chore(deps): bump the aws-cdk group across 1 directory with 3 updates

[dependabot]

Bumps the aws-cdk group with 3 updates in the / directory: @aws-cdk/toolkit-lib, aws-cdk-lib and aws-cdk.

Updates @aws-cdk/toolkit-lib from 1.39.0 to 1.40.0

Release notes

Sourced from @​aws-cdk/toolkit-lib's releases.

@​aws-cdk/toolkit-lib@​v1.40.0

1.40.0 (2026-08-26)

Features

• cli: warn of non-existent stacks in cdk destroy (#984) (ca8a14a)
• integ-runner: detect bootstrap errors and retry tests in valid regions (#1898) (f98fed5), closes #1115
• show the target environment in cdk diff stack headers (#1885) (f875d81), closes #286

Bug Fixes

• cli: gc 'print'/'tag' progress no longer shows NaN% or misleading '0 assets' (#1873) (10f688a), closes #625
• cli: guide Stage users to a working pattern in stack-selection error (#1847) (d51353e), closes #1451 #1451
• toolkit-lib: allowCrossAccountAssetPublishing cache ignores which stack's environment it was computed for (#1884) (f661b31), closes #1883 #1839
• toolkit-lib: cdk validate drops the plugin's customSeverity label (#1894) (7a7a4ba)
• toolkit-lib: clean up the loser of noOlderThan()'s timer/resolver race (#1870) (8d772fc), closes #1869
• toolkit-lib: finalizing deployment after refactor intermittently fails while stacks are still in UPDATE_IN_PROGRESS (#1805) (beb1e2f), closes #1804
• toolkit-lib: stack progress monitor double-counts the stack itself when a cleanup phase occurs (#1857) (2845174), closes #1856

Commits

• d51353e fix(cli): guide Stage users to a working pattern in stack-selection error (#1...
• f98fed5 feat(integ-runner): detect bootstrap errors and retry tests in valid regions ...
• 25ca63c test(cli-integ): remove integ test asserting CloudFormation drift-detection c...
• 793316b refactor(cli): consolidate stack selection on toolkit-lib selectors (#1896)
• 7a7a4ba fix(toolkit-lib): cdk validate drops the plugin's customSeverity label (#1894)
• ca8a14a feat(cli): warn of non-existent stacks in cdk destroy (#984)
• f875d81 feat: show the target environment in cdk diff stack headers (#1885)
• 8d772fc fix(toolkit-lib): clean up the loser of noOlderThan()'s timer/resolver race (...
• 10f688a fix(cli): gc 'print'/'tag' progress no longer shows NaN% or misleading '0 ass...
• f661b31 fix(toolkit-lib): allowCrossAccountAssetPublishing cache ignores which stack'...
• Additional commits viewable in compare view

Updates aws-cdk-lib from 2.266.0 to 2.267.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.267.0

⚠ BREAKING CHANGES

• kinesisfirehose: After this change, specifying an unsupported timeZone on the Firehose S3Bucket destination now throws a ValidationError during synthesis instead of failing at CloudFormation deployment. Affected values: 3-letter IANA abbreviations (e.g. EST), Etc/UTC, Etc/GMT, Factory, and strings containing characters outside [a-zA-Z/_]+. Use a supported standard IANA identifier (e.g. America/New_York) or UTC for synth to pass.

Features

• backup: add indexActions prop to BackupPlanRule (#34051) (b8be853), closes #34050
• bedrockagentcore: add manageDeliveryResourcePolicy opt-out for runtime observability (#38372) (5fb086b), closes #38342
• ci: integration test deployment on maintainer approval (#38519) (c5f6b4f), closes #37333
• core: Size objects now properly stringify (#38662) (90fe151)
• sqs: metricApproximateNumberOfMessagesOutstanding (#38661) (f29b27b)

Bug Fixes

• assets: SymlinkFollowMode.BLOCK_EXTERNAL will throw errors while bundling (#38506) (a11e451)
• bedrockagentcore: least-privilege browser recording S3 grant (#38604) (7e11d11)
• ci: add environment for Atmosphere variables access (#38625) (785773e), closes #38519
• cloudfront-origins: readTimeout and keepaliveTimeout reject valid values (#38432) (6251e1a), closes #38433 #18628
• core: performance counters use too much memory (#38620) (d0ce23c)
• core: single file bundled output should be file (#38548) (9e22774)
• core: stack.node.addDependency gets slower as stacks grow (#38597) (2ab9be4), closes #38522
• core: symlinks in directory bundling output (#38665) (8d8ae2c)
• core: validation plugin check adds too much overhead (#38619) (df15b9f)
• dynamodb: TableV2.grants.*Data does not include index resources (#37892) (e48a97f), closes #37569
• dynamodb: TableV2MultiAccountReplica rejects imported tables with tokenized ARNs (#38365) (08f05e5), closes #38354
• dynamodb: avoid TableGrantsProps deprecation warnings for TableV2 (#38399) (fb5c25b), closes #37221
• ec2: NatInstanceProvider and NatInstanceProviderV2 always trigger the keyName deprecation warning (#38347) (47f2151), closes #30806
• kinesisfirehose: add validation for customTimeZone in S3BucketProps (#38514) (8cf9f90), closes #36089
• lambda: allow SnapStart for container image functions (#38680) (a5adc00), closes #38281 #38281 #38265
• rds: serverlessV2 capacity props reject tokens at synth time (#38044) (b7880de), closes #38043 #9044 #31810 #32905
• s3-deployment: increase default memory limit from 128MB to 1024MB (#35501) (7a04f32), closes #35487
• stepfunctions-tasks: resolve EvaluateExpression paths via a values lookup (#38682) (02301ea)
• stack.availabilityZones are not stable strings (#38580) (f89474a)

---

Alpha modules (2.267.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: schema Type is now an opaque class; construct column types via the Schema factories or Schema.custom(...) rather than { isPrimitive, inputString } literals. StorageParameter.custom(key, value) requires a string value, and StorageParameter.writeKmsKeyId takes a kms.IKey instead of a string.
• glue-alpha: S3TableProps.bucket/encryption/encryptionKey are removed. Use storage: S3TableStorage.managedBucket(S3TableEncryption.kms(key?)) / S3TableStorage.fromBucket(bucket) and clientSideEncryption: TableClientSideEncryption.kms(key?). S3Table.encryption/encryptionKey are removed (clientSideEncryptionKey exposes the client-side key; read bucket.encryptionKey for server-side). The TableEncryption enum and the deprecated Table/TableProps are removed — use S3Table.

Features

• glue-alpha: add a typed secret input to Connection (#38585) (ede4a1c)
• glue-alpha: add subnet selection to Connection (#38561) (f9d7eac)
• glue-alpha: model S3Table storage/encryption as value objects (#38591) (9990e16)
• glue-alpha: opaque Schema Type with Schema.custom, and stronger StorageParameter types (#38592) (5c45eb0)
• msk-alpha: support Kafka 4.2 (#38323) (97b181c)
• s3tables-alpha: add storage class configuration support (#37339) (63ccf6d)

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.267.0-alpha.0 (2026-08-27)

⚠ BREAKING CHANGES

• glue-alpha: schema Type is now an opaque class; construct column types via the Schema factories or Schema.custom(...) rather than { isPrimitive, inputString } literals. StorageParameter.custom(key, value) requires a string value, and StorageParameter.writeKmsKeyId takes a kms.IKey instead of a string.
• glue-alpha: S3TableProps.bucket/encryption/encryptionKey are removed. Use storage: S3TableStorage.managedBucket(S3TableEncryption.kms(key?)) / S3TableStorage.fromBucket(bucket) and clientSideEncryption: TableClientSideEncryption.kms(key?). S3Table.encryption/encryptionKey are removed (clientSideEncryptionKey exposes the client-side key; read bucket.encryptionKey for server-side). The TableEncryption enum and the deprecated Table/TableProps are removed — use S3Table.

Features

• glue-alpha: add a typed secret input to Connection (#38585) (ede4a1c)
• glue-alpha: add subnet selection to Connection (#38561) (f9d7eac)
• glue-alpha: model S3Table storage/encryption as value objects (#38591) (9990e16)
• glue-alpha: opaque Schema Type with Schema.custom, and stronger StorageParameter types (#38592) (5c45eb0)
• msk-alpha: support Kafka 4.2 (#38323) (97b181c)
• s3tables-alpha: add storage class configuration support (#37339) (63ccf6d)

Bug Fixes

• glue-alpha: validate that DATE partition projection interval is set when required (#38594) (0e2b582)
• lambda-python-alpha: escape Docker bundling command arguments (#38583) (f7ce07b)

2.266.0-alpha.0 (2026-08-19)

⚠ BREAKING CHANGES

• glue-alpha: DataQualityRulesetProps.rulesetDqdl: string is replaced by dqdl: Dqdl. Build it with Dqdl.fromString('Rules = [ ... ]').
• glue-alpha: s3Encryption, cloudWatchEncryption, and jobBookmarksEncryption are no longer object literals. Use S3Encryption.s3Managed() / S3Encryption.kms(key?), CloudWatchEncryption.kms(key?), and JobBookmarksEncryption.clientSideKms(key?). The CloudWatchEncryptionMode and JobBookmarksEncryptionMode enums are removed (their mode is now implicit); S3EncryptionMode is retained.
• glue-alpha: this is a corrective breaking change. Apps that leaned on the bug, and did things like InputFormat x = OutputFormat.AVRO; will get a compilation error in other jsii languages. The intended usage, on the other hand, was broken before and works now.
• glue-alpha: workerType and numberOfWorkers are no longer top-level job props. For Spark jobs, pass them together via workerConfiguration: { workerType, numberOfWorkers }. PythonShellJob no longer accepts them (it is sized by maxCapacity). RayJob no longer accepts workerType (it is fixed to Z.2X).
• glue-alpha: SparkJobProps.enableMetrics removed, which will cause a compilation error for any app using it. But there is no behavior change, since this is a dead prop.
• glue-alpha: a differing/tokenized has_encrypted_data supplied via parameters now throws.

Features

• glue-alpha: add warning for maxRetries when job run queuing is enabled (#38575) (09ae11e)
• glue-alpha: model SecurityConfiguration encryption as factory subtypes (#38586) (e37e7a6)
• glue-alpha: new hasEncryptedData property (#38511) (c977e36)
• glue-alpha: pair workerType and numberOfWorkers into a required workerConfiguration (#38576) (5f3b1b6)
• glue-alpha: wrap DataQualityRuleset DQDL in a typed value object (#38587) (fd01268)

Bug Fixes

... (truncated)

Commits

• 71747d9 chore: update analytics metadata blueprints
• 02301ea fix(stepfunctions-tasks): resolve EvaluateExpression paths via a values looku...
• a5adc00 fix(lambda): allow SnapStart for container image functions (#38680)
• b8be853 feat(backup): add indexActions prop to BackupPlanRule (#34051)
• 8d8ae2c fix(core): symlinks in directory bundling output (#38665)
• be1a352 chore(core): auto-load temporary schemas for CloudFormation validation (#38595)
• b7880de fix(rds): serverlessV2 capacity props reject tokens at synth time (#38044)
• 08f05e5 fix(dynamodb): TableV2MultiAccountReplica rejects imported tables with toke...
• fb5c25b fix(dynamodb): avoid TableGrantsProps deprecation warnings for TableV2 (#38399)
• 5fb086b feat(bedrockagentcore): add manageDeliveryResourcePolicy opt-out for runtime ...
• Additional commits viewable in compare view

Updates aws-cdk from 2.1138.0 to 2.1139.0

Release notes

Sourced from aws-cdk's releases.

aws-cdk@v2.1139.0

2.1139.0 (2026-08-26)

Features

• cli: default to errors-only progress when run by an AI agent (#1850) (37bbd4d), closes #1800
• deps: upgrade aws-cdk-lib (#1868) (7ff50e7)
• show the target environment in cdk diff stack headers (#1885) (f875d81), closes #286

Bug Fixes

• aws-cdk: cdk migrate deduplication drops resources with compound identifiers (#1879) (d30e791)
• aws-cdk: remove SIGINT listener leak in TelemetrySession (#1863) (83dcea3), closes #1862
• cli: --yes mode requires a TTY when a request's default is falsy (#1892) (acc6f4d)
• cli: cdk CLI alias package declares an entrypoint that does not exist (#1897) (2a6a802)
• cli: guide Stage users to a working pattern in stack-selection error (#1847) (d51353e), closes #1451 #1451
• cli: recognize the AI_AGENT convention and more coding agents (#1855) (6f7d58e), closes /github.com/anthropics/claude-code/blob/770933ea1ad2fa7b858191e397a65e6644771c64/CHANGELOG.md#L2349 /github.com/charmbracelet/crush/blob/7d78d7422a92918441a68d01d96d48fa3b9fd9db/internal/shell/shell.go#L46 /github.com/anomalyco/opencode/blob/b155b15694dbcc6768f11d2f25cc2bdd1f738ab4/packages/opencode/src/index.ts#L75 /github.com/anomalyco/opencode/blob/b155b15694dbcc6768f11d2f25cc2bdd1f738ab4/packages/opencode/src/index.ts#L76 /github.com/github/copilot-cli/blob/3f9c5e1ce792150a852804132e2b08c58e9a8e95/changelog.md#L1971 /github.com/QwenLM/qwen-code/blob/099a71c9364473303adb31e0dfb5f488b31634d9/packages/core/src/services/shellExecutionService.ts#L806 /github.com/openai/codex/blob/4a942885c8b4745757a9f86ad2075e16c42483c5/codex-rs/protocol/src/shell_environment.rs#L7 /github.com/openai/codex/blob/4a942885c8b4745757a9f86ad2075e16c42483c5/codex-rs/core/src/spawn.rs#L26 /github.com/openai/codex/blob/4a942885c8b4745757a9f86ad2075e16c42483c5/codex-rs/core/src/unified_exec/process_manager.rs#L93 /github.com/cline/cline/blob/16875140fbc7bae51aad79c203837b4f51e54aa5/apps/vscode/src/hosts/vscode/terminal/VscodeTerminalRegistry.ts#L31
• toolkit-lib: finalizing deployment after refactor intermittently fails while stacks are still in UPDATE_IN_PROGRESS (#1805) (beb1e2f), closes #1804

Commits

• d51353e fix(cli): guide Stage users to a working pattern in stack-selection error (#1...
• 793316b refactor(cli): consolidate stack selection on toolkit-lib selectors (#1896)
• 2a6a802 fix(cli): cdk CLI alias package declares an entrypoint that does not exist ...
• 83dcea3 fix(aws-cdk): remove SIGINT listener leak in TelemetrySession (#1863)
• acc6f4d fix(cli): --yes mode requires a TTY when a request's default is falsy (#1892)
• c31e049 refactor(cli): make IoHost listener removers using-compatible (#1888)
• e895513 refactor(cli): scope IoHost listeners via suppressMessages decorator (#1887)
• f875d81 feat: show the target environment in cdk diff stack headers (#1885)
• 0bae125 test(cli): snapshot the cdk synth output contract (#1865)
• d30e791 fix(aws-cdk): cdk migrate deduplication drops resources with compound identif...
• Additional commits viewable in compare view