chore(deps): bump the minor-and-patch group with 14 updates

[dependabot]

Bumps the minor-and-patch group with 14 updates:

Package	From	To
oxfmt	0.65.0	0.67.0
oxlint	1.80.0	1.82.0
@aws-sdk/client-translate	3.1123.0	3.1127.0
@types/aws-lambda	8.10.162	8.10.163
@types/node	26.4.0	26.5.0
@aws-sdk/client-cognito-identity-provider	3.1123.0	3.1127.0
aws-cdk-lib	2.267.0	2.268.0
aws-cdk	2.1139.0	2.1140.0
@aws-sdk/client-lambda	3.1123.0	3.1127.0
@aws-sdk/client-ssm	3.1123.0	3.1127.0
next-safe-action	8.6.1	8.7.3
@playwright/test	1.62.1	1.63.0
@types/react-dom	19.2.5	19.2.7
@aws-sdk/client-dsql	3.1123.0	3.1127.0

Updates oxfmt from 0.65.0 to 0.67.0

Changelog

Sourced from oxfmt's changelog.

[0.67.0] - 2026-09-07

🛡️ Security

• 9a612d5 deps: Update npm packages (#26178) (renovate[bot])

[0.64.0] - 2026-08-18

🚀 Features

• c07fe7c oxfmt: Support experimentalOperatorPosition (#25643) (leaysgur)

📚 Documentation

• fed6681 oxfmt: Skip expanding overrides options (#25572) (leaysgur)

[0.62.0] - 2026-08-03

🐛 Bug Fixes

• e6e584b oxfmt: Type jsdoc. enum options (#25008) (leaysgur)

[0.59.0] - 2026-07-13

🐛 Bug Fixes

• 415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

[0.55.0] - 2026-06-15

🚀 Features

• 9a2788b linter/unicorn: Implement prefer-export-from rule (#22935) (AliceLanniste)

[0.54.0] - 2026-06-08

📚 Documentation

• dadafe3 oxlint, oxfmt: Mention migrate skills in npm READMEs (#22965) (Boshen)
• f88961a oxfmt: Annotate each config option with supported languages (#22953) (leaysgur)

[0.52.0] - 2026-05-26

🚀 Features

• 16b8058 oxfmt: Support vite-plus/resolveConfig for vite.config.ts (#22454) (leaysgur)

[0.50.0] - 2026-05-15

🐛 Bug Fixes

... (truncated)

Commits

• b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
• 9a612d5 chore(deps): update npm packages (#26178)
• 0b4e2e6 release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
• 5ff57f8 fix(formatter/sort-imports): handle custom side effect groups (#26217)
• 63bc313 chore(npm): update funding URL (#26066)
• See full diff in compare view

Updates oxlint from 1.80.0 to 1.82.0

Release notes

Sourced from oxlint's releases.

oxlint v1.82.0 & oxfmt v0.67.0

Table of Contents

• Oxlint v1.82.0
• Oxfmt v0.67.0

Oxlint v1.82.0

💥 BREAKING CHANGES

• 66744f0 parser: [BREAKING] Rename panicked to fatal_error in ParserReturn (#26382) (overlookmotel)

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

🐛 Bug Fixes

• aa38ddf linter/unicorn/numeric-separators-style: Correct schema defaults (#26393) (camc314)
• 562dd14 jsx-a11y/anchor-has-content: Allow anchors passed as custom component props (#26360) (Mikhail Baev)
• 253cdb2 linter/eslint/id-length: Exempt TS interface/type-literal members with never (#26310) (Pearce Ropion)
• 8c7ea76 ast_visit: Account for trimmed source offsets (#26223) (Cameron)
• 5f9cffc linter/typescript/no-explicit-any: Fix rest parameter to unknown[] (#26279) (camc314)
• 4de9fa3 linter/react/jsx-no-literals: Check nested JSX expression literals (#26253) (camc314)
• 07851b9 parser: Fix debug assert failure when lexer error with tokens enabled (#26229) (overlookmotel)
• 9cee146 oxlint/lsp: Don't try to parse fix message, always fallback (#26204) (Sysix)
• a662c40 linter/eslint/no-useless-assignment: Handle destructuring assignments (#25925) (camc314)
• 304bd9a linter/eslint/no-array-constructor: Handle ASI hazards in fixer (#26166) (Hamody We)
• b41bb35 linter: Qualify rules in rules output (#26250) (camc314)
• 895c685 linter/typescript/no-extraneous-class: Avoid deleting class expressions (#26231) (camc314)
• 4ba33c8 linter/eslint/no-unused-vars: Handle stored arrow references (#26225) (camc314)

