From 4555732d8f2c69e716211fdf8ce46f979f0ef051 Mon Sep 17 00:00:00 2001
From: Aidan Daly <aidandal@amazon.com>
Date: Thu, 1 Oct 2026 14:45:24 +0000
Subject: [PATCH 1/8] fix(templates): allow patched MCP 1.x releases

---
 .../assets.snapshot.test.ts.snap              |  8 ++---
 .../__tests__/python-dependencies.test.ts     | 35 +++++++++++++++++++
 src/assets/mcp/python/pyproject.toml          |  2 +-
 .../langchain_langgraph/base/pyproject.toml   |  2 +-
 .../python/http/strands/base/pyproject.toml   |  2 +-
 .../python/mcp/standalone/base/pyproject.toml |  2 +-
 6 files changed, 43 insertions(+), 8 deletions(-)
 create mode 100644 src/assets/__tests__/python-dependencies.test.ts

diff --git a/src/assets/__tests__/__snapshots__/assets.snapshot.test.ts.snap b/src/assets/__tests__/__snapshots__/assets.snapshot.test.ts.snap
index 285e085d41..413a869263 100644
--- a/src/assets/__tests__/__snapshots__/assets.snapshot.test.ts.snap
+++ b/src/assets/__tests__/__snapshots__/assets.snapshot.test.ts.snap
@@ -985,7 +985,7 @@ description = "MCP Server demonstrating HTTP tool patterns"
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
-    "mcp[cli] ~= 1.24.0",
+    "mcp[cli] >= 1.28.1, < 2.0.0",
     "httpx >= 0.27.0",
     "opentelemetry-distro",
     "opentelemetry-exporter-otlp",
@@ -5978,7 +5978,7 @@ dependencies = [
     "aws-opentelemetry-distro ~= 0.18.0",
     "opentelemetry-instrumentation-langchain >= 0.59.0",
     "langgraph >= 1.0.2",
-    "mcp ~= 1.24.0",
+    "mcp >= 1.28.1, < 2.0.0",
     "langchain-mcp-adapters >= 0.3.1",
     "langchain >= 1.0.3",
     "bedrock-agentcore >= 1.8.0",
@@ -7684,7 +7684,7 @@ dependencies = [
     "bedrock-agentcore >= 1.9.1",
     "botocore[crt] >= 1.35.0",
     {{#if (eq modelProvider "Gemini")}}"google-genai >= 1.0.0",
-    {{/if}}"mcp ~= 1.24.0",
+    {{/if}}"mcp >= 1.28.1, < 2.0.0",
     {{#if (eq modelProvider "OpenAI")}}"openai >= 1.0.0",
     {{/if}}{{#if (eq modelProvider "LiteLLM")}}"litellm >= 1.0.0",
     {{/if}}{{#if bedrockMantle}}"openai >= 1.0.0",
@@ -8437,7 +8437,7 @@ description = "AgentCore MCP Server"
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
-    "mcp ~= 1.24.0",
+    "mcp >= 1.28.1, < 2.0.0",
 ]
 
 [tool.hatch.build.targets.wheel]
diff --git a/src/assets/__tests__/python-dependencies.test.ts b/src/assets/__tests__/python-dependencies.test.ts
new file mode 100644
index 0000000000..c30b719442
--- /dev/null
+++ b/src/assets/__tests__/python-dependencies.test.ts
@@ -0,0 +1,35 @@
+import { copyAndRenderDir } from '../../cli/templates/render';
+import { mkdtempSync, readFileSync, rmSync } from 'fs';
+import { tmpdir } from 'os';
+import { join, resolve } from 'path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+const ASSETS_DIR = resolve(__dirname, '..');
+
+describe('generated Python dependency constraints', () => {
+  let outputDir: string;
+
+  beforeAll(() => {
+    outputDir = mkdtempSync(join(tmpdir(), 'python-dependencies-'));
+  });
+
+  afterAll(() => {
+    rmSync(outputDir, { recursive: true, force: true });
+  });
+
+  it.each([
+    ['python/http/strands/base', 'mcp'],
+    ['python/http/langchain_langgraph/base', 'mcp'],
+    ['python/mcp/standalone/base', 'mcp'],
+    ['mcp/python', 'mcp[cli]'],
+  ])('%s permits patched MCP 1.x releases', async (assetDir, dependency) => {
+    const destination = join(outputDir, assetDir);
+    await copyAndRenderDir(join(ASSETS_DIR, assetDir), destination, {
+      name: 'dependency_probe',
+      modelProvider: 'Bedrock',
+    });
+
+    const pyproject = readFileSync(join(destination, 'pyproject.toml'), 'utf-8');
+    expect(pyproject).toContain(`"${dependency} >= 1.28.1, < 2.0.0"`);
+  });
+});
diff --git a/src/assets/mcp/python/pyproject.toml b/src/assets/mcp/python/pyproject.toml
index c454b2b13e..1ff703924e 100644
--- a/src/assets/mcp/python/pyproject.toml
+++ b/src/assets/mcp/python/pyproject.toml
@@ -9,7 +9,7 @@ description = "MCP Server demonstrating HTTP tool patterns"
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
-    "mcp[cli] ~= 1.24.0",
+    "mcp[cli] >= 1.28.1, < 2.0.0",
     "httpx >= 0.27.0",
     "opentelemetry-distro",
     "opentelemetry-exporter-otlp",
diff --git a/src/assets/python/http/langchain_langgraph/base/pyproject.toml b/src/assets/python/http/langchain_langgraph/base/pyproject.toml
index dde5bc4325..9436a5bc1b 100644
--- a/src/assets/python/http/langchain_langgraph/base/pyproject.toml
+++ b/src/assets/python/http/langchain_langgraph/base/pyproject.toml
@@ -12,7 +12,7 @@ dependencies = [
     "aws-opentelemetry-distro ~= 0.18.0",
     "opentelemetry-instrumentation-langchain >= 0.59.0",
     "langgraph >= 1.0.2",
-    "mcp ~= 1.24.0",
+    "mcp >= 1.28.1, < 2.0.0",
     "langchain-mcp-adapters >= 0.3.1",
     "langchain >= 1.0.3",
     "bedrock-agentcore >= 1.8.0",
diff --git a/src/assets/python/http/strands/base/pyproject.toml b/src/assets/python/http/strands/base/pyproject.toml
index 7f146d42b6..5b8c7b20de 100644
--- a/src/assets/python/http/strands/base/pyproject.toml
+++ b/src/assets/python/http/strands/base/pyproject.toml
@@ -14,7 +14,7 @@ dependencies = [
     "bedrock-agentcore >= 1.9.1",
     "botocore[crt] >= 1.35.0",
     {{#if (eq modelProvider "Gemini")}}"google-genai >= 1.0.0",
-    {{/if}}"mcp ~= 1.24.0",
+    {{/if}}"mcp >= 1.28.1, < 2.0.0",
     {{#if (eq modelProvider "OpenAI")}}"openai >= 1.0.0",
     {{/if}}{{#if (eq modelProvider "LiteLLM")}}"litellm >= 1.0.0",
     {{/if}}{{#if bedrockMantle}}"openai >= 1.0.0",
diff --git a/src/assets/python/mcp/standalone/base/pyproject.toml b/src/assets/python/mcp/standalone/base/pyproject.toml
index 791ce25eda..dc31eed897 100644
--- a/src/assets/python/mcp/standalone/base/pyproject.toml
+++ b/src/assets/python/mcp/standalone/base/pyproject.toml
@@ -9,7 +9,7 @@ description = "AgentCore MCP Server"
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
-    "mcp ~= 1.24.0",
+    "mcp >= 1.28.1, < 2.0.0",
 ]
 
