[codex] fix(deps): resolve open dependabot alerts

cdk/package.json

@@ -37,6 +37,8 @@
   },
   "overrides": {
     "ajv": "8.18.0",
+    "flatted": "3.4.2",
+    "picomatch": "2.3.2",
     "aws-cdk-lib": {
       "minimatch": "10.2.4"
     }

cdk/requirements-build.txt

@@ -1,4 +1,3 @@
 build==1.3.0
-setuptools==75.3.2
-wheel==0.45.1
-
+setuptools==80.10.1
+wheel==0.46.2

docs/planning/app-integration/M0.md

@@ -12,7 +12,7 @@ pack pinning (“pin to the most recent release”).
 
 GovTheory packs will be pinned to explicit versions:
 - AppTheory stable pin (expected): `v0.15.0`
-- TableTheory stable pin (expected): `v1.5.0`
+- TableTheory stable pin (expected): `v1.5.1`
 
 AppTheory must not depend on an ambiguous / unreleased TableTheory version if we expect other repos to `go get` the pinned
 tag successfully.

go.mod

@@ -17,7 +17,7 @@ require (
 	github.com/aws/jsii-runtime-go v1.127.0
 	github.com/oklog/ulid/v2 v2.1.1
 	github.com/stretchr/testify v1.11.1
-	github.com/theory-cloud/tabletheory v1.5.0
+	github.com/theory-cloud/tabletheory v1.5.1
 	go.uber.org/zap v1.27.1
 	gopkg.in/yaml.v3 v3.0.1
 	pgregory.net/rapid v1.2.0

go.sum

@@ -73,8 +73,8 @@ github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
 github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
-github.com/theory-cloud/tabletheory v1.5.0 h1:BrUpbkzr0os20c8g5DowX84qOF9w0a76sVkypaAPYrk=
-github.com/theory-cloud/tabletheory v1.5.0/go.mod h1:SvW/SkYjgmUFp051IrtKmp5T9KTyHfKJIYCtSgzSLEo=
+github.com/theory-cloud/tabletheory v1.5.1 h1:2AQpln+cKQ8XCawL3cRsF4lDGkBkTEzEM18Nxbcv6r8=
+github.com/theory-cloud/tabletheory v1.5.1/go.mod h1:SvW/SkYjgmUFp051IrtKmp5T9KTyHfKJIYCtSgzSLEo=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=

py/pyproject.toml

@@ -11,7 +11,7 @@ readme = "README.md"
 license = "Apache-2.0"
 license-files = ["LICENSE"]
 dependencies = [
-  "tabletheory-py @ https://github.com/theory-cloud/TableTheory/releases/download/v1.5.0/tabletheory_py-1.5.0-py3-none-any.whl",
+  "tabletheory-py @ https://github.com/theory-cloud/TableTheory/releases/download/v1.5.1/tabletheory_py-1.5.1-py3-none-any.whl",
 ]
 
 [tool.setuptools]

scripts/verify-cdk-python-build.sh

@@ -24,6 +24,15 @@ fi
 
 export SOURCE_DATE_EPOCH="${epoch}"
 
+build_requirement="$(awk -F'==' '$1=="build" {print $2}' cdk/requirements-build.txt)"
+setuptools_requirement="$(awk -F'==' '$1=="setuptools" {print $2}' cdk/requirements-build.txt)"
+wheel_requirement="$(awk -F'==' '$1=="wheel" {print $2}' cdk/requirements-build.txt)"
+
+if [[ -z "${build_requirement}" || -z "${setuptools_requirement}" || -z "${wheel_requirement}" ]]; then
+  echo "cdk-python-build: FAIL (cdk/requirements-build.txt must pin build, setuptools, and wheel)" >&2
+  exit 1
+fi
+
 mkdir -p dist
 
 if [[ ! -d "cdk/.venv" ]]; then
@@ -118,6 +127,28 @@ PY
 
 cp LICENSE "${tmp_dir}/python/LICENSE"
 
+TMP_PY_DIR="${tmp_dir}/python" \
+BUILD_REQUIREMENT="${build_requirement}" \
+SETUPTOOLS_REQUIREMENT="${setuptools_requirement}" \
+WHEEL_REQUIREMENT="${wheel_requirement}" \
+python3 - <<'PY'
+import os
+import re
+from pathlib import Path
+
+pyproject = Path(os.environ["TMP_PY_DIR"]) / "pyproject.toml"
+text = pyproject.read_text(encoding="utf-8")
+expected = (
+    f'requires = ["setuptools=={os.environ["SETUPTOOLS_REQUIREMENT"]}", '
+    f'"wheel=={os.environ["WHEEL_REQUIREMENT"]}", '
+    f'"build=={os.environ["BUILD_REQUIREMENT"]}"]'
+)
+updated = re.sub(r'^requires = \[.*\]$', expected, text, count=1, flags=re.MULTILINE)
+if updated == text:
+    raise SystemExit("cdk-python-build: FAIL (unable to rewrite generated python build requirements)")
+pyproject.write_text(updated, encoding="utf-8")
+PY
+
 TMP_PY_DIR="${tmp_dir}/python" python3 - <<'PY'
 import os
 from pathlib import Path

ts/package.json

@@ -21,7 +21,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-apigatewaymanagementapi": "^3.1015.0",
-    "@theory-cloud/tabletheory-ts": "https://github.com/theory-cloud/TableTheory/releases/download/v1.5.0/theory-cloud-tabletheory-ts-1.5.0.tgz"
+    "@theory-cloud/tabletheory-ts": "https://github.com/theory-cloud/TableTheory/releases/download/v1.5.1/theory-cloud-tabletheory-ts-1.5.1.tgz"
   },
   "overrides": {
     "@typescript-eslint/typescript-estree": {
@@ -38,7 +38,9 @@
     "eslint-plugin-import": {
       "minimatch": "3.1.4"
     },
-    "fast-xml-parser": "5.3.8"
+    "fast-xml-parser": "5.5.9",
+    "flatted": "3.4.2",
+    "yaml": "2.8.3"
   },
   "files": [
     "dist",