chore(deps): bump the aws-cdk group across 1 directory with 3 updates

[dependabot]

Bumps the aws-cdk group with 3 updates in the / directory: @aws-cdk/toolkit-lib, aws-cdk-lib and aws-cdk.

Updates @aws-cdk/toolkit-lib from 1.40.1 to 1.41.0

Release notes

Sourced from @​aws-cdk/toolkit-lib's releases.

@​aws-cdk/toolkit-lib@​v1.41.0

1.41.0 (2026-09-09)

Features

• cli: cdk synth --watch re-synthesizes on file changes (#1851) (ef24968), closes #1782
• exclude stacks from the selection with ! patterns (#1920) (021a083), closes #1908 #758 #1909

Bug Fixes

• cloud control hotswap removes reserved aws: tags (#1940) (ba340b3)
• toolkit-lib: guard against a stack with no metadata in countAssemblyResults (#1952) (c07d251), closes aws-amplify/amplify-backend#3316 aws-amplify/amplify-backend#3316
• toolkit-lib: reject discovered Windows paths containing %VAR% (#1924) (ebf9bc5), closes #1763 #1849
• toolkit-lib: retry backoff has no jitter, retries stay in lockstep (#1942) (5280569), closes #1777 #1941 #1500 #1777 #1777
• toolkit-lib: throttled final event poll fails a successful deploy (#1941) (b4e81f7), closes #1777 #1777 #1777 #1950 #1777
• toolkit-lib: warn when hook failure detail can't be fetched (#1950) (03aebdc), closes #1923

Commits

• c07d251 fix(toolkit-lib): guard against a stack with no metadata in countAssemblyResu...
• ba340b3 fix: cloud control hotswap removes reserved aws: tags (#1940)
• ef24968 feat(cli): cdk synth --watch re-synthesizes on file changes (#1851)
• b4e81f7 fix(toolkit-lib): throttled final event poll fails a successful deploy (#1941)
• 03aebdc fix(toolkit-lib): warn when hook failure detail can't be fetched (#1950)
• 021a083 feat: exclude stacks from the selection with ! patterns (#1920)
• bebc0f2 chore(deps): upgrade dependencies (#1948)
• 5280569 fix(toolkit-lib): retry backoff has no jitter, retries stay in lockstep (#1942)
• ebf9bc5 fix(toolkit-lib): reject discovered Windows paths containing %VAR% (#1924)
• See full diff in compare view

Updates aws-cdk-lib from 2.268.0 to 2.269.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.269.0

Features

• bedrockagentcore: graduate Policy submodule to stable (#38687) (2b95e32), closes #37219
• update L1 CloudFormation resource definitions (#38784) (1b5e2e0)
• logs: support DELIVERY log group class (#38703) (b7a057a), closes #34338
• s3-deployment: expose deployed object version IDs (#38766) (09342df), closes #38765

Bug Fixes

• awslint: use a default import for chalk (#38110) (36d14e0), closes #38109 #38058
• core: cdk-nag warnings cannot be suppressed (#38787) (211029f)
• core: cdk-nag's findings duplicated in multi-environment apps (#38707) (4b7b2e7), closes #38483 #38135
• core: tree.json generation is quadratic in the number of subtrees (#38761) (3d034b6), closes #38762
• core: unnecessary warnings around builtins and AZs (#38673) (6860777)
• core: upgrade CloudFormation validation to latest version (#38804) (d703eb6)
• dynamodb: TableV2 emits internal grants deprecation warnings (#38806) (57b3043), closes #38709 #38399 #37892
• ecs: allow ephemeralStorageGiB for Windows Fargate platform version 1.0.0 (#37589) (855dfeb), closes #37510
• ecs: removing the last target group from a service is not deployed (#38776) (73100f6), closes #35446 #35446 #35452
• lambda-go: escape generated go build path arguments (#38785) (279d101)
• s3-deployment: sanitize all log outputs to mitigate CWE-117/93 (#37670) (47a3a38), closes #37671 #30746 #28469 #30211

---

Alpha modules (2.269.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: Glue job constructs now reject construct-managed and Glue-reserved arguments passed through defaultArguments. Previously, a managed argument set via defaultArguments was silently honored in SparkJob and PythonShellJob (customer value won over the construct default) and silently ignored in RayJob (construct default won). Both behaviors let a caller bypass the construct's security and observability defaults with no error. Passing any of the following through defaultArguments now throws a ValidationError at synthesis time:
• construct-managed arguments — --enable-continuous-cloudwatch-log, --continuous-log-logGroup, --continuous-log-logStreamPrefix, --continuous-log-conversionPattern, --enable-continuous-log-filter, --enable-metrics, --enable-observability-metrics, --enable-spark-ui, --spark-event-logs-path, --job-language, --class, --extra-jars, --user-jars-first, --extra-py-files, --extra-files, library-set
• Glue-reserved arguments — --debug, --mode, --JOB_NAME, --endpoint

A managed argument is rejected whether or not the current configuration emits it, so a disabled feature (e.g. enableMetrics: false) cannot be re-enabled through defaultArguments. Configure these through their dedicated props instead (continuousLogging, enableMetrics, enableObservabilityMetrics, sparkUI, className, extraJars, extraJarsFirst, extraPythonFiles, extraFiles). For example, replace defaultArguments: { '--enable-continuous-cloudwatch-log': 'false' } with continuousLogging: { enabled: false }. Arguments without a dedicated prop (e.g. --enable-glue-datacatalog) are unaffected and remain settable via defaultArguments.

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.269.0-alpha.0 (2026-09-10)

⚠ BREAKING CHANGES

• glue-alpha: Glue job constructs now reject construct-managed and Glue-reserved arguments passed through defaultArguments. Previously, a managed argument set via defaultArguments was silently honored in SparkJob and PythonShellJob (customer value won over the construct default) and silently ignored in RayJob (construct default won). Both behaviors let a caller bypass the construct's security and observability defaults with no error. Passing any of the following through defaultArguments now throws a ValidationError at synthesis time:
• construct-managed arguments — --enable-continuous-cloudwatch-log, --continuous-log-logGroup, --continuous-log-logStreamPrefix, --continuous-log-conversionPattern, --enable-continuous-log-filter, --enable-metrics, --enable-observability-metrics, --enable-spark-ui, --spark-event-logs-path, --job-language, --class, --extra-jars, --user-jars-first, --extra-py-files, --extra-files, library-set
• Glue-reserved arguments — --debug, --mode, --JOB_NAME, --endpoint

A managed argument is rejected whether or not the current configuration emits it, so a disabled feature (e.g. enableMetrics: false) cannot be re-enabled through defaultArguments. Configure these through their dedicated props instead (continuousLogging, enableMetrics, enableObservabilityMetrics, sparkUI, className, extraJars, extraJarsFirst, extraPythonFiles, extraFiles). For example, replace defaultArguments: { '--enable-continuous-cloudwatch-log': 'false' } with continuousLogging: { enabled: false }. Arguments without a dedicated prop (e.g. --enable-glue-datacatalog) are unaffected and remain settable via defaultArguments.

The checkNoReservedArgs(defaultArguments?) method on the Job base class was removed. It is replaced by two protected members: setManagedArgument(key, value?), which each job class calls to declare (and, when a value is present, emit) a managed argument, and mergeDefaultArguments(defaultArguments?), which validates the caller-supplied defaultArguments against the accumulated reserved set and returns the merged map.

• route53resolver-alpha: FirewallRuleGroupAssociation now honors the previously-ignored mutationProtection and name props. Stacks that set mutationProtection: true will enable mutation protection on redeploy (which blocks further CloudFormation update/delete until it is set back to false); stacks that set name will write it to the template, which may replace the association.
• glue-alpha: trigger Action and Condition are no longer plain objects — use Action.job(...) / Action.crawler(...) and Condition.job(...) / Condition.crawler(...). Jobs are referenced via IJobRef and crawlers via ICrawlerRef (a CfnCrawler instance or CfnCrawler.fromCrawlerName(...)) instead of a CfnCrawler field or crawler-name string; IJob now extends the generated IJobRef. addDailyScheduledTrigger/addWeeklyScheduledTrigger/addCustomScheduledTrigger are replaced by addScheduledTrigger(id, { schedule, ... }) (use TriggerSchedule.daily()/weekly()/cron(...)). addNotifyEventTrigger is renamed addEventTrigger (NotifyEventTriggerOptions → EventTriggerOptions). All addXxxTrigger methods now return ITriggerRef instead of CfnTrigger.
• glue-alpha: PartitionProjectionConfiguration's variant fields (integerRange, dateRange, interval, digits, format, intervalUnit, values) are no longer public; DATE projection now takes step: { interval, intervalUnit } instead of top-level interval/intervalUnit.
• glue-alpha: ConnectionOptions no longer has subnet, vpc, or vpcSubnets; use network: ConnectionNetwork.subnet(...) or network: ConnectionNetwork.vpc(...) instead.

Features

• glue-alpha: ensure job parameters consistency (#38480) (bc7dc0c)
• glue-alpha: model Connection VPC placement as a value object (#38729) (f72e9fe)
• glue-alpha: model partition projection variants as internal state (#38726) (16527cd)
• glue-alpha: overhaul the workflow trigger API (#38579) (c8f917d)

... (truncated)

Commits

• 5df21f1 chore: update analytics metadata blueprints
• 61bba72 chore(release): 2.269.0
• 2b95e32 feat(bedrockagentcore): graduate Policy submodule to stable (#38687)
• 57b3043 fix(dynamodb): TableV2 emits internal grants deprecation warnings (#38806)
• d703eb6 fix(core): upgrade CloudFormation validation to latest version (#38804)
• 1b5e2e0 feat: update L1 CloudFormation resource definitions (#38784)
• 855dfeb fix(ecs): allow ephemeralStorageGiB for Windows Fargate platform version 1.0....
• 1083ba5 docs(stepfunctions-tasks): clarify that fromStringSet only accepts static arr...
• 73100f6 fix(ecs): removing the last target group from a service is not deployed (#38776)
• 0749210 chore(bedrock-alpha): add OpenAI foundation models (#38760)
• Additional commits viewable in compare view

Updates aws-cdk from 2.1140.0 to 2.1141.0

Release notes

Sourced from aws-cdk's releases.

aws-cdk@v2.1141.0

2.1141.0 (2026-09-09)

Features

• cli: cdk synth --watch re-synthesizes on file changes (#1851) (ef24968), closes #1782
• deps: upgrade aws-cdk-lib (#1943) (af2f9a3)
• exclude stacks from the selection with ! patterns (#1920) (021a083), closes #1908 #758 #1909

Commits

• ef24968 feat(cli): cdk synth --watch re-synthesizes on file changes (#1851)
• 021a083 feat: exclude stacks from the selection with ! patterns (#1920)
• d4cb6e9 chore(cli): publish toolkit versions to docs (#1944)
• bebc0f2 chore(deps): upgrade dependencies (#1948)
• af2f9a3 feat(deps): upgrade aws-cdk-lib (#1943)
• See full diff in compare view