chore(deps): bump the aws-cdk group across 1 directory with 3 updates

[dependabot]

Bumps the aws-cdk group with 3 updates in the / directory: @aws-cdk/toolkit-lib, aws-cdk-lib and aws-cdk.

Updates @aws-cdk/toolkit-lib from 1.40.1 to 1.42.0

Release notes

Sourced from @​aws-cdk/toolkit-lib's releases.

@​aws-cdk/toolkit-lib@​v1.42.0

1.42.0 (2026-09-23)

Features

• cli: support --change-set-name for cdk diff (#1982) (25b5038)
• unique change set names for diff, bootstrap and orphan (#1985) (29c9fe8), references #1982

Bug Fixes

• make plugins shape error more useful (#1987) (f3fd269)
• toolkit-lib: cdk refactor bypasses proxy config when discovering the deployment role (#1986) (f52b435)
• toolkit-lib: cdk watch loses log events when one log group is throttled (#1992) (e4d65d8), closes #879, references #879
• toolkit-lib: classify create-only properties as non-hotswappable (#1967) (87ce486), closes #1965
• toolkit-lib: diff leaves a deleting shell stack behind, breaking the next deploy (#1994) (9c6bd0e), closes #1993
• toolkit-lib: hotswap template cache ignores target environment (#1875) (63fc88a), closes #1874
• toolkit-lib: stale synth lock blocks every later synth when the CLI gets the same PID (#1991) (77b3cd6), closes #1990, references aws/aws-cdk#24946
• validation errors in non-top-level-Stack not reported (#1981) (da1a2e0), closes #1974

@​aws-cdk/toolkit-lib@​v1.41.1

1.41.1 (2026-09-16)

@​aws-cdk/toolkit-lib@​v1.41.0

1.41.0 (2026-09-09)

Features

• cli: cdk synth --watch re-synthesizes on file changes (#1851) (ef24968), closes #1782
• exclude stacks from the selection with ! patterns (#1920) (021a083), closes #1908 #758 #1909

Bug Fixes

• cloud control hotswap removes reserved aws: tags (#1940) (ba340b3)
• toolkit-lib: guard against a stack with no metadata in countAssemblyResults (#1952) (c07d251), closes aws-amplify/amplify-backend#3316 aws-amplify/amplify-backend#3316
• toolkit-lib: reject discovered Windows paths containing %VAR% (#1924) (ebf9bc5), closes #1763 #1849
• toolkit-lib: retry backoff has no jitter, retries stay in lockstep (#1942) (5280569), closes #1777 #1941 #1500 #1777 #1777
• toolkit-lib: throttled final event poll fails a successful deploy (#1941) (b4e81f7), closes #1777 #1777 #1777 #1950 #1777
• toolkit-lib: warn when hook failure detail can't be fetched (#1950) (03aebdc), closes #1923

Commits

• 9c6bd0e fix(toolkit-lib): diff leaves a deleting shell stack behind, breaking the nex...
• e4d65d8 fix(toolkit-lib): cdk watch loses log events when one log group is throttled ...
• 77b3cd6 fix(toolkit-lib): stale synth lock blocks every later synth when the CLI gets...
• 87ce486 fix(toolkit-lib): classify create-only properties as non-hotswappable (#1967)
• eb102f8 docs(cli): document cloud assembly as a trust boundary (#1983)
• f3fd269 fix: make plugins shape error more useful (#1987)
• f52b435 fix(toolkit-lib): cdk refactor bypasses proxy config when discovering the dep...
• 29c9fe8 feat: unique change set names for diff, bootstrap and orphan (#1985)
• 25b5038 feat(cli): support --change-set-name for cdk diff (#1982)
• da1a2e0 fix: validation errors in non-top-level-Stack not reported (#1981)
• Additional commits viewable in compare view

Updates aws-cdk-lib from 2.268.0 to 2.270.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.270.0

⚠ BREAKING CHANGES

• ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

  aws-codecommit: AWS::CodeCommit::Repository: Id attribute removed. aws-config: AWS::Config::DeliveryChannel: DeliveryFrequency property values narrowed to an enum. aws-dms: AWS::DMS::ReplicationTask: Id attribute removed.

