From 46cbbda9c06cfba677a8ca39c9cae7420da9b8cf Mon Sep 17 00:00:00 2001
From: Eli Fine <eli88fine@gmail.com>
Date: Mon, 24 Nov 2025 10:19:34 +0000
Subject: [PATCH 01/12] bump copier

---
 .devcontainer/devcontainer.json     | 2 +-
 .devcontainer/install-ci-tooling.py | 6 +++---
 extensions/context.py               | 6 +++---
 pyproject.toml                      | 2 +-
 uv.lock                             | 8 ++++----
 5 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 06e83dc0..cd7f24ca 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -61,5 +61,5 @@
   "initializeCommand": "sh .devcontainer/initialize-command.sh",
   "onCreateCommand": "sh .devcontainer/on-create-command.sh",
   "postStartCommand": "sh .devcontainer/post-start-command.sh"
-  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): 43411b4a # spellchecker:disable-line
+  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): fba21c65 # spellchecker:disable-line
 }
diff --git a/.devcontainer/install-ci-tooling.py b/.devcontainer/install-ci-tooling.py
index 230ea1ed..880938cb 100644
--- a/.devcontainer/install-ci-tooling.py
+++ b/.devcontainer/install-ci-tooling.py
@@ -5,10 +5,10 @@
 import subprocess
 import sys
 
-UV_VERSION = "0.9.7"
-COPIER_VERSION = "9.10.3"
+UV_VERSION = "0.9.11"
+COPIER_VERSION = "9.11.0"
 COPIER_TEMPLATE_EXTENSIONS_VERSION = "0.3.3"
-PRE_COMMIT_VERSION = "4.3.0"
+PRE_COMMIT_VERSION = "4.5.0"
 GITHUB_WINDOWS_RUNNER_BIN_PATH = r"C:\Users\runneradmin\.local\bin"
 parser = argparse.ArgumentParser(description="Install CI tooling for the repo")
 _ = parser.add_argument(
diff --git a/extensions/context.py b/extensions/context.py
index 24febf5b..6902c0a3 100644
--- a/extensions/context.py
+++ b/extensions/context.py
@@ -11,10 +11,10 @@ class ContextUpdater(ContextHook):
     @override
     def hook(self, context: dict[Any, Any]) -> dict[Any, Any]:
         # These are duplicated in the install-ci-tooling.py script in this repository
-        context["uv_version"] = "0.9.7"
-        context["pre_commit_version"] = "4.3.0"
+        context["uv_version"] = "0.9.11"
+        context["pre_commit_version"] = "4.5.0"
         # These also in pyproject.toml
-        context["copier_version"] = "9.10.3"
+        context["copier_version"] = "9.11.0"
         context["copier_template_extensions_version"] = "0.3.3"
         #######
         context["pnpm_version"] = "10.21.0"
diff --git a/pyproject.toml b/pyproject.toml
index 86a81258..3b6bdb9a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -9,6 +9,6 @@ dependencies = [
     "pytest-cov>=7.0.0",
     "pytest-randomly>=4.0.1",
     "pyright[nodejs]>=1.1.407",
-    "copier>=9.10.2",
+    "copier>=9.11.0",
     "copier-template-extensions>=0.3.3"
 ]
diff --git a/uv.lock b/uv.lock
index 097dfc18..17652e78 100644
--- a/uv.lock
+++ b/uv.lock
@@ -22,7 +22,7 @@ wheels = [
 
 [[package]]
 name = "copier"
-version = "9.10.2"
+version = "9.11.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "colorama" },
@@ -39,9 +39,9 @@ dependencies = [
     { name = "pyyaml" },
     { name = "questionary" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/fc/88/11f7279c994526855576c3d1860fb9bfb950baf4d545b172089352a806de/copier-9.10.2.tar.gz", hash = "sha256:495159b796bc745a90238b2097053555f9e4283efc7181ee3b5402a5cbe21614", size = 586648, upload-time = "2025-09-09T19:36:09.381Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/06/61/226642b1efad2a39008ee5b913cd82a6f22a564b652e8f0645488a27a2e2/copier-9.11.0.tar.gz", hash = "sha256:e73d6989fa140b621a5c571984c46122704086a9caa84a6e07699a5234d297ab", size = 592030, upload-time = "2025-11-20T21:08:01.419Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/56/10/402af0f5db39e62cbae4bff55abad1ac9547a63430120685de4f3383d7fb/copier-9.10.2-py3-none-any.whl", hash = "sha256:85b37839e2bac93b8b48d17dc438f362fdf8787a07d821d8263a427e8be8a522", size = 56001, upload-time = "2025-09-09T19:36:08.083Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/ee/657b24e9b2406f572db273e943237c39c86da7d06ac7bc0686cacea1f59d/copier-9.11.0-py3-none-any.whl", hash = "sha256:628adac090f7b333bb64bf5cab03456b99971a77e4d5b2b979e30b8451cbda9d", size = 56432, upload-time = "2025-11-20T21:07:59.618Z" },
 ]
 