 [tool.hatch.build.targets.wheel]

From d7c0b1bd2766b544a38239af17ac03eb91787960 Mon Sep 17 00:00:00 2001
From: Aidan Daly <aidandal@amazon.com>
Date: Thu, 1 Oct 2026 14:49:55 +0000
Subject: [PATCH 2/8] fix(templates): require patched AgentCore Python SDK
 versions

---
 .../assets.snapshot.test.ts.snap              | 18 ++++++++--------
 .../__tests__/python-dependencies.test.ts     | 21 +++++++++++++++++++
 .../python/a2a/strands/base/pyproject.toml    |  2 +-
 .../python/agui/googleadk/base/pyproject.toml |  2 +-
 .../langchain_langgraph/base/pyproject.toml   |  2 +-
 .../python/agui/strands/base/pyproject.toml   |  2 +-
 .../python/http/autogen/base/pyproject.toml   |  2 +-
 .../python/http/googleadk/base/pyproject.toml |  2 +-
 .../langchain_langgraph/base/pyproject.toml   |  2 +-
 .../http/openaiagents/base/pyproject.toml     |  2 +-
 .../python/http/strands/base/pyproject.toml   |  2 +-
 11 files changed, 39 insertions(+), 18 deletions(-)

diff --git a/src/assets/__tests__/__snapshots__/assets.snapshot.test.ts.snap b/src/assets/__tests__/__snapshots__/assets.snapshot.test.ts.snap
index 413a869263..ad8326a46e 100644
--- a/src/assets/__tests__/__snapshots__/assets.snapshot.test.ts.snap
+++ b/src/assets/__tests__/__snapshots__/assets.snapshot.test.ts.snap
@@ -2304,7 +2304,7 @@ dependencies = [
     {{#if (eq modelProvider "Anthropic")}}"anthropic >= 0.30.0",
     {{/if}}"a2a-sdk[all] >= 0.3.0, < 0.4.0",
     "aws-opentelemetry-distro ~= 0.18.0",
-    "bedrock-agentcore[a2a] >= 1.9.1",
+    "bedrock-agentcore[a2a] >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     {{#if (eq modelProvider "Gemini")}}"google-genai >= 1.0.0",
     {{/if}}{{#if (eq modelProvider "OpenAI")}}"openai >= 1.0.0",
@@ -2609,7 +2609,7 @@ requires-python = ">=3.10"
 dependencies = [
     "ag-ui-adk >= 0.6.0",
     "ag-ui-protocol >= 0.1.10",
-    "bedrock-agentcore >= 1.8.0",
+    "bedrock-agentcore >= 1.18.1",
     "fastapi >= 0.115.12",
     "google-adk >= 1.16.0, < 2.0.0",
     "google-genai >= 1.0.0, < 2.0.0",
@@ -2982,7 +2982,7 @@ dependencies = [
     {{/if}}{{#if (eq modelProvider "OpenAI")}}"langchain-openai >= 0.2.0",
     {{/if}}"aws-opentelemetry-distro ~= 0.18.0",
     "opentelemetry-instrumentation-langchain >= 0.59.0",
-    "bedrock-agentcore >= 1.8.0",
+    "bedrock-agentcore >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     "langgraph >= 0.3.25",
     "langchain >= 0.3.0",
@@ -3324,7 +3324,7 @@ dependencies = [
     {{/if}}"ag-ui-strands >= 0.1.7",
     "ag-ui-protocol >= 0.1.10",
     "aws-opentelemetry-distro ~= 0.18.0",
-    "bedrock-agentcore >= 1.9.1",
+    "bedrock-agentcore >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     "fastapi >= 0.115.12",
     {{#if (eq modelProvider "Gemini")}}"google-genai >= 1.0.0",
@@ -3835,7 +3835,7 @@ dependencies = [
     "autogen-ext[mcp] >= 0.7.5",
     "opentelemetry-distro",
     "opentelemetry-exporter-otlp",
-    "bedrock-agentcore >= 1.8.0",
+    "bedrock-agentcore >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     "tiktoken",
 {{#if (eq modelProvider "Bedrock")}}
@@ -5407,7 +5407,7 @@ dependencies = [
     "google-genai >= 1.0.0, < 2.0.0",
     # 1.13.0 was yanked for broken imports.
     "opentelemetry-resourcedetector-gcp >= 1.9.0a0, < 2.0.0, != 1.13.0",
-    "bedrock-agentcore >= 1.0.3",
+    "bedrock-agentcore >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     {{#if hasGateway}}{{#if (includes gatewayAuthTypes "AWS_IAM")}}"mcp-proxy-for-aws >= 1.1.0",
     {{/if}}{{/if}}
@@ -5981,7 +5981,7 @@ dependencies = [
     "mcp >= 1.28.1, < 2.0.0",
     "langchain-mcp-adapters >= 0.3.1",
     "langchain >= 1.0.3",
-    "bedrock-agentcore >= 1.8.0",
+    "bedrock-agentcore >= 1.18.1",
     "botocore[crt] >= 1.35.0",
 {{#if (eq modelProvider "Bedrock")}}
     "langchain-aws >= 1.0.0",
@@ -6446,7 +6446,7 @@ requires-python = ">=3.10"
 dependencies = [
     "aws-opentelemetry-distro ~= 0.18.0",
     "openai-agents >= 0.16.0",
