chore(deps): bump the cdk group across 1 directory with 2 updates

[dependabot]

Bumps the cdk group with 2 updates in the / directory: aws-cdk-lib and aws-cdk.

Updates aws-cdk-lib from 2.267.0 to 2.269.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.269.0

Features

• bedrockagentcore: graduate Policy submodule to stable (#38687) (2b95e32), closes #37219
• update L1 CloudFormation resource definitions (#38784) (1b5e2e0)
• logs: support DELIVERY log group class (#38703) (b7a057a), closes #34338
• s3-deployment: expose deployed object version IDs (#38766) (09342df), closes #38765

Bug Fixes

• awslint: use a default import for chalk (#38110) (36d14e0), closes #38109 #38058
• core: cdk-nag warnings cannot be suppressed (#38787) (211029f)
• core: cdk-nag's findings duplicated in multi-environment apps (#38707) (4b7b2e7), closes #38483 #38135
• core: tree.json generation is quadratic in the number of subtrees (#38761) (3d034b6), closes #38762
• core: unnecessary warnings around builtins and AZs (#38673) (6860777)
• core: upgrade CloudFormation validation to latest version (#38804) (d703eb6)
• dynamodb: TableV2 emits internal grants deprecation warnings (#38806) (57b3043), closes #38709 #38399 #37892
• ecs: allow ephemeralStorageGiB for Windows Fargate platform version 1.0.0 (#37589) (855dfeb), closes #37510
• ecs: removing the last target group from a service is not deployed (#38776) (73100f6), closes #35446 #35446 #35452
• lambda-go: escape generated go build path arguments (#38785) (279d101)
• s3-deployment: sanitize all log outputs to mitigate CWE-117/93 (#37670) (47a3a38), closes #37671 #30746 #28469 #30211

---

Alpha modules (2.269.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: Glue job constructs now reject construct-managed and Glue-reserved arguments passed through defaultArguments. Previously, a managed argument set via defaultArguments was silently honored in SparkJob and PythonShellJob (customer value won over the construct default) and silently ignored in RayJob (construct default won). Both behaviors let a caller bypass the construct's security and observability defaults with no error. Passing any of the following through defaultArguments now throws a ValidationError at synthesis time:
• construct-managed arguments — --enable-continuous-cloudwatch-log, --continuous-log-logGroup, --continuous-log-logStreamPrefix, --continuous-log-conversionPattern, --enable-continuous-log-filter, --enable-metrics, --enable-observability-metrics, --enable-spark-ui, --spark-event-logs-path, --job-language, --class, --extra-jars, --user-jars-first, --extra-py-files, --extra-files, library-set
• Glue-reserved arguments — --debug, --mode, --JOB_NAME, --endpoint

A managed argument is rejected whether or not the current configuration emits it, so a disabled feature (e.g. enableMetrics: false) cannot be re-enabled through defaultArguments. Configure these through their dedicated props instead (continuousLogging, enableMetrics, enableObservabilityMetrics, sparkUI, className, extraJars, extraJarsFirst, extraPythonFiles, extraFiles). For example, replace defaultArguments: { '--enable-continuous-cloudwatch-log': 'false' } with continuousLogging: { enabled: false }. Arguments without a dedicated prop (e.g. --enable-glue-datacatalog) are unaffected and remain settable via defaultArguments.

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.269.0-alpha.0 (2026-09-10)

⚠ BREAKING CHANGES

• glue-alpha: Glue job constructs now reject construct-managed and Glue-reserved arguments passed through defaultArguments. Previously, a managed argument set via defaultArguments was silently honored in SparkJob and PythonShellJob (customer value won over the construct default) and silently ignored in RayJob (construct default won). Both behaviors let a caller bypass the construct's security and observability defaults with no error. Passing any of the following through defaultArguments now throws a ValidationError at synthesis time:
• construct-managed arguments — --enable-continuous-cloudwatch-log, --continuous-log-logGroup, --continuous-log-logStreamPrefix, --continuous-log-conversionPattern, --enable-continuous-log-filter, --enable-metrics, --enable-observability-metrics, --enable-spark-ui, --spark-event-logs-path, --job-language, --class, --extra-jars, --user-jars-first, --extra-py-files, --extra-files, library-set
• Glue-reserved arguments — --debug, --mode, --JOB_NAME, --endpoint