 [[package]]
@@ -59,7 +59,7 @@ dependencies = [
 
 [package.metadata]
 requires-dist = [
-    { name = "copier", specifier = ">=9.10.2" },
+    { name = "copier", specifier = ">=9.11.0" },
     { name = "copier-template-extensions", specifier = ">=0.3.3" },
     { name = "pyright", extras = ["nodejs"], specifier = ">=1.1.407" },
     { name = "pytest", specifier = ">=9.0.0" },

From 4f26e3e87145e4f795567c3d3e00b977101898c4 Mon Sep 17 00:00:00 2001
From: Eli Fine <eli88fine@gmail.com>
Date: Mon, 24 Nov 2025 10:21:28 +0000
Subject: [PATCH 02/12] bump pytest

---
 .devcontainer/devcontainer.json | 2 +-
 extensions/context.py           | 6 +++---
 pyproject.toml                  | 2 +-
 uv.lock                         | 8 ++++----
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index cd7f24ca..362b61eb 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -61,5 +61,5 @@
   "initializeCommand": "sh .devcontainer/initialize-command.sh",
   "onCreateCommand": "sh .devcontainer/on-create-command.sh",
   "postStartCommand": "sh .devcontainer/post-start-command.sh"
-  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): fba21c65 # spellchecker:disable-line
+  // Devcontainer context hash (do not manually edit this, it's managed by a pre-commit hook): 876c1d76 # spellchecker:disable-line
 }
diff --git a/extensions/context.py b/extensions/context.py
index 6902c0a3..d8a3a2ed 100644
--- a/extensions/context.py
+++ b/extensions/context.py
@@ -20,13 +20,13 @@ def hook(self, context: dict[Any, Any]) -> dict[Any, Any]:
         context["pnpm_version"] = "10.21.0"
         # These are duplicated in the pyproject.toml of this repository
         context["pyright_version"] = "1.1.407"
-        context["pytest_version"] = "9.0.0"
+        context["pytest_version"] = "9.0.1"
         context["pytest_randomly_version"] = "4.0.1"
         context["pytest_cov_version"] = "7.0.0"
         #######
         context["sphinx_version"] = "8.1.3"
-        context["pulumi_version"] = "3.206.0"
-        context["pulumi_aws_version"] = "7.11.0"
+        context["pulumi_version"] = "3.208.0"
+        context["pulumi_aws_version"] = "7.12.0"
         context["pulumi_aws_native_version"] = "1.38.0"
         context["pulumi_command_version"] = "1.1.3"
         context["pulumi_github_version"] = "6.8.0"
diff --git a/pyproject.toml b/pyproject.toml
index 3b6bdb9a..e4f2cb66 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -5,7 +5,7 @@ description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.12.7"
 dependencies = [
-    "pytest>=9.0.0",
+    "pytest>=9.0.1",
     "pytest-cov>=7.0.0",
     "pytest-randomly>=4.0.1",
     "pyright[nodejs]>=1.1.407",
diff --git a/uv.lock b/uv.lock
index 17652e78..ba3f48a1 100644
--- a/uv.lock
+++ b/uv.lock
@@ -62,7 +62,7 @@ requires-dist = [
     { name = "copier", specifier = ">=9.11.0" },
     { name = "copier-template-extensions", specifier = ">=0.3.3" },
     { name = "pyright", extras = ["nodejs"], specifier = ">=1.1.407" },
-    { name = "pytest", specifier = ">=9.0.0" },
+    { name = "pytest", specifier = ">=9.0.1" },
     { name = "pytest-cov", specifier = ">=7.0.0" },
     { name = "pytest-randomly", specifier = ">=4.0.1" },
 ]
@@ -402,7 +402,7 @@ nodejs = [
 