-    "bedrock-agentcore >= 1.8.0",
+    "bedrock-agentcore >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     {{#if hasGateway}}{{#if (includes gatewayAuthTypes "AWS_IAM")}}"mcp-proxy-for-aws >= 1.1.0",
     {{/if}}{{/if}}
@@ -7681,7 +7681,7 @@ requires-python = ">=3.10"
 dependencies = [
     {{#if (eq modelProvider "Anthropic")}}"anthropic >= 0.30.0",
     {{/if}}"aws-opentelemetry-distro ~= 0.18.0",
-    "bedrock-agentcore >= 1.9.1",
+    "bedrock-agentcore >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     {{#if (eq modelProvider "Gemini")}}"google-genai >= 1.0.0",
     {{/if}}"mcp >= 1.28.1, < 2.0.0",
diff --git a/src/assets/__tests__/python-dependencies.test.ts b/src/assets/__tests__/python-dependencies.test.ts
index c30b719442..6b225a81b6 100644
--- a/src/assets/__tests__/python-dependencies.test.ts
+++ b/src/assets/__tests__/python-dependencies.test.ts
@@ -32,4 +32,25 @@ describe('generated Python dependency constraints', () => {
     const pyproject = readFileSync(join(destination, 'pyproject.toml'), 'utf-8');
     expect(pyproject).toContain(`"${dependency} >= 1.28.1, < 2.0.0"`);
   });
+
+  it.each([
+    ['python/http/strands/base', 'bedrock-agentcore'],
+    ['python/http/langchain_langgraph/base', 'bedrock-agentcore'],
+    ['python/http/googleadk/base', 'bedrock-agentcore'],
+    ['python/http/openaiagents/base', 'bedrock-agentcore'],
+    ['python/http/autogen/base', 'bedrock-agentcore'],
+    ['python/a2a/strands/base', 'bedrock-agentcore[a2a]'],
+    ['python/agui/strands/base', 'bedrock-agentcore'],
+    ['python/agui/langchain_langgraph/base', 'bedrock-agentcore'],
+    ['python/agui/googleadk/base', 'bedrock-agentcore'],
+  ])('%s requires an AgentCore SDK with the package-installation fix', async (assetDir, dependency) => {
+    const destination = join(outputDir, assetDir);
+    await copyAndRenderDir(join(ASSETS_DIR, assetDir), destination, {
+      name: 'dependency_probe',
+      modelProvider: 'Bedrock',
+    });
+
+    const pyproject = readFileSync(join(destination, 'pyproject.toml'), 'utf-8');
+    expect(pyproject).toContain(`"${dependency} >= 1.18.1"`);
+  });
 });
diff --git a/src/assets/python/a2a/strands/base/pyproject.toml b/src/assets/python/a2a/strands/base/pyproject.toml
index c9177f265f..4490efffbd 100644
--- a/src/assets/python/a2a/strands/base/pyproject.toml
+++ b/src/assets/python/a2a/strands/base/pyproject.toml
@@ -12,7 +12,7 @@ dependencies = [
     {{#if (eq modelProvider "Anthropic")}}"anthropic >= 0.30.0",
     {{/if}}"a2a-sdk[all] >= 0.3.0, < 0.4.0",
     "aws-opentelemetry-distro ~= 0.18.0",
-    "bedrock-agentcore[a2a] >= 1.9.1",
+    "bedrock-agentcore[a2a] >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     {{#if (eq modelProvider "Gemini")}}"google-genai >= 1.0.0",
     {{/if}}{{#if (eq modelProvider "OpenAI")}}"openai >= 1.0.0",
diff --git a/src/assets/python/agui/googleadk/base/pyproject.toml b/src/assets/python/agui/googleadk/base/pyproject.toml
index 50e4701fa4..4c33de2ceb 100644
--- a/src/assets/python/agui/googleadk/base/pyproject.toml
+++ b/src/assets/python/agui/googleadk/base/pyproject.toml
@@ -11,7 +11,7 @@ requires-python = ">=3.10"
 dependencies = [
     "ag-ui-adk >= 0.6.0",
     "ag-ui-protocol >= 0.1.10",
-    "bedrock-agentcore >= 1.8.0",
+    "bedrock-agentcore >= 1.18.1",
     "fastapi >= 0.115.12",
     "google-adk >= 1.16.0, < 2.0.0",
     "google-genai >= 1.0.0, < 2.0.0",
diff --git a/src/assets/python/agui/langchain_langgraph/base/pyproject.toml b/src/assets/python/agui/langchain_langgraph/base/pyproject.toml
index f79854e8f5..03506eb01f 100644
--- a/src/assets/python/agui/langchain_langgraph/base/pyproject.toml
+++ b/src/assets/python/agui/langchain_langgraph/base/pyproject.toml
@@ -18,7 +18,7 @@ dependencies = [
     {{/if}}{{#if (eq modelProvider "OpenAI")}}"langchain-openai >= 0.2.0",
     {{/if}}"aws-opentelemetry-distro ~= 0.18.0",
     "opentelemetry-instrumentation-langchain >= 0.59.0",
-    "bedrock-agentcore >= 1.8.0",
