chore(deps): bump the aws-cdk group across 1 directory with 3 updates

[dependabot]

Bumps the aws-cdk group with 3 updates in the / directory: @aws-cdk/cdk-assets-lib, @aws-cdk/toolkit-lib and aws-cdk-lib.

Updates @aws-cdk/cdk-assets-lib from 1.4.10 to 1.4.16

Release notes

Sourced from @​aws-cdk/cdk-assets-lib's releases.

@​aws-cdk/cdk-assets-lib@​v1.4.16

1.4.16 (2026-08-19)

Bug Fixes

• bucket URL is incorrect for local S3 emulators (#1625) (927a6cc)

@​aws-cdk/cdk-assets-lib@​v1.4.15

1.4.15 (2026-07-22)

@​aws-cdk/cdk-assets-lib@​v1.4.14

1.4.14 (2026-07-16)

@​aws-cdk/cdk-assets-lib@​v1.4.13

1.4.13 (2026-07-10)

Commits

• 927a6cc fix: bucket URL is incorrect for local S3 emulators (#1625)
• bcc0f2b chore(deps): upgrade dependencies (#1841)
• 3d19877 chore(deps): upgrade dependencies (#1806)
• b6a2d8d chore(deps): upgrade dependencies (#1794)
• 957c309 chore: revert "refactor: migrate all subprocess call sites to the shared subp...
• e8aaa6b refactor: migrate all subprocess call sites to the shared subprocess module (...
• 553e45e chore(deps): upgrade dependencies (#1705)
• 24211a5 chore(deps): upgrade dependencies (#1692)
• 1e25583 chore(deps): upgrade projen and regenerate project files (#1690)
• fc95a5a chore: modernize tsconfig settings across all packages (#1685)
• Additional commits viewable in compare view

Updates @aws-cdk/toolkit-lib from 1.28.0 to 1.39.0

Release notes

Sourced from @​aws-cdk/toolkit-lib's releases.

@​aws-cdk/toolkit-lib@​v1.39.0

1.39.0 (2026-08-19)

Features

• cli: add "errors-only" progress mode that only prints errors (#1800) (a4c0282)
• cli: support notification-arns in cdk import (#1740) (f8e7da1), closes aws/aws-cdk#23548

Bug Fixes

• bucket URL is incorrect for local S3 emulators (#1625) (927a6cc)
• toolkit-lib: asset publisher cache ignores environment on cache hit (#1839) (88f6ad1), closes #1838
• toolkit-lib: downstream stack selection uses wrong key for nested stacks (#1835) (a80074a), closes #1834
• toolkit-lib: drift numResourcesUnchecked ignores UNKNOWN-status resources (#1837) (4374bc6), closes #1836
• toolkit-lib: drop the deep clone used to remove one metadata key (#1826) (a826ad8), closes #1823 #1824
• toolkit-lib: fail gc on ECR tagging permission errors (#1828) (8e19558), closes #347
• toolkit-lib: hotswap deployments fail with TypeError when a nested stack output joins a List<> parameter (#1842) (bee9159), closes #1829
• toolkit-lib: hotswap silently drops empty-string Lambda Description (#1831) (da4c982), closes #1830
• toolkit-lib: NoStack masks the real error when a new stack fails to deploy (#1845) (a9a23b4), closes #1802 #1803 #1802
• toolkit-lib: stale REVIEW_IN_PROGRESS read fails a running deployment (#1848) (9321643), closes #1802 #1803

@​aws-cdk/toolkit-lib@​v1.38.3

1.38.3 (2026-08-17)

Bug Fixes

• cli: deployments skipped even though changes exist when previous deployment was with hotswap (#1819) (52c292d)
• toolkit-lib: clean up the diff change set when early validation fails (#1821) (750d650), closes #1767
• toolkit-lib: every change-set deployment announces "waiting in review for manual execution (--no-execute)" although the change set is executed (#1818) (86ee97e), closes #1815 #1273

@​aws-cdk/toolkit-lib@​v1.38.2

1.38.2 (2026-08-12)

Bug Fixes

• toolkit-lib: refactor digest ignores the properties of resources that have a DependsOn attribute (#1813) (c1c46b0), closes #1811

@​aws-cdk/toolkit-lib@​v1.38.1

1.38.1 (2026-08-07)

Bug Fixes

... (truncated)

Commits

• a4c0282 feat(cli): add "errors-only" progress mode that only prints errors (#1800)
• 9321643 fix(toolkit-lib): stale REVIEW_IN_PROGRESS read fails a running deployment (#...
• 4374bc6 fix(toolkit-lib): drift numResourcesUnchecked ignores UNKNOWN-status resource...
• 8e19558 fix(toolkit-lib): fail gc on ECR tagging permission errors (#1828)
• a80074a fix(toolkit-lib): downstream stack selection uses wrong key for nested stacks...
• a826ad8 fix(toolkit-lib): drop the deep clone used to remove one metadata key (#1826)
• 927a6cc fix: bucket URL is incorrect for local S3 emulators (#1625)
• b409e72 docs(toolkit-lib): fix resource import mapping docs to say keys are logical I...
• f8e7da1 feat(cli): support notification-arns in cdk import (#1740)
• 88f6ad1 fix(toolkit-lib): asset publisher cache ignores environment on cache hit (#1839)
• Additional commits viewable in compare view

Updates aws-cdk-lib from 2.262.1 to 2.266.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.266.0

Features

• adding controlPlaneScalingConfig to Cluster (#36863) (94e5c1a)
• update L1 CloudFormation resource definitions (#38578) (ccd2633)

Bug Fixes

• ec2: add DependsOn VPCGatewayAttachment to IPv6 default route (#37893) (ab272bc), closes #37853
• sns-subscriptions: use regionalized service principal for opt-in region SQS subscriptions (#38339) (67a7eb1), closes #32526

---

Alpha modules (2.266.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: DataQualityRulesetProps.rulesetDqdl: string is replaced by dqdl: Dqdl. Build it with Dqdl.fromString('Rules = [ ... ]').
• glue-alpha: s3Encryption, cloudWatchEncryption, and jobBookmarksEncryption are no longer object literals. Use S3Encryption.s3Managed() / S3Encryption.kms(key?), CloudWatchEncryption.kms(key?), and JobBookmarksEncryption.clientSideKms(key?). The CloudWatchEncryptionMode and JobBookmarksEncryptionMode enums are removed (their mode is now implicit); S3EncryptionMode is retained.
• glue-alpha: this is a corrective breaking change. Apps that leaned on the bug, and did things like InputFormat x = OutputFormat.AVRO; will get a compilation error in other jsii languages. The intended usage, on the other hand, was broken before and works now.
• glue-alpha: workerType and numberOfWorkers are no longer top-level job props. For Spark jobs, pass them together via workerConfiguration: { workerType, numberOfWorkers }. PythonShellJob no longer accepts them (it is sized by maxCapacity). RayJob no longer accepts workerType (it is fixed to Z.2X).
• glue-alpha: SparkJobProps.enableMetrics removed, which will cause a compilation error for any app using it. But there is no behavior change, since this is a dead prop.
• glue-alpha: a differing/tokenized has_encrypted_data supplied via parameters now throws.

Features

• glue-alpha: add warning for maxRetries when job run queuing is enabled (#38575) (09ae11e)
• glue-alpha: model SecurityConfiguration encryption as factory subtypes (#38586) (e37e7a6)
• glue-alpha: new hasEncryptedData property (#38511) (c977e36)
• glue-alpha: pair workerType and numberOfWorkers into a required workerConfiguration (#38576) (5f3b1b6)
• glue-alpha: wrap DataQualityRuleset DQDL in a typed value object (#38587) (fd01268)

Bug Fixes

• glue-alpha: correct OutputFormat.AVRO/ORC type and tidy GA-hygiene items (#38593) (35aefaf)
• glue-alpha: omit comments from struct type strings (#38008) (5f16a86), closes #26935
• mediapackagev2-alpha: add GetChannel grant on MediaPackageV2 (#38582) (74d922c), closes #38581

v2.265.0

Features

• bedrock-agentcore: add StreamDeliveryResources support to Memory L2 Construct (#37527) (817c50b)
• cloudwatch: support AT_LEAST expression for composite alarm rules (#37693) (974e43b), closes #37692 #36100
• docdb: add managed password support (#35711) (fcf54bf)
• ec2: add ipAddressType and dnsRecordIpType to GatewayVpcEndpoint (#37900) (000f532), closes #37883
• ec2: add volume initialization rate to ebs props for launchtemplate (#36451) (da4281e), closes #36374
• kinesisfirehose: add HTTP Endpoint and Datadog destination (#33657) (4c47171), closes #20354 #15502

Bug Fixes

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.267.0-alpha.0 (2026-08-27)

⚠ BREAKING CHANGES

• glue-alpha: schema Type is now an opaque class; construct column types via the Schema factories or Schema.custom(...) rather than { isPrimitive, inputString } literals. StorageParameter.custom(key, value) requires a string value, and StorageParameter.writeKmsKeyId takes a kms.IKey instead of a string.
• glue-alpha: S3TableProps.bucket/encryption/encryptionKey are removed. Use storage: S3TableStorage.managedBucket(S3TableEncryption.kms(key?)) / S3TableStorage.fromBucket(bucket) and clientSideEncryption: TableClientSideEncryption.kms(key?). S3Table.encryption/encryptionKey are removed (clientSideEncryptionKey exposes the client-side key; read bucket.encryptionKey for server-side). The TableEncryption enum and the deprecated Table/TableProps are removed — use S3Table.

Features

• glue-alpha: add a typed secret input to Connection (#38585) (ede4a1c)
• glue-alpha: add subnet selection to Connection (#38561) (f9d7eac)
• glue-alpha: model S3Table storage/encryption as value objects (#38591) (9990e16)
• glue-alpha: opaque Schema Type with Schema.custom, and stronger StorageParameter types (#38592) (5c45eb0)
• msk-alpha: support Kafka 4.2 (#38323) (97b181c)
• s3tables-alpha: add storage class configuration support (#37339) (63ccf6d)

Bug Fixes

• glue-alpha: validate that DATE partition projection interval is set when required (#38594) (0e2b582)
• lambda-python-alpha: escape Docker bundling command arguments (#38583) (f7ce07b)

2.266.0-alpha.0 (2026-08-19)

⚠ BREAKING CHANGES

• glue-alpha: DataQualityRulesetProps.rulesetDqdl: string is replaced by dqdl: Dqdl. Build it with Dqdl.fromString('Rules = [ ... ]').
• glue-alpha: s3Encryption, cloudWatchEncryption, and jobBookmarksEncryption are no longer object literals. Use S3Encryption.s3Managed() / S3Encryption.kms(key?), CloudWatchEncryption.kms(key?), and JobBookmarksEncryption.clientSideKms(key?). The CloudWatchEncryptionMode and JobBookmarksEncryptionMode enums are removed (their mode is now implicit); S3EncryptionMode is retained.
• glue-alpha: this is a corrective breaking change. Apps that leaned on the bug, and did things like InputFormat x = OutputFormat.AVRO; will get a compilation error in other jsii languages. The intended usage, on the other hand, was broken before and works now.
• glue-alpha: workerType and numberOfWorkers are no longer top-level job props. For Spark jobs, pass them together via workerConfiguration: { workerType, numberOfWorkers }. PythonShellJob no longer accepts them (it is sized by maxCapacity). RayJob no longer accepts workerType (it is fixed to Z.2X).
• glue-alpha: SparkJobProps.enableMetrics removed, which will cause a compilation error for any app using it. But there is no behavior change, since this is a dead prop.
• glue-alpha: a differing/tokenized has_encrypted_data supplied via parameters now throws.

Features

• glue-alpha: add warning for maxRetries when job run queuing is enabled (#38575) (09ae11e)
• glue-alpha: model SecurityConfiguration encryption as factory subtypes (#38586) (e37e7a6)
• glue-alpha: new hasEncryptedData property (#38511) (c977e36)
• glue-alpha: pair workerType and numberOfWorkers into a required workerConfiguration (#38576) (5f3b1b6)
• glue-alpha: wrap DataQualityRuleset DQDL in a typed value object (#38587) (fd01268)

Bug Fixes

... (truncated)

Commits

• 0163b4c chore: update analytics metadata blueprints
• ccd2633 feat: update L1 CloudFormation resource definitions (#38578)
• f0207a1 docs(s3): clarify cross-account replication ownership (#38349)
• ab272bc fix(ec2): add DependsOn VPCGatewayAttachment to IPv6 default route (#37893)
• 834909b docs(aws_elasticloadbalancerv2): documentation Update for multiValueHeaderEna...
• ebb622f Merge branch 'main' into merge-back/2.265.0
• 67a7eb1 fix(sns-subscriptions): use regionalized service principal for opt-in region ...
• 94e5c1a feat: adding controlPlaneScalingConfig to Cluster (#36863)
• 3c8d99e chore: update analytics metadata blueprints
• a29b5c0 fix(secretsmanager): correct SAR rotation app versions for GovCloud (#38462)
• Additional commits viewable in compare view