chore(deps): bump the aws-cdk group across 1 directory with 3 updates

[dependabot]

Bumps the aws-cdk group with 3 updates in the / directory: @aws-cdk/cdk-assets-lib, @aws-cdk/toolkit-lib and aws-cdk-lib.

Updates @aws-cdk/cdk-assets-lib from 1.4.10 to 1.4.17

Release notes

Sourced from @​aws-cdk/cdk-assets-lib's releases.

@​aws-cdk/cdk-assets-lib@​v1.4.17

1.4.17 (2026-08-26)

Bug Fixes

• cdk-assets-lib: bucket ownership cache ignores expectedAccount, can silently bypass the cross-account safety check (#1859) (7a88564), closes #1858
• cdk-assets-lib: pLimit.dispose() doesn't stop new jobs from starting (#1877) (0696f5c), closes #1876

@​aws-cdk/cdk-assets-lib@​v1.4.16

1.4.16 (2026-08-19)

Bug Fixes

• bucket URL is incorrect for local S3 emulators (#1625) (927a6cc)

@​aws-cdk/cdk-assets-lib@​v1.4.15

1.4.15 (2026-07-22)

@​aws-cdk/cdk-assets-lib@​v1.4.14

1.4.14 (2026-07-16)

@​aws-cdk/cdk-assets-lib@​v1.4.13

1.4.13 (2026-07-10)

Commits

• 0696f5c fix(cdk-assets-lib): pLimit.dispose() doesn't stop new jobs from starting (#1...
• 8f5a9c0 chore(deps): upgrade dependencies (#1886)
• 3a80afa refactor: migrate all subprocess call sites to the shared subprocess module (...
• 7a88564 fix(cdk-assets-lib): bucket ownership cache ignores expectedAccount, can sile...
• 927a6cc fix: bucket URL is incorrect for local S3 emulators (#1625)
• bcc0f2b chore(deps): upgrade dependencies (#1841)
• 3d19877 chore(deps): upgrade dependencies (#1806)
• b6a2d8d chore(deps): upgrade dependencies (#1794)
• 957c309 chore: revert "refactor: migrate all subprocess call sites to the shared subp...
• e8aaa6b refactor: migrate all subprocess call sites to the shared subprocess module (...
• Additional commits viewable in compare view

Updates @aws-cdk/toolkit-lib from 1.28.0 to 1.40.0

Release notes

Sourced from @​aws-cdk/toolkit-lib's releases.

@​aws-cdk/toolkit-lib@​v1.40.0

1.40.0 (2026-08-26)

Features

• cli: warn of non-existent stacks in cdk destroy (#984) (ca8a14a)
• integ-runner: detect bootstrap errors and retry tests in valid regions (#1898) (f98fed5), closes #1115
• show the target environment in cdk diff stack headers (#1885) (f875d81), closes #286

Bug Fixes

• cli: gc 'print'/'tag' progress no longer shows NaN% or misleading '0 assets' (#1873) (10f688a), closes #625
• cli: guide Stage users to a working pattern in stack-selection error (#1847) (d51353e), closes #1451 #1451
• toolkit-lib: allowCrossAccountAssetPublishing cache ignores which stack's environment it was computed for (#1884) (f661b31), closes #1883 #1839
• toolkit-lib: cdk validate drops the plugin's customSeverity label (#1894) (7a7a4ba)
• toolkit-lib: clean up the loser of noOlderThan()'s timer/resolver race (#1870) (8d772fc), closes #1869
• toolkit-lib: finalizing deployment after refactor intermittently fails while stacks are still in UPDATE_IN_PROGRESS (#1805) (beb1e2f), closes #1804
• toolkit-lib: stack progress monitor double-counts the stack itself when a cleanup phase occurs (#1857) (2845174), closes #1856

@​aws-cdk/toolkit-lib@​v1.39.0

1.39.0 (2026-08-19)

Features

• cli: add "errors-only" progress mode that only prints errors (#1800) (a4c0282)
• cli: support notification-arns in cdk import (#1740) (f8e7da1), closes aws/aws-cdk#23548

Bug Fixes

• bucket URL is incorrect for local S3 emulators (#1625) (927a6cc)
• toolkit-lib: asset publisher cache ignores environment on cache hit (#1839) (88f6ad1), closes #1838
• toolkit-lib: downstream stack selection uses wrong key for nested stacks (#1835) (a80074a), closes #1834
• toolkit-lib: drift numResourcesUnchecked ignores UNKNOWN-status resources (#1837) (4374bc6), closes #1836
• toolkit-lib: drop the deep clone used to remove one metadata key (#1826) (a826ad8), closes #1823 #1824
• toolkit-lib: fail gc on ECR tagging permission errors (#1828) (8e19558), closes #347
• toolkit-lib: hotswap deployments fail with TypeError when a nested stack output joins a List<> parameter (#1842) (bee9159), closes #1829
• toolkit-lib: hotswap silently drops empty-string Lambda Description (#1831) (da4c982), closes #1830
• toolkit-lib: NoStack masks the real error when a new stack fails to deploy (#1845) (a9a23b4), closes #1802 #1803 #1802
• toolkit-lib: stale REVIEW_IN_PROGRESS read fails a running deployment (#1848) (9321643), closes #1802 #1803

