only enable Schema extraction when DSM explicitly enabled (#​7175)
  • remove redundant dependency check for dynamic assemblies (#​7222)
  • Bump libdatadog from 19.0.1 to 19.1.0. (#​7232)
  • feat: add injection metadata fields to telemetry forwarder (#​7237)
  • DSM default state reversal (#​7244)
  • chore: add malformed baggage header telemetry (#​7254)
  • Fix SSI injection telemetry (#​7288)
  • Increase rejit timeout from 100ms to 150ms (#​7289)
  • Add agent response handling to native interop (#​7201)
  • Prevent and remove double-disposal in DiscoveryService and RemoteConfigurationManager (#​7240)
    ... (truncated)

3.21.0

Summary

  • [Tracing] Add support for NLog 6.x.x
  • [Test Optimization] Improve the CodeOwners parser
  • [Data stream Monitoring] Various fixes for Kinesis, SQS, SNS, and RabbitMQ integrations
  • [Serverless] Add preview support for Datadog.AzureFunctions NuGet package

Changes

Tracer

  • Add support for NLog 6.0 (#​7131)
  • Show correct agent_uri path in startup log for named pipes (#​7199)
  • Try removing exceptions from the shutdown path (#​7200)
  • Use non-BOM version of Encoding.UTF8 in Libdatadog interop code (#​7204)
  • feat(libdatadog-logger): integrate libdatadog logging (#​7075)

CI Visibility

  • [Test Optimization] Improve the CodeOwners parser (#​7155)

ASM

  • [AAP] Report ASM RC status to Telemetry Config (#​7141)
  • [AAP] Send WAF config errors to Telemetry Logs (#​7142)

Continuous Profiler

  • Don't load the profiler on arm64 (#​7169)
  • [Profiler] Remove ssi telemetry (#​7176)
  • [Profiler] Protect against thread abort (#​7187)

Debugger

  • [Exception Replay] Groundwork to support Test Optimization (#​7085)
  • [Dynamic Instrumentaiton] Marking instrumentation as failure if IsReEntryField is absent (#​7188)
  • [Dynamic Instrumentation] Reducing noisy log lines (#​7198)

Serverless

  • Add new Datadog.AzureFunctions nuget package (#​7111)
  • [Serverless] Update nuget package reference (#​7203)
  • Add support for writing managed logs to the console (stdout) (#​7160)

Fixes

  • fix: Handle both SQS StringValue and SNS BinaryValue in context extraction (#​7205)

Build / Test

  • [Profiler] Fix flacky tests (#​7161)
  • Adding Throughput Test for Kafka & DSM (#​7133)
  • ServiceBus.Minimal.Rebus SQL connection error (#​7146)
  • [Test Optimization] Remove impacted tests backend tests (#​7151)
  • [Test Package Versions Bump] Updating package versions (#​7156)
  • Fix test InitializesTracerWhenTracingIsDisabled Flakiness (#​7163)
  • Bump the gh-actions-packages group across 2 directories with 3 updates (#​7166)
  • Add retry to smoke crash tracking tests (#​7172)
    ... (truncated)

3.20.1

Summary

Ensures we never load the Continuous Profiler on linux arm64, as it's unsupported. Loading an unloading the Continuous Profiler can trigger crash conditions on some old versions of glibc.

Changes

Continuous Profiler

  • Don't load the profiler on arm64 (#​7169)

Miscellaneous

  • [fleet installer] Remove the global instrumentation commands (#​7182)

Build / Test

  • Fix release process by removing check for SSI artifacts (#​7180)
  • Add workaround for messed up execution_benchmark results (#​7181)

Changes since 3.20.0

Commits viewable in compare view.

Updated FluentValidation from 11.11.0 to 12.0.0.

Release notes

Sourced from FluentValidation's releases.

12.0.0

Release notes

Please read the upgrade guide if you are moving from 11.x to 12.x

Changes in 12.0.0

  • Drops support for netstandard2.0, netstandard2.1, .net 5, .net 6 and .net 7. Minimum supported platform is now .net 8.
  • Add support for dependent rules for custom rules (#​2170)
  • Removes deprecated DI extensions
  • Removes deprecated transform methods (#​2027)
  • Remove the ability to disable the root-model null check (#​2069)
  • Use Zomp.SyncMethodGenerator to clean up internal sync/async code paths and increase performance (#​2136)
  • Add Serbian (Cyrillic) language; rename existing Serbian to Serbian (Latin) (#​2283)

Downloads

Binaries can be downloaded from nuget:

Commits viewable in compare view.

Updated Microsoft.Extensions.DependencyInjection.Abstractions from 9.0.6 to 9.0.7.

Release notes

Sourced from Microsoft.Extensions.DependencyInjection.Abstractions's releases.

9.0.7

Release

What's Changed

Full Changelog: dotnet/runtime@v9.0.6...v9.0.7

Commits viewable in compare view.