A managed argument is rejected whether or not the current configuration emits it, so a disabled feature (e.g. enableMetrics: false) cannot be re-enabled through defaultArguments. Configure these through their dedicated props instead (continuousLogging, enableMetrics, enableObservabilityMetrics, sparkUI, className, extraJars, extraJarsFirst, extraPythonFiles, extraFiles). For example, replace defaultArguments: { '--enable-continuous-cloudwatch-log': 'false' } with continuousLogging: { enabled: false }. Arguments without a dedicated prop (e.g. --enable-glue-datacatalog) are unaffected and remain settable via defaultArguments.

The checkNoReservedArgs(defaultArguments?) method on the Job base class was removed. It is replaced by two protected members: setManagedArgument(key, value?), which each job class calls to declare (and, when a value is present, emit) a managed argument, and mergeDefaultArguments(defaultArguments?), which validates the caller-supplied defaultArguments against the accumulated reserved set and returns the merged map.

• route53resolver-alpha: FirewallRuleGroupAssociation now honors the previously-ignored mutationProtection and name props. Stacks that set mutationProtection: true will enable mutation protection on redeploy (which blocks further CloudFormation update/delete until it is set back to false); stacks that set name will write it to the template, which may replace the association.
• glue-alpha: trigger Action and Condition are no longer plain objects — use Action.job(...) / Action.crawler(...) and Condition.job(...) / Condition.crawler(...). Jobs are referenced via IJobRef and crawlers via ICrawlerRef (a CfnCrawler instance or CfnCrawler.fromCrawlerName(...)) instead of a CfnCrawler field or crawler-name string; IJob now extends the generated IJobRef. addDailyScheduledTrigger/addWeeklyScheduledTrigger/addCustomScheduledTrigger are replaced by addScheduledTrigger(id, { schedule, ... }) (use TriggerSchedule.daily()/weekly()/cron(...)). addNotifyEventTrigger is renamed addEventTrigger (NotifyEventTriggerOptions → EventTriggerOptions). All addXxxTrigger methods now return ITriggerRef instead of CfnTrigger.
• glue-alpha: PartitionProjectionConfiguration's variant fields (integerRange, dateRange, interval, digits, format, intervalUnit, values) are no longer public; DATE projection now takes step: { interval, intervalUnit } instead of top-level interval/intervalUnit.
• glue-alpha: ConnectionOptions no longer has subnet, vpc, or vpcSubnets; use network: ConnectionNetwork.subnet(...) or network: ConnectionNetwork.vpc(...) instead.

Features

• glue-alpha: ensure job parameters consistency (#38480) (bc7dc0c)
• glue-alpha: model Connection VPC placement as a value object (#38729) (f72e9fe)
• glue-alpha: model partition projection variants as internal state (#38726) (16527cd)
• glue-alpha: overhaul the workflow trigger API (#38579) (c8f917d)

... (truncated)

Commits

• 5df21f1 chore: update analytics metadata blueprints
• 61bba72 chore(release): 2.269.0
• 2b95e32 feat(bedrockagentcore): graduate Policy submodule to stable (#38687)
• 57b3043 fix(dynamodb): TableV2 emits internal grants deprecation warnings (#38806)
• d703eb6 fix(core): upgrade CloudFormation validation to latest version (#38804)
• 1b5e2e0 feat: update L1 CloudFormation resource definitions (#38784)
• 855dfeb fix(ecs): allow ephemeralStorageGiB for Windows Fargate platform version 1.0....
• 1083ba5 docs(stepfunctions-tasks): clarify that fromStringSet only accepts static arr...
• 73100f6 fix(ecs): removing the last target group from a service is not deployed (#38776)
• 0749210 chore(bedrock-alpha): add OpenAI foundation models (#38760)
• Additional commits viewable in compare view

Updates aws-cdk from 2.1139.0 to 2.1141.0

Release notes

Sourced from aws-cdk's releases.

aws-cdk@v2.1141.0

2.1141.0 (2026-09-09)

Features

• cli: cdk synth --watch re-synthesizes on file changes (#1851) (ef24968), closes #1782
• deps: upgrade aws-cdk-lib (#1943) (af2f9a3)
• exclude stacks from the selection with ! patterns (#1920) (021a083), closes #1908 #758 #1909

aws-cdk@v2.1140.0

2.1140.0 (2026-09-04)

Features

• deps: upgrade aws-cdk-lib (#1914) (c1d93ab)

Bug Fixes

• fatal failures hide the underlying error cause (#1939) (5b77563)

Commits

• ef24968 feat(cli): cdk synth --watch re-synthesizes on file changes (#1851)
• 021a083 feat: exclude stacks from the selection with ! patterns (#1920)
• d4cb6e9 chore(cli): publish toolkit versions to docs (#1944)
• bebc0f2 chore(deps): upgrade dependencies (#1948)
• af2f9a3 feat(deps): upgrade aws-cdk-lib (#1943)
• 5b77563 fix: fatal failures hide the underlying error cause (#1939)
• c1d93ab feat(deps): upgrade aws-cdk-lib (#1914)
• 50db732 refactor(toolkit-lib): rename versioned stack selection methods (#1910)
• 6ae45d7 chore(deps): upgrade dependencies (#1913)
• 5766544 chore: ban direct child_process and shell:true outside the subprocess tool (#...
• See full diff in compare view

[github-actions]

Hello 👋! When you're ready to run Chromatic, please apply the run_chromatic label to this PR.

You will need to reapply the label each time you want to run Chromatic.

Click here to see the Chromatic project.

[github-actions]

🚀 Image pushed to AWS ECR

Image digest: sha256:e87f2cd12f4a591ea586664d65798d38c204e21ca0d34ec38c9a0e4f6a1ab580

🐛 Run the image locally

The following can be used to run the image locally:

# Refer to image using the immutable digest. Find alternatives below.
IMAGE_IDENTIFIER="@sha256:e87f2cd12f4a591ea586664d65798d38c204e21ca0d34ec38c9a0e4f6a1ab580"

# Refer to image using branch tag
# IMAGE_IDENTIFIER=":branch-dependabot-npm_and_yarn-cdk-463a74a59a"

# Refer to image using build tag
# IMAGE_IDENTIFIER=":build-31221"

# Set environment variables for the AWS CLI
AWS_PROFILE="<A_PROFILE_FROM_JANUS>"
AWS_DEFAULT_REGION="eu-west-1"

IMAGE_ACCOUNT_ID=$(aws ssm get-parameter --name /organisation/accounts/artifacts --query "Parameter.Value" --output text)
REGISTRY="${IMAGE_ACCOUNT_ID}.dkr.ecr.${AWS_DEFAULT_REGION}.amazonaws.com"
IMAGE="${REGISTRY}/guardian/dotcom-rendering${IMAGE_IDENTIFIER}"

# Login to AWS ECR https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry_auth.html
aws ecr get-login-password | docker login --username AWS --password-stdin $REGISTRY

# Pull the image
docker pull $IMAGE

# Run the image. You'll likely need to set additional flags. See https://docs.docker.com/reference/cli/docker/container/run.
docker run $IMAGE

---

From guardian/actions-publish-image.

[github-actions]

Deploy build 31221 of dotcom:rendering-all to CODE

All deployment options

• Deploy build 31221 of dotcom:rendering-all to CODE
• Deploy parts of build 31221 to CODE by previewing it first
• What's on CODE right now?

---

From guardian/actions-riff-raff.

[github-actions]

Deploy build 3198 of dotcom:ab-testing to CODE

All deployment options

• Deploy build 3198 of dotcom:ab-testing to CODE
• Deploy parts of build 3198 to CODE by previewing it first
• What's on CODE right now?

---

From guardian/actions-riff-raff.

[akash1810]

@dependabot rebase