build(deps): bump the npm-patch-and-minor group across 1 directory with 7 updates

[dependabot]

Bumps the npm-patch-and-minor group with 7 updates in the / directory:

Package	From	To
@aws-sdk/client-athena	3.1118.0	3.1120.0
@aws-sdk/client-s3	3.1119.0	3.1120.0
@aws-sdk/client-ssm	3.1119.0	3.1120.0
@kensio/smartass	1.37.7	1.37.8
@kensio/yulin	1.21.3	1.21.7
@types/node	26.3.0	26.4.0
aws-cdk-lib	2.266.0	2.267.0

Updates @aws-sdk/client-athena from 3.1118.0 to 3.1120.0

Release notes

Sourced from @​aws-sdk/client-athena's releases.

v3.1120.0

3.1120.0(2026-08-27)

Documentation Changes

• client-opensearch: Updating SDK and CLI documentation for AttachDataSource API. (d696fe76)

New Features

• client-lambda-microvms: Added InsufficientCapacityException to RunMicrovm for capacity-related failures. Added lifecycle status field (AVAILABLE, DEPRECATED) to ListManagedMicrovmImageVersions. Added ConflictException to CreateMicrovmAuthToken and CreateMicrovmShellAuthToken for unregistered MicroVMs. (72a8ff80)
• client-codedeploy: Added a deploymentMode parameter to CreateDeployment. Set it to RESTART to restart an EC2 and on-premises fleet, using the last successful revision, honoring Deployment Configuration. (78d4f964)
• client-cloudwatch-logs: Added resultCount to QueryStatistics in GetQueryResults. This field returns the total number of output rows in the final result set, helping customers programmatically determine whether a query produced results after all operations including post-aggregation filters. (0e4d242b)
• client-datazone: Add cascadeDelete to DeleteDomain. When specified, DataZone recursively deletes all projects, environments, subscriptions, and their underlying AWS resources before removing the domain. Deletion progress is reported via deleteProgress and resource failures via failureReasons on GetDomain. (3a74dc4b)
• client-rds: Adding support for the full snapshot size, in bytes, of DB instance snapshots. (ab2f66f5)
• client-ec2: EC2 allows AMI owners to define compatible instance types on their AMIs, blocking RunInstances calls automatically for launches on non-permitted instance types. (311b3b26)
• client-cognito-identity-provider: Adds the AdminDeleteSoftwareToken API operation, enabling administrators to remove a user's registered TOTP (software token) MFA configuration from a user pool. (f661bebc)

---

For list of updated packages, view updated-packages.md in assets-3.1120.0.zip

v3.1119.0

3.1119.0(2026-08-26)

Chores

• codegen: smithy-aws-typescript-codegen 0.53.0 (#8276) (dffb383b)

New Features

• client-sagemaker: Amazon SageMaker AI now supports ml.g7 instances for model optimization. You can now run model optimization jobs on ml.g7 instances, in supported AWS Regions. (6d5e1066)
• client-devops-agent: AWS DevOps Agent now supports trigger filter groups for Release Readiness Review, letting you control when the capability auto-triggers based on webhook events and target branches. (bc3d53d5)
• client-license-manager-user-subscriptions: Released support for License Expiry field in ListProductSubscriptions API (454d7f7f)
• client-ec2: Adds deleting state to possible VPC States. (43091d55)
• client-network-firewall: Adding new status enum for Firewalls. (4cb21cb3)

---

For list of updated packages, view updated-packages.md in assets-3.1119.0.zip

Changelog

Sourced from @​aws-sdk/client-athena's changelog.

3.1120.0 (2026-08-27)

Note: Version bump only for package @​aws-sdk/client-athena

3.1119.0 (2026-08-26)

Note: Version bump only for package @​aws-sdk/client-athena

Commits

• d6be6f8 Publish v3.1120.0
• ba4e449 Publish v3.1119.0
• See full diff in compare view

Updates @aws-sdk/client-s3 from 3.1119.0 to 3.1120.0

Release notes

Sourced from @​aws-sdk/client-s3's releases.

v3.1120.0

3.1120.0(2026-08-27)

Documentation Changes

• client-opensearch: Updating SDK and CLI documentation for AttachDataSource API. (d696fe76)

New Features

• client-lambda-microvms: Added InsufficientCapacityException to RunMicrovm for capacity-related failures. Added lifecycle status field (AVAILABLE, DEPRECATED) to ListManagedMicrovmImageVersions. Added ConflictException to CreateMicrovmAuthToken and CreateMicrovmShellAuthToken for unregistered MicroVMs. (72a8ff80)
• client-codedeploy: Added a deploymentMode parameter to CreateDeployment. Set it to RESTART to restart an EC2 and on-premises fleet, using the last successful revision, honoring Deployment Configuration. (78d4f964)
• client-cloudwatch-logs: Added resultCount to QueryStatistics in GetQueryResults. This field returns the total number of output rows in the final result set, helping customers programmatically determine whether a query produced results after all operations including post-aggregation filters. (0e4d242b)
• client-datazone: Add cascadeDelete to DeleteDomain. When specified, DataZone recursively deletes all projects, environments, subscriptions, and their underlying AWS resources before removing the domain. Deletion progress is reported via deleteProgress and resource failures via failureReasons on GetDomain. (3a74dc4b)
• client-rds: Adding support for the full snapshot size, in bytes, of DB instance snapshots. (ab2f66f5)
• client-ec2: EC2 allows AMI owners to define compatible instance types on their AMIs, blocking RunInstances calls automatically for launches on non-permitted instance types. (311b3b26)
• client-cognito-identity-provider: Adds the AdminDeleteSoftwareToken API operation, enabling administrators to remove a user's registered TOTP (software token) MFA configuration from a user pool. (f661bebc)

---

For list of updated packages, view updated-packages.md in assets-3.1120.0.zip

Changelog

Sourced from @​aws-sdk/client-s3's changelog.

3.1120.0 (2026-08-27)

Note: Version bump only for package @​aws-sdk/client-s3

Commits

• d6be6f8 Publish v3.1120.0
• See full diff in compare view

Updates @aws-sdk/client-ssm from 3.1119.0 to 3.1120.0

Release notes

Sourced from @​aws-sdk/client-ssm's releases.

v3.1120.0

3.1120.0(2026-08-27)

Documentation Changes

• client-opensearch: Updating SDK and CLI documentation for AttachDataSource API. (d696fe76)

New Features

• client-lambda-microvms: Added InsufficientCapacityException to RunMicrovm for capacity-related failures. Added lifecycle status field (AVAILABLE, DEPRECATED) to ListManagedMicrovmImageVersions. Added ConflictException to CreateMicrovmAuthToken and CreateMicrovmShellAuthToken for unregistered MicroVMs. (72a8ff80)
• client-codedeploy: Added a deploymentMode parameter to CreateDeployment. Set it to RESTART to restart an EC2 and on-premises fleet, using the last successful revision, honoring Deployment Configuration. (78d4f964)
• client-cloudwatch-logs: Added resultCount to QueryStatistics in GetQueryResults. This field returns the total number of output rows in the final result set, helping customers programmatically determine whether a query produced results after all operations including post-aggregation filters. (0e4d242b)
• client-datazone: Add cascadeDelete to DeleteDomain. When specified, DataZone recursively deletes all projects, environments, subscriptions, and their underlying AWS resources before removing the domain. Deletion progress is reported via deleteProgress and resource failures via failureReasons on GetDomain. (3a74dc4b)
• client-rds: Adding support for the full snapshot size, in bytes, of DB instance snapshots. (ab2f66f5)
• client-ec2: EC2 allows AMI owners to define compatible instance types on their AMIs, blocking RunInstances calls automatically for launches on non-permitted instance types. (311b3b26)
• client-cognito-identity-provider: Adds the AdminDeleteSoftwareToken API operation, enabling administrators to remove a user's registered TOTP (software token) MFA configuration from a user pool. (f661bebc)

---

For list of updated packages, view updated-packages.md in assets-3.1120.0.zip

Changelog

Sourced from @​aws-sdk/client-ssm's changelog.

3.1120.0 (2026-08-27)

Note: Version bump only for package @​aws-sdk/client-ssm

Commits

• d6be6f8 Publish v3.1120.0
• See full diff in compare view

Updates @kensio/smartass from 1.37.7 to 1.37.8

Release notes

Sourced from @​kensio/smartass's releases.

v1.37.8

1.37.8 (2026-09-03)

Added

• add assertNotEqual (#127) (1973d73), closes #126

Packaging

• deps-dev: bump @​types/node from 26.3.0 to 26.4.0 in the npm-patch-and-minor group across 1 directory (#124) (b0f7032)
• deps-dev: bump eslint-plugin-unicorn from 72.0.0 to 73.0.0 (#125) (063119b)
• deps-dev: bump the npm-patch-and-minor group across 1 directory with 3 updates (#123) (a1b0791)

Commits

• 1973d73 feat: add assertNotEqual (#127)
• 063119b build(deps-dev): bump eslint-plugin-unicorn from 72.0.0 to 73.0.0 (#125)
• b0f7032 build(deps-dev): bump @​types/node from 26.3.0 to 26.4.0 in the npm-patch-and-...
• a1b0791 build(deps-dev): bump the npm-patch-and-minor group across 1 directory with 3...
• bbc3cb3 chore: version 1.37.7 (#122)
• See full diff in compare view

Updates @kensio/yulin from 1.21.3 to 1.21.7

Release notes

Sourced from @​kensio/yulin's releases.

v1.21.7

1.21.7 (2026-09-03)

Fixed

• record template Tags instead of refusing (#1283) (ca3b557), closes #1282

v1.21.6

1.21.6 (2026-09-03)

Added

• name CDK's unresolved zone lookup (#1274) (55dbf91), closes #1273
• read iam:PermissionsBoundary on CreateRole (#1278) (9c8f0c8), closes #1271
• sim DynamoDB document transactions (#1275) (0619b10), closes #1269

Fixed

• answer Ref with a skipped Resource's name (#1277) (276820e), closes #1272
• authorize CloudFront policy Resources (#1279) (98fed04), closes #1270

v1.21.5

1.21.5 (2026-09-03)

Added

• publish CDK assets as their own principal (#1266) (b7c684b), closes #1265

Packaging and dependencies

• deps-dev: bump eslint-plugin-unicorn from 72.0.0 to 73.0.0 (#1264) (6354e3f)
• deps-dev: bump the npm-patch-and-minor group across 1 directory with 41 updates (#1263) (9212e75)

v1.21.4

1.21.4 (2026-09-02)

Added

• apply Function URL CORS configuration (#1241) (0e4330b), closes #1217
• capture Lambda output without printing it (#1246) (7ef4026)
• create and execute CloudFormation change sets (#1234) (db58ad0), closes #1221
• expand SAM Auth and Cognito events (#1244) (66217d5), closes #1226
• expand what a served S3 request can say (#1248) (ef2c883), closes #1231
• fail a query the Athena engine turns down (#1261) (b41a144), closes #1254
• fill three CFN template language gaps (#1238) (f2bcd39), closes #1225
• give a simulated Stack its own stack ID (#1240) (7cc87bc), closes #1224
• honor stream mapping retry limits (#1243) (d02e258), closes #1219
• keep a resource through replace or delete (#1247) (6c02464), closes #1223
• project simulated Query and Scan reads (#1259) (45e4252), closes #1258
• put Lambda timers on the simulated clock (#1251) (a0c2477), closes #1218

... (truncated)

Commits

• ca3b557 fix: record template Tags instead of refusing (#1283)
• a7a4d35 docs: rewrite developer guides (#1284)
• 932f3a4 chore: version 1.21.6 (#1281)
• e1b2720 docs: fix skip examples that no longer skip (#1280)
• 9c8f0c8 feat: read iam:PermissionsBoundary on CreateRole (#1278)
• 98fed04 fix: authorize CloudFront policy Resources (#1279)
• 276820e fix: answer Ref with a skipped Resource's name (#1277)
• 0619b10 feat: sim DynamoDB document transactions (#1275)
• fef34fd test: pin the error page an OAC Bucket serves (#1276)
• 55dbf91 feat: name CDK's unresolved zone lookup (#1274)
• Additional commits viewable in compare view

Updates @types/node from 26.3.0 to 26.4.0

Commits

• See full diff in compare view

Updates aws-cdk-lib from 2.266.0 to 2.267.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.267.0

⚠ BREAKING CHANGES

• kinesisfirehose: After this change, specifying an unsupported timeZone on the Firehose S3Bucket destination now throws a ValidationError during synthesis instead of failing at CloudFormation deployment. Affected values: 3-letter IANA abbreviations (e.g. EST), Etc/UTC, Etc/GMT, Factory, and strings containing characters outside [a-zA-Z/_]+. Use a supported standard IANA identifier (e.g. America/New_York) or UTC for synth to pass.

Features

• backup: add indexActions prop to BackupPlanRule (#34051) (b8be853), closes #34050
• bedrockagentcore: add manageDeliveryResourcePolicy opt-out for runtime observability (#38372) (5fb086b), closes #38342
• ci: integration test deployment on maintainer approval (#38519) (c5f6b4f), closes #37333
• core: Size objects now properly stringify (#38662) (90fe151)
• sqs: metricApproximateNumberOfMessagesOutstanding (#38661) (f29b27b)

Bug Fixes

• assets: SymlinkFollowMode.BLOCK_EXTERNAL will throw errors while bundling (#38506) (a11e451)
• bedrockagentcore: least-privilege browser recording S3 grant (#38604) (7e11d11)
• ci: add environment for Atmosphere variables access (#38625) (785773e), closes #38519
• cloudfront-origins: readTimeout and keepaliveTimeout reject valid values (#38432) (6251e1a), closes #38433 #18628
• core: performance counters use too much memory (#38620) (d0ce23c)
• core: single file bundled output should be file (#38548) (9e22774)
• core: stack.node.addDependency gets slower as stacks grow (#38597) (2ab9be4), closes #38522
• core: symlinks in directory bundling output (#38665) (8d8ae2c)
• core: validation plugin check adds too much overhead (#38619) (df15b9f)
• dynamodb: TableV2.grants.*Data does not include index resources (#37892) (e48a97f), closes #37569
• dynamodb: TableV2MultiAccountReplica rejects imported tables with tokenized ARNs (#38365) (08f05e5), closes #38354
• dynamodb: avoid TableGrantsProps deprecation warnings for TableV2 (#38399) (fb5c25b), closes #37221
• ec2: NatInstanceProvider and NatInstanceProviderV2 always trigger the keyName deprecation warning (#38347) (47f2151), closes #30806
• kinesisfirehose: add validation for customTimeZone in S3BucketProps (#38514) (8cf9f90), closes #36089
• lambda: allow SnapStart for container image functions (#38680) (a5adc00), closes #38281 #38281 #38265
• rds: serverlessV2 capacity props reject tokens at synth time (#38044) (b7880de), closes #38043 #9044 #31810 #32905
• s3-deployment: increase default memory limit from 128MB to 1024MB (#35501) (7a04f32), closes #35487
• stepfunctions-tasks: resolve EvaluateExpression paths via a values lookup (#38682) (02301ea)
• stack.availabilityZones are not stable strings (#38580) (f89474a)

---

Alpha modules (2.267.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: schema Type is now an opaque class; construct column types via the Schema factories or Schema.custom(...) rather than { isPrimitive, inputString } literals. StorageParameter.custom(key, value) requires a string value, and StorageParameter.writeKmsKeyId takes a kms.IKey instead of a string.
• glue-alpha: S3TableProps.bucket/encryption/encryptionKey are removed. Use storage: S3TableStorage.managedBucket(S3TableEncryption.kms(key?)) / S3TableStorage.fromBucket(bucket) and clientSideEncryption: TableClientSideEncryption.kms(key?). S3Table.encryption/encryptionKey are removed (clientSideEncryptionKey exposes the client-side key; read bucket.encryptionKey for server-side). The TableEncryption enum and the deprecated Table/TableProps are removed — use S3Table.

Features

• glue-alpha: add a typed secret input to Connection (#38585) (ede4a1c)
• glue-alpha: add subnet selection to Connection (#38561) (f9d7eac)
• glue-alpha: model S3Table storage/encryption as value objects (#38591) (9990e16)
• glue-alpha: opaque Schema Type with Schema.custom, and stronger StorageParameter types (#38592) (5c45eb0)
• msk-alpha: support Kafka 4.2 (#38323) (97b181c)
• s3tables-alpha: add storage class configuration support (#37339) (63ccf6d)

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.268.0-alpha.0 (2026-09-02)

⚠ BREAKING CHANGES

• glue-alpha: DataQualityTargetTable's constructor is removed — use DataQualityTargetTable.fromTable(database, table) or fromTableName(database, tableName); IDatabase now extends IDatabaseRef.
• glue-alpha: DataQualityRulesetProps.clientToken is removed; use the CfnDataQualityRuleset L1 for request-level idempotency.
• glue-alpha: S3Table.clientSideEncryptionKey is now kms.IKeyRef instead of kms.IKey.
• glue-alpha: DataQualityRulesetProps.rulesetName is now required. AWS::Glue::DataQualityRuleset made Name a required property, so the name can no longer be left for CloudFormation to generate.

Features

• glue-alpha: reference-typed DataQualityTargetTable and remove clientToken (#38730) (c8fafbd)

Code Refactoring

• glue-alpha: use kms.IKeyRef for KMS key inputs where possible (#38725) (604ac23)

2.267.0-alpha.0 (2026-08-27)

⚠ BREAKING CHANGES

• glue-alpha: schema Type is now an opaque class; construct column types via the Schema factories or Schema.custom(...) rather than { isPrimitive, inputString } literals. StorageParameter.custom(key, value) requires a string value, and StorageParameter.writeKmsKeyId takes a kms.IKey instead of a string.
• glue-alpha: S3TableProps.bucket/encryption/encryptionKey are removed. Use storage: S3TableStorage.managedBucket(S3TableEncryption.kms(key?)) / S3TableStorage.fromBucket(bucket) and clientSideEncryption: TableClientSideEncryption.kms(key?). S3Table.encryption/encryptionKey are removed (clientSideEncryptionKey exposes the client-side key; read bucket.encryptionKey for server-side). The TableEncryption enum and the deprecated Table/TableProps are removed — use S3Table.

Features

• glue-alpha: add a typed secret input to Connection (#38585) (ede4a1c)
• glue-alpha: add subnet selection to Connection (#38561) (f9d7eac)
• glue-alpha: model S3Table storage/encryption as value objects (#38591) (9990e16)
• glue-alpha: opaque Schema Type with Schema.custom, and stronger StorageParameter types (#38592) (5c45eb0)
• msk-alpha: support Kafka 4.2 (#38323) (97b181c)
• s3tables-alpha: add storage class configuration support (#37339) (63ccf6d)

Bug Fixes

• glue-alpha: validate that DATE partition projection interval is set when required (#38594) (0e2b582)
• lambda-python-alpha: escape Docker bundling command arguments (#38583) (f7ce07b)

2.266.0-alpha.0 (2026-08-19)

⚠ BREAKING CHANGES

... (truncated)

Commits

• 71747d9 chore: update analytics metadata blueprints
• 02301ea fix(stepfunctions-tasks): resolve EvaluateExpression paths via a values looku...
• a5adc00 fix(lambda): allow SnapStart for container image functions (#38680)
• b8be853 feat(backup): add indexActions prop to BackupPlanRule (#34051)
• 8d8ae2c fix(core): symlinks in directory bundling output (#38665)
• be1a352 chore(core): auto-load temporary schemas for CloudFormation validation (#38595)
• b7880de fix(rds): serverlessV2 capacity props reject tokens at synth time (#38044)
• 08f05e5 fix(dynamodb): TableV2MultiAccountReplica rejects imported tables with toke...
• fb5c25b fix(dynamodb): avoid TableGrantsProps deprecation warnings for TableV2 (#38399)
• 5fb086b feat(bedrockagentcore): add manageDeliveryResourcePolicy opt-out for runtime ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.