 [[package]]
 name = "pytest"
-version = "9.0.0"
+version = "9.0.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "colorama", marker = "sys_platform == 'win32'" },
@@ -411,9 +411,9 @@ dependencies = [
     { name = "pluggy" },
     { name = "pygments" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/da/1d/eb34f286b164c5e431a810a38697409cca1112cee04b287bb56ac486730b/pytest-9.0.0.tar.gz", hash = "sha256:8f44522eafe4137b0f35c9ce3072931a788a21ee40a2ed279e817d3cc16ed21e", size = 1562764, upload-time = "2025-11-08T17:25:33.34Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/07/56/f013048ac4bc4c1d9be45afd4ab209ea62822fb1598f40687e6bf45dcea4/pytest-9.0.1.tar.gz", hash = "sha256:3e9c069ea73583e255c3b21cf46b8d3c56f6e3a1a8f6da94ccb0fcf57b9d73c8", size = 1564125, upload-time = "2025-11-12T13:05:09.333Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/72/99/cafef234114a3b6d9f3aaed0723b437c40c57bdb7b3e4c3a575bc4890052/pytest-9.0.0-py3-none-any.whl", hash = "sha256:e5ccdf10b0bac554970ee88fc1a4ad0ee5d221f8ef22321f9b7e4584e19d7f96", size = 373364, upload-time = "2025-11-08T17:25:31.811Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/8b/6300fb80f858cda1c51ffa17075df5d846757081d11ab4aa35cef9e6258b/pytest-9.0.1-py3-none-any.whl", hash = "sha256:67be0030d194df2dfa7b556f2e56fb3c3315bd5c8822c6951162b92b32ce7dad", size = 373668, upload-time = "2025-11-12T13:05:07.379Z" },
 ]
 
 [[package]]

From 37f9da652e9e8eb5063b079dfe47e2389f610331 Mon Sep 17 00:00:00 2001
From: Eli Fine <eli88fine@gmail.com>
Date: Mon, 24 Nov 2025 10:28:03 +0000
Subject: [PATCH 03/12] pydantic

---
 extensions/context.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extensions/context.py b/extensions/context.py
index d8a3a2ed..ae63a3f1 100644
--- a/extensions/context.py
+++ b/extensions/context.py
@@ -33,7 +33,7 @@ def hook(self, context: dict[Any, Any]) -> dict[Any, Any]:
         context["pulumi_okta_version"] = "6.1.0"
         context["boto3_version"] = "1.40.57"
         context["ephemeral_pulumi_deploy_version"] = "0.0.5"
-        context["pydantic_version"] = "2.12.3"
+        context["pydantic_version"] = "2.12.4"
         context["pyinstaller_version"] = "6.16.0"
         context["setuptools_version"] = "80.7.1"
         context["strawberry_graphql_version"] = "0.284.1"

From e929ca6a1937fb5f3e1e234ce346351082a0cdef Mon Sep 17 00:00:00 2001
From: Eli Fine <eli88fine@gmail.com>
Date: Mon, 24 Nov 2025 11:01:46 +0000
Subject: [PATCH 04/12] root timeout

---
 .github/workflows/ci.yaml                 | 3 +++
 .github/workflows/tag-on-merge.yaml       | 1 +
 extensions/context.py                     | 3 +++
 template/extensions/context.py.jinja-base | 3 +++
 4 files changed, 10 insertions(+)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 10ffc0dd..c44da0e2 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -22,6 +22,7 @@ jobs:
         python-version:
             - 3.12.7
     name: Pre-commit for Py${{ matrix.python-version }} on ${{ matrix.os }}
+    timeout-minutes: 8
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v5.0.0
@@ -75,6 +76,7 @@ jobs:
           '--data-file tests/copier_data/data2.yaml',
           ]
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 8
     env:
       UV_PYTHON: ${{ matrix.python-version }}
     permissions:
@@ -155,6 +157,7 @@ jobs:
 
