Update dependency aws-cdk-lib to v2.260.0 [SECURITY]

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
aws-cdk-lib (source)	2.207.0 → 2.260.0

---

aws-cdk-lib: OS Command Injection in NodejsFunction Bundling

CVE-2026-11417 / GHSA-999r-qq7v-r334

More information

Details

Summary

AWS CDK (aws-cdk-lib) is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow a threat actor who controls the value of one or more bundling properties (externalModules, define, loader, inject, or esbuildArgs) to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters. This issue requires the threat actor to control the value of one or more of the affected bundling properties in the CDK application.

Impact

During local Lambda bundling, NodejsFunction assembled an esbuild command string from the bundling properties externalModules, define, loader, inject, and esbuildArgs and executed it via a shell (bash -c on Linux/macOS, cmd /c on Windows) through spawnSync. The property values were interpolated without escaping or validation, so values containing shell metacharacters could execute arbitrary commands with the privileges of the user running cdk synth, cdk deploy, or cdk diff. Exploitation requires a threat actor to control one or more of the affected property values in the CDK application — for example via an untrusted npm dependency that vends a wrapper construct, or via a pull request that introduces untrusted values.

Impacted versions:

< 2.245.0 (on Windows, < 2.246.0)

Patches

This issue has been addressed in aws-cdk-lib version 2.245.0 (PR #​37292), with a Windows-specific regression fix in 2.246.0 (PR #​37412). The fix replaces shell-based command execution with array-based spawnSync invocation that does not invoke a shell. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds

Ensure the values supplied to NodejsFunction bundling properties (externalModules, define, loader, inject, esbuildArgs) originate only from trusted sources, and audit third-party constructs and pull requests that set them. Upgrading to a fixed version is the recommended remediation.

References

If you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

Acknowledgement

AWS would like to thank the external researcher Hesham Ashraf who reported this issue through the AWS Vulnerability Disclosure Program (HackerOne) for collaborating on it through the coordinated vulnerability disclosure process.

Severity

• CVSS Score: 7.0 / 10 (High)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/aws/aws-cdk/security/advisories/GHSA-999r-qq7v-r334
• https://nvd.nist.gov/vuln/detail/CVE-2026-11417
• https://github.com/aws/aws-cdk/pull/37292
• https://github.com/aws/aws-cdk/pull/37412
• https://aws.amazon.com/security/security-bulletins/2026-041-aws
• https://github.com/aws/aws-cdk/releases/tag/v2.245.0
• https://github.com/advisories/GHSA-999r-qq7v-r334

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling

CVE-2026-13760 / GHSA-vcrf-j523-4mrf

More information

Details

Summary

AWS CDK (aws-cdk-lib) is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. OS command injection issue in the NodejsFunction Docker bundling pipeline in aws-cdk-lib before 2.260.0 that might allow an actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters in the OsCommand helper. This issue requires the actor to control the content of a package.json dependency version string that is processed during Docker-based bundling with nodeModules specified.

Impact

During Docker-based Lambda bundling, when the nodeModules option is specified, NodejsFunction assembled a shell command string, including file-operation commands generated by an internal OsCommand helper, from the version strings of the modules listed in nodeModules, and executed it via a shell (bash -c) inside the bundling container. These version strings were interpolated without shell escaping, so values containing shell metacharacters could execute arbitrary commands inside the bundling container - which has read/write bind mounts to the host filesystem - with the privileges of the user running cdk synth, cdk deploy, or cdk diff. Leveraging this issue requires an actor to control a dependency version string for one of the listed modules - for example via an untrusted npm package referenced through nodeModules.

Impacted versions:

< 2.260.0

Patches

This issue has been addressed in aws-cdk-lib version 2.260.0 (PR #​38133). We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds

Ensure that the modules listed in the nodeModules bundling option - and the version strings declared for them in your project's package.json, as well as the versions of the corresponding installed packages - come only from trusted sources, and audit third-party constructs and dependencies that introduce them. Using local bundling instead of Docker-based bundling avoids the affected code path. Upgrading to a fixed version is the recommended remediation.

References

If you have any questions or comments about this advisory, we ask that you contact AWS Security via our vulnerability reporting page or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

Acknowledgement

We would like to thank the external researcher Mostafa Ashraf who reported this issue through the AWS Vulnerability Disclosure Program (HackerOne @​kaporia) for collaborating on it through the coordinated vulnerability disclosure process.

