chore(deps): upgrade dev dependencies

[cdklabs-automation]

Upgrades project dependencies. See details in workflow run.

---

Automatically created by projen via the "upgrade-dev-deps-main" workflow

[rix0rrr]

Doesn't build because of an issue with the new types of streamx: mafintosh/streamx#124

[sanjanaravikumar-az]

Root Cause

This upgrade PR bumped streamx ^2.27.0 → ^2.28.0. streamx 2.28.0 ships new TypeScript type definitions that are incompatible with Node's built-in stream types (upstream: mafintosh/streamx#124). This breaks the jsii compile of src/backend/shared/tarball.lambda-shared.ts:

• TS2345: Gunzip is not assignable to Writable<WritableEvents>
• TS2339: Property 'pipe' does not exist on type 'Writable<WritableEvents>'
• TS7006: implicit any on the .on('entry', ...) callback parameters

That failing build check is why auto-merge stayed blocked.

Fix

Pinned streamx to ~2.27.0 in .projenrc.ts. This reverts only the streamx bump; the other dependency upgrades in this PR are unaffected. projen regenerates package.json / yarn.lock / .projen/* on the next build (self-mutation).

Verified locally: reproduced the 6 compile errors on 2.28.0, then confirmed a clean jsii compile + bundles (.jsii produced) on 2.27.0, with no projen drift.

This pin is temporary tech debt — once mafintosh/streamx#124 is resolved, the pin should be removed and @types/streamx dropped (streamx will then ship its own types).

[sanjanaravikumar-az]

Root Cause — Update (build-fix completion)

The initial .projenrc.ts streamx pin fixed the jsii compile, but the build check then failed at a second, packaging-level step (not a new dependency issue):

build » default (projen synth) runs a frozen postSynthesize install (yarn install --frozen-lockfile). Because only .projenrc.ts had been committed, synth regenerated package.json to streamx@~2.27.0 while the committed yarn.lock still pinned 2.28.0:

error Your lockfile needs to be updated, but yarn was run with `--frozen-lockfile`.
Task "build » default" failed when executing "ts-node ... .projenrc.ts"

Fix: also committed the regenerated package.json (streamx@~2.27.0). The build job's non-frozen yarn install --check-files step reconciles yarn.lock on disk before the frozen postSynthesize install, so build » default now passes. The remaining generated artifacts (yarn.lock, .projen/*, and test snapshots) are refreshed and committed by the build's self-mutation step.

Validated locally on the branch head: reproduced the frozen-install failure, confirmed CI=true npx projen (the failing step) exits 0, and a full npx projen build is green (45/45 test suites, 236 tests, eslint clean, jsii-pacmak packaged).

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 12 package(s) with unknown licenses.
• ⚠️ 1 packages with OpenSSF Scorecard issues.

View full job summary