Updated NJsonSchema from 11.3.2 to 11.4.0.

Release notes

Sourced from NJsonSchema's releases.

11.4.0

What's Changed

New Contributors

Full Changelog: RicoSuter/NJsonSchema@v11.3.2...v11.4.0

Commits viewable in compare view.

Updated Polly from 8.6.1 to 8.6.2.

Release notes

Sourced from Polly's releases.

8.6.2

What's Changed

New Contributors

Full Changelog: App-vNext/Polly@8.6.1...8.6.2

Commits viewable in compare view.

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot
Bump Amazon.CDK.Lib and 13 others
0d79b7e 
Bumps Amazon.CDK.Lib from 2.203.0 to 2.208.0
Bumps Amazon.Lambda.Core to 2.7.0
Bumps Aspire.Hosting.Testing from 9.3.1 to 9.4.0
Bumps AWS.Lambda.Powertools.Logging to 2.0.1
Bumps AWSSDK.DynamoDBv2 to 4.0.3.1
Bumps AWSSDK.EventBridge from 3.7.406.1 to 4.0.3.1
Bumps AWSSDK.SimpleNotificationService from 3.7.400.172 to 4.0.0.15
Bumps AWSSDK.SimpleSystemsManagement to 4.0.2.5
Bumps AWSSDK.StepFunctions from 3.7.403.115 to 4.0.0.17
Bumps Datadog.Trace to 3.22.0
Bumps FluentValidation from 11.11.0 to 12.0.0
Bumps Microsoft.Extensions.DependencyInjection.Abstractions from 9.0.6 to 9.0.7
Bumps NJsonSchema to 11.4.0
Bumps Polly to 8.6.2

---
updated-dependencies:
- dependency-name: Amazon.CDK.Lib
  dependency-version: 2.208.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: Amazon.Lambda.Core
  dependency-version: 2.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: Amazon.Lambda.Core
  dependency-version: 2.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: Aspire.Hosting.Testing
  dependency-version: 9.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: AWS.Lambda.Powertools.Logging
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: AWS.Lambda.Powertools.Logging
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: AWSSDK.DynamoDBv2
  dependency-version: 4.0.3.1
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: AWSSDK.DynamoDBv2
  dependency-version: 4.0.3.1
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: AWSSDK.DynamoDBv2
  dependency-version: 4.0.3.1
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: AWSSDK.EventBridge
  dependency-version: 4.0.3.1
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: AWSSDK.SimpleNotificationService
  dependency-version: 4.0.0.15
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: AWSSDK.SimpleSystemsManagement
  dependency-version: 4.0.2.5
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: AWSSDK.SimpleSystemsManagement
  dependency-version: 4.0.2.5
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: AWSSDK.StepFunctions
  dependency-version: 4.0.0.17
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: Datadog.Trace
  dependency-version: 3.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: Datadog.Trace
  dependency-version: 3.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: Datadog.Trace
  dependency-version: 3.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: FluentValidation
  dependency-version: 12.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: Microsoft.Extensions.DependencyInjection.Abstractions
  dependency-version: 9.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: NJsonSchema
  dependency-version: 11.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: NJsonSchema
  dependency-version: 11.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: NJsonSchema
  dependency-version: 11.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: Polly
  dependency-version: 8.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: Polly
  dependency-version: 8.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added .NET dependencies Pull requests that update a dependency file labels Aug 1, 2025
@dependabot dependabot bot requested a review from jeastham1993 as a code owner August 1, 2025 13:10
@dependabot dependabot bot added .NET dependencies Pull requests that update a dependency file labels Aug 1, 2025
@jeastham1993 jeastham1993 merged commit 1326b22 into main Sep 2, 2025
8 of 10 checks passed
@claude
Copy link

claude bot commented Sep 2, 2025 •
edited
Loading

Claude finished @dependabot[bot]'s task —— View job

PR Review: Dependency Updates

Reviewing this dependency update PR with focus on code quality, security, and compatibility.

Todo List:

  • Read repository guidelines (CLAUDE.md)
  • Analyze changed .csproj files
  • Review major version updates for breaking changes
  • Assess security implications
  • Check for potential compatibility issues
  • Provide comprehensive feedback and recommendations

🔍 Review Summary

This PR updates 14 NuGet packages across 3 projects in the order service. While most updates are patch/minor versions, there are several major version bumps that require careful attention.

