Skip to content

fix(lib): Disallow constructs 10.8 until support can be added - #363

Merged
jsteinich merged 1 commit into
open-constructs:mainfrom
jsteinich:disallow_constructs-10-8
Aug 1, 2026
Merged

fix(lib): Disallow constructs 10.8 until support can be added#363
jsteinich merged 1 commit into
open-constructs:mainfrom
jsteinich:disallow_constructs-10-8

Conversation

@jsteinich

@jsteinich jsteinich commented Aug 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Related issue

Fixes https://github.com/open-constructs/cdk-terrain/actions/runs/30545326461/job/90912362214

Description

constructs 10.8.0 moved to the jsii 6.0.7 compiler and dropped jsii.tsc: {outDir: "lib", rootDir: "src"} from its package.json (replaced by jsii.tsconfig/validateTsconfig).

In jsii/lib/common/symbol-id.js, findPackageInfo reads tscOutDir only from jsii.tsc.outDir in package.json. tscRootDir has an assembly-metadata fallback (asm.metadata.tscRootDir); tscOutDir does not, and no tsconfig.json ships in the tarball. So normalizePath bails, the computed symbolId stays lib/construct:Construct instead of src/construct:Construct, misses the assembly's symbolIdMap, and importedSymbol comes back undefined. assemblies.js:234 swallows this in a bare catch {}/undefined path, so you get silently wrong output instead of an error.
See aws/jsii-compiler#2740 for more details.

Needed to additionally quote the installed dependency in the template so that shell wouldn't mangle the updated version range.

We could skip the peer dependency constraint, but it's clear that cdktn isn't fully compatible with constructs 10.8 at this time. We can revisit when we update to JSII 6.x.

Checklist

  • I have updated the PR title to match CDKTN's style guide
  • I have run the linter on my code locally
  • I have performed a self-review of my code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation if applicable
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works if applicable
  • New and existing unit tests pass locally with my changes

@jsteinich
jsteinich marked this pull request as ready for review August 1, 2026 16:02
@jsteinich
jsteinich requested a review from a team as a code owner August 1, 2026 16:02
sakul-learning
sakul-learning approved these changes Aug 1, 2026
View reviewed changes

@sakul-learning sakul-learning left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved. I built the PR head and verified cdktn init --template java using the locally packaged cdktn artifact; initialization, ./gradlew install, and ./gradlew test passed. Local testing briefly hit a semver@7.8.5 resolution issue in pack.mjs, resolved with a clean npm cache/staging directory and apparently unrelated to this PR.

@jsteinich
jsteinich merged commit 8bdae0d into open-constructs:main Aug 1, 2026
266 checks passed
@jsteinich
jsteinich deleted the disallow_constructs-10-8 branch August 1, 2026 18:27
@open-constructs-cdktn open-constructs-cdktn Bot mentioned this pull request Jul 30, 2026
Merged
so0k pushed a commit that referenced this pull request Aug 7, 2026
@open-constructs-cdktn
chore(release): release v0.24.0 (#303)
b91823e 
🤖 Release PR — merge to cut a new release. Kept open and rebased
as commits land on `main`.
---


<details><summary>0.24.0</summary>

##
[0.24.0](v0.23.4...v0.24.0)
(2026-08-06)


### ⚠ BREAKING CHANGES

* **lib:** validate Terraform function versions by default
([#362](#362))
* **deps:** Require Node 22 minimum
([#345](#345))
* **lib:** preserve symlinks in TerraformAsset walkers
([#321](#321))
* **cli:** replace node-fetch with undici
([#306](#306))

### Features

* **lib:** canonical asset hashes behind the canonicalAssetHashes
feature flag
([#323](#323))
([76dd4ff](76dd4ff))
* **lib:** validate Terraform function versions by default
([#362](#362))
([4ac0736](4ac0736))
* support newer provider plugin-protocol features via targetVersions
(RFC-04)
([#296](#296))
([90322f9](90322f9))


### Bug Fixes

* **cli:** don't downgrade prebuilt providers on a transient registry
failure
([#298](#298))
([a960c5c](a960c5c))
* **cli:** include dev dependencies in npm version lookup
([#280](#280))
([955204a](955204a))
* **docs:** fix stale constructs pin breaking with()/IMixin docs
([#305](#305))
([605cf63](605cf63))
* **gha:** Allow pnpm to update the lockfile after package updates
([#318](#318))
([a899b7c](a899b7c))
* **gha:** Fix pnpm upgrade workflow
([#335](#335))
([e1a69fc](e1a69fc))
* **gha:** flip merged release PR label to autorelease: tagged
([#302](#302))
([8d64f6c](8d64f6c))
* **gha:** mint the Go-publish token from the CDKTN Maintainers app
([#369](#369))
([71921ce](71921ce))
* **gha:** mint the Go-publish token from the open-constructs-cdktn App
([#368](#368))
([179f10c](179f10c))
* **gha:** pass the Go-publish App token as x-access-token userinfo
([#370](#370))
([4e3ff19](4e3ff19))
* **lib:** Disallow constructs 10.8 until support can be added
([#363](#363))
([8bdae0d](8bdae0d))
* **lib:** preserve symlinks in TerraformAsset walkers
([#321](#321))
([6360e20](6360e20))
* typo in `moveFromId` JSDoc
([#355](#355))
([e1cf8ce](e1cf8ce))