Severity

• CVSS Score: 7.0 / 10 (High)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/aws/aws-cdk/security/advisories/GHSA-vcrf-j523-4mrf
• https://nvd.nist.gov/vuln/detail/CVE-2026-13760
• https://github.com/aws/aws-cdk/pull/38133
• https://github.com/aws/aws-cdk/commit/baa9e1dff469306cc23b8f4bd232d703f98bf68a
• https://aws.amazon.com/security/security-bulletins/2026-050-aws
• https://github.com/aws/aws-cdk/releases/tag/v2.260.0
• https://github.com/advisories/GHSA-vcrf-j523-4mrf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

AWS CDK CodeBuild S3 Log Encryption Boolean Inversion

GHSA-464c-974j-9xm6

More information

Details

Summary

The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. We identified an issue in which explicitly setting encrypted: true on the S3LoggingOptions property of an AWS CodeBuild project construct produces the opposite of the intended behavior, disabling encryption on CodeBuild build logs stored in S3.

Impact

The S3LoggingOptions.encrypted property in the aws-codebuild module uses positive polarity (true = encryption ON), but is mapped directly to the CloudFormation S3LogsConfig.EncryptionDisabled field, which uses negative polarity (true = encryption OFF). Because the value is not negated before being passed to CloudFormation, any explicit assignment produces inverted behavior:

• Setting encrypted: true (intending encryption ON) causes CloudFormation to receive EncryptionDisabled: true, disabling encryption.

• Setting encrypted: false (intending encryption OFF) causes CloudFormation to receive EncryptionDisabled: false, enabling encryption.

Users who omit the property entirely are not affected, as undefined passes through to CloudFormation, which defaults to encryption enabled.

Users affected by this issue could have CodeBuild S3 build logs stored using SSE-S3 (Amazon S3-managed keys, AES-256) rather than the AWS managed keys that CodeBuild applies by default. Since January 5, 2023, Amazon S3 automatically encrypts all new object uploads with SSE-S3, so logs written after that date remain encrypted at rest. However, logs written prior to that date to buckets that did not have default encryption configured at the time are potentially not encrypted at rest.

Impacted versions: >= 1.75.0 and <= 2.252.0

Patches

This issue has been addressed in aws-cdk-lib version 2.253.0. Upgrade to the latest version and ensure any forked or derivative code is patched to incorporate the new fixes.

Workarounds

Users who are unable to immediately upgrade to version 2.253.0 should omit the encrypted property from their S3LoggingOptions configuration entirely. When the property is omitted, the value is not passed to CloudFormation, and CodeBuild applies its default behavior of encrypting build logs using AWS managed keys.

References

If you have any questions or comments about this advisory, contact AWS Security via our issue reporting page [1] or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.

[1] https://aws.amazon.com/security/vulnerability-reporting/

Acknowledgement

AWS thanks AISafe for collaborating on this issue through the coordinated disclosure process.

Severity

• CVSS Score: 3.3 / 10 (Low)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

References

• https://github.com/aws/aws-cdk/security/advisories/GHSA-464c-974j-9xm6
• https://github.com/aws/aws-cdk/pull/37761
• https://github.com/aws/aws-cdk/commit/40319185dc645d2afc6acf1d25547a86250e97af
• https://github.com/aws/aws-cdk/releases/tag/v2.253.0
• https://github.com/advisories/GHSA-464c-974j-9xm6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

aws/aws-cdk (aws-cdk-lib)

v2.260.0

Compare Source

Features

• update L1 CloudFormation resource definitions (#​38151) (f266a47), closes /docs.aws.amazon.com/AmazonS3/latest/userguide/s3-files-prereq-policies.html#s3
• core: add external traces to ConstructError (#​38131) (e360dd9)
• core: append external stack traces to metadata if available (#​38124) (c77a08c)

Bug Fixes

• bundling: docker build can be skipped if already performed (#​38134) (2f9ae95)
• core: stack traces contain decorator paths (#​38130) (318f645)
• core: weak cross-stack references fail for list attributes (#​37948) (6bb9d75), closes #​37910
• lambda-nodejs: reuse posixShellEscape for Docker bundling file operations (#​38133) (baa9e1d)

---

Alpha modules (2.260.0-alpha.0)

v2.259.0

Compare Source

⚠ BREAKING CHANGES

• lambda: Runtime.NODEJS_LATEST now resolves to nodejs24.x in every region. Customers who pin to a concrete runtime (Runtime.NODEJS_22_X, useLatestRuntimeVersion: false in aws-lambda-nodejs.NodejsFunction) are unaffected. Existing AWS::Lambda::Function resources synthesized with NODEJS_LATEST will see Runtime: nodejs22.x → Runtime: nodejs24.x on next deploy. Lambda accepts runtime updates in place.

