chore(deps): update dependency aws-cdk-lib to v2.265.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
aws-cdk-lib (source)	2.261.0 → 2.265.0

---

Release Notes

aws/aws-cdk (aws-cdk-lib)

v2.265.0

Compare Source

Features

• bedrock-agentcore: add StreamDeliveryResources support to Memory L2 Construct (#​37527) (817c50b)
• cloudwatch: support AT_LEAST expression for composite alarm rules (#​37693) (974e43b), closes #​37692 #​36100
• docdb: add managed password support (#​35711) (fcf54bf)
• ec2: add ipAddressType and dnsRecordIpType to GatewayVpcEndpoint (#​37900) (000f532), closes #​37883
• ec2: add volume initialization rate to ebs props for launchtemplate (#​36451) (da4281e), closes #​36374
• kinesisfirehose: add HTTP Endpoint and Datadog destination (#​33657) (4c47171), closes #​20354 #​15502

Bug Fixes

• cloudwatch: make concrete widgets assignable to widget interface (#​37695) (e322035), closes #​37600
• core: cdk validate can hang indefinitely (#​38510) (0a238f3), closes #​38498 #​38425
• secretsmanager: correct SAR rotation app versions for GovCloud (#​38462) (a29b5c0)
• bump brace-expansion to 5.0.9 to address CVE-2026-69152 (#​38520) (8764b7b), closes #​38496 #​38410

---

Alpha modules (2.265.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: PySparkFlexEtlJob and ScalaSparkFlexEtlJob now default to GlueVersion.V5_0 instead of V3_0. Set glueVersion explicitly to keep the previous behavior.
• glue-alpha: removal policy of existing Database resources will change to RETAIN.