+    "bedrock-agentcore >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     "langgraph >= 0.3.25",
     "langchain >= 0.3.0",
diff --git a/src/assets/python/agui/strands/base/pyproject.toml b/src/assets/python/agui/strands/base/pyproject.toml
index c75a5badbf..6f6af6de3d 100644
--- a/src/assets/python/agui/strands/base/pyproject.toml
+++ b/src/assets/python/agui/strands/base/pyproject.toml
@@ -13,7 +13,7 @@ dependencies = [
     {{/if}}"ag-ui-strands >= 0.1.7",
     "ag-ui-protocol >= 0.1.10",
     "aws-opentelemetry-distro ~= 0.18.0",
-    "bedrock-agentcore >= 1.9.1",
+    "bedrock-agentcore >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     "fastapi >= 0.115.12",
     {{#if (eq modelProvider "Gemini")}}"google-genai >= 1.0.0",
diff --git a/src/assets/python/http/autogen/base/pyproject.toml b/src/assets/python/http/autogen/base/pyproject.toml
index 7437061445..4fcad51e93 100644
--- a/src/assets/python/http/autogen/base/pyproject.toml
+++ b/src/assets/python/http/autogen/base/pyproject.toml
@@ -13,7 +13,7 @@ dependencies = [
     "autogen-ext[mcp] >= 0.7.5",
     "opentelemetry-distro",
     "opentelemetry-exporter-otlp",
-    "bedrock-agentcore >= 1.8.0",
+    "bedrock-agentcore >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     "tiktoken",
 {{#if (eq modelProvider "Bedrock")}}
diff --git a/src/assets/python/http/googleadk/base/pyproject.toml b/src/assets/python/http/googleadk/base/pyproject.toml
index 5ae5d38c17..3105ca488b 100644
--- a/src/assets/python/http/googleadk/base/pyproject.toml
+++ b/src/assets/python/http/googleadk/base/pyproject.toml
@@ -14,7 +14,7 @@ dependencies = [
     "google-genai >= 1.0.0, < 2.0.0",
     # 1.13.0 was yanked for broken imports.
     "opentelemetry-resourcedetector-gcp >= 1.9.0a0, < 2.0.0, != 1.13.0",
-    "bedrock-agentcore >= 1.0.3",
+    "bedrock-agentcore >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     {{#if hasGateway}}{{#if (includes gatewayAuthTypes "AWS_IAM")}}"mcp-proxy-for-aws >= 1.1.0",
     {{/if}}{{/if}}
diff --git a/src/assets/python/http/langchain_langgraph/base/pyproject.toml b/src/assets/python/http/langchain_langgraph/base/pyproject.toml
index 9436a5bc1b..21e38ce991 100644
--- a/src/assets/python/http/langchain_langgraph/base/pyproject.toml
+++ b/src/assets/python/http/langchain_langgraph/base/pyproject.toml
@@ -15,7 +15,7 @@ dependencies = [
     "mcp >= 1.28.1, < 2.0.0",
     "langchain-mcp-adapters >= 0.3.1",
     "langchain >= 1.0.3",
-    "bedrock-agentcore >= 1.8.0",
+    "bedrock-agentcore >= 1.18.1",
     "botocore[crt] >= 1.35.0",
 {{#if (eq modelProvider "Bedrock")}}
     "langchain-aws >= 1.0.0",
diff --git a/src/assets/python/http/openaiagents/base/pyproject.toml b/src/assets/python/http/openaiagents/base/pyproject.toml
index fa26663a60..ae6458babf 100644
--- a/src/assets/python/http/openaiagents/base/pyproject.toml
+++ b/src/assets/python/http/openaiagents/base/pyproject.toml
@@ -11,7 +11,7 @@ requires-python = ">=3.10"
 dependencies = [
     "aws-opentelemetry-distro ~= 0.18.0",
     "openai-agents >= 0.16.0",
-    "bedrock-agentcore >= 1.8.0",
+    "bedrock-agentcore >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     {{#if hasGateway}}{{#if (includes gatewayAuthTypes "AWS_IAM")}}"mcp-proxy-for-aws >= 1.1.0",
     {{/if}}{{/if}}
diff --git a/src/assets/python/http/strands/base/pyproject.toml b/src/assets/python/http/strands/base/pyproject.toml
index 5b8c7b20de..10a753e257 100644
--- a/src/assets/python/http/strands/base/pyproject.toml
+++ b/src/assets/python/http/strands/base/pyproject.toml
@@ -11,7 +11,7 @@ requires-python = ">=3.10"
 dependencies = [
     {{#if (eq modelProvider "Anthropic")}}"anthropic >= 0.30.0",
     {{/if}}"aws-opentelemetry-distro ~= 0.18.0",
-    "bedrock-agentcore >= 1.9.1",
+    "bedrock-agentcore >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     {{#if (eq modelProvider "Gemini")}}"google-genai >= 1.0.0",
     {{/if}}"mcp >= 1.28.1, < 2.0.0",