Features

• update L1 CloudFormation resource definitions (#38823) (4386bf1)
• core: add cross-resource GameLift launch-path rules (CDK-GameLift-006/007) (ba98771)
• core: merge default Rego rules into explicitly registered plugins (160c8a6)
• core: replace schema-covered Rego rules with cross-field invariants (07a8153)
• core: ship default CloudFormation validation rules in Rego (5388c88)
• core: ship default CloudFormation validation rules in Rego (#38448) (4ccdad8), closes #38456
• glue: graduate to stable 🚀 (#38799) (a9e36a3)
• lambda: add DirectS3Read support for S3 Files filesystem mounts (#38752) (1482712), closes #38751

Bug Fixes

• apigatewayv2: missing WebSocket Lambda permissions for routes sharing one integration (#38154) (4317f8e), closes #38148
• core: annotations cannot be acked without feature flag (#38772) (941f847)
• ecs: correct enableManagedDraining docs to reflect CloudFormation implicit default (#37228) (74c19a3), closes #35539 aws/aws-cdk#35539
• s3: l2 construct Bucket replication metrics cannot be enabled without replication time control (RTC) (#35929) (cd97d96), closes #35772 aws/aws-cdk#35772

---

Alpha modules (2.270.0-alpha.0)

v2.269.0

Features

• bedrockagentcore: graduate Policy submodule to stable (#38687) (2b95e32), closes #37219
• update L1 CloudFormation resource definitions (#38784) (1b5e2e0)
• logs: support DELIVERY log group class (#38703) (b7a057a), closes #34338
• s3-deployment: expose deployed object version IDs (#38766) (09342df), closes #38765

Bug Fixes

• awslint: use a default import for chalk (#38110) (36d14e0), closes #38109 #38058
• core: cdk-nag warnings cannot be suppressed (#38787) (211029f)
• core: cdk-nag's findings duplicated in multi-environment apps (#38707) (4b7b2e7), closes #38483 #38135
• core: tree.json generation is quadratic in the number of subtrees (#38761) (3d034b6), closes #38762
• core: unnecessary warnings around builtins and AZs (#38673) (6860777)
• core: upgrade CloudFormation validation to latest version (#38804) (d703eb6)
• dynamodb: TableV2 emits internal grants deprecation warnings (#38806) (57b3043), closes #38709 #38399 #37892
• ecs: allow ephemeralStorageGiB for Windows Fargate platform version 1.0.0 (#37589) (855dfeb), closes #37510

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.271.0-alpha.0 (2026-09-25)

2.270.0-alpha.0 (2026-09-17)

2.269.0-alpha.0 (2026-09-10)

⚠ BREAKING CHANGES

• glue-alpha: Glue job constructs now reject construct-managed and Glue-reserved arguments passed through defaultArguments. Previously, a managed argument set via defaultArguments was silently honored in SparkJob and PythonShellJob (customer value won over the construct default) and silently ignored in RayJob (construct default won). Both behaviors let a caller bypass the construct's security and observability defaults with no error. Passing any of the following through defaultArguments now throws a ValidationError at synthesis time:
• construct-managed arguments — --enable-continuous-cloudwatch-log, --continuous-log-logGroup, --continuous-log-logStreamPrefix, --continuous-log-conversionPattern, --enable-continuous-log-filter, --enable-metrics, --enable-observability-metrics, --enable-spark-ui, --spark-event-logs-path, --job-language, --class, --extra-jars, --user-jars-first, --extra-py-files, --extra-files, library-set
• Glue-reserved arguments — --debug, --mode, --JOB_NAME, --endpoint

A managed argument is rejected whether or not the current configuration emits it, so a disabled feature (e.g. enableMetrics: false) cannot be re-enabled through defaultArguments. Configure these through their dedicated props instead (continuousLogging, enableMetrics, enableObservabilityMetrics, sparkUI, className, extraJars, extraJarsFirst, extraPythonFiles, extraFiles). For example, replace defaultArguments: { '--enable-continuous-cloudwatch-log': 'false' } with continuousLogging: { enabled: false }. Arguments without a dedicated prop (e.g. --enable-glue-datacatalog) are unaffected and remain settable via defaultArguments.

The checkNoReservedArgs(defaultArguments?) method on the Job base class was removed. It is replaced by two protected members: setManagedArgument(key, value?), which each job class calls to declare (and, when a value is present, emit) a managed argument, and mergeDefaultArguments(defaultArguments?), which validates the caller-supplied defaultArguments against the accumulated reserved set and returns the merged map.

• route53resolver-alpha: FirewallRuleGroupAssociation now honors the previously-ignored mutationProtection and name props. Stacks that set mutationProtection: true will enable mutation protection on redeploy (which blocks further CloudFormation update/delete until it is set back to false); stacks that set name will write it to the template, which may replace the association.
• glue-alpha: trigger Action and Condition are no longer plain objects — use Action.job(...) / Action.crawler(...) and Condition.job(...) / Condition.crawler(...). Jobs are referenced via IJobRef and crawlers via ICrawlerRef (a CfnCrawler instance or CfnCrawler.fromCrawlerName(...)) instead of a CfnCrawler field or crawler-name string; IJob now extends the generated IJobRef. addDailyScheduledTrigger/addWeeklyScheduledTrigger/addCustomScheduledTrigger are replaced by addScheduledTrigger(id, { schedule, ... }) (use TriggerSchedule.daily()/weekly()/cron(...)). addNotifyEventTrigger is renamed addEventTrigger (NotifyEventTriggerOptions → EventTriggerOptions). All addXxxTrigger methods now return ITriggerRef instead of CfnTrigger.
• glue-alpha: PartitionProjectionConfiguration's variant fields (integerRange, dateRange, interval, digits, format, intervalUnit, values) are no longer public; DATE projection now takes step: { interval, intervalUnit } instead of top-level interval/intervalUnit.
• glue-alpha: ConnectionOptions no longer has subnet, vpc, or vpcSubnets; use network: ConnectionNetwork.subnet(...) or network: ConnectionNetwork.vpc(...) instead.

Features

• glue-alpha: ensure job parameters consistency (#38480) (bc7dc0c)

... (truncated)

Commits

• 54f2838 chore: update analytics metadata blueprints
• 4386bf1 feat: update L1 CloudFormation resource definitions (#38823)
• cd97d96 fix(s3): l2 construct Bucket replication metrics cannot be enabled without ...
• 1482712 feat(lambda): add DirectS3Read support for S3 Files filesystem mounts (#38752)
• 941f847 fix(core): annotations cannot be acked without feature flag (#38772)
• 4317f8e fix(apigatewayv2): missing WebSocket Lambda permissions for routes sharing on...
• d9d4e25 Merge branch 'main' into iankhou/gamelift-rego-default-rules
• 74c19a3 fix(ecs): correct enableManagedDraining docs to reflect CloudFormation implic...
• 11350bd Merge branch 'main' into merge-back/2.269.0
• 916704a Merge branch 'main' into iankhou/gamelift-rego-default-rules
• Additional commits viewable in compare view

Updates aws-cdk from 2.1140.0 to 2.1143.0

Release notes

Sourced from aws-cdk's releases.

aws-cdk@v2.1143.0

2.1143.0 (2026-09-23)

Features

• cli: --debug-cli reports active handles that block process exit (#1651) (670fd75), references #1217
• cli: support --change-set-name for cdk diff (#1982) (25b5038)
• deps: upgrade aws-cdk-lib (#1979) (8904fc5)
• unique change set names for diff, bootstrap and orphan (#1985) (29c9fe8), references #1982

aws-cdk@v2.1142.0

2.1142.0 (2026-09-16)

Features

• deps: upgrade aws-cdk-lib (#1963) (a73eebf)

Bug Fixes

• cli: shorten the agent detection notice (#1958) (439c5ce), closes #1850

aws-cdk@v2.1141.0

2.1141.0 (2026-09-09)

Features

• cli: cdk synth --watch re-synthesizes on file changes (#1851) (ef24968), closes #1782
• deps: upgrade aws-cdk-lib (#1943) (af2f9a3)
• exclude stacks from the selection with ! patterns (#1920) (021a083), closes #1908 #758 #1909

Commits

• eb102f8 docs(cli): document cloud assembly as a trust boundary (#1983)
• ca64124 test(aws-cdk): mock agent detection instead of clearing its env vars (#1966)
• 29c9fe8 feat: unique change set names for diff, bootstrap and orphan (#1985)
• 25b5038 feat(cli): support --change-set-name for cdk diff (#1982)
• 670fd75 feat(cli): --debug-cli reports active handles that block process exit (#1651)
• 8904fc5 feat(deps): upgrade aws-cdk-lib (#1979)
• a719384 chore(deps): upgrade dependencies (#1977)
• 19baa75 chore(integ-testing): tests leak buckets under Atmosphere (#1956)
• a73eebf feat(deps): upgrade aws-cdk-lib (#1963)
• fa68b1c chore(deps): upgrade dependencies (#1961)
• Additional commits viewable in compare view

[svozza]

@dependabot recreate