are the CDK deps still pinned at 1.111.0? those will all auto-update whenever we run deploy or start, correct? (when an SST release pins CDK at a higher version)

Yes currently pinned to 1.111.0 but I don't believe they auto update. The sst cli will print out instructions on how to update if it detects drift between the version it's expecting

Yeah we try to update it periodically. Or if somebody puts in a request we go update it right away.

got it. so someday I’ll just see a message like “update your CDK packages by typing…”

Yup exactly