From d06d03ee3b47f7a673aa7b590b5a8c19094f3f4b Mon Sep 17 00:00:00 2001
From: Aidan Daly <aidandal@amazon.com>
Date: Thu, 1 Oct 2026 14:52:22 +0000
Subject: [PATCH 3/8] fix(container): apply Debian package updates during
 builds

---
 .../__tests__/__snapshots__/dockerfile-render.test.ts.snap | 4 ++++
 src/assets/__tests__/dockerfile-render.test.ts             | 7 +++++++
 src/assets/container/python/Dockerfile                     | 2 ++
 3 files changed, 13 insertions(+)

diff --git a/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap b/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap
index 90bb1457de..ac9cb44f03 100644
--- a/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap
+++ b/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap
@@ -3,6 +3,8 @@
 exports[`Dockerfile enableOtel rendering > renders opentelemetry-instrument CMD when enableOtel is true > Dockerfile-enableOtel-true 1`] = `
 "FROM public.ecr.aws/docker/library/python:3.12-slim-trixie
 
+RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
+
 RUN pip install --no-cache-dir uv
 
 ARG UV_DEFAULT_INDEX
@@ -43,6 +45,8 @@ CMD ["opentelemetry-instrument", "python", "-m", "main"]
 exports[`Dockerfile enableOtel rendering > renders plain python CMD when enableOtel is false > Dockerfile-enableOtel-false 1`] = `
 "FROM public.ecr.aws/docker/library/python:3.12-slim-trixie
 
+RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
+
 RUN pip install --no-cache-dir uv
 
 ARG UV_DEFAULT_INDEX
diff --git a/src/assets/__tests__/dockerfile-render.test.ts b/src/assets/__tests__/dockerfile-render.test.ts
index 33e3968d76..fc68e68a5a 100644
--- a/src/assets/__tests__/dockerfile-render.test.ts
+++ b/src/assets/__tests__/dockerfile-render.test.ts
@@ -8,6 +8,13 @@ const DOCKERFILE_PATH = path.resolve(__dirname, '..', 'container', 'python', 'Do
 describe('Dockerfile enableOtel rendering', () => {
   const template = Handlebars.compile(fs.readFileSync(DOCKERFILE_PATH, 'utf-8'));
 
+  it('renders OS updates before switching to the runtime user', () => {
+    const rendered = template({ entrypoint: 'main', enableOtel: true });
+    expect(rendered).toContain('apt-get update');
+    expect(rendered).toContain('apt-get upgrade -y');
+    expect(rendered.indexOf('apt-get upgrade -y')).toBeLessThan(rendered.indexOf('USER bedrock_agentcore'));
+  });
+
   it('renders opentelemetry-instrument CMD when enableOtel is true', () => {
     const rendered = template({ entrypoint: 'main', enableOtel: true });
     expect(rendered).toMatchSnapshot('Dockerfile-enableOtel-true');
diff --git a/src/assets/container/python/Dockerfile b/src/assets/container/python/Dockerfile
index 265fd9a3e3..f2310e452a 100644
--- a/src/assets/container/python/Dockerfile
+++ b/src/assets/container/python/Dockerfile
@@ -1,5 +1,7 @@
 FROM public.ecr.aws/docker/library/python:3.12-slim-trixie
 
+RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
+
 {{#if gitSkills}}
 RUN apt-get update && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/*
 

From dc0030f625a22cc6765b49614850d3bee4c24229 Mon Sep 17 00:00:00 2001
From: Aidan Daly <aidandal@amazon.com>
Date: Thu, 1 Oct 2026 14:54:30 +0000
Subject: [PATCH 4/8] fix(container): omit uv cache from runtime images

---
 .../__tests__/__snapshots__/dockerfile-render.test.ts.snap  | 2 ++
 src/assets/__tests__/dockerfile-render.test.ts              | 6 ++++++
 src/assets/container/python/Dockerfile                      | 1 +
 3 files changed, 9 insertions(+)

diff --git a/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap b/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap
index ac9cb44f03..79c4650c7f 100644
--- a/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap
+++ b/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap
@@ -13,6 +13,7 @@ ARG UV_INDEX
 WORKDIR /app
 
 ENV UV_SYSTEM_PYTHON=1 \\
+    UV_NO_CACHE=1 \\
     UV_COMPILE_BYTECODE=1 \\
     UV_NO_PROGRESS=1 \\
     PYTHONUNBUFFERED=1 \\
@@ -55,6 +56,7 @@ ARG UV_INDEX
 WORKDIR /app
 
 ENV UV_SYSTEM_PYTHON=1 \\
+    UV_NO_CACHE=1 \\
     UV_COMPILE_BYTECODE=1 \\
     UV_NO_PROGRESS=1 \\
     PYTHONUNBUFFERED=1 \\
diff --git a/src/assets/__tests__/dockerfile-render.test.ts b/src/assets/__tests__/dockerfile-render.test.ts
index fc68e68a5a..05685bd5cf 100644
--- a/src/assets/__tests__/dockerfile-render.test.ts
+++ b/src/assets/__tests__/dockerfile-render.test.ts
@@ -15,6 +15,12 @@ describe('Dockerfile enableOtel rendering', () => {
     expect(rendered.indexOf('apt-get upgrade -y')).toBeLessThan(rendered.indexOf('USER bedrock_agentcore'));
   });
 
+  it('disables uv caching before installing the locked dependencies', () => {
+    const rendered = template({ entrypoint: 'main', enableOtel: true });
+    expect(rendered).toContain('UV_NO_CACHE=1');
+    expect(rendered.indexOf('UV_NO_CACHE=1')).toBeLessThan(rendered.indexOf('RUN uv sync --frozen'));
+  });
+
   it('renders opentelemetry-instrument CMD when enableOtel is true', () => {
     const rendered = template({ entrypoint: 'main', enableOtel: true });
     expect(rendered).toMatchSnapshot('Dockerfile-enableOtel-true');
diff --git a/src/assets/container/python/Dockerfile b/src/assets/container/python/Dockerfile
index f2310e452a..70630923d8 100644
--- a/src/assets/container/python/Dockerfile
+++ b/src/assets/container/python/Dockerfile
@@ -14,6 +14,7 @@ ARG UV_INDEX
 WORKDIR /app
 
 ENV UV_SYSTEM_PYTHON=1 \
+    UV_NO_CACHE=1 \
     UV_COMPILE_BYTECODE=1 \
     UV_NO_PROGRESS=1 \
     PYTHONUNBUFFERED=1 \

From 15e0cb33492bc0fdf520ac9f5b49e54bc7f9e1fb Mon Sep 17 00:00:00 2001
From: Aidan Daly <aidandal@amazon.com>
Date: Thu, 1 Oct 2026 14:59:52 +0000
Subject: [PATCH 5/8] fix(container): remove uv after dependency installation

