Merge pull request #338 from citizensadvice/CLOUD-733_require_fixed_versions_so_dependency_tree_is_correct_in_downstream

CLOUD-733: Require fixed versions so dependency tree is correct in downstream

Author: simonwgill

pyproject.toml

@@ -6,11 +6,17 @@ requires-python = ">=3.10"
 license = { file = "LICENSE" }
 authors = [{ name = "Citizens Advice", email = "cloud.engineering@citizensadvice.org.uk" }]
 dependencies = [
-    "aws-cdk-lib>=2.215,<3.0",
     "cdk8s>=2.70.15,<3.0",
     "constructs>=10.4,<11.0",
     "cdk_remote_stack>=2.1,<3.0",
-    "aws-cdk-lambda-layer-kubectl-v36>=2.0.0,<3.0",
+    # aws-cdk-lib and aws-cdk-lambda-layer-kubectl-v* must be pinned to an exact version
+    # so that dependabot will change the constraint here as well as the lockfile.
+    # Downstream projects like eks-platform-cdk only use this constraint information,
+    # they don't use the lockfile in this project at all. Since the two lambda layers 
+    # used in the EKS handlers are being instantiated in the downstream projects, the version
+    # locked by those projects is the one that matters.
+    "aws-cdk-lib==2.264.0",
+    "aws-cdk-lambda-layer-kubectl-v36==2.0.0",
 ]
 
 [project.urls]