Migrate cdktf to cdktn

[MarcAstr0]

Description

As of December 10, 2025, CDK for Terraform (cdktf) has been deprecated and is no longer maintained, leaving unpatched downstream vulnerabilities in the chain. CDK Terrain (cdktn) is an actively maintained community fork (forked from cdktf 0.21.0, our exact version) with full API compatibility. This PR migrates Booster's infrastructure packages from cdktf to cdktn and refreshes related security-sensitive dependencies.

Changes

• Replaces all cdktf / @cdktf/* dependencies with cdktn / @cdktn/* in framework-provider-azure-infrastructure and framework-integration-tests.
• Updates all cdktf imports in the Azure infrastructure code to cdktn (~27 source files).
• Bumps cdktn to the latest available versions (cdktn 0.23.3, @cdktn/provider-azurerm 16.4.0, @cdktn/provider-null 13.1.0, @cdktn/provider-time 13.1.0).
• Bumps the Effect ecosystem within the safe @effect/platform-node < 0.76 ceiling (effect 3.13.2 → 3.21.3, plus @effect/platform, @effect/platform-node, @effect/cli, @effect/printer*, @effect/typeclass to their latest in-range patches).
• Bumps uuid 11.0.5 → 11.1.1 in framework-types and framework-provider-azure-infrastructure.
• Adds security overrides in common/config/rush/.pnpmfile.cjs (shell-quote, tar, serialize-javascript, flatted, minimatch, brace-expansion, ws, nanoid, js-yaml, yaml, follow-redirects, undici) to address remaining HIGH/CRITICAL transitives.

Checks

• Project Builds
• Project passes tests and checks
• Updated documentation accordingly

[what-the-diff]

PR Summary

• Integration of the New Package cdktn in place of cdktf
  This PR includes the replacement of the cdktf package with the new cdktn package in the @boostercloud/framework-core system. This not only includes the addition of a new JSON file documenting this migration, but also modifications to multiple import statements within the codebase, particularly within the framework-provider-azure-infrastructure package. This change increases the adaptability and efficiency of the system.

• Updated Dependency Versions
  Numerous dependency versions within the framework-core and framework-integration-tests have been updated. These include new versions of effect, @effect/platform, @effect/cli, @effect/printer, @effect/typeclass, and @effect/platform-node. Such updates ensure higher performance, improved stability and additional features in the application.

• New Security Override for the undici Package
  The .pnpmfile.cjs configuration received a security upgrade with the introduction of a new security override for the undici package. This upgrade enhances the security of the application, protecting it from potential vulnerabilities.

• Updated Logging Messages Reflecting Recent Changes
  With the transition to cdktn, logging messages have been adjusted to correctly represent the new deployment process, thereby enhancing the overall transparency and user-friendliness of the system.

• Updated @effect Libraries Versions
  Several @effect libraries have been updated, including effect, @effect/cli, @effect/platform, @effect/printer, @effect/printer-ansi, and @effect/typeclass. These updates ensure the system remains up-to-date with the latest improvements in these libraries, thereby promoting better functionality and user experience.

[MarcAstr0]

/integration sha=89055ff

[github-actions]

⌛ Integration tests are running...

Check their status here 👈

[github-actions]

✅ Integration tests have finished successfully!

[MarcAstr0]

/integration sha=3b14e9d

[github-actions]

⌛ Integration tests are running...

Check their status here 👈

[github-actions]

✅ Integration tests have finished successfully!

[Copilot]

Pull request overview

This PR migrates Booster’s Azure infrastructure and integration-test tooling from deprecated CDK for Terraform (cdktf) to the actively maintained community fork CDK Terrain (cdktn), while also refreshing several security-sensitive dependencies and applying PNPM security overrides.

Changes:

• Replaces cdktf / @cdktf/* dependencies and imports with cdktn / @cdktn/* across the Azure infrastructure synthesis/deploy code.
• Updates Effect ecosystem and uuid versions in multiple packages.
• Extends Rush/PNPM .pnpmfile.cjs security overrides to force safer transitive dependency ranges.

Reviewed changes

Copilot reviewed 34 out of 35 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
packages/framework-types/package.json	Bumps uuid and several effect/@effect/* deps.
packages/framework-provider-azure-infrastructure/src/infrastructure/types/application-synth-stack.ts	Switches provider and CDK imports from cdktf to cdktn.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/web-pubsub-extension-key/terraform-sleep.ts	Migrates TerraformStack/dependable and time-provider imports to cdktn.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/web-pubsub-extension-key/terraform-function-app-data.ts	Migrates AzureRM/time provider imports to cdktn.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/terraform-web-pubsub.ts	Switches AzureRM resource import to @cdktn/provider-azurerm.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/terraform-web-pubsub-hub.ts	Switches AzureRM hub import to @cdktn/provider-azurerm.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/terraform-web-pub-sub-extension-key.ts	Switches host-keys data source import to @cdktn/provider-azurerm.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/terraform-storage-account.ts	Switches storage account import to @cdktn/provider-azurerm.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/terraform-service-plan.ts	Switches service plan import to @cdktn/provider-azurerm.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/terraform-resource-group.ts	Switches resource group import to @cdktn/provider-azurerm.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/terraform-outputs.ts	Switches TerraformOutput import to cdktn.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/terraform-function-app.ts	Switches function app resource/config imports to @cdktn/provider-azurerm.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/terraform-function-app-settings.ts	Switches storage account import to @cdktn/provider-azurerm.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/terraform-event-hub.ts	Switches Event Hub resource import to @cdktn/provider-azurerm.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/terraform-event-hub-namespace.ts	Switches Event Hub namespace import to @cdktn/provider-azurerm.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/terraform-cosmosdb-sql-database.ts	Switches CosmosDB SQL DB import to @cdktn/provider-azurerm.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/terraform-cosmosdb-database.ts	Switches CosmosDB account import to @cdktn/provider-azurerm.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/terraform-containers.ts	Switches TerraformStack and AzureRM/provider imports to cdktn.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/gateway/terraform-virtual-network.ts	Switches VNet import to @cdktn/provider-azurerm.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/gateway/terraform-subnet.ts	Switches subnet import to @cdktn/provider-azurerm.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/gateway/terraform-subnet-security.ts	Switches subnet NSG association import to @cdktn/provider-azurerm.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/gateway/terraform-public-ip.ts	Switches public IP import to @cdktn/provider-azurerm.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/gateway/terraform-public-ip-data.ts	Switches public IP data source import to @cdktn/provider-azurerm.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/gateway/terraform-network-security-group.ts	Switches NSG import to @cdktn/provider-azurerm.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/gateway/terraform-application-gateway.ts	Switches App Gateway imports to @cdktn/provider-azurerm.
packages/framework-provider-azure-infrastructure/src/infrastructure/synth/application-synth.ts	Switches TerraformStack and AzureRM provider/resource imports to cdktn.
packages/framework-provider-azure-infrastructure/src/infrastructure/index.ts	Updates deploy command to cdktn-cli and adjusts deploy failure messaging.
packages/framework-provider-azure-infrastructure/src/infrastructure/azure-stack.ts	Switches Fn/TerraformStack imports from cdktf to cdktn.
packages/framework-provider-azure-infrastructure/src/infrastructure/application-builder.ts	Switches CDK app import to cdktn and updates synth-generation log message.
packages/framework-provider-azure-infrastructure/package.json	Replaces cdktf* deps with cdktn* deps and bumps uuid.
packages/framework-integration-tests/package.json	Replaces cdktf* deps with cdktn* deps and bumps Effect platform deps.
packages/framework-core/package.json	Bumps Effect ecosystem dependencies.
common/config/rush/.pnpmfile.cjs	Adds/updates security override ranges for multiple vulnerable transitives.
common/changes/@boostercloud/framework-core/chore-migrate-cdktf-to-cdktn_2026-05-05-20-03.json	Adds a changeset entry documenting the migration as a patch release.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[alvaroloes]

Thanks for taking on the cdktn migration. I found one release/security issue that should be fixed before merging: some vulnerabilities are only corrected by the Rush pnpmfile/lockfile rewrite, while the published package manifests still declare the old exact direct dependency versions. Consumers installing the published Booster packages will not run this repo's pnpmfile, so those direct dependency fixes will not reach them.

I also saw the existing unresolved Copilot inline thread in packages/framework-provider-azure-infrastructure/src/infrastructure/index.ts around the catch block using error.message plus the extra } in the rejection string; I did not duplicate that comment, but it still looks actionable.

[alvaroloes]

Second-pass note after a deeper review:

• The direct-dependency security issue from my previous inline comment is broader than the examples I listed there. Besides framework-core, framework-types, and framework-provider-aws-infrastructure, the PR branch still has exact old ws: 8.18.0 declarations in application-tester, framework-integration-tests, and framework-provider-local. If the goal is to ship the security fixes to published/installed packages, those direct manifests should be bumped too, not only rewritten by Rush's pnpmfile in this repo.
• The Azure synth docs still tell users they can deploy the generated output with cdktf, while this PR removes cdktf/cdktf-cli and the deploy path now uses cdktn-cli. I could not attach this as an inline diff comment because website/docs/10_going-deeper/infrastructure-providers.mdx is not changed in the PR, but it should be updated before release or tracked as an explicit follow-up.

I rechecked the cdktn import paths and CLI invocation shape: the imports used by the Azure infrastructure package exist in the published cdktn packages, npx cdktn-cli resolves to the package's cdktn binary in a temp install, and cdktn still intentionally uses cdktf.json / cdktf.out naming internally.

[MarcAstr0]

/integration sha=8cce6b3

[github-actions]

⌛ Integration tests are running...

Check their status here 👈

[github-actions]

❌ Oh no! Integration tests have failed

[github-actions]

⌛ Integration tests are running...

Check their status here 👈

[github-actions]

✅ Integration tests have finished successfully!

[alvaroloes]

Re-reviewed latest head 8cce6b3.

The package-manifest security fixes from the previous review look good now: the direct ws specs are bumped to ^8.20.1, yaml is bumped to ^1.10.3, the lockfile resolves them to safe versions, and the Azure synth docs were updated away from cdktf.

I still cannot approve because the deployment error handler in packages/framework-provider-azure-infrastructure/src/infrastructure/index.ts:47 is unchanged. runCommand rejects with stderr as a string, so error.message will be undefined at runtime, and the template string still has the extra trailing }. This is already covered by the existing unresolved Copilot thread, so I am not duplicating the inline comment, but it remains an actionable blocker.

[Copilot]

Pull request overview

Copilot reviewed 38 out of 39 changed files in this pull request and generated 1 comment.

[alvaroloes]

Re-reviewed latest head 95b9688. The previously blocking deploy error handling is fixed, the package-manifest dependency fixes and docs updates remain in place, and I don’t see any remaining merge-blocking issues.

All visible checks are passing (changes-check, lint, unit-tests, CodeQL, CodeSee). The remaining unresolved Copilot note is a log-message clarity suggestion around cdktf.json naming; I don’t consider it a blocker because cdktn intentionally retains cdktf.json / cdktf.out artifact names.