fix(templates): refresh Python dependencies and container hygiene

src/assets/__tests__/__snapshots__/assets.snapshot.test.ts.snap

@@ -985,7 +985,7 @@ description = "MCP Server demonstrating HTTP tool patterns"
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
-    "mcp[cli] ~= 1.24.0",
+    "mcp[cli] >= 1.28.1, < 2.0.0",
     "httpx >= 0.27.0",
     "opentelemetry-distro",
     "opentelemetry-exporter-otlp",
@@ -2304,7 +2304,7 @@ dependencies = [
     {{#if (eq modelProvider "Anthropic")}}"anthropic >= 0.30.0",
     {{/if}}"a2a-sdk[all] >= 0.3.0, < 0.4.0",
     "aws-opentelemetry-distro ~= 0.18.0",
-    "bedrock-agentcore[a2a] >= 1.9.1",
+    "bedrock-agentcore[a2a,strands-agents] >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     {{#if (eq modelProvider "Gemini")}}"google-genai >= 1.0.0",
     {{/if}}{{#if (eq modelProvider "OpenAI")}}"openai >= 1.0.0",
@@ -2609,7 +2609,7 @@ requires-python = ">=3.10"
 dependencies = [
     "ag-ui-adk >= 0.6.0",
     "ag-ui-protocol >= 0.1.10",
-    "bedrock-agentcore >= 1.8.0",
+    "bedrock-agentcore >= 1.18.1",
     "fastapi >= 0.115.12",
     "google-adk >= 1.16.0, < 2.0.0",
     "google-genai >= 1.0.0, < 2.0.0",
@@ -2982,7 +2982,7 @@ dependencies = [
     {{/if}}{{#if (eq modelProvider "OpenAI")}}"langchain-openai >= 0.2.0",
     {{/if}}"aws-opentelemetry-distro ~= 0.18.0",
     "opentelemetry-instrumentation-langchain >= 0.59.0",
-    "bedrock-agentcore >= 1.8.0",
+    "bedrock-agentcore >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     "langgraph >= 0.3.25",
     "langchain >= 0.3.0",
@@ -3324,7 +3324,7 @@ dependencies = [
     {{/if}}"ag-ui-strands >= 0.1.7",
     "ag-ui-protocol >= 0.1.10",
     "aws-opentelemetry-distro ~= 0.18.0",
-    "bedrock-agentcore >= 1.9.1",
+    "bedrock-agentcore[strands-agents] >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     "fastapi >= 0.115.12",
     {{#if (eq modelProvider "Gemini")}}"google-genai >= 1.0.0",
@@ -3835,7 +3835,7 @@ dependencies = [
     "autogen-ext[mcp] >= 0.7.5",
     "opentelemetry-distro",
     "opentelemetry-exporter-otlp",
-    "bedrock-agentcore >= 1.8.0",
+    "bedrock-agentcore >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     "tiktoken",
 {{#if (eq modelProvider "Bedrock")}}
@@ -5407,7 +5407,7 @@ dependencies = [
     "google-genai >= 1.0.0, < 2.0.0",
     # 1.13.0 was yanked for broken imports.
     "opentelemetry-resourcedetector-gcp >= 1.9.0a0, < 2.0.0, != 1.13.0",
-    "bedrock-agentcore >= 1.0.3",
+    "bedrock-agentcore >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     {{#if hasGateway}}{{#if (includes gatewayAuthTypes "AWS_IAM")}}"mcp-proxy-for-aws >= 1.1.0",
     {{/if}}{{/if}}
@@ -5978,10 +5978,10 @@ dependencies = [
     "aws-opentelemetry-distro ~= 0.18.0",
     "opentelemetry-instrumentation-langchain >= 0.59.0",
     "langgraph >= 1.0.2",
-    "mcp ~= 1.24.0",
+    "mcp >= 1.28.1, < 2.0.0",
     "langchain-mcp-adapters >= 0.3.1",
     "langchain >= 1.0.3",
-    "bedrock-agentcore >= 1.8.0",
+    "bedrock-agentcore >= 1.18.1",
     "botocore[crt] >= 1.35.0",
 {{#if (eq modelProvider "Bedrock")}}
     "langchain-aws >= 1.0.0",
@@ -6446,7 +6446,7 @@ requires-python = ">=3.10"
 dependencies = [
     "aws-opentelemetry-distro ~= 0.18.0",
     "openai-agents >= 0.16.0",
-    "bedrock-agentcore >= 1.8.0",
+    "bedrock-agentcore >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     {{#if hasGateway}}{{#if (includes gatewayAuthTypes "AWS_IAM")}}"mcp-proxy-for-aws >= 1.1.0",
     {{/if}}{{/if}}
@@ -7681,10 +7681,10 @@ requires-python = ">=3.10"
 dependencies = [
     {{#if (eq modelProvider "Anthropic")}}"anthropic >= 0.30.0",
     {{/if}}"aws-opentelemetry-distro ~= 0.18.0",
-    "bedrock-agentcore >= 1.9.1",
+    "bedrock-agentcore[strands-agents] >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     {{#if (eq modelProvider "Gemini")}}"google-genai >= 1.0.0",
-    {{/if}}"mcp ~= 1.24.0",
+    {{/if}}"mcp >= 1.28.1, < 2.0.0",
     {{#if (eq modelProvider "OpenAI")}}"openai >= 1.0.0",
     {{/if}}{{#if (eq modelProvider "LiteLLM")}}"litellm >= 1.0.0",
     {{/if}}{{#if bedrockMantle}}"openai >= 1.0.0",
@@ -8437,7 +8437,7 @@ description = "AgentCore MCP Server"
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
-    "mcp ~= 1.24.0",
+    "mcp >= 1.28.1, < 2.0.0",
 ]
 
 [tool.hatch.build.targets.wheel]

src/assets/__tests__/__snapshots__/dockerfile-render.test.ts.snap

@@ -3,6 +3,8 @@
 exports[`Dockerfile enableOtel rendering > renders opentelemetry-instrument CMD when enableOtel is true > Dockerfile-enableOtel-true 1`] = `
 "FROM public.ecr.aws/docker/library/python:3.12-slim-trixie
 
+RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
+
 RUN pip install --no-cache-dir uv
 
 ARG UV_DEFAULT_INDEX
@@ -11,6 +13,7 @@ ARG UV_INDEX
 WORKDIR /app
 
 ENV UV_SYSTEM_PYTHON=1 \\
+    UV_NO_CACHE=1 \\
     UV_COMPILE_BYTECODE=1 \\
     UV_NO_PROGRESS=1 \\
     PYTHONUNBUFFERED=1 \\
@@ -25,7 +28,7 @@ COPY pyproject.toml uv.lock ./
 RUN uv sync --frozen --no-dev --no-install-project
 
 COPY --chown=bedrock_agentcore:bedrock_agentcore . .
-RUN uv sync --frozen --no-dev
+RUN uv sync --frozen --no-dev && /usr/local/bin/python -m pip uninstall -y uv
 
 USER bedrock_agentcore
 
@@ -43,6 +46,8 @@ CMD ["opentelemetry-instrument", "python", "-m", "main"]
 exports[`Dockerfile enableOtel rendering > renders plain python CMD when enableOtel is false > Dockerfile-enableOtel-false 1`] = `
 "FROM public.ecr.aws/docker/library/python:3.12-slim-trixie
 
+RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
+
 RUN pip install --no-cache-dir uv
 
 ARG UV_DEFAULT_INDEX
@@ -51,6 +56,7 @@ ARG UV_INDEX
 WORKDIR /app
 
 ENV UV_SYSTEM_PYTHON=1 \\
+    UV_NO_CACHE=1 \\
     UV_COMPILE_BYTECODE=1 \\
     UV_NO_PROGRESS=1 \\
     PYTHONUNBUFFERED=1 \\
@@ -65,7 +71,7 @@ COPY pyproject.toml uv.lock ./
 RUN uv sync --frozen --no-dev --no-install-project
 
 COPY --chown=bedrock_agentcore:bedrock_agentcore . .
-RUN uv sync --frozen --no-dev
+RUN uv sync --frozen --no-dev && /usr/local/bin/python -m pip uninstall -y uv
 
 USER bedrock_agentcore
 

src/assets/__tests__/dockerfile-render.test.ts

@@ -8,6 +8,27 @@ const DOCKERFILE_PATH = path.resolve(__dirname, '..', 'container', 'python', 'Do
 describe('Dockerfile enableOtel rendering', () => {
   const template = Handlebars.compile(fs.readFileSync(DOCKERFILE_PATH, 'utf-8'));
 
+  it('renders OS updates before switching to the runtime user', () => {
+    const rendered = template({ entrypoint: 'main', enableOtel: true });
+    expect(rendered).toContain('apt-get update');
+    expect(rendered).toContain('apt-get upgrade -y');
+    expect(rendered.indexOf('apt-get upgrade -y')).toBeLessThan(rendered.indexOf('USER bedrock_agentcore'));
+  });
+
+  it('disables uv caching before installing the locked dependencies', () => {
+    const rendered = template({ entrypoint: 'main', enableOtel: true });
+    expect(rendered).toContain('UV_NO_CACHE=1');
+    expect(rendered.indexOf('UV_NO_CACHE=1')).toBeLessThan(rendered.indexOf('RUN uv sync --frozen'));
+  });
+
+  it('removes the global uv installation after the final sync and before changing users', () => {
+    const rendered = template({ entrypoint: 'main', enableOtel: true });
+    const uninstall = '/usr/local/bin/python -m pip uninstall -y uv';
+    expect(rendered).toContain(uninstall);
+    expect(rendered.lastIndexOf('uv sync --frozen')).toBeLessThan(rendered.indexOf(uninstall));
+    expect(rendered.indexOf(uninstall)).toBeLessThan(rendered.indexOf('USER bedrock_agentcore'));
+  });
+
   it('renders opentelemetry-instrument CMD when enableOtel is true', () => {
     const rendered = template({ entrypoint: 'main', enableOtel: true });
     expect(rendered).toMatchSnapshot('Dockerfile-enableOtel-true');

src/assets/__tests__/python-dependencies.test.ts

@@ -0,0 +1,56 @@
+import { copyAndRenderDir } from '../../cli/templates/render';
+import { mkdtempSync, readFileSync, rmSync } from 'fs';
+import { tmpdir } from 'os';
+import { join, resolve } from 'path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+const ASSETS_DIR = resolve(__dirname, '..');
+
+describe('generated Python dependency constraints', () => {
+  let outputDir: string;
+
+  beforeAll(() => {
+    outputDir = mkdtempSync(join(tmpdir(), 'python-dependencies-'));
+  });
+
+  afterAll(() => {
+    rmSync(outputDir, { recursive: true, force: true });
+  });
+
+  it.each([
+    ['python/http/strands/base', 'mcp'],
+    ['python/http/langchain_langgraph/base', 'mcp'],
+    ['python/mcp/standalone/base', 'mcp'],
+    ['mcp/python', 'mcp[cli]'],
+  ])('%s permits patched MCP 1.x releases', async (assetDir, dependency) => {
+    const destination = join(outputDir, assetDir);
+    await copyAndRenderDir(join(ASSETS_DIR, assetDir), destination, {
+      name: 'dependency_probe',
+      modelProvider: 'Bedrock',
+    });
+
+    const pyproject = readFileSync(join(destination, 'pyproject.toml'), 'utf-8');
+    expect(pyproject).toContain(`"${dependency} >= 1.28.1, < 2.0.0"`);
+  });
+
+  it.each([
+    ['python/http/strands/base', 'bedrock-agentcore[strands-agents]'],
+    ['python/http/langchain_langgraph/base', 'bedrock-agentcore'],
+    ['python/http/googleadk/base', 'bedrock-agentcore'],
+    ['python/http/openaiagents/base', 'bedrock-agentcore'],
+    ['python/http/autogen/base', 'bedrock-agentcore'],
+    ['python/a2a/strands/base', 'bedrock-agentcore[a2a,strands-agents]'],
+    ['python/agui/strands/base', 'bedrock-agentcore[strands-agents]'],
+    ['python/agui/langchain_langgraph/base', 'bedrock-agentcore'],
+    ['python/agui/googleadk/base', 'bedrock-agentcore'],
+  ])('%s requires an AgentCore SDK with the package-installation fix', async (assetDir, dependency) => {
+    const destination = join(outputDir, assetDir);
+    await copyAndRenderDir(join(ASSETS_DIR, assetDir), destination, {
+      name: 'dependency_probe',
+      modelProvider: 'Bedrock',
+    });
+
+    const pyproject = readFileSync(join(destination, 'pyproject.toml'), 'utf-8');
+    expect(pyproject).toContain(`"${dependency} >= 1.18.1"`);
+  });
+});

src/assets/container/python/Dockerfile

@@ -1,5 +1,7 @@
 FROM public.ecr.aws/docker/library/python:3.12-slim-trixie
 
+RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/*
+
 {{#if gitSkills}}
 RUN apt-get update && apt-get install -y --no-install-recommends git && rm -rf /var/lib/apt/lists/*
 
@@ -12,6 +14,7 @@ ARG UV_INDEX
 WORKDIR /app
 
 ENV UV_SYSTEM_PYTHON=1 \
+    UV_NO_CACHE=1 \
     UV_COMPILE_BYTECODE=1 \
     UV_NO_PROGRESS=1 \
     PYTHONUNBUFFERED=1 \
@@ -26,7 +29,7 @@ COPY pyproject.toml uv.lock ./
 RUN uv sync --frozen --no-dev --no-install-project
 
 COPY --chown=bedrock_agentcore:bedrock_agentcore . .
-RUN uv sync --frozen --no-dev
+RUN uv sync --frozen --no-dev && /usr/local/bin/python -m pip uninstall -y uv
 
 USER bedrock_agentcore
 

src/assets/mcp/python/pyproject.toml

@@ -9,7 +9,7 @@ description = "MCP Server demonstrating HTTP tool patterns"
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
-    "mcp[cli] ~= 1.24.0",
+    "mcp[cli] >= 1.28.1, < 2.0.0",
     "httpx >= 0.27.0",
     "opentelemetry-distro",
     "opentelemetry-exporter-otlp",

src/assets/python/a2a/strands/base/pyproject.toml

@@ -12,7 +12,7 @@ dependencies = [
     {{#if (eq modelProvider "Anthropic")}}"anthropic >= 0.30.0",
     {{/if}}"a2a-sdk[all] >= 0.3.0, < 0.4.0",
     "aws-opentelemetry-distro ~= 0.18.0",
-    "bedrock-agentcore[a2a] >= 1.9.1",
+    "bedrock-agentcore[a2a,strands-agents] >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     {{#if (eq modelProvider "Gemini")}}"google-genai >= 1.0.0",
     {{/if}}{{#if (eq modelProvider "OpenAI")}}"openai >= 1.0.0",

src/assets/python/agui/googleadk/base/pyproject.toml

@@ -11,7 +11,7 @@ requires-python = ">=3.10"
 dependencies = [
     "ag-ui-adk >= 0.6.0",
     "ag-ui-protocol >= 0.1.10",
-    "bedrock-agentcore >= 1.8.0",
+    "bedrock-agentcore >= 1.18.1",
     "fastapi >= 0.115.12",
     "google-adk >= 1.16.0, < 2.0.0",
     "google-genai >= 1.0.0, < 2.0.0",

src/assets/python/agui/langchain_langgraph/base/pyproject.toml

@@ -18,7 +18,7 @@ dependencies = [
     {{/if}}{{#if (eq modelProvider "OpenAI")}}"langchain-openai >= 0.2.0",
     {{/if}}"aws-opentelemetry-distro ~= 0.18.0",
     "opentelemetry-instrumentation-langchain >= 0.59.0",
-    "bedrock-agentcore >= 1.8.0",
+    "bedrock-agentcore >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     "langgraph >= 0.3.25",
     "langchain >= 0.3.0",

src/assets/python/agui/strands/base/pyproject.toml

@@ -13,7 +13,7 @@ dependencies = [
     {{/if}}"ag-ui-strands >= 0.1.7",
     "ag-ui-protocol >= 0.1.10",
     "aws-opentelemetry-distro ~= 0.18.0",
-    "bedrock-agentcore >= 1.9.1",
+    "bedrock-agentcore[strands-agents] >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     "fastapi >= 0.115.12",
     {{#if (eq modelProvider "Gemini")}}"google-genai >= 1.0.0",

src/assets/python/http/autogen/base/pyproject.toml

@@ -13,7 +13,7 @@ dependencies = [
     "autogen-ext[mcp] >= 0.7.5",
     "opentelemetry-distro",
     "opentelemetry-exporter-otlp",
-    "bedrock-agentcore >= 1.8.0",
+    "bedrock-agentcore >= 1.18.1",
     "botocore[crt] >= 1.35.0",
     "tiktoken",
 {{#if (eq modelProvider "Bedrock")}}