⚠️ Critical Issues & Breaking Changes

1. FluentValidation 11.11.0 → 12.0.0 (MAJOR)

  • Breaking Change: FluentValidation 12.x drops support for .NET 6, .NET 7, and .NET Standard 2.x
  • Issue: The main projects target .NET 8, but this is still a major version change with potential API changes
  • Risk: Medium - Could break existing validation logic
  • Recommendation: Review validation code and test thoroughly

2. AWS SDK Packages 3.x → 4.x (MAJOR)

Multiple AWS SDK packages were upgraded from v3 to v4:

  • AWSSDK.DynamoDBv2: 3.7.408.1 → 4.0.3.1

  • AWSSDK.EventBridge: 3.7.406.1 → 4.0.3.1

  • AWSSDK.SimpleNotificationService: 3.7.400.172 → 4.0.0.15

  • AWSSDK.SimpleSystemsManagement: 3.7.406.1 → 4.0.2.5

  • AWSSDK.StepFunctions: 3.7.403.115 → 4.0.0.17

  • Breaking Change: AWS SDK v4 includes significant API changes

  • Issue: These are major version updates with potential breaking changes

  • Risk: High - Could break AWS service integrations

  • Recommendation: Critical - Test all AWS integrations thoroughly

3. Aspire.Hosting.Testing 9.3.1 → 9.4.0 (MINOR)

  • Issue: Minor version update, but Aspire is still evolving rapidly
  • Risk: Low-Medium - Could affect testing infrastructure
  • Note: Only used in unit tests

🔧 Configuration Issues

1. Target Framework Mismatch

  • Issue: CLAUDE.md specifies .NET 9 and C# 12+, but projects target .NET 8
  • Impact: Not using latest language features and runtime improvements
  • Recommendation: Consider upgrading to .NET 9 to align with guidelines

2. FluentAssertions Version Conflict

  • Issue: CLAUDE.md specifies "FluentAssertions no higher than version 7", but unit tests use v8.4.0
  • Impact: Violates established guidelines
  • Recommendation: Downgrade FluentAssertions or update guidelines

3. Integration Test Dependencies

  • Issue: Integration tests still use AWS SDK v3 packages while main projects use v4
  • Files: Orders.IntegrationTests.csproj (lines 12, 24)
  • Impact: Version mismatch could cause test failures
  • Recommendation: Update integration test dependencies to match main projects

✅ Positive Updates

Security & Performance Improvements:

  • Datadog.Trace: 3.20.0 → 3.22.0 - Includes security fixes and performance improvements
  • Polly: 8.6.1 → 8.6.2 - Performance optimizations
  • Microsoft.Extensions.DependencyInjection.Abstractions: 9.0.6 → 9.0.7 - Bug fixes
  • NJsonSchema: 11.3.2 → 11.4.0 - Performance optimizations and caching improvements

📋 Testing & Quality Concerns

1. Missing Migration Testing

  • Issue: No evidence of testing for major version API changes
  • Risk: Runtime failures in production
  • Recommendation: Run comprehensive integration tests

2. Test Coverage for Breaking Changes

  • Issue: Major version updates should include regression testing
  • Recommendation: Focus testing on:
    • FluentValidation rule behavior
    • AWS SDK API calls
    • DynamoDB operations
    • EventBridge publishing
    • SNS messaging

🚨 Immediate Action Required

  1. Test AWS SDK v4 Integration - Critical priority

    • Verify DynamoDB operations work correctly
    • Test EventBridge event publishing
    • Validate SNS messaging functionality
    • Check Step Functions integration

  2. Fix Version Inconsistencies

    • Update integration test AWS SDK versions
    • Resolve FluentAssertions version conflict

  3. Review FluentValidation Usage

    • Check for deprecated APIs
    • Verify validation behavior hasn't changed

💡 Recommendations

Short Term:

  • Run full integration test suite focusing on AWS services
  • Update integration test dependencies to match main projects
  • Review and test FluentValidation rules

Long Term:

  • Consider upgrading to .NET 9 per CLAUDE.md guidelines
  • Establish dependency update testing procedures
  • Implement automated compatibility testing

📊 Risk Assessment

  • High Risk: AWS SDK v4 major version changes
  • Medium Risk: FluentValidation v12 breaking changes
  • Low Risk: Other minor/patch updates

Overall Assessment: This PR contains significant breaking changes that require thorough testing before deployment.

@jeastham1993 jeastham1993 deleted the dependabot/nuget/src/order-service/cdk/multi-4c875176d4 branch September 2, 2025 10:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jeastham1993 jeastham1993 Awaiting requested review from jeastham1993 jeastham1993 is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Trigger: Token strings not resolving @aws-cdk/aws-s3-deployment: broken cross stack reference when used in Source.jsonData (aws-cloudwatch): Allow setting id and visible properties for cloudwatch Metric (docker assets): .dockerignore is processed incorrectly before 1.73.0 and broken after 1.73.0 Metric SEARCH Expression support for GraphWidget CDK Construct
core: Asset bundling ignored when deploy with --exclusive flag with nested stack (pipelines): Assets are missing to be packaged since StackSynthesizer being ignored aws-lambda-python-alpha: Support uv (aws-autoscaling): Build guardrail to prevent availability risk by instance profile deletion/recreation during migration to LT (cloudwatch-dashboards): Add support for queryLanguage property

2 participants

@jeastham1993