   required-check:
     runs-on: ubuntu-24.04
+    timeout-minutes: 2
     needs: [ lint-matrix ]
     if: always()
     permissions: {}
diff --git a/.github/workflows/tag-on-merge.yaml b/.github/workflows/tag-on-merge.yaml
index 2f91c730..3c208ca7 100644
--- a/.github/workflows/tag-on-merge.yaml
+++ b/.github/workflows/tag-on-merge.yaml
@@ -10,6 +10,7 @@ jobs:
   create-tag:
     if: github.event.pull_request.merged == true
     runs-on: ubuntu-24.04
+    timeout-minutes: 2
     permissions:
       contents: write
     steps:
diff --git a/extensions/context.py b/extensions/context.py
index ae63a3f1..79d06768 100644
--- a/extensions/context.py
+++ b/extensions/context.py
@@ -102,6 +102,9 @@ def hook(self, context: dict[Any, Any]) -> dict[Any, Any]:
         context["gha_pypi_publish"] = "v1.13.0"
         context["gha_sleep"] = "v2.0.3"
         context["gha_windows_runner"] = "windows-2025"
+        context["gha_short_timeout_minutes"] = "2"
+        context["gha_medium_timeout_minutes"] = "8"
+        context["gha_long_timeout_minutes"] = "15"
         #######
         context["debian_release_name"] = "bookworm"
         context["alpine_image_version"] = "3.22"
diff --git a/template/extensions/context.py.jinja-base b/template/extensions/context.py.jinja-base
index 5951ff97..2d3b1778 100644
--- a/template/extensions/context.py.jinja-base
+++ b/template/extensions/context.py.jinja-base
@@ -95,6 +95,9 @@ class ContextUpdater(ContextHook):
         context["gha_sleep"] = "{{ gha_sleep }}"
         context["gha_linux_runner"] = "{{ gha_linux_runner }}"
         context["gha_windows_runner"] = "{{ gha_windows_runner }}"
+        context["gha_short_timeout_minutes"] = "{{ gha_short_timeout_minutes }}"
+        context["gha_medium_timeout_minutes"] = "{{ gha_medium_timeout_minutes }}"
+        context["gha_long_timeout_minutes"] = "{{ gha_long_timeout_minutes }}"
 
         context["py312_version"] = "{{ py312_version }}"
         context["py313_version"] = "{{ py313_version }}"

From 6000ca66d8e8722e232c4a7ec3206ca3e58d0b71 Mon Sep 17 00:00:00 2001
From: Eli Fine <eli88fine@gmail.com>
Date: Mon, 24 Nov 2025 11:03:48 +0000
Subject: [PATCH 05/12] in template

---
 .../reusable_workflows/build-docker-image.yaml.jinja-base       | 1 +
 template/.github/workflows/ci.yaml.jinja-base                   | 2 ++
 template/.github/workflows/get-values.yaml.jinja-base           | 1 +
 template/.github/workflows/pre-commit.yaml.jinja-base           | 1 +
 4 files changed, 5 insertions(+)

diff --git a/template/.github/reusable_workflows/build-docker-image.yaml.jinja-base b/template/.github/reusable_workflows/build-docker-image.yaml.jinja-base
index 123b9a79..473ce2fc 100644
--- a/template/.github/reusable_workflows/build-docker-image.yaml.jinja-base
+++ b/template/.github/reusable_workflows/build-docker-image.yaml.jinja-base
@@ -43,6 +43,7 @@ permissions:
 jobs:
   build-image:
     name: Build Docker Image
+    timeout-minutes: {% endraw %}{{ gha_medium_timeout_minutes }}{% raw %}
     runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %}
     outputs:
       artifact-name: ${{ steps.calculate-build-context-hash.outputs.image_name_no_slashes }}
diff --git a/template/.github/workflows/ci.yaml.jinja-base b/template/.github/workflows/ci.yaml.jinja-base
index 0677ca02..b1d96516 100644
--- a/template/.github/workflows/ci.yaml.jinja-base
+++ b/template/.github/workflows/ci.yaml.jinja-base
@@ -43,6 +43,7 @@ jobs:
           '--data-file tests/copier_data/data2.yaml',
           ]
     runs-on: ${{ matrix.os }}
+    timeout-minutes: {% endraw %}{{ gha_medium_timeout_minutes }}{% raw %}
     env:
       UV_PYTHON: ${{ matrix.python-version }}
     permissions:
@@ -131,6 +132,7 @@ jobs:
 