  Customer-code compatibility — IMPORTANT: Node.js 24 removes support for callback-style asynchronous handlers ((event, context, callback) => {...}) per the launch blog. Customers whose Lambda code still uses callback-based handlers will see runtime errors after the bump. Customers should migrate to async (event, context) => {...} or pin to Runtime.NODEJS_22_X explicitly.

Features

• core: recommend the use of weak references if no choice has been made (#​38070) (6e74e5e)
• ecs: add forceNewDeployment option for Fargate and EC2 services (#​36797) (3d9c4df), closes #​27762
• eks: use the recommended AL2023 instead of AL2 AMI type (under feature flag) (#​37850) (6a2dcb7), closes #​32211
• lambda: upgrade lambda and custom resource default runtime to nodejs24.x (#​38031) (36c84c6)

Bug Fixes

• spec2cdk: sanitize hyphens in EventBridge event namespace names (#​38088) (b8f41bf), closes 40aws-cdk/spec2cdk/lib/naming/conventions.ts#L195

Reverts

• "chore(bundling): check if docker image is cached before building" (#​38116) (359f2fb), closes aws/aws-cdk#37951

---

Alpha modules (2.259.0-alpha.0)

v2.258.1

Compare Source

Reverts

• "chore(bundling): check if docker image is cached before building" (#​38116) (8ec236c), closes aws/aws-cdk#37951

---

Alpha modules (2.258.1-alpha.0)

v2.258.0

Compare Source

⚠ BREAKING CHANGES

• ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

• aws-pcaconnectorad: AWS::PCAConnectorAD::ServicePrincipalName: ConnectorArn property is now required.
• aws-pcaconnectorad: AWS::PCAConnectorAD::ServicePrincipalName: DirectoryRegistrationArn property is now required.
• aws-pcaconnectorad: AWS::PCAConnectorAD::TemplateGroupAccessControlEntry: GroupSecurityIdentifier property is now required.
• aws-pcaconnectorad: AWS::PCAConnectorAD::TemplateGroupAccessControlEntry: TemplateArn property is now required.

Features

• core: trace property assignments in CfnResource.addPropertyOverride (#​38072) (a226372)
• update L1 CloudFormation resource definitions (#​37993) (664a878)
• aws-cdk-lib: emits performance counters if synthesis is slow (#​38004) (cb03794), closes #​37919 #​37843
• bedrockagentcore: expose default endpoint application log group on Runtime (#​37812) (8e25d78), closes #​37796
• core: add scope to IPolicyValidationContext (#​38006) (cae7456)
• core: allow validation plugins to create new files in cloud assembly (#​38007) (d9f38a9)
• core: fine-grained control over cross-stack reference strength (#​37840) (bddcd44)
• core: include suppressed violations in validation-report.json (#​38009) (f396892)
• core: new validation report schema (#​37970) (4e09b52), closes aws/aws-cdk-cli#1515
• eks: add AlbControllerVersion support for v2.8.3 through v3.2.2 (#​37752) (20abc6a), closes #​37414
• eks: add deletionProtection property to Cluster construct (#​36474) (5b19ac5), closes #​36460
• elasticache: replace CacheEngine/UserEngine enums with enum-like classes (#​37816) (6ad84b3), closes #​37813

Bug Fixes

• autoscaling: use of ScheduledAction.endTime is dangerous (#​38014) (109fae7)
• aws-cdk-lib: make token resolution ~25% faster (#​37920) (87483dc)
• bedrockagentcore: relax allowlistedHeaders pattern to match CFN schema (#​37969) (e0d6c8a), closes #​37964
• cloudwatch: metric math validation reports quoted strings as unknown identifiers (#​37977) (59bae38)
• core: cross-region SSM writer orphans parameters when resource is replaced during stack update (#​38059) (f130388)
• core: handle string "false" for boolean context values in validation (#​37989) (a26ed73)
• integ-tests: responseURL logged in onTimeout (#​37972) (b9259dd)
• lambda-nodejs: bundling rejects entry paths containing ".." (#​38022) (a7cc53c), closes #​38017 #​37572 #​37572
• lambda-nodejs: perf counters e2e test uses incorrect filename (#​38033) (d88637f)

---

Alpha modules (2.258.0-alpha.0)

Features

• integ-tests-alpha: add option to set the provider log level (#​38005) (c634a79)

Bug Fixes

• custom-resource-handlers: deterministic asset hashes for generated lambdas (#​37634) (6c3d5bc), closes #​34307
• glue-alpha: deprecate Ray Jobs (#​38055) (3fa428b)
• glue-alpha: restore notifyDelayAfter to PySpark and Scala Spark ETL jobs (#​37815) (05be88a), closes #​33839
• integ-tests-alpha: assertion failures print too much unnecessary information (#​37974) (bc0de1d)
• mediapackagev2-alpha: cdnAuth on OriginEndpoint now generates the required policy (#​38013) (1d56b46)

v2.257.0

Compare Source

⚠ BREAKING CHANGES

• ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

  • aws-neptunegraph: AWS::NeptuneGraph::GraphSnapshot: GraphIdentifier property is now required.

Features

• update L1 CloudFormation resource definitions (#​37955) (211b06c)
• core: failSynthOnValidationErrors context key to suppress console output and exit code (#​37909) (deb968f), closes aws/aws-cdk-cli#1515

---

Alpha modules (2.257.0-alpha.0)

v2.256.1

Compare Source

Bug Fixes

• invalid lock file (#​37943) (73ae91d), closes #​37726 #​37929 #​37870

---

Alpha modules (2.256.1-alpha.0)

v2.256.0

Compare Source

Features

• aws-cdk-lib: emits performance counters if synthesis is slow (#​37919) (caa0f4c), closes #​37843
• core: validations report is always written to cloud assembly (#​37867) (dddc6e0)
• ec2: replace any return types with specific interfaces in IPeer methods (#​36637) (626e44d), closes #​36636
• s3: support bucketNamePrefix and bucketNamespace properties (#​37386) (997b003), closes #​37760

Bug Fixes

• core: handle token-wrapped Boxes in property merge strategies (#​37902) (18435e3)
• core: prevent stack overflow on large construct trees (#​37901) (10163cb), closes #​37903

---

Alpha modules (2.256.0-alpha.0)

v2.255.0

Compare Source

Features

• aws-cdk-lib: emits performance counters if synthesis is slow (#​37843) (ea33967)
• bedrockagentcore: graduate to stable 🚀 (#​37876) (00cf601)
• core: builtin PropertyMergeStrategys are now compatible with deferred Box values (#​37844) (ca4b722)
• core: persist asset fingerprinting cache (#​37822) (605a776)
• ec2: add C8A instance type support (#​36736) (0d088ca), closes #​36722

Bug Fixes

• core: cached Lazys use the Box API internally (#​37889) (464fa3d)
• core: default stack trace size adds unnecessary overhead (#​37827) (0b1fb2b)
• core: share a single IAM role across cross-account Fn::GetStackOutput consumers (#​37871) (fee8b90)
• dynamodb: remove deprecated scope for stream grants (#​36680) (570d552), closes #​36289
• iam: validate PolicyStatement SID is alphanumeric for identity policies (#​36150) (a7edd72), closes #​34819 #​34828 #​34819

---

Alpha modules (2.255.0-alpha.0)

Features

• bedrock-agentcore-alpha: Graduation of the library to stable. The Policy submodule is the only submodule that remains in alpha. All other constructs have graduated to stable in aws-cdk-lib/aws-bedrockagentcore and we recommend migrating to the stable versions (#​37876) (00cf601)

v2.254.0

Compare Source

⚠ BREAKING CHANGES

• ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

aws-elasticache: AWS::ElastiCache::CacheCluster: Id attribute removed.
aws-sagemaker: AWS::SageMaker::Model: Id attribute removed.
aws-vpclattice: AWS::VpcLattice::AuthPolicy: State attribute enum values changed from ACTIVE|INACTIVE to Active|Inactive.

Features

• update L1 CloudFormation resource definitions (#​37826) (fb4197e)
• cloudwatch: add PromQL Alarm L2 construct (#​37793) (13a4924)
• core: PropertyMergeStrategy now supports array merge strategies (#​37841) (701305d)
• core: plugin violations can be suppressed (#​37808) (a47ad39), closes #​37781
• core: weak cross environment references (#​37800) (fe23dce)
• core: weak cross-stack references in the same environment (#​37824) (167ff3c)
• dynamodb: resource policies for streams (#​37254) (7e5679c)
• lambda: add SQS provisionedPollerConfig support with validation and fix type mismatch (#​37550) (086738b), closes #​37197 /github.com/aws/aws-cdk/pull/37197#pullrequestreview-2772143562 #​37197
• ses: auto email validation for configuration sets (#​36679) (3a58641)

Bug Fixes

• file fingerprinting is now ~33% faster (#​37802) (b871018)
• core: "exports cannot be updated" for cross-region references (#​37790) (af11f00)
• rds: add lower bound validation for ClusterInstance promotionTier (#​37519) (16c0a29), closes #​37518
• s3deploy: empty sources leads to deployment error (#​37786) (d28ad30)
• bundled jsonschema in @​aws-cdk/cloud-assembly-api causes ELSPROBLEMS (#​37774) (64651d3), closes #​37756

---

Alpha modules (2.254.0-alpha.0)

Features

• bedrock-agentcore-alpha: add tags support to Evaluator and OnlineEvaluationConfig (#​37804) (adbf88f)
• bedrock-agentcore-alpha: add identity L2 constructs (#​37610) (67c3af2)
• mediapackagev2-alpha: add OAC integration between CloudFront and MediaPackageV2 (#​37701) (654f59c)

Bug Fixes

• bedrock-agentcore-alpha: fix cedar policy bug (#​37782) (e678d5c), closes #​37828
• custom-resource-handlers: deployment fails when parameter already exists (#​37852) (025c38c)

v2.253.1

Compare Source

Bug Fixes

• core: "exports cannot be updated" for cross-region references (#​37790) (b0c00e2)
• s3deploy: empty sources leads to deployment error (#​37786) (f61656a)

---

Alpha modules (2.253.1-alpha.0)

v2.253.0

Compare Source

Features

• update L1 CloudFormation resource definitions (#​37753) (a661c2d)
• apigatewayv2-integrations: auto-include EventBusName in HttpEventBridgeIntegration default parameter mapping (#​36780) (9734bb4), closes #​36775
• core: add Fn::GetStackOutput for cross-region references (#​37724) (ffae861)
• core: integrate construct annotations into validation report (#​37712) (438bd0b)
• synthetics: add Playwright 5.1 and 6.0 runtimes (#​37665) (c1afb43)
• emr instance fleet priority allocation (#​35731) (db1188a), closes #​35710 /github.com/aws/aws-cdk/blob/3ec6d06c7c58e4f14b3fb114d7c35dc6d01794d9/packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/emr/private/cluster-utils.ts#L91

Bug Fixes

• cloudfront: skip cachePolicyName length validation for unresolved tokens (#​37751) (3b96e97), closes #​23567 #​34102
• cloudwatch: remove false positive warning for CDK tokens in MathExpression (#​36882) (c29dc17), closes #​34977
• codebuild: correct S3 log encryption boolean inversion (#​37761) (4031918)
• ecs: enabling the circuitBreaker is not recommended loudly enough (#​37755) (a52af7d)
• eks: add dependency from HelmChart custom resource to s3 chartAsset IAM policy (#​37731) (99d0a5b), closes #​19880

---

Alpha modules (2.253.0-alpha.0)

Features

• bedrock-agentcore-alpha: add OnlineEvaluationConfig and Evaluator L2 constructs (#​37615) (c13de04), closes #​37614
• glue-alpha: add extraPythonFiles support to PythonShellJob (#​37130) (c9c6f9c), closes #​34448

Bug Fixes

• bedrock-agentcore-alpha: self-managed memory strategy validation throws on unresolved tokens (#​37691) (7956537), closes #​37197

v2.252.0

Compare Source

Features

• core: Validations class now supports addWarning, addError, and acknowledge (#​37668) (5e8083c), closes aws/aws-cdk-rfcs#899
• core: add Box API for deferred values with accurate stack traces (#​37604) (d592a96)

Bug Fixes

• aws-cdk-lib: cannot be used as a bundledDependency (#​37726) (6ba0598), closes #​37717
• s3: resolve S3 notification removal race condition (#​37708) (dc5be98), closes #​37667

---

Alpha modules (2.252.0-alpha.0)

v2.251.0

Compare Source

⚠ BREAKING CHANGES

• ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

aws-elasticloadbalancing: AWS::ElasticLoadBalancing::LoadBalancer: SourceSecurityGroup attribute removed.
aws-elasticloadbalancing: AWS::ElasticLoadBalancing::LoadBalancer: PolicyItem type removed.
aws-elasticloadbalancing: AWS::ElasticLoadBalancing::LoadBalancer: SourceSecurityGroup type removed.

Features

• update L1 CloudFormation resource definitions (#​37684) (9e6c2ef)
• lambda: add ruby 4.0 runtime (#​37650) (04d4337)
• update L1 CloudFormation resource definitions (#​37644) (e64f943)
• core: Validations class is the new way to add validation plugins to CDK Apps (#​37611) (95696b4), closes #​37613
• core: graduate policyValidationBeta1 interfaces to policyValidation (#​37613) (8c613cf)
• ecs: support for service connect access log configuration (#​36067) (5ad1c06)
• route53: accelerated recovery for public hosted zone (#​36358) (f1b7b03)
• synthetics: support canary group (#​35689) (20ccd31), closes #​34043

Bug Fixes

• core: Stage.policyValidationBeta1 is mutable (#​37612) (3c1faf1)
• core: construct creation stack traces are implicit (#​37643) (5635c20)
• core: synth output is not valid YAML when using policy validation (#​37597) (927dd60), closes #​25331
• core: token stack traces expensively clutter --debug mode (#​37642) (498c546)
• core: tree metadata does not contain logical ID (#​37630) (284ab23)
• ec2: fixing vpc endpoint for eu-isoe-west-1 region (#​37596) (555c930), closes #​31690
• events-targets: make LogGroupTargetInput extend RuleTargetInput for JSII compatibility (#​37451) (46dbc7a), closes #​36733
• lambda: add Token.isUnresolved checks to provisioned poller config validation (#​37197) (667ed30)
• stepfunctions-tasks: warn when CallAwsServiceCrossRegion endpoint is resolved from state input (#​37646) (9fdf590)

---

Alpha modules (2.251.0-alpha.0)

Features

• bedrock-agentcore-alpha: add L2 constructs for policy and policy engine (#​37238) (1e89e7e)
• bedrock-agentcore-alpha: add observability configuration for Runtime (#​36689) (34b43aa), closes #​36596
• bedrock-agentcore-alpha: support No Authorization for AgentCore Gateway (#​36610) (f20bd8e)
• dsql-alpha: initial L2 construct (#​34599) (be1a458), closes #​34593

v2.250.0

Compare Source

⚠ BREAKING CHANGES

• ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

aws-emr: AWS::EMR::Cluster: MonitoringConfiguration property removed.
aws-emr: AWS::EMR::Cluster: CloudWatchLogConfiguration type removed.
aws-emr: AWS::EMR::Cluster: EMRConfiguration type removed.
aws-emr: AWS::EMR::Cluster: MonitoringConfiguration type removed.

Features

• s3files: s3Files Lambda L1 integration (#​37547) (af41262)
• update L1 CloudFormation resource definitions (#​37582) (c99ce64)
• mediapackagev2: add region attribute on mediapackagev2 resources and extra naming validation (#​37526) (112ed67)

Bug Fixes

• eks-v2: respect securityGroup(s) in KubectlProviderOptions (#​37247) (4c530fa), closes #​36653
• lambda-nodejs: if entry path is not under project root, bundling in Docker fails in an unclear way (#​37572) (73662df)

---

Alpha modules (2.250.0-alpha.0)

v2.249.0

Compare Source

⚠ BREAKING CHANGES

• L1 resources are automatically generated from
  public CloudFormation Resource Schemas. They ar

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[QuiltSimon]

Closing as superseded by #66. Both start from the same baseline (aws-cdk-lib 2.207.0, which is still what main's package.json pins) and touch the same two files (package.json, package-lock.json), but #66 goes to 2.266.0 versus this PR's 2.260.0 — a strict superset that includes the CVE-2026-11417 fix this PR was opened for. Verified from the body bump tables and diffs, not the titles. If #66 turns out not to land, Renovate will refile this against current main.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (2.260.0). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.