---
 docs/container-builds.md                      | 32 +++++++++++++++++--
 .../dockerfile-render.test.ts.snap            |  4 +--
 .../__tests__/dockerfile-render.test.ts       |  8 +++++
 src/assets/container/python/Dockerfile        |  2 +-
 4 files changed, 41 insertions(+), 5 deletions(-)

diff --git a/docs/container-builds.md b/docs/container-builds.md
index 0049372145..24a98337c4 100644
--- a/docs/container-builds.md
+++ b/docs/container-builds.md
@@ -39,16 +39,44 @@ app/MyAgent/
 
 ## Generated Dockerfile
 
-The template uses `public.ecr.aws/docker/library/python:3.12-slim` as the base image (with `uv` installed via
+The template uses `public.ecr.aws/docker/library/python:3.12-slim-trixie` as the base image (with `uv` installed via
 `pip install uv`) with these design choices:
 
+- **OS updates**: Installs available Debian package updates during the build
 - **Layer caching**: Dependencies (`pyproject.toml`) are installed before copying application code
 - **Non-root**: Runs as `bedrock_agentcore` (UID 1000)
 - **Observability**: Default CMD wraps the agent with `opentelemetry-instrument`
-- **Fast installs**: Uses `uv pip install` for dependency resolution
+- **Locked installs**: Uses `uv sync --frozen --no-dev` to install the versions in `uv.lock`
+- **Build-tool cleanup**: Disables uv caching and removes uv after the final dependency installation
 
 You can customize the Dockerfile freely — add system packages, change the base image, or use multi-stage builds.
 
+### Updating Existing Python Projects
+
+Updating the CLI does not rewrite an existing project's Dockerfile, dependency constraints, or lockfile. Update the
+affected entries in the agent's `pyproject.toml` dependency list, keeping its other dependencies and package extras:
+
+```toml
+dependencies = [
+    "mcp >= 1.28.1, < 2.0.0",
+    "bedrock-agentcore >= 1.18.1",
+]
+```
+
+Then refresh the lockfile from the agent's code directory:
+
+```bash
+uv lock --upgrade
+```
+
+For an older generated container Dockerfile, add the OS update step before switching users, set `UV_NO_CACHE=1` before
+both sync steps, and remove the globally installed uv after the final sync. Keep uv if your custom application invokes
+it at runtime. Rebuild and redeploy the changed image, test the application, and inspect its package versions and scan
+findings.
+
+Docker may reuse cached base images and OS-update layers on later builds. When building manually, use
+`docker build --pull --no-cache` to refresh them; a successful unchanged deployment is not evidence of updated packages.
+
 ### TypeScript Dockerfile
 
 For TypeScript agents, the generated `Dockerfile` uses `public.ecr.aws/docker/library/node:22-slim`:
diff --git a/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap b/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap
index 79c4650c7f..82815febef 100644
--- a/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap
+++ b/src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap
@@ -28,7 +28,7 @@ COPY pyproject.toml uv.lock ./
 RUN uv sync --frozen --no-dev --no-install-project
 
 COPY --chown=bedrock_agentcore:bedrock_agentcore . .
-RUN uv sync --frozen --no-dev
+RUN uv sync --frozen --no-dev && /usr/local/bin/python -m pip uninstall -y uv
 
 USER bedrock_agentcore
 
@@ -71,7 +71,7 @@ COPY pyproject.toml uv.lock ./
 RUN uv sync --frozen --no-dev --no-install-project
 
 COPY --chown=bedrock_agentcore:bedrock_agentcore . .
-RUN uv sync --frozen --no-dev
+RUN uv sync --frozen --no-dev && /usr/local/bin/python -m pip uninstall -y uv
 
 USER bedrock_agentcore
 
diff --git a/src/assets/__tests__/dockerfile-render.test.ts b/src/assets/__tests__/dockerfile-render.test.ts
index 05685bd5cf..a3df1f75ac 100644
--- a/src/assets/__tests__/dockerfile-render.test.ts
+++ b/src/assets/__tests__/dockerfile-render.test.ts
@@ -21,6 +21,14 @@ describe('Dockerfile enableOtel rendering', () => {
     expect(rendered.indexOf('UV_NO_CACHE=1')).toBeLessThan(rendered.indexOf('RUN uv sync --frozen'));
   });
 
+  it('removes the global uv installation after the final sync and before changing users', () => {
+    const rendered = template({ entrypoint: 'main', enableOtel: true });
+    const uninstall = '/usr/local/bin/python -m pip uninstall -y uv';
+    expect(rendered).toContain(uninstall);
+    expect(rendered.lastIndexOf('uv sync --frozen')).toBeLessThan(rendered.indexOf(uninstall));
+    expect(rendered.indexOf(uninstall)).toBeLessThan(rendered.indexOf('USER bedrock_agentcore'));
+  });
+
   it('renders opentelemetry-instrument CMD when enableOtel is true', () => {
     const rendered = template({ entrypoint: 'main', enableOtel: true });
     expect(rendered).toMatchSnapshot('Dockerfile-enableOtel-true');
diff --git a/src/assets/container/python/Dockerfile b/src/assets/container/python/Dockerfile
index 70630923d8..f85b3fede0 100644
--- a/src/assets/container/python/Dockerfile
+++ b/src/assets/container/python/Dockerfile
@@ -29,7 +29,7 @@ COPY pyproject.toml uv.lock ./
 RUN uv sync --frozen --no-dev --no-install-project
 
 COPY --chown=bedrock_agentcore:bedrock_agentcore . .
-RUN uv sync --frozen --no-dev
+RUN uv sync --frozen --no-dev && /usr/local/bin/python -m pip uninstall -y uv
 
 USER bedrock_agentcore
 

From 7b9205ba9f50d8b24bfa20041c61fa408c307170 Mon Sep 17 00:00:00 2001
From: Aidan Daly <aidandal@amazon.com>
Date: Thu, 1 Oct 2026 15:28:50 +0000
Subject: [PATCH 6/8] fix(templates): honor SDK Strands integration
 dependencies