### Miscellaneous Chores

* **cli:** replace Ink + React with smaller-tree CLI libraries
([#264](#264))
([a6aff7e](a6aff7e))
* **cli:** replace node-fetch with undici
([#306](#306))
([1317141](1317141))
* **deps:** bump glob to 13.0.6
([#307](#307))
([47ee2bb](47ee2bb))
* **deps:** bump the github-actions-backward-compatible group with 2
updates
([#295](#295))
([eab2a01](eab2a01))
* **deps:** replace lerna with nx
([#315](#315))
([94999fc](94999fc))
* **deps:** Require Node 22 minimum
([#345](#345))
([2bf315d](2bf315d))
* **deps:** update ci-info to 4.4.0 across all packages
([#329](#329))
([557a163](557a163))
* **deps:** update fs-extra to 11.3.6 across all packages
([#328](#328))
([95753a9](95753a9))
* **deps:** update minimatch to 10.2.5
([#330](#330))
([d1c1c53](d1c1c53))
* **deps:** Update sscaff to v2.0.388
([#331](#331))
([38ea0ba](38ea0ba))
* **deps:** Update zod to v4.4.3
([#332](#332))
([c10ee35](c10ee35))
* **deps:** Upgrade dependencies
([#347](#347))
([45d3a66](45d3a66))
* remove cdktf from tests
([#277](#277))
([dc9a8e9](dc9a8e9))
* ship Terraform 1.15.8 in the jsii-terraform image
([#367](#367))
([deaa9b0](deaa9b0))
* Upgrade dependencies for lib
([#348](#348))
([d616f17](d616f17))
</details>

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: open-constructs-cdktn[bot] <291052431+open-constructs-cdktn[bot]@users.noreply.github.com>
so0k added a commit to cdktn-io/cdktn-repository-manager that referenced this pull request Aug 7, 2026
@so0k
fix: pass cdktn's constructs peer range through verbatim
54c2239 
cdktn 0.24.0 declares constructs '>=10.6.0 <10.8.0' (10.8 disallowed,
open-constructs/cdk-terrain#363) instead of a caret range. upgrade-cdktf
stripped a caret that wasn't there and re-prepended one, writing the
invalid 'constructsVersion: "^>=10.6.0 <10.8.0"' into the template --
every provider regen then died at pnpm install with
ERR_PNPM_INVALID_PEER_DEPENDENCY_SPECIFICATION (canary run 31135007155).

Template value corrected, and upgrade-cdktf now passes whatever range
cdktn declares straight through (quoting the yarn add in upgrade_self
for ranges containing spaces).
@sakul-learning sakul-learning mentioned this pull request Aug 7, 2026
Closed
@so0k so0k mentioned this pull request Aug 7, 2026
Merged
so0k added a commit to cdktn-io/cdktn-repository-manager that referenced this pull request Aug 7, 2026
@so0k
fix: restore the 0.24 fan-out fixes wiped by the upgrade-cdktf force-…
6d92fa3 
…push (#65)

## What happened

The two fix commits on `auto/upgrade-providers-cdktn-24` (constructs
range + TF 1.15.8 selection, canary-verified on random/aws) were
**silently wiped before #63 merged**: a re-run of the failed
upgrade-cdktf workflow re-executed `peter-evans/create-pull-request`,
which force-pushes the branch with exactly its regenerated content. The
squash that landed as `f66f42d` therefore carries the mangled
`constructsVersion: "^>=10.6.0 <10.8.0"` and lacks the container digest
+ `TERRAFORM_BINARY_NAME` — and the fleet fan-out from that merge failed
on **all 29 providers** at `pnpm install` (cleanly: no provider PRs were
created).

## This PR (cherry-picks of the wiped commits)

- `projenrc.template.js`: `constructsVersion: ">=10.6.0 <10.8.0"` —
cdktn 0.24's peer range verbatim (constructs 10.8 disallowed,
open-constructs/cdk-terrain#363)
- `upgrade-repositories.yml`: container pinned to the 0.24.0
jsii-terraform digest (`8a260318…`, ships TF 1.15.8) +
`TERRAFORM_BINARY_NAME: terraform1.15.8` on the fetch step — without it
the regen silently produces bindings with none of the new protocol
surfaces (functions/ephemeral/write-only/resource-identity need TF
≥1.8/1.10/1.11/1.12; the image default is 1.6.5)
- `upgrade-cdktf.yml`: pass cdktn's constructs peer range through
verbatim instead of caret-mangling it (root cause of the bad template
value)

## Rollout note

Merging re-triggers deploy → the full fan-out, now with the exact
configuration the canary proved (cdktn-io/cdktn-provider-random#47,
cdktn-io/cdktn-provider-aws#81, both merged with
ephemeral/functions/write-only surfaces present).

Note: upgrade-cdktf's re-run risk is gone — main's template minor now
equals latest (0.24), so its gate no longer opens.

🤖 Generated with [Claude Code](https://claude.com/claude-code)
X-Guardian pushed a commit to X-Guardian/cdk-terrain that referenced this pull request Aug 10, 2026
@jsteinich Simon Heather
fix(lib): Disallow constructs 10.8 until support can be added (open-c…
8428546 
…onstructs#363)

<!--

Unless this is a very simple 1-line-of-code change, please create a new
issue describing the change you're proposing first, then link to it from
this PR.

Read more about our process in our contributing guide:
https://github.com/open-constructs/cdk-terrain/blob/main/CONTRIBUTING.md

-->

### Related issue

Fixes
https://github.com/open-constructs/cdk-terrain/actions/runs/30545326461/job/90912362214

### Description

constructs 10.8.0 moved to the jsii 6.0.7 compiler and dropped jsii.tsc:
{outDir: "lib", rootDir: "src"} from its package.json (replaced by
jsii.tsconfig/validateTsconfig).

In jsii/lib/common/symbol-id.js, findPackageInfo reads tscOutDir only
from jsii.tsc.outDir in package.json. tscRootDir has an
assembly-metadata fallback (asm.metadata.tscRootDir); tscOutDir does
not, and no tsconfig.json ships in the tarball. So normalizePath bails,
the computed symbolId stays lib/construct:Construct instead of
src/construct:Construct, misses the assembly's symbolIdMap, and
importedSymbol comes back undefined. assemblies.js:234 swallows this in
a bare catch {}/undefined path, so you get silently wrong output instead
of an error.
See aws/jsii-compiler#2740 for more details.

Needed to additionally quote the installed dependency in the template so
that shell wouldn't mangle the updated version range.

We could skip the peer dependency constraint, but it's clear that cdktn
isn't fully compatible with constructs 10.8 at this time. We can revisit
when we update to JSII 6.x.

### Checklist

- [x] I have updated the PR title to match [CDKTN's style
guide](https://github.com/open-constructs/cdk-terrain/blob/main/CONTRIBUTING.md#pull-requests-1)
- [x] I have run the linter on my code locally
- [x] I have performed a self-review of my code
- [x] I have commented my code, particularly in hard-to-understand areas
- [ ] I have made corresponding changes to the
[documentation](https://github.com/open-constructs/cdk-terrain-docs/tree/main/content)
if applicable
- [x] My changes generate no new warnings
- [ ] I have added tests that prove my fix is effective or that my
feature works if applicable
- [x] New and existing unit tests pass locally with my changes

<!-- If this is still a work in progress, feel free to open a draft PR
until you're able to check off all the items on the list above -->
X-Guardian pushed a commit to X-Guardian/cdk-terrain that referenced this pull request Aug 10, 2026
@open-constructs-cdktn Simon Heather
chore(release): release v0.24.0 (open-constructs#303)
37dd8dc 
🤖 Release PR — merge to cut a new release. Kept open and rebased
as commits land on `main`.
---


<details><summary>0.24.0</summary>

##
[0.24.0](open-constructs/cdk-terrain@v0.23.4...v0.24.0)
(2026-08-06)


### ⚠ BREAKING CHANGES

* **lib:** validate Terraform function versions by default
([open-constructs#362](open-constructs#362))
* **deps:** Require Node 22 minimum
([open-constructs#345](open-constructs#345))
* **lib:** preserve symlinks in TerraformAsset walkers
([open-constructs#321](open-constructs#321))
* **cli:** replace node-fetch with undici
([open-constructs#306](open-constructs#306))

### Features

* **lib:** canonical asset hashes behind the canonicalAssetHashes
feature flag
([open-constructs#323](open-constructs#323))
([76dd4ff](open-constructs@76dd4ff))
* **lib:** validate Terraform function versions by default
([open-constructs#362](open-constructs#362))
([4ac0736](open-constructs@4ac0736))
* support newer provider plugin-protocol features via targetVersions
(RFC-04)
([open-constructs#296](open-constructs#296))
([90322f9](open-constructs@90322f9))


### Bug Fixes

* **cli:** don't downgrade prebuilt providers on a transient registry
failure
([open-constructs#298](open-constructs#298))
([a960c5c](open-constructs@a960c5c))
* **cli:** include dev dependencies in npm version lookup
([open-constructs#280](open-constructs#280))
([955204a](open-constructs@955204a))
* **docs:** fix stale constructs pin breaking with()/IMixin docs
([open-constructs#305](open-constructs#305))
([605cf63](open-constructs@605cf63))
* **gha:** Allow pnpm to update the lockfile after package updates
([open-constructs#318](open-constructs#318))
([a899b7c](open-constructs@a899b7c))
* **gha:** Fix pnpm upgrade workflow
([open-constructs#335](open-constructs#335))
([e1a69fc](open-constructs@e1a69fc))
* **gha:** flip merged release PR label to autorelease: tagged
([open-constructs#302](open-constructs#302))
([8d64f6c](open-constructs@8d64f6c))
* **gha:** mint the Go-publish token from the CDKTN Maintainers app
([open-constructs#369](open-constructs#369))
([71921ce](open-constructs@71921ce))
* **gha:** mint the Go-publish token from the open-constructs-cdktn App
([open-constructs#368](open-constructs#368))
([179f10c](open-constructs@179f10c))
* **gha:** pass the Go-publish App token as x-access-token userinfo
([open-constructs#370](open-constructs#370))
([4e3ff19](open-constructs@4e3ff19))
* **lib:** Disallow constructs 10.8 until support can be added
([open-constructs#363](open-constructs#363))
([8bdae0d](open-constructs@8bdae0d))
* **lib:** preserve symlinks in TerraformAsset walkers
([open-constructs#321](open-constructs#321))
([6360e20](open-constructs@6360e20))
* typo in `moveFromId` JSDoc
([open-constructs#355](open-constructs#355))
([e1cf8ce](open-constructs@e1cf8ce))


### Miscellaneous Chores

* **cli:** replace Ink + React with smaller-tree CLI libraries
([open-constructs#264](open-constructs#264))
([a6aff7e](open-constructs@a6aff7e))
* **cli:** replace node-fetch with undici
([open-constructs#306](open-constructs#306))
([1317141](open-constructs@1317141))
* **deps:** bump glob to 13.0.6
([open-constructs#307](open-constructs#307))
([47ee2bb](open-constructs@47ee2bb))
* **deps:** bump the github-actions-backward-compatible group with 2
updates
([open-constructs#295](open-constructs#295))
([eab2a01](open-constructs@eab2a01))
* **deps:** replace lerna with nx
([open-constructs#315](open-constructs#315))
([94999fc](open-constructs@94999fc))
* **deps:** Require Node 22 minimum
([open-constructs#345](open-constructs#345))
([2bf315d](open-constructs@2bf315d))
* **deps:** update ci-info to 4.4.0 across all packages
([open-constructs#329](open-constructs#329))
([557a163](open-constructs@557a163))
* **deps:** update fs-extra to 11.3.6 across all packages
([open-constructs#328](open-constructs#328))
([95753a9](open-constructs@95753a9))
* **deps:** update minimatch to 10.2.5
([open-constructs#330](open-constructs#330))
([d1c1c53](open-constructs@d1c1c53))
* **deps:** Update sscaff to v2.0.388
([open-constructs#331](open-constructs#331))
([38ea0ba](open-constructs@38ea0ba))
* **deps:** Update zod to v4.4.3
([open-constructs#332](open-constructs#332))
([c10ee35](open-constructs@c10ee35))
* **deps:** Upgrade dependencies
([open-constructs#347](open-constructs#347))
([45d3a66](open-constructs@45d3a66))
* remove cdktf from tests
([open-constructs#277](open-constructs#277))
([dc9a8e9](open-constructs@dc9a8e9))
* ship Terraform 1.15.8 in the jsii-terraform image
([open-constructs#367](open-constructs#367))
([deaa9b0](open-constructs@deaa9b0))
* Upgrade dependencies for lib
([open-constructs#348](open-constructs#348))
([d616f17](open-constructs@d616f17))
</details>

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: open-constructs-cdktn[bot] <291052431+open-constructs-cdktn[bot]@users.noreply.github.com>
@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

I'm going to lock this pull request because it has been closed for 30 days. This helps our maintainers find and focus on the active issues. If you've found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions Bot locked as resolved and limited conversation to collaborators Sep 1, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@so0k so0k so0k approved these changes
+1 more reviewer
@sakul-learning sakul-learning sakul-learning approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@jsteinich @so0k @sakul-learning