@​aws-cdk/toolkit-lib@​v1.38.3

1.38.3 (2026-08-17)

... (truncated)

Commits

• d51353e fix(cli): guide Stage users to a working pattern in stack-selection error (#1...
• f98fed5 feat(integ-runner): detect bootstrap errors and retry tests in valid regions ...
• 25ca63c test(cli-integ): remove integ test asserting CloudFormation drift-detection c...
• 793316b refactor(cli): consolidate stack selection on toolkit-lib selectors (#1896)
• 7a7a4ba fix(toolkit-lib): cdk validate drops the plugin's customSeverity label (#1894)
• ca8a14a feat(cli): warn of non-existent stacks in cdk destroy (#984)
• f875d81 feat: show the target environment in cdk diff stack headers (#1885)
• 8d772fc fix(toolkit-lib): clean up the loser of noOlderThan()'s timer/resolver race (...
• 10f688a fix(cli): gc 'print'/'tag' progress no longer shows NaN% or misleading '0 ass...
• f661b31 fix(toolkit-lib): allowCrossAccountAssetPublishing cache ignores which stack'...
• Additional commits viewable in compare view

Updates aws-cdk-lib from 2.262.1 to 2.267.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.267.0

⚠ BREAKING CHANGES

• kinesisfirehose: After this change, specifying an unsupported timeZone on the Firehose S3Bucket destination now throws a ValidationError during synthesis instead of failing at CloudFormation deployment. Affected values: 3-letter IANA abbreviations (e.g. EST), Etc/UTC, Etc/GMT, Factory, and strings containing characters outside [a-zA-Z/_]+. Use a supported standard IANA identifier (e.g. America/New_York) or UTC for synth to pass.

Features

• backup: add indexActions prop to BackupPlanRule (#34051) (b8be853), closes #34050
• bedrockagentcore: add manageDeliveryResourcePolicy opt-out for runtime observability (#38372) (5fb086b), closes #38342
• ci: integration test deployment on maintainer approval (#38519) (c5f6b4f), closes #37333
• core: Size objects now properly stringify (#38662) (90fe151)
• sqs: metricApproximateNumberOfMessagesOutstanding (#38661) (f29b27b)

Bug Fixes

• assets: SymlinkFollowMode.BLOCK_EXTERNAL will throw errors while bundling (#38506) (a11e451)
• bedrockagentcore: least-privilege browser recording S3 grant (#38604) (7e11d11)
• ci: add environment for Atmosphere variables access (#38625) (785773e), closes #38519
• cloudfront-origins: readTimeout and keepaliveTimeout reject valid values (#38432) (6251e1a), closes #38433 #18628
• core: performance counters use too much memory (#38620) (d0ce23c)
• core: single file bundled output should be file (#38548) (9e22774)
• core: stack.node.addDependency gets slower as stacks grow (#38597) (2ab9be4), closes #38522
• core: symlinks in directory bundling output (#38665) (8d8ae2c)
• core: validation plugin check adds too much overhead (#38619) (df15b9f)
• dynamodb: TableV2.grants.*Data does not include index resources (#37892) (e48a97f), closes #37569
• dynamodb: TableV2MultiAccountReplica rejects imported tables with tokenized ARNs (#38365) (08f05e5), closes #38354
• dynamodb: avoid TableGrantsProps deprecation warnings for TableV2 (#38399) (fb5c25b), closes #37221
• ec2: NatInstanceProvider and NatInstanceProviderV2 always trigger the keyName deprecation warning (#38347) (47f2151), closes #30806
• kinesisfirehose: add validation for customTimeZone in S3BucketProps (#38514) (8cf9f90), closes #36089
• lambda: allow SnapStart for container image functions (#38680) (a5adc00), closes #38281 #38281 #38265
• rds: serverlessV2 capacity props reject tokens at synth time (#38044) (b7880de), closes #38043 #9044 #31810 #32905
• s3-deployment: increase default memory limit from 128MB to 1024MB (#35501) (7a04f32), closes #35487
• stepfunctions-tasks: resolve EvaluateExpression paths via a values lookup (#38682) (02301ea)
• stack.availabilityZones are not stable strings (#38580) (f89474a)

---

Alpha modules (2.267.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: schema Type is now an opaque class; construct column types via the Schema factories or Schema.custom(...) rather than { isPrimitive, inputString } literals. StorageParameter.custom(key, value) requires a string value, and StorageParameter.writeKmsKeyId takes a kms.IKey instead of a string.
• glue-alpha: S3TableProps.bucket/encryption/encryptionKey are removed. Use storage: S3TableStorage.managedBucket(S3TableEncryption.kms(key?)) / S3TableStorage.fromBucket(bucket) and clientSideEncryption: TableClientSideEncryption.kms(key?). S3Table.encryption/encryptionKey are removed (clientSideEncryptionKey exposes the client-side key; read bucket.encryptionKey for server-side). The TableEncryption enum and the deprecated Table/TableProps are removed — use S3Table.