---
 docs/container-builds.md                                    | 4 ++++
 .../__tests__/__snapshots__/assets.snapshot.test.ts.snap    | 6 +++---
 src/assets/__tests__/python-dependencies.test.ts            | 6 +++---
 src/assets/python/a2a/strands/base/pyproject.toml           | 2 +-
 src/assets/python/agui/strands/base/pyproject.toml          | 2 +-
 src/assets/python/http/strands/base/pyproject.toml          | 2 +-
 6 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/docs/container-builds.md b/docs/container-builds.md
index 24a98337c4..a749ade1ca 100644
--- a/docs/container-builds.md
+++ b/docs/container-builds.md
@@ -63,6 +63,10 @@ dependencies = [
 ]
 ```
 
+Strands projects using the AgentCore Memory integration should enable the SDK's `strands-agents` extra, for example
+`bedrock-agentcore[strands-agents] >= 1.18.1`. This extra declares the compatible Strands dependency. Remove old Strands
+minor-version pins that would prevent resolution of that dependency, while retaining any model-provider extras.
+
 Then refresh the lockfile from the agent's code directory:
 
 ```bash
diff --git a/src/assets/__tests__/__snapshots__/assets.snapshot.test.ts.snap b/src/assets/__tests__/__snapshots__/assets.snapshot.test.ts.snap
index ad8326a46e..f473069b6d 100644
--- a/src/assets/__tests__/__snapshots__/assets.snapshot.test.ts.snap
+++ b/src/assets/__tests__/__snapshots__/assets.snapshot.test.ts.snap
@@ -2304,7 +2304,7 @@ dependencies = [
     {{#if (eq modelProvider "Anthropic")}}"anthropic >= 0.30.0",
     {{/if}}"a2a-sdk[all] >= 0.3.0, < 0.4.0",
     "aws-opentelemetry-distro ~= 0.18.0",
-    "bedrock-agentcore[a2a] >= 1.18.1",
+    "bedrock-agentcore[a2a,strands-agents] >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     {{#if (eq modelProvider "Gemini")}}"google-genai >= 1.0.0",
     {{/if}}{{#if (eq modelProvider "OpenAI")}}"openai >= 1.0.0",
@@ -3324,7 +3324,7 @@ dependencies = [
     {{/if}}"ag-ui-strands >= 0.1.7",
     "ag-ui-protocol >= 0.1.10",
     "aws-opentelemetry-distro ~= 0.18.0",
-    "bedrock-agentcore >= 1.18.1",
+    "bedrock-agentcore[strands-agents] >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     "fastapi >= 0.115.12",
     {{#if (eq modelProvider "Gemini")}}"google-genai >= 1.0.0",
@@ -7681,7 +7681,7 @@ requires-python = ">=3.10"
 dependencies = [
     {{#if (eq modelProvider "Anthropic")}}"anthropic >= 0.30.0",
     {{/if}}"aws-opentelemetry-distro ~= 0.18.0",
-    "bedrock-agentcore >= 1.18.1",
+    "bedrock-agentcore[strands-agents] >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     {{#if (eq modelProvider "Gemini")}}"google-genai >= 1.0.0",
     {{/if}}"mcp >= 1.28.1, < 2.0.0",
diff --git a/src/assets/__tests__/python-dependencies.test.ts b/src/assets/__tests__/python-dependencies.test.ts
index 6b225a81b6..83ac660a0a 100644
--- a/src/assets/__tests__/python-dependencies.test.ts
+++ b/src/assets/__tests__/python-dependencies.test.ts
@@ -34,13 +34,13 @@ describe('generated Python dependency constraints', () => {
   });
 
   it.each([
-    ['python/http/strands/base', 'bedrock-agentcore'],
+    ['python/http/strands/base', 'bedrock-agentcore[strands-agents]'],
     ['python/http/langchain_langgraph/base', 'bedrock-agentcore'],
     ['python/http/googleadk/base', 'bedrock-agentcore'],
     ['python/http/openaiagents/base', 'bedrock-agentcore'],
     ['python/http/autogen/base', 'bedrock-agentcore'],
-    ['python/a2a/strands/base', 'bedrock-agentcore[a2a]'],
-    ['python/agui/strands/base', 'bedrock-agentcore'],
+    ['python/a2a/strands/base', 'bedrock-agentcore[a2a,strands-agents]'],
+    ['python/agui/strands/base', 'bedrock-agentcore[strands-agents]'],
     ['python/agui/langchain_langgraph/base', 'bedrock-agentcore'],
     ['python/agui/googleadk/base', 'bedrock-agentcore'],
   ])('%s requires an AgentCore SDK with the package-installation fix', async (assetDir, dependency) => {
diff --git a/src/assets/python/a2a/strands/base/pyproject.toml b/src/assets/python/a2a/strands/base/pyproject.toml
index 4490efffbd..c8be5d2bfe 100644
--- a/src/assets/python/a2a/strands/base/pyproject.toml
+++ b/src/assets/python/a2a/strands/base/pyproject.toml
@@ -12,7 +12,7 @@ dependencies = [
     {{#if (eq modelProvider "Anthropic")}}"anthropic >= 0.30.0",
     {{/if}}"a2a-sdk[all] >= 0.3.0, < 0.4.0",
     "aws-opentelemetry-distro ~= 0.18.0",
-    "bedrock-agentcore[a2a] >= 1.18.1",
+    "bedrock-agentcore[a2a,strands-agents] >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     {{#if (eq modelProvider "Gemini")}}"google-genai >= 1.0.0",
     {{/if}}{{#if (eq modelProvider "OpenAI")}}"openai >= 1.0.0",
diff --git a/src/assets/python/agui/strands/base/pyproject.toml b/src/assets/python/agui/strands/base/pyproject.toml
index 6f6af6de3d..d3ac3e907e 100644
--- a/src/assets/python/agui/strands/base/pyproject.toml
+++ b/src/assets/python/agui/strands/base/pyproject.toml
@@ -13,7 +13,7 @@ dependencies = [
     {{/if}}"ag-ui-strands >= 0.1.7",
     "ag-ui-protocol >= 0.1.10",
     "aws-opentelemetry-distro ~= 0.18.0",
-    "bedrock-agentcore >= 1.18.1",
+    "bedrock-agentcore[strands-agents] >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     "fastapi >= 0.115.12",
     {{#if (eq modelProvider "Gemini")}}"google-genai >= 1.0.0",
diff --git a/src/assets/python/http/strands/base/pyproject.toml b/src/assets/python/http/strands/base/pyproject.toml
index 10a753e257..a4544f1d7b 100644
--- a/src/assets/python/http/strands/base/pyproject.toml
+++ b/src/assets/python/http/strands/base/pyproject.toml
@@ -11,7 +11,7 @@ requires-python = ">=3.10"
 dependencies = [
     {{#if (eq modelProvider "Anthropic")}}"anthropic >= 0.30.0",
     {{/if}}"aws-opentelemetry-distro ~= 0.18.0",
-    "bedrock-agentcore >= 1.18.1",
+    "bedrock-agentcore[strands-agents] >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     {{#if (eq modelProvider "Gemini")}}"google-genai >= 1.0.0",
     {{/if}}"mcp >= 1.28.1, < 2.0.0",

From f51cfd4441b231f3c914daf11bb3d693f86ba64b Mon Sep 17 00:00:00 2001
From: Aidan Daly <aidandal@amazon.com>
Date: Thu, 1 Oct 2026 16:06:56 +0000
Subject: [PATCH 7/8] fix(deps): refresh audited transitive dependencies

---
 npm-shrinkwrap.json | 39 ++++++++++++++++++++++++++-------------
 1 file changed, 26 insertions(+), 13 deletions(-)

diff --git a/npm-shrinkwrap.json b/npm-shrinkwrap.json
index 7c0b869343..48cce2edc3 100644
--- a/npm-shrinkwrap.json
+++ b/npm-shrinkwrap.json
@@ -3756,27 +3756,40 @@
       }
     },
     "node_modules/@humanfs/core": {
-      "version": "0.19.1",
-      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
-      "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==",
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
       "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/types": "^0.15.0"
+      },
       "engines": {
         "node": ">=18.18.0"
       }
     },
     "node_modules/@humanfs/node": {
-      "version": "0.16.7",
-      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.7.tgz",
-      "integrity": "sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==",
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@humanfs/core": "^0.19.1",
+        "@humanfs/core": "^0.19.2",
+        "@humanfs/types": "^0.15.0",
         "@humanwhocodes/retry": "^0.4.0"
       },
       "engines": {
         "node": ">=18.18.0"
       }
     },
+    "node_modules/@humanfs/types": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
     "node_modules/@humanwhocodes/module-importer": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
@@ -7598,9 +7611,9 @@
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
@@ -9412,9 +9425,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.7",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz",
-      "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
+      "version": "3.1.8",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
+      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
       "funding": [
         {
           "type": "github",

From eb57c260707fad6c35a0a4f3e8add5623fae9751 Mon Sep 17 00:00:00 2001
From: Aidan Daly <aidandal@amazon.com>
Date: Thu, 1 Oct 2026 16:20:51 +0000
Subject: [PATCH 8/8] docs: remove container guide changes from security fix

---
 docs/container-builds.md | 36 ++----------------------------------
 1 file changed, 2 insertions(+), 34 deletions(-)

diff --git a/docs/container-builds.md b/docs/container-builds.md
index a749ade1ca..0049372145 100644
--- a/docs/container-builds.md
+++ b/docs/container-builds.md
@@ -39,48 +39,16 @@ app/MyAgent/
 
 ## Generated Dockerfile
 
-The template uses `public.ecr.aws/docker/library/python:3.12-slim-trixie` as the base image (with `uv` installed via
+The template uses `public.ecr.aws/docker/library/python:3.12-slim` as the base image (with `uv` installed via
 `pip install uv`) with these design choices:
 
-- **OS updates**: Installs available Debian package updates during the build
 - **Layer caching**: Dependencies (`pyproject.toml`) are installed before copying application code
 - **Non-root**: Runs as `bedrock_agentcore` (UID 1000)
 - **Observability**: Default CMD wraps the agent with `opentelemetry-instrument`
-- **Locked installs**: Uses `uv sync --frozen --no-dev` to install the versions in `uv.lock`
-- **Build-tool cleanup**: Disables uv caching and removes uv after the final dependency installation
+- **Fast installs**: Uses `uv pip install` for dependency resolution
 
 You can customize the Dockerfile freely — add system packages, change the base image, or use multi-stage builds.
 
-### Updating Existing Python Projects
-
-Updating the CLI does not rewrite an existing project's Dockerfile, dependency constraints, or lockfile. Update the
-affected entries in the agent's `pyproject.toml` dependency list, keeping its other dependencies and package extras:
-
-```toml
-dependencies = [
-    "mcp >= 1.28.1, < 2.0.0",
-    "bedrock-agentcore >= 1.18.1",
-]
-```
-
-Strands projects using the AgentCore Memory integration should enable the SDK's `strands-agents` extra, for example
-`bedrock-agentcore[strands-agents] >= 1.18.1`. This extra declares the compatible Strands dependency. Remove old Strands
-minor-version pins that would prevent resolution of that dependency, while retaining any model-provider extras.
-
-Then refresh the lockfile from the agent's code directory:
-
-```bash
-uv lock --upgrade
-```
-
-For an older generated container Dockerfile, add the OS update step before switching users, set `UV_NO_CACHE=1` before
-both sync steps, and remove the globally installed uv after the final sync. Keep uv if your custom application invokes
-it at runtime. Rebuild and redeploy the changed image, test the application, and inspect its package versions and scan
-findings.
-
-Docker may reuse cached base images and OS-update layers on later builds. When building manually, use
-`docker build --pull --no-cache` to refresh them; a successful unchanged deployment is not evidence of updated packages.
-
 ### TypeScript Dockerfile
 
 For TypeScript agents, the generated `Dockerfile` uses `public.ecr.aws/docker/library/node:22-slim`: