chore: update Rust toolchain + all dependencies, fix local CDK bundling

cdk/package.json

@@ -12,16 +12,16 @@
   },
   "devDependencies": {
     "@types/node": "^24.0.0",
-    "@vitest/ui": "^4.0.18",
-    "aws-cdk": "2.1121.0",
-    "aws-cdk-github-oidc": "^2.4.1",
+    "@vitest/ui": "^4.1.9",
+    "aws-cdk": "2.1128.1",
+    "aws-cdk-github-oidc": "^4.2.5",
     "ts-node": "^10.9.2",
-    "typescript": "~5.9.3",
-    "vitest": "^4.0.18"
+    "typescript": "~6.0.3",
+    "vitest": "^4.1.9"
   },
   "dependencies": {
     "@cdklabs/aws-lambda-rust": "^0.0.10",
-    "aws-cdk-lib": "2.253.1",
+    "aws-cdk-lib": "2.260.0",
     "constructs": "^10.4.5",
     "cross-fetch": "^4.1.0",
     "dotenv": "^17.2.3",

devenv.lock

@@ -3,11 +3,11 @@
     "aws-op": {
       "flake": false,
       "locked": {
-        "lastModified": 1773263157,
-        "narHash": "sha256-XtnsKePbR8V0aQ9rCS9U1y6Arvi6qEQg7zW5YRYa1TA=",
+        "lastModified": 1781709427,
+        "narHash": "sha256-sAN4TfTspVyHAGLOTKerqoNOHHoQYoI2LZHu8oxWPjA=",
         "owner": "stabbylambda",
         "repo": "devenv-aws-op",
-        "rev": "770c5a638226168b1db9b30e8b4ead8b120d0402",
+        "rev": "c09bb6c0b0ed8f4da56c0ab23db465ddd5cf1d58",
         "type": "github"
       },
       "original": {
@@ -19,11 +19,11 @@
     "devenv": {
       "locked": {
         "dir": "src/modules",
-        "lastModified": 1780630679,
-        "narHash": "sha256-hhQyVAYmNKziZ0T+T4Gsk0PYmnz4vdzOzpkJAmDASKM=",
+        "lastModified": 1782492839,
+        "narHash": "sha256-j9wrcB4al5QhMelEghJ0Qs+RQPT+wyCcI4070NEgPLQ=",
         "owner": "cachix",
         "repo": "devenv",
-        "rev": "90ed6227ab389dd4e874a69a724f25dba312b754",
+        "rev": "3d39d0817d62069f7b18821c34a617b5141cb278",
         "type": "github"
       },
       "original": {
@@ -38,11 +38,11 @@
         "nixpkgs-src": "nixpkgs-src"
       },
       "locked": {
-        "lastModified": 1778507786,
-        "narHash": "sha256-HzSQCKMsMr8r55LwM1JuzIOB+8bzk0FEv6sItKvsfoY=",
+        "lastModified": 1782132010,
+        "narHash": "sha256-ZnAVHdVrotp80iIMm5CSR1fdxPlw7Uwmwxb+O/wsgZ8=",
         "owner": "cachix",
         "repo": "devenv-nixpkgs",
-        "rev": "8f24a228a782e24576b155d1e39f0d914b380691",
+        "rev": "12866ae2dddbc0ab8b329915f8072bb9c75bde89",
         "type": "github"
       },
       "original": {
@@ -55,11 +55,11 @@
     "nixpkgs-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1778274207,
-        "narHash": "sha256-I4puXmX1iovcCHZlRmztO3vW0mAbbRvq4F8wgIMQ1MM=",
+        "lastModified": 1781607440,
+        "narHash": "sha256-rxO+uc/KFbSJp+pgyXRuAX6QlG9hJdnt0BXpEQRXY+U=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b3da656039dc7a6240f27b2ef8cc6a3ef3bccae7",
+        "rev": "3e41b24abd260e8f71dbe2f5737d24122f972158",
         "type": "github"
       },
       "original": {
@@ -84,11 +84,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780715792,
-        "narHash": "sha256-4+8gPeiPeud89mjo865RwpqmKwa1MThRsq2SvRxo7mg=",
+        "lastModified": 1782530211,
+        "narHash": "sha256-Zn5H2VVMaP79C+bvaUQD+SBXSKoTnURMZGiUrG00zII=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "27b7e78c6935293ee868469cc4172e9b8b17823b",
+        "rev": "06ba695dfefc4afc513b49dfc41c4bf0dd2eaeb1",
         "type": "github"
       },
       "original": {

devenv.nix

@@ -1,23 +1,41 @@
 { pkgs, lib, config, inputs, ... }:
 
+let
+  rustTargets = [
+    "x86_64-unknown-linux-gnu"
+    "aarch64-unknown-linux-gnu"
+  ];
+
+  # The @cdklabs/aws-lambda-rust CDK construct decides between local
+  # (cargo-zigbuild) and Docker bundling by probing
+  # `rustup target list --installed`. Our Rust toolchain comes from the Nix
+  # rust-overlay rather than rustup, so the real rustup has no default toolchain
+  # and the probe fails, forcing (unavailable) Docker bundling. This shim reports
+  # the configured targets as installed so the construct takes the Docker-free
+  # local build path via cargo-zigbuild.
+  rustupShim = pkgs.writeShellScriptBin "rustup" ''
+    if [ "$1" = "target" ] && [ "$2" = "list" ]; then
+      printf '%s\n' ${lib.escapeShellArgs rustTargets}
+      exit 0
+    fi
+    exit 0
+  '';
+in
 {
   dotenv.disableHint = true;
 
   env.CHRONO_TZ_TIMEZONE_FILTER = "(UTC|US/.*)";
 
   languages.rust.enable = true;
   languages.rust.channel = "stable";
-  languages.rust.targets = [
-    "x86_64-unknown-linux-gnu"
-    "aarch64-unknown-linux-gnu"
-  ];
+  languages.rust.targets = rustTargets;
 
   languages.javascript.enable = true;
   languages.javascript.package = pkgs.nodejs_24;
   languages.javascript.corepack.enable = true;
 
   packages = [
-    pkgs.rustup # not actually using rustup, but the cdk builder expects it
+    rustupShim # rustup shim so the cdk rust builder bundles locally instead of via Docker
     pkgs.cargo-zigbuild
     pkgs.cargo-lambda
     pkgs.cargo-watch