Features

• glue-alpha: add a typed secret input to Connection (#38585) (ede4a1c)
• glue-alpha: add subnet selection to Connection (#38561) (f9d7eac)
• glue-alpha: model S3Table storage/encryption as value objects (#38591) (9990e16)
• glue-alpha: opaque Schema Type with Schema.custom, and stronger StorageParameter types (#38592) (5c45eb0)
• msk-alpha: support Kafka 4.2 (#38323) (97b181c)
• s3tables-alpha: add storage class configuration support (#37339) (63ccf6d)

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.267.0-alpha.0 (2026-08-27)

⚠ BREAKING CHANGES

• glue-alpha: schema Type is now an opaque class; construct column types via the Schema factories or Schema.custom(...) rather than { isPrimitive, inputString } literals. StorageParameter.custom(key, value) requires a string value, and StorageParameter.writeKmsKeyId takes a kms.IKey instead of a string.
• glue-alpha: S3TableProps.bucket/encryption/encryptionKey are removed. Use storage: S3TableStorage.managedBucket(S3TableEncryption.kms(key?)) / S3TableStorage.fromBucket(bucket) and clientSideEncryption: TableClientSideEncryption.kms(key?). S3Table.encryption/encryptionKey are removed (clientSideEncryptionKey exposes the client-side key; read bucket.encryptionKey for server-side). The TableEncryption enum and the deprecated Table/TableProps are removed — use S3Table.

Features

• glue-alpha: add a typed secret input to Connection (#38585) (ede4a1c)
• glue-alpha: add subnet selection to Connection (#38561) (f9d7eac)
• glue-alpha: model S3Table storage/encryption as value objects (#38591) (9990e16)
• glue-alpha: opaque Schema Type with Schema.custom, and stronger StorageParameter types (#38592) (5c45eb0)
• msk-alpha: support Kafka 4.2 (#38323) (97b181c)
• s3tables-alpha: add storage class configuration support (#37339) (63ccf6d)

Bug Fixes

• glue-alpha: validate that DATE partition projection interval is set when required (#38594) (0e2b582)
• lambda-python-alpha: escape Docker bundling command arguments (#38583) (f7ce07b)

2.266.0-alpha.0 (2026-08-19)

⚠ BREAKING CHANGES

• glue-alpha: DataQualityRulesetProps.rulesetDqdl: string is replaced by dqdl: Dqdl. Build it with Dqdl.fromString('Rules = [ ... ]').
• glue-alpha: s3Encryption, cloudWatchEncryption, and jobBookmarksEncryption are no longer object literals. Use S3Encryption.s3Managed() / S3Encryption.kms(key?), CloudWatchEncryption.kms(key?), and JobBookmarksEncryption.clientSideKms(key?). The CloudWatchEncryptionMode and JobBookmarksEncryptionMode enums are removed (their mode is now implicit); S3EncryptionMode is retained.
• glue-alpha: this is a corrective breaking change. Apps that leaned on the bug, and did things like InputFormat x = OutputFormat.AVRO; will get a compilation error in other jsii languages. The intended usage, on the other hand, was broken before and works now.
• glue-alpha: workerType and numberOfWorkers are no longer top-level job props. For Spark jobs, pass them together via workerConfiguration: { workerType, numberOfWorkers }. PythonShellJob no longer accepts them (it is sized by maxCapacity). RayJob no longer accepts workerType (it is fixed to Z.2X).
• glue-alpha: SparkJobProps.enableMetrics removed, which will cause a compilation error for any app using it. But there is no behavior change, since this is a dead prop.
• glue-alpha: a differing/tokenized has_encrypted_data supplied via parameters now throws.

Features

• glue-alpha: add warning for maxRetries when job run queuing is enabled (#38575) (09ae11e)
• glue-alpha: model SecurityConfiguration encryption as factory subtypes (#38586) (e37e7a6)
• glue-alpha: new hasEncryptedData property (#38511) (c977e36)
• glue-alpha: pair workerType and numberOfWorkers into a required workerConfiguration (#38576) (5f3b1b6)
• glue-alpha: wrap DataQualityRuleset DQDL in a typed value object (#38587) (fd01268)

Bug Fixes

... (truncated)

Commits

• 71747d9 chore: update analytics metadata blueprints
• 02301ea fix(stepfunctions-tasks): resolve EvaluateExpression paths via a values looku...
• a5adc00 fix(lambda): allow SnapStart for container image functions (#38680)
• b8be853 feat(backup): add indexActions prop to BackupPlanRule (#34051)
• 8d8ae2c fix(core): symlinks in directory bundling output (#38665)
• be1a352 chore(core): auto-load temporary schemas for CloudFormation validation (#38595)
• b7880de fix(rds): serverlessV2 capacity props reject tokens at synth time (#38044)
• 08f05e5 fix(dynamodb): TableV2MultiAccountReplica rejects imported tables with toke...
• fb5c25b fix(dynamodb): avoid TableGrantsProps deprecation warnings for TableV2 (#38399)
• 5fb086b feat(bedrockagentcore): add manageDeliveryResourcePolicy opt-out for runtime ...
• Additional commits viewable in compare view