Merge branch 'main' into dependabot/github_actions/NHSDigital/eps-common-workflows/dot-github/workflows/tag-release.yml-5.3.12

Author: MatthewPopat-NHS

.trivyignore.yaml

@@ -11,6 +11,12 @@ vulnerabilities:
   - id: CVE-2026-24842
     statement: downstream dependency for tar - waiting for new npm release
     expired_at: 2026-06-01
+  - id: CVE-2026-25547
+    statement: downstream dependency for @isaacs/brace-expansion - waiting for new npm release
+    expired_at: 2026-06-01
+  - id: CVE-2026-0775
+    statement: downstream dependency for npmcli - waiting for new npm release
+    expired_at: 2026-06-01
   - id: CVE-2026-24049
     statement: downstream dependency for wheel - waiting for new python release
     expired_at: 2026-06-01
@@ -29,6 +35,9 @@ vulnerabilities:
   - id: CVE-2025-61728
     statement: downstream dependency for asdf/go - waiting for new asdf release
     expired_at: 2026-06-01
-  - id: CVE-2026-25128
-    statement: downstream dependency for fast-xml-parser - waiting for aws-sdk release
+  - id: CVE-2025-61730
+    statement: downstream dependency for asdf/go - waiting for new asdf release
+    expired_at: 2026-06-01
+  - id: CVE-2025-68121
+    statement: downstream dependency for asdf/go - waiting for new asdf release
     expired_at: 2026-06-01

package-lock.json

@@ -11,7 +11,7 @@
   "keywords": [],
   "license": "MIT",
   "devDependencies": {
-    "@types/node": "^25.1.0",
+    "@types/node": "^25.2.3",
     "@typescript-eslint/eslint-plugin": "^8.54.0",
     "@typescript-eslint/parser": "^8.54.0",
     "@vitest/coverage-v8": "^4.0.18",
@@ -26,10 +26,10 @@
     "vitest": "^4.0.13"
   },
   "dependencies": {
-    "aws-cdk": "^2.1104.0",
-    "aws-cdk-lib": "^2.236.0",
+    "aws-cdk": "^2.1105.0",
+    "aws-cdk-lib": "^2.238.0",
     "cdk-nag": "^2.37.52",
     "constructs": "^10.4.5",
-    "esbuild": "^0.27.2"
+    "esbuild": "^0.27.3"
   }
 }

package.json

@@ -20,11 +20,11 @@
     "private": false,
     "type": "module",
     "dependencies": {
-        "@aws-sdk/client-cloudformation": "^3.978.0",
-        "@aws-sdk/client-route-53": "^3.975.0",
+        "@aws-sdk/client-cloudformation": "^3.987.0",
+        "@aws-sdk/client-route-53": "^3.987.0",
         "@aws-sdk/client-s3": "^3.978.0",
-        "aws-cdk": "^2.1104.0",
-        "aws-cdk-lib": "^2.236.0",
+        "aws-cdk": "^2.1105.0",
+        "aws-cdk-lib": "^2.238.0",
         "cdk-nag": "^2.37.52",
         "constructs": "^10.4.5"
     },
@@ -38,6 +38,6 @@
     "main": "lib/src/index.js",
     "types": "lib/src/index.d.ts",
     "devDependencies": {
-        "@types/node": "^25.1.0"
+        "@types/node": "^25.2.3"
     }
 }

packages/cdkConstructs/package.json

@@ -261,11 +261,15 @@ export async function getActiveApiVersions(basePath: string): Promise<ActiveVers
   return {baseEnvVersion, sandboxEnvVersion}
 }
 
-async function getActiveApiVersion(apimDomain: string, basePath: string): Promise<string> {
+async function getActiveApiVersion(apigeeEnv: string, basePath: string): Promise<string> {
   const headers: Record<string, string> = {
     Accept: "application/json",
     apikey: `${process.env.APIM_STATUS_API_KEY}`
   }
+  let apimDomain = "api.service.nhs.uk"
+  if (apigeeEnv !== "prod") {
+    apimDomain = `${apigeeEnv}.api.service.nhs.uk`
+  }
   const url = `https://${apimDomain}/${basePath}/_status`
   console.log(`Checking live api status endpoint at ${url} for active version`)
   const response = await fetch(url, {headers})