🛡️ Security

• 9a612d5 deps: Update npm packages (#26178) (renovate[bot])

Oxfmt v0.67.0

💥 BREAKING CHANGES

• 66744f0 parser: [BREAKING] Rename panicked to fatal_error in ParserReturn (#26382) (overlookmotel)
• 2c9a947 parser: [BREAKING] Reduce MAX_LEN to 256 bytes below u32::MAX (#26352) (overlookmotel)

🚀 Features

• 68e12ab formatter_css: Follow the oxc-css-parser's acceptance line (#26337) (leaysgur)

🐛 Bug Fixes

• f7acdc0 formatter: Treat a JSDoc cast target as opaque in chain layouts (#26375) (leaysgur)
• 104061b formatter: Keep JSDoc cast parens with a comment inside them (#26374) (leaysgur)
• 3d00a76 formatter_css: Keep comment inside important and simple-vars colon (#26370) (leaysgur)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.82.0] - 2026-09-07

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

[1.81.0] - 2026-08-31

📚 Documentation

• d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

• 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

• 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
• aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
• 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
• beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
• 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
• 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
• 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

[1.78.0] - 2026-08-10

🚀 Features

• ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#25207) (Mikhail Baev)
• d4a897c linter/eslint: Implement one-var rule (#24470) (Cole Ellison)
• 5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#24571) (Cole Ellison)

🐛 Bug Fixes

• 9573937 linter/typescript: Validate ban-ts-comment description_format (#25320) (Mikhail Baev)

[1.77.0] - 2026-08-03

🐛 Bug Fixes

• 5c0fa61 linter/eslint/no-warning-comments: Unify config structs and remove manual options docs (#25151) (Mikhail Baev)

📚 Documentation

• 9dc7756 linter/typescript/no-unnecessary-condition: Clarify options (#25110) (camc314)

... (truncated)

Commits

• b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
• aa38ddf fix(linter/unicorn/numeric-separators-style): correct schema defaults (#26393)
• 6a0e19c feat(linter/eslint/no-unmodified-loop-condition): support `checkConditionalEx...
• 0b4e2e6 release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
• d5be037 docs(linter/typescript/switch-exhaustiveness-check): clarify default case com...
• 63bc313 chore(npm): update funding URL (#26066)
• See full diff in compare view

Updates @aws-sdk/client-translate from 3.1123.0 to 3.1127.0

Release notes

Sourced from @​aws-sdk/client-translate's releases.

v3.1127.0

3.1127.0(2026-09-04)

New Features

• client-mediatailor: Elemental MediaTailor now supports two new Monetization Functions lifecycle hooks, Post Ads Response and Pre Manifest Insertion, and a VAST Request function type that calls a VAST or VMAP ad server. This release also adds Yield Optimization with demand from Amazon Publisher Services. (c238a693)
• client-service-quotas: Service Quotas adds the AdjustableAtLevel property to QuotaContext, indicating whether a quota is adjustable at the account or resource level. (f56bdf2c)
• client-bedrock: New AWS REVIEW mode as supported data retention mode for Bedrock models (cbd9ea9a)
• client-ec2: Adds support for ValidateSecurityGroupQuotasForInterface, an API that specifically authorized AWS services use to validate security group rule quotas before creating an elastic network interface. (f51c3b3e)

---

For list of updated packages, view updated-packages.md in assets-3.1127.0.zip

v3.1126.0

3.1126.0(2026-09-03)

Documentation Changes

• client-sfn: Updates Step Functions API documentation around CloudTrail, Execution name reuse and sort order of ListExecutions API (8dda8b4b)
• client-elastic-load-balancing-v2: This release adds support for sending TCP resets for Gateway Load Balancer when a flow's idle timeout expires, or when a target becomes unhealthy or is deregistered. This adds updates the CLI documentation. (a16f1659)

New Features

• client-socialmessaging: Adding support for WhatsApp Flows with endpoints. (3a3a6205)
• client-transfer: AWS Transfer Family SFTP Connectors now support specifying an ordered list of AWS Secrets Manager version stages for secret retrieval. This enables seamless credential rotation workflows where external partners may take time to update their systems with new credentials. (e4bf3ecc)
• client-transcribe: Amazon Transcribe now supports specifying up to 29 PII entity types in the ContentRedaction configuration of a StartTranscriptionJob request, allowing all supported entity types to be redacted in a single batch transcription job. (5fb0b9a5)
• client-connect: This release enables TagOnCreate for Rule resource on CreateRule API. It also introduces a new field called PreEvaluationFilters to Rule resource, thereby impacting all Create, Update, Describe and Search APIs for Rules (18bb14bc)
• client-ecs: Adds a critical parameter to the Amazon ECS managed daemon APIs that controls whether a daemon task failure drains the container instance. Non-critical daemon failures no longer drain the instance or block instance registration. (2e6a07d5)
• client-evs: Amazon EVS now allows users to set, update, and retrieve values for parameters that apply across all EVS Environments in their account at a regional level, such as the VCF License portability core count. (803b694c)
• client-drs: AWS Elastic Disaster Recovery now includes source server architecture in SourceProperties to identify x86 and ARM64 systems. (20f19e0e)
• client-bedrock-agentcore: Adds log group name prefix trace source selection, custom or source log group result destinations, and metrics namespace customization (823b2d33)
• client-bedrock-agentcore-control: AgentCore Identity adds Consent Portal APIs to manage portals that let end users grant OAuth authorization for agents to access resources. AgentCore Evaluation adds trace source selection by log group prefix, custom or source log group result destinations, and metrics namespace customization. (2f826477)
• client-eks: Deprecate EncryptionConfig resources field. Amazon EKS encrypts all Kubernetes API data with envelope encryption by default for clusters running Kubernetes version 1.28 or higher, so this field no longer affects which resources are encrypted. (c66ca41b)
• client-guardduty: Adding support for Sequence Activities in GuardDuty Findings (5c12a0eb)
• lib-transfer-manager: add download directory functionality (#8274) (6e591ee8)

---

For list of updated packages, view updated-packages.md in assets-3.1126.0.zip

v3.1125.0

3.1125.0(2026-09-02)

New Features

• client-ec2: This release adds support to retain interruptible Capacity Reservations in an active state when all capacity is reclaimed. (336c7896)
• client-sagemaker-featurestore-runtime: Amazon SageMaker Feature Store now supports the UpdateRecord API, enabling partial updates to individual feature values in an existing Online Store record without rewriting the entire record. This reduces write payloads and latency for high-frequency feature-level writes . (71920960)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-translate's changelog.

3.1127.0 (2026-09-04)

Note: Version bump only for package @​aws-sdk/client-translate

3.1126.0 (2026-09-03)

Note: Version bump only for package @​aws-sdk/client-translate

3.1125.0 (2026-09-02)

Note: Version bump only for package @​aws-sdk/client-translate

3.1124.0 (2026-09-01)

Note: Version bump only for package @​aws-sdk/client-translate

Commits

• 8893344 Publish v3.1127.0
• 7131e74 Publish v3.1126.0
• 678282b Publish v3.1125.0
• e80cab3 Publish v3.1124.0
• See full diff in compare view

Updates @types/aws-lambda from 8.10.162 to 8.10.163

Commits

• See full diff in compare view

Updates @types/node from 26.4.0 to 26.5.0

Commits

• See full diff in compare view

Updates @aws-sdk/client-cognito-identity-provider from 3.1123.0 to 3.1127.0

Release notes

Sourced from @​aws-sdk/client-cognito-identity-provider's releases.

v3.1127.0

3.1127.0(2026-09-04)

New Features

• client-mediatailor: Elemental MediaTailor now supports two new Monetization Functions lifecycle hooks, Post Ads Response and Pre Manifest Insertion, and a VAST Request function type that calls a VAST or VMAP ad server. This release also adds Yield Optimization with demand from Amazon Publisher Services. (c238a693)
• client-service-quotas: Service Quotas adds the AdjustableAtLevel property to QuotaContext, indicating whether a quota is adjustable at the account or resource level. (f56bdf2c)
• client-bedrock: New AWS REVIEW mode as supported data retention mode for Bedrock models (cbd9ea9a)
• client-ec2: Adds support for ValidateSecurityGroupQuotasForInterface, an API that specifically authorized AWS services use to validate security group rule quotas before creating an elastic network interface. (f51c3b3e)

---

For list of updated packages, view updated-packages.md in assets-3.1127.0.zip

v3.1126.0

3.1126.0(2026-09-03)

Documentation Changes

• client-sfn: Updates Step Functions API documentation around CloudTrail, Execution name reuse and sort order of ListExecutions API (8dda8b4b)
• client-elastic-load-balancing-v2: This release adds support for sending TCP resets for Gateway Load Balancer when a flow's idle timeout expires, or when a target becomes unhealthy or is deregistered. This adds updates the CLI documentation. (a16f1659)

New Features

• client-socialmessaging: Adding support for WhatsApp Flows with endpoints. (3a3a6205)
• client-transfer: AWS Transfer Family SFTP Connectors now support specifying an ordered list of AWS Secrets Manager version stages for secret retrieval. This enables seamless credential rotation workflows where external partners may take time to update their systems with new credentials. (e4bf3ecc)
• client-transcribe: Amazon Transcribe now supports specifying up to 29 PII entity types in the ContentRedaction configuration of a StartTranscriptionJob request, allowing all supported entity types to be redacted in a single batch transcription job. (5fb0b9a5)
• client-connect: This release enables TagOnCreate for Rule resource on CreateRule API. It also introduces a new field called PreEvaluationFilters to Rule resource, thereby impacting all Create, Update, Describe and Search APIs for Rules (18bb14bc)
• client-ecs: Adds a critical parameter to the Amazon ECS managed daemon APIs that controls whether a daemon task failure drains the container instance. Non-critical daemon failures no longer drain the instance or block instance registration. (2e6a07d5)
• client-evs: Amazon EVS now allows users to set, update, and retrieve values for parameters that apply across all EVS Environments in their account at a regional level, such as the VCF License portability core count. (803b694c)
• client-drs: AWS Elastic Disaster Recovery now includes source server architecture in SourceProperties to identify x86 and ARM64 systems. (20f19e0e)
• client-bedrock-agentcore: Adds log group name prefix trace source selection, custom or source log group result destinations, and metrics namespace customization (823b2d33)
• client-bedrock-agentcore-control: AgentCore Identity adds Consent Portal APIs to manage portals that let end users grant OAuth authorization for agents to access resources. AgentCore Evaluation adds trace source selection by log group prefix, custom or source log group result destinations, and metrics namespace customization. (2f826477)
• client-eks: Deprecate EncryptionConfig resources field. Amazon EKS encrypts all Kubernetes API data with envelope encryption by default for clusters running Kubernetes version 1.28 or higher, so this field no longer affects which resources are encrypted. (c66ca41b)
• client-guardduty: Adding support for Sequence Activities in GuardDuty Findings (5c12a0eb)
• lib-transfer-manager: add download directory functionality (#8274) (6e591ee8)

---

For list of updated packages, view updated-packages.md in assets-3.1126.0.zip

v3.1125.0

3.1125.0(2026-09-02)

New Features

• client-ec2: This release adds support to retain interruptible Capacity Reservations in an active state when all capacity is reclaimed. (336c7896)
• client-sagemaker-featurestore-runtime: Amazon SageMaker Feature Store now supports the UpdateRecord API, enabling partial updates to individual feature values in an existing Online Store record without rewriting the entire record. This reduces write payloads and latency for high-frequency feature-level writes . (71920960)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-cognito-identity-provider's changelog.

3.1127.0 (2026-09-04)

Note: Version bump only for package @​aws-sdk/client-cognito-identity-provider

3.1126.0 (2026-09-03)

Note: Version bump only for package @​aws-sdk/client-cognito-identity-provider

3.1125.0 (2026-09-02)

Note: Version bump only for package @​aws-sdk/client-cognito-identity-provider

3.1124.0 (2026-09-01)

Note: Version bump only for package @​aws-sdk/client-cognito-identity-provider

Commits

• 8893344 Publish v3.1127.0
• 7131e74 Publish v3.1126.0
• 678282b Publish v3.1125.0
• e80cab3 Publish v3.1124.0
• See full diff in compare view

Updates aws-cdk-lib from 2.267.0 to 2.268.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.268.0

⚠ BREAKING CHANGES

L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

• aws-athena: AWS::Athena::Session removed.
• aws-bcmdataexports: AWS::BCMDataExports::Table removed.
• aws-bedrock: AWS::Bedrock::DefaultPromptRouter and AWS::Bedrock::ModelInvocationJob removed.
• aws-bedrockagentcore: AWS::BedrockAgentCore::Browser, AWS::BedrockAgentCore::CodeInterpreter, and AWS::BedrockAgentCore::TokenVault removed; AWS::BedrockAgentCore::PaymentConnector ConnectorType and AWS::BedrockAgentCore::PaymentCredentialProvider CredentialProviderVendor are now immutable; AWS::BedrockAgentCore::CapacityProvider OperatingSystem allowed values in the LaunchParameters type reduced from [LINUX_X86_64, LINUX_ARM64, MAC_ARM64, WINDOWS_X86_64] to [LINUX_X86_64, LINUX_ARM64].
• aws-certificatemanager: AWS::CertificateManager::Certificate Id attribute removed.
• aws-chime: on both AWS::Chime::AppInstance and AWS::Chime::AppInstanceBot, the CreatedTimestamp and LastUpdatedTimestamp attribute types changed from number to string.
• aws-cloudformation: AWS::CloudFormation::ResourceScan removed.
• aws-codeartifact: AWS::CodeArtifact::Package removed.
• aws-codebuild: AWS::CodeBuild::Sandbox removed; AWS::CodeBuild::SourceCredential Id attribute removed.
• aws-dax: AWS::DAX::ParameterGroup Id attribute removed; Description property is now immutable.
• aws-dms: Id attribute removed from AWS::DMS::Endpoint, AWS::DMS::EventSubscription, and AWS::DMS::ReplicationSubnetGroup; AWS::DMS::ReplicationTask MigrationType property is now immutable.
• aws-docdb: Id attribute removed from AWS::DocDB::DBClusterParameterGroup and AWS::DocDB::DBSubnetGroup.
• aws-dynamodb: AWS::DynamoDB::Export removed.
• aws-elasticache: AWS::ElastiCache::ReservedCacheNode removed.
• aws-emr: AWS::EMR::NotebookExecution removed.
• aws-events: AWS::Events::Replay removed.
• aws-fis: AWS::FIS::SafetyLever removed.
• aws-glue:
  • Id attribute removed from AWS::Glue::Classifier, AWS::Glue::Connection, AWS::Glue::CustomEntityType, AWS::Glue::DataQualityRuleset, AWS::Glue::MLTransform, AWS::Glue::SecurityConfiguration, AWS::Glue::TableOptimizer, and AWS::Glue::Workflow.
  • AWS::Glue::Connection: complex-property types AuthenticationConfigurationInput and OAuth2PropertiesInput renamed to AuthenticationConfiguration and OAuth2Properties respectively.
  • AWS::Glue::DataQualityRuleset: Name, TargetTable.DatabaseName, and TargetTable.TableName properties are now required; Name property is now immutable; Tags property type changed from json to map<string>.
  • AWS::Glue::CustomEntityType: Name property is now immutable; Tags property is no longer recognised as resource tags.
  • AWS::Glue::MLTransform: TransformEncryption property is now immutable.
• aws-greengrassv2: AWS::GreengrassV2::Component and AWS::GreengrassV2::CoreDevice removed.
• aws-identitystore: AWS::IdentityStore::AllGroupMemberships removed.
• aws-imagebuilder: AWS::ImageBuilder::AllImageBuildVersions, AWS::ImageBuilder::AllWorkflowBuildVersions, AWS::ImageBuilder::WorkflowExecution, and AWS::ImageBuilder::WorkflowStepExecution removed.
• aws-medialive: AWS::MediaLive::Offering removed.
• aws-mediaconvert: AWS::MediaConvert::Preset Id attribute removed.
• aws-mediapackage: AWS::MediaPackage::HarvestJob removed.
• aws-memorydb: AWS::MemoryDB::MultiRegionParameterGroup and AWS::MemoryDB::ReservedNode removed.
• aws-omics: AWS::Omics::Reference removed.
• aws-osis: AWS::OSIS::PipelineBlueprint removed.
• aws-personalize: AWS::Personalize::DataDeletionJob and AWS::Personalize::Recipe removed.
• aws-redshiftserverless: AWS::RedshiftServerless::RecoveryPoint removed.
• aws-route53: AWS::Route53::RecordSet GeoProximityLocation property removed, along with its supporting GeoProximityLocation and Coordinates complex-property types; Id attribute removed.
• aws-sagemaker: AWS::SageMaker::ModelCardExportJob, AWS::SageMaker::MonitoringScheduleAlert, and AWS::SageMaker::TransformJob removed.
• aws-ses: AWS::SES::ReceiptRuleSet Id attribute removed.
• aws-signer: AWS::Signer::SigningJob removed.
• aws-ssm: AWS::SSM::Session removed; AWS::SSM::Association InstanceId property is now immutable.
• aws-sso: AWS::SSO::ApplicationProvider removed.
• aws-stepfunctions: AWS::StepFunctions::MapRun removed.
• aws-transcribe: AWS::Transcribe::MedicalTranscriptionJob removed.
• aws-vpclattice: AWS::VpcLattice::ServiceNetwork SharingConfig property is now immutable.

Features

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.269.0-alpha.0 (2026-09-10)

⚠ BREAKING CHANGES

• glue-alpha: Glue job constructs now reject construct-managed and Glue-reserved arguments passed through defaultArguments. Previously, a managed argument set via defaultArguments was silently honored in SparkJob and PythonShellJob (customer value won over the construct default) and silently ignored in RayJob (construct default won). Both behaviors let a caller bypass the construct's security and observability defaults with no error. Passing any of the following through defaultArguments now throws a ValidationError at synthesis time:
• construct-managed arguments — --enable-continuous-cloudwatch-log, --continuous-log-logGroup, --continuous-log-logStreamPrefix, --continuous-log-conversionPattern, --enable-continuous-log-filter, --enable-metrics, --enable-observability-metrics, --enable-spark-ui, --spark-event-logs-path, --job-language, --class, --extra-jars, --user-jars-first, --extra-py-files, --extra-files, library-set
• Glue-reserved arguments — --debug, --mode, --JOB_NAME, --endpoint

A managed argument is rejected whether or not the current configuration emits it, so a disabled feature (e.g. enableMetrics: false) cannot be re-enabled through defaultArguments. Configure these through their dedicated props instead (continuousLogging, enableMetrics, enableObservabilityMetrics, sparkUI, className, extraJars, extraJarsFirst, extraPythonFiles, extraFiles). For example, replace defaultArguments: { '--enable-continuous-cloudwatch-log': 'false' } with continuousLogging: { enabled: false }. Arguments without a dedicated prop (e.g. --enable-glue-datacatalog) are unaffected and remain settable via defaultArguments.

The checkNoReservedArgs(defaultArguments?) method on the Job base class was removed. It is replaced by two protected members: setManagedArgument(key, value?), which each job class calls to declare (and, when a value is present, emit) a managed argument, and mergeDefaultArguments(defaultArguments?), which validates the caller-supplied defaultArguments against the accumulated reserved set and returns the merged map.

• route53resolver-alpha: FirewallRuleGroupAssociation now honors the previously-ignored mutationProtection and name props. Stacks that set mutationProtection: true will enable mutation protection on redeploy (which blocks further CloudFormation update/delete until it is set back to false); stacks that set name will write it to the template, which may replace the association.
• glue-alpha: trigger Action and Condition are no longer plain objects — use Action.job(...) / Action.crawler(...) and Condition.job(...) / Condition.crawler(...). Jobs are referenced via IJobRef and crawlers via ICrawlerRef (a CfnCrawler instance or CfnCrawler.fromCrawlerName(...)) instead of a CfnCrawler field or crawler-name string; IJob now extends the generated IJobRef. addDailyScheduledTrigger/addWeeklyScheduledTrigger/addCustomScheduledTrigger are replaced by addScheduledTrigger(id, { schedule, ... }) (use TriggerSchedule.daily()/weekly()/cron(...)). addNotifyEventTrigger is renamed addEventTrigger (NotifyEventTriggerOptions → EventTriggerOptions). All addXxxTrigger methods now return ITriggerRef instead of CfnTrigger.
• glue-alpha: PartitionProjectionConfiguration's variant fields (integerRange, dateRange, interval, digits, format, intervalUnit, values) are no longer public; DATE projection now takes step: { interval, intervalUnit } instead of top-level interval/intervalUnit.
• glue-alpha: ConnectionOptions no longer has subnet, vpc, or vpcSubnets; use network: ConnectionNetwork.subnet(...) or network: ConnectionNetwork.vpc(...) instead.

Features

• glue-alpha: ensure job parameters consistency (#38480) (bc7dc0c)
• glue-alpha: model Connection VPC placement as a value object (#38729) (f72e9fe)
• glue-alpha: model partition projection variants as internal state (#38726) (16527cd)
• glue-alpha: overhaul the workflow trigger API (#38579) (c8f917d)

... (truncated)

Commits

• 26336c6 chore: update analytics metadata blueprints
• 53fdc99 feat: update L1 CloudFormation resource definitions (#38732)
• f2e3b7d chore(core): validateAgainstDefaultRules feature flag is ignored when set via...
• d5df2ee fix(core): upgrade CloudFormation validation to latest version (#38668)
• ecdafa9 fix(eks-v2): generate and export L1 constructs from aws-eks-v2 (#37640)
• 9322f5d docs: fix typo in circuit breaker error message (#38723)
• 688b0c1 fix(core): templates are not checked for circular dependencies (#38712)
• b0f7d9c feat(ec2): support CpuOptions on LaunchTemplate (#38193)
• 51234fd feat: update L1 CloudFormation resource definitions (#38693)
• 8fd1ef6 fix(core): ignored external symlinks throw validation error (#38679)
• Additional commits viewable in compare view

Updates aws-cdk from 2.1139.0 to 2.1140.0

Release notes

Sourced from aws-cdk's releases.

aws-cdk@v2.1140.0

2.1140.0 (2026-09-04)

Features

• deps: upgrade aws-cdk-lib (#1914) (c1d93ab)

Bug Fixes

• fatal failures hide the underlying error cause (#1939) (5b77563)

Commits

• 5b77563 fix: fatal failures hide the underlying error cause (#1939)
• c1d93ab feat(deps): upgrade aws-cdk-lib (#1914)
• 50db732 refactor(toolkit-lib): rename versioned stack selection methods (#1910)
• 6ae45d7 chore(deps): upgrade dependencies (#1913)
• 5766544 chore: ban direct child_process and shell:true outside the subprocess tool (#...
• See full diff in compare view

Updates @aws-sdk/client-lambda from 3.1123.0 to 3.1127.0

Release notes

Sourced from @​aws-sdk/client-lambda's releases.

v3.1127.0

3.1127.0(2026-09-04)

New Features

• client-mediatailor: Elemental MediaTailor now supports two new Monetization Functions lifecycle hooks, Post Ads Response and Pre Manifest Insertion, and a VAST Request function type that calls a VAST or VMAP ad server. This release also adds Yield Optimization with demand from Amazon Publisher Services. (c238a693)
• client-service-quotas: Service Quotas adds the AdjustableAtLevel property to QuotaContext, indicating whether a quota is adjustable at the account or resource level. (f56bdf2c)
• client-bedrock: New AWS REVIEW mode as supported data retention mode for Bedrock models (cbd9ea9a)
• client-ec2: Adds support for ValidateSecurityGroupQuotasForInterface, an API that specifically authorized AWS services use to validate security group rule quotas before creating an elastic network interface. (f51c3b3e)

---

For list of updated packages, view updated-packages.md in assets-3.1127.0.zip

v3.1126.0

3.1126.0(2026-09-03)

Documentation Changes

• client-sfn: Updates Step Functions API documentation around CloudTrail, Execution name reuse and sort order of ListExecutions API (8dda8b4b)
• client-elastic-load-balancing-v2: This release adds support for sending TCP resets for Gateway Load Balancer when a flow's idle timeout expires, or when a target becomes unhealthy or is deregistered. This adds updates the CLI documentation. (a16f1659)