   required-check:
     runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %}
+    timeout-minutes: {% endraw %}{{ gha_short_timeout_minutes }}{% raw %}
     needs: [ lint-matrix, get-values ]
     permissions:
       statuses: write # needed for updating status on Dependabot PRs
diff --git a/template/.github/workflows/get-values.yaml.jinja-base b/template/.github/workflows/get-values.yaml.jinja-base
index 71de5d66..1ae071ec 100644
--- a/template/.github/workflows/get-values.yaml.jinja-base
+++ b/template/.github/workflows/get-values.yaml.jinja-base
@@ -19,6 +19,7 @@ permissions:
 jobs:
   get-values:
     runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %}
+    timeout-minutes: {% endraw %}{{ gha_short_timeout_minutes }}{% raw %}
     outputs:
       new-dependabot-sha: ${{ steps.update-hash.outputs.new-sha }}
       dependabot-commit-created: ${{ steps.update-hash.outputs.commit-created }}
diff --git a/template/.github/workflows/pre-commit.yaml.jinja-base b/template/.github/workflows/pre-commit.yaml.jinja-base
index 478ba2ed..fd21b54d 100644
--- a/template/.github/workflows/pre-commit.yaml.jinja-base
+++ b/template/.github/workflows/pre-commit.yaml.jinja-base
@@ -28,6 +28,7 @@ permissions:
 jobs:
   pre-commit:
     runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %}
+    timeout-minutes: {% endraw %}{{ gha_medium_timeout_minutes }}{% raw %}
     name: Pre-commit
     steps:
       - name: Checkout code during push

From 039ae8f9a6968b577c1ff677a3f3f581694eb920 Mon Sep 17 00:00:00 2001
From: Eli Fine <eli88fine@gmail.com>
Date: Mon, 24 Nov 2025 11:08:14 +0000
Subject: [PATCH 06/12] extensions

---
 .devcontainer/devcontainer.json                     | 4 ++--
 template/.devcontainer/devcontainer.json.jinja-base | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 362b61eb..77f5479d 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -21,11 +21,11 @@
       "extensions": [
         // basic tooling
         // "eamodio.gitlens@15.5.1",
-        "coderabbit.coderabbit-vscode@0.15.2",
+        "coderabbit.coderabbit-vscode@0.16.0",
         "ms-vscode.live-server@0.5.2025051301",
         "MS-vsliveshare.vsliveshare@1.0.5905",
         "github.copilot@1.388.0",
-        "github.copilot-chat@0.33.2025102701",
+        "github.copilot-chat@0.34.2025112401",
         // Python
         "ms-python.python@2025.13.2025090201",
         "ms-python.vscode-pylance@2025.7.102",
diff --git a/template/.devcontainer/devcontainer.json.jinja-base b/template/.devcontainer/devcontainer.json.jinja-base
index 2e9fd5f6..2e88e236 100644
--- a/template/.devcontainer/devcontainer.json.jinja-base
+++ b/template/.devcontainer/devcontainer.json.jinja-base
@@ -27,11 +27,11 @@
       "extensions": [
         // basic tooling
         // "eamodio.gitlens@15.5.1",
-        "coderabbit.coderabbit-vscode@0.15.2",
+        "coderabbit.coderabbit-vscode@0.16.0",
         "ms-vscode.live-server@0.5.2025051301",
         "MS-vsliveshare.vsliveshare@1.0.5905",
         "github.copilot@1.388.0",
-        "github.copilot-chat@0.33.2025102701",{% endraw %}{% if install_claude_cli %}{% raw %}
+        "github.copilot-chat@0.34.2025112401",{% endraw %}{% if install_claude_cli %}{% raw %}
         "anthropic.claude-code@2.0.27",{% endraw %}{% endif %}{% raw %}
 
         // Python

From d23117e6c156bab1adc135c82ee69a394bfc794d Mon Sep 17 00:00:00 2001
From: Eli Fine <eli88fine@gmail.com>
Date: Mon, 24 Nov 2025 11:35:30 +0000
Subject: [PATCH 07/12] pulumi timeout

---
 ...f template_uses_pulumi %}pulumi-aws.yml{% endif %}.jinja-base | 1 +
 1 file changed, 1 insertion(+)

diff --git a/template/template/.github/workflows/{% if template_uses_pulumi %}pulumi-aws.yml{% endif %}.jinja-base b/template/template/.github/workflows/{% if template_uses_pulumi %}pulumi-aws.yml{% endif %}.jinja-base
index 8aca3ec5..b533c259 100644
--- a/template/template/.github/workflows/{% if template_uses_pulumi %}pulumi-aws.yml{% endif %}.jinja-base	
+++ b/template/template/.github/workflows/{% if template_uses_pulumi %}pulumi-aws.yml{% endif %}.jinja-base	
@@ -93,6 +93,7 @@ permissions:
 jobs:
   pulumi:
     runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %}
+    timeout-minutes: {% endraw %}{{ gha_long_timeout_minutes }}{% raw %}
     env:
       IAC_GITHUB_API_TOKENS: ${{ secrets.iac-github-api-tokens }} # only used in non-enterprise situations when not using full fledged Secrets Manager
     steps:

From 106bceb73e1e06826763c41e39a5277e93dd4b23 Mon Sep 17 00:00:00 2001
From: Eli Fine <eli88fine@gmail.com>
Date: Mon, 24 Nov 2025 11:36:41 +0000
Subject: [PATCH 08/12] boto

---
 extensions/context.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extensions/context.py b/extensions/context.py
index 79d06768..8ce9f33a 100644
--- a/extensions/context.py
+++ b/extensions/context.py
@@ -31,7 +31,7 @@ def hook(self, context: dict[Any, Any]) -> dict[Any, Any]:
         context["pulumi_command_version"] = "1.1.3"
         context["pulumi_github_version"] = "6.8.0"
         context["pulumi_okta_version"] = "6.1.0"
-        context["boto3_version"] = "1.40.57"
+        context["boto3_version"] = "1.41.2"
         context["ephemeral_pulumi_deploy_version"] = "0.0.5"
         context["pydantic_version"] = "2.12.4"
         context["pyinstaller_version"] = "6.16.0"

From c09f252c1849ae537e8d65822f996be7dbc2808c Mon Sep 17 00:00:00 2001
From: Eli Fine <eli88fine@gmail.com>
Date: Mon, 24 Nov 2025 11:37:20 +0000
Subject: [PATCH 09/12] pnpm

---
 extensions/context.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extensions/context.py b/extensions/context.py
index 8ce9f33a..e793dea5 100644
--- a/extensions/context.py
+++ b/extensions/context.py
@@ -17,7 +17,7 @@ def hook(self, context: dict[Any, Any]) -> dict[Any, Any]:
         context["copier_version"] = "9.11.0"
         context["copier_template_extensions_version"] = "0.3.3"
         #######
-        context["pnpm_version"] = "10.21.0"
+        context["pnpm_version"] = "10.23.0"
         # These are duplicated in the pyproject.toml of this repository
         context["pyright_version"] = "1.1.407"
         context["pytest_version"] = "9.0.1"

From cdebdbac7ad9c6f7214028e9ed8b2baf25723547 Mon Sep 17 00:00:00 2001
From: Eli Fine <eli88fine@gmail.com>
Date: Mon, 24 Nov 2025 11:51:54 +0000
Subject: [PATCH 10/12] mutx

---
 .../reusable_workflows/build-docker-image.yaml.jinja-base     | 4 ++--
 template/.github/workflows/ci.yaml.jinja-base                 | 2 +-
 template/.github/workflows/pre-commit.yaml.jinja-base         | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/template/.github/reusable_workflows/build-docker-image.yaml.jinja-base b/template/.github/reusable_workflows/build-docker-image.yaml.jinja-base
index 473ce2fc..9745af5a 100644
--- a/template/.github/reusable_workflows/build-docker-image.yaml.jinja-base
+++ b/template/.github/reusable_workflows/build-docker-image.yaml.jinja-base
@@ -43,7 +43,7 @@ permissions:
 jobs:
   build-image:
     name: Build Docker Image
-    timeout-minutes: {% endraw %}{{ gha_medium_timeout_minutes }}{% raw %}
+    timeout-minutes: {% endraw %}{{ gha_long_timeout_minutes }}{% raw %}
     runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %}
     outputs:
       artifact-name: ${{ steps.calculate-build-context-hash.outputs.image_name_no_slashes }}
@@ -95,7 +95,7 @@ jobs:
         uses: ben-z/gh-action-mutex@{% endraw %}{{ gha_mutex }}{% raw %}
         with:
           branch: mutex-${{ inputs.repository }}-${{ inputs.image_name }}
-        timeout-minutes: 30 # this is the amount of time this action will wait to attempt to acquire the mutex lock before failing, e.g. if other jobs are queued up in front of it
+        timeout-minutes: {% endraw %}{{ gha_medium_timeout_minutes }}{% raw %} # this is the amount of time this action will wait to attempt to acquire the mutex lock before failing, e.g. if other jobs are queued up in front of it
 