New Features

• client-socialmessaging: Adding support for WhatsApp Flows with endpoints. (3a3a6205)
• client-transfer: AWS Transfer Family SFTP Connectors now support specifying an ordered list of AWS Secrets Manager version stages for secret retrieval. This enables seamless credential rotation workflows where external partners may take time to update their systems with new credentials. (e4bf3ecc)
• client-transcribe: Amazon Transcribe now supports specifying up to 29 PII entity types in the ContentRedaction configuration of a StartTranscriptionJob request, allowing all supported entity types to be redacted in a single batch transcription job. (5fb0b9a5)
• client-connect: This release enables TagOnCreate for Rule resource on CreateRule API. It also introduces a new field called PreEvaluationFilters to Rule resource, thereby impacting all Create, Update, Describe and Search APIs for Rules (18bb14bc)
• client-ecs: Adds a critical parameter to the Amazon ECS managed daemon APIs that controls whether a daemon task failure drains the container instance. Non-critical daemon failures no longer drain the instance or block instance registration. (2e6a07d5)
• client-evs: Amazon EVS now allows users to set, update, and retrieve values for parameters that apply across all EVS Environments in their account at a regional level, such as the VCF License portability core count. (803b694c)
• client-drs: AWS Elastic Disaster Recovery now includes source server architecture in SourceProperties to identify x86 and ARM64 systems. (20f19e0e)
• client-bedrock-agentcore: Adds log group name prefix trace source selection, custom or source log group result destinations, and metrics namespace customization (823b2d33)
• client-bedrock-agentcore-control: AgentCore Identity adds Consent Portal APIs to manage portals that let end users grant OAuth authorization for agents to access resources. AgentCore Evaluation adds trace source selection by log group prefix, custom or source log group result destinations, and metrics namespace customization. (2f826477)
• client-eks: Deprecate EncryptionConfig resources field. Amazon EKS encrypts all Kubernetes API data with envelope encryption by default for clusters running Kubernetes version 1.28 or higher, so this field no longer affects which resources are encrypted. (c66ca41b)
• client-guardduty: Adding support for Sequence Activities in GuardDuty Findings (5c12a0eb)
• lib-transfer-manager: add download directory functionality (#8274) (6e591ee8)

---

For list of updated packages, view updated-packages.md in assets-3.1126.0.zip

v3.1125.0

3.1125.0(2026-09-02)

New Features

• client-ec2: This release adds support to retain interruptible Capacity Reservations in an active state when all capacity is reclaimed. (336c7896)
• client-sagemaker-featurestore-runtime: Amazon SageMaker Feature Store now supports the UpdateRecord API, enabling partial updates to individual feature values in an existing Online Store record without rewriting the entire record. This reduces write payloads and latency for high-frequency feature-level writes . (71920960)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-lambda's changelog.

3.1127.0 (2026-09-04)

Note: Version bump only for package @​aws-sdk/client-lambda

3.1126.0 (2026-09-03)

Note: Version bump only for package @​aws-sdk/client-lambda

3.1125.0 (2026-09-02)

Note: Version bump only for package @​aws-sdk/client-lambda

3.1124.0 (2026-09-01)

Features

• client-lambda: AWS Lambda now provides configurable control over S3 direct access, allowing you to explicitly enable or disable how functions stream file reads directly from S3 buckets. This gives you flexibility to tune data access behavior based on your workload requirements, independent of memory size. (b4738db)

Commits

• 8893344 Publish v3.1127.0
• 7131e74 Publish v3.1126.0
• 678282b Publish v3.1125.0
• e80cab3 Publish v3.1124.0
• b4738db feat(client-lambda): AWS Lambda now provides configurable control over S3 dir...
• See full diff in compare view

Updates @aws-sdk/client-ssm from 3.1123.0 to 3.1127.0

Release notes

Sourced from @​aws-sdk/client-ssm's releases.

v3.1127.0

3.1127.0(2026-09-04)

New Features

• client-mediatailor: Elemental MediaTailor now supports two new Monetization Functions lifecycle hooks, Post Ads Response and Pre Manifest Insertion, and a VAST Request function type that calls a VAST or VMAP ad server. This release also adds Yield Optimi...

  Description has been truncated