       - name: Test if docker image exists
         if: ${{ inputs.push-role-name != 'no-push' }}
diff --git a/template/.github/workflows/ci.yaml.jinja-base b/template/.github/workflows/ci.yaml.jinja-base
index b1d96516..f092d914 100644
--- a/template/.github/workflows/ci.yaml.jinja-base
+++ b/template/.github/workflows/ci.yaml.jinja-base
@@ -106,7 +106,7 @@ jobs:
         uses: ben-z/gh-action-mutex@{% endraw %}{{ gha_mutex }}{% raw %}
         with:
           branch: mutex-venv-${{ matrix.os }}-${{ matrix.python-version }}
-        timeout-minutes: 30 # this is the amount of time this action will wait to attempt to acquire the mutex lock before failing, e.g. if other jobs are queued up in front of it
+        timeout-minutes: {% endraw %}{{ gha_medium_timeout_minutes }}{% raw %} # this is the amount of time this action will wait to attempt to acquire the mutex lock before failing, e.g. if other jobs are queued up in front of it
 
       - name: Cache Pre-commit hooks
         uses: actions/cache@{% endraw %}{{ gha_cache }}{% raw %}
diff --git a/template/.github/workflows/pre-commit.yaml.jinja-base b/template/.github/workflows/pre-commit.yaml.jinja-base
index fd21b54d..74a47fa2 100644
--- a/template/.github/workflows/pre-commit.yaml.jinja-base
+++ b/template/.github/workflows/pre-commit.yaml.jinja-base
@@ -56,7 +56,7 @@ jobs:
         uses: ben-z/gh-action-mutex@{% endraw %}{{ gha_mutex }}{% raw %}
         with:
           branch: mutex-venv-{% endraw %}{{ gha_linux_runner }}{% raw %}-py${{ inputs.python-version }}-nodejs-${{ inputs.node-version }}
-        timeout-minutes: 30 # this is the amount of time this action will wait to attempt to acquire the mutex lock before failing, e.g. if other jobs are queued up in front of it
+        timeout-minutes: {% endraw %}{{ gha_medium_timeout_minutes }}{% raw %} # this is the amount of time this action will wait to attempt to acquire the mutex lock before failing, e.g. if other jobs are queued up in front of it
 
       - name: Cache Pre-commit hooks
         uses: actions/cache@{% endraw %}{{ gha_cache }}{% raw %}

From c8855118e8313496ad1bb0c21a25fe9b917f127a Mon Sep 17 00:00:00 2001
From: Eli Fine <eli88fine@gmail.com>
Date: Mon, 24 Nov 2025 11:52:48 +0000
Subject: [PATCH 11/12] more timeout

---
 ... template_uses_pulumi %}pulumi-aws.yml{% endif %}.jinja-base | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/template/template/.github/workflows/{% if template_uses_pulumi %}pulumi-aws.yml{% endif %}.jinja-base b/template/template/.github/workflows/{% if template_uses_pulumi %}pulumi-aws.yml{% endif %}.jinja-base
index b533c259..afc7015b 100644
--- a/template/template/.github/workflows/{% if template_uses_pulumi %}pulumi-aws.yml{% endif %}.jinja-base	
+++ b/template/template/.github/workflows/{% if template_uses_pulumi %}pulumi-aws.yml{% endif %}.jinja-base	
@@ -111,7 +111,7 @@ jobs:
         uses: ben-z/gh-action-mutex@{% endraw %}{{ gha_mutex }}{% raw %}
         with:
           branch: mutex-pulumi-${{ inputs.PULUMI_STACK_NAME }}-${{ inputs.ADDITIONAL_MUTEX_SUFFIX }}
-        timeout-minutes: 30 # this is the amount of time this action will wait to attempt to acquire the mutex lock before failing, e.g. if other jobs are queued up in front of it
+        timeout-minutes: {% endraw %}{{ gha_medium_timeout_minutes }}{% raw %} # this is the amount of time this action will wait to attempt to acquire the mutex lock before failing, e.g. if other jobs are queued up in front of it
 
       - name: Pulumi Initial Destroy to cleanup any leftovers
         uses: ./.github/actions/pulumi_ephemeral_deploy

From 229220d99596461236e97c9997302d400ba3e065 Mon Sep 17 00:00:00 2001
From: Eli Fine <eli88fine@gmail.com>
Date: Mon, 24 Nov 2025 11:56:03 +0000
Subject: [PATCH 12/12] longer pulumi

---
 extensions/context.py                                         | 1 +
 template/extensions/context.py.jinja-base                     | 1 +
 ...emplate_uses_pulumi %}pulumi-aws.yml{% endif %}.jinja-base | 4 ++--
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/extensions/context.py b/extensions/context.py
index e793dea5..242d20dd 100644
--- a/extensions/context.py
+++ b/extensions/context.py
@@ -105,6 +105,7 @@ def hook(self, context: dict[Any, Any]) -> dict[Any, Any]:
         context["gha_short_timeout_minutes"] = "2"
         context["gha_medium_timeout_minutes"] = "8"
         context["gha_long_timeout_minutes"] = "15"
+        context["gha_xlong_timeout_minutes"] = "45"
         #######
         context["debian_release_name"] = "bookworm"
         context["alpine_image_version"] = "3.22"
diff --git a/template/extensions/context.py.jinja-base b/template/extensions/context.py.jinja-base
index 2d3b1778..76c335c7 100644
--- a/template/extensions/context.py.jinja-base
+++ b/template/extensions/context.py.jinja-base
@@ -98,6 +98,7 @@ class ContextUpdater(ContextHook):
         context["gha_short_timeout_minutes"] = "{{ gha_short_timeout_minutes }}"
         context["gha_medium_timeout_minutes"] = "{{ gha_medium_timeout_minutes }}"
         context["gha_long_timeout_minutes"] = "{{ gha_long_timeout_minutes }}"
+        context["gha_xlong_timeout_minutes"] = "{{ gha_xlong_timeout_minutes }}"
 
         context["py312_version"] = "{{ py312_version }}"
         context["py313_version"] = "{{ py313_version }}"
diff --git a/template/template/.github/workflows/{% if template_uses_pulumi %}pulumi-aws.yml{% endif %}.jinja-base b/template/template/.github/workflows/{% if template_uses_pulumi %}pulumi-aws.yml{% endif %}.jinja-base
index afc7015b..0f3c3c25 100644
--- a/template/template/.github/workflows/{% if template_uses_pulumi %}pulumi-aws.yml{% endif %}.jinja-base	
+++ b/template/template/.github/workflows/{% if template_uses_pulumi %}pulumi-aws.yml{% endif %}.jinja-base	
@@ -93,7 +93,7 @@ permissions:
 jobs:
   pulumi:
     runs-on: {% endraw %}{{ gha_linux_runner }}{% raw %}
-    timeout-minutes: {% endraw %}{{ gha_long_timeout_minutes }}{% raw %}
+    timeout-minutes: {% endraw %}{{ gha_xlong_timeout_minutes }}{% raw %}
     env:
       IAC_GITHUB_API_TOKENS: ${{ secrets.iac-github-api-tokens }} # only used in non-enterprise situations when not using full fledged Secrets Manager
     steps:
@@ -111,7 +111,7 @@ jobs:
         uses: ben-z/gh-action-mutex@{% endraw %}{{ gha_mutex }}{% raw %}
         with:
           branch: mutex-pulumi-${{ inputs.PULUMI_STACK_NAME }}-${{ inputs.ADDITIONAL_MUTEX_SUFFIX }}
-        timeout-minutes: {% endraw %}{{ gha_medium_timeout_minutes }}{% raw %} # this is the amount of time this action will wait to attempt to acquire the mutex lock before failing, e.g. if other jobs are queued up in front of it
+        timeout-minutes: {% endraw %}{{ gha_long_timeout_minutes }}{% raw %} # this is the amount of time this action will wait to attempt to acquire the mutex lock before failing, e.g. if other jobs are queued up in front of it
 
       - name: Pulumi Initial Destroy to cleanup any leftovers
         uses: ./.github/actions/pulumi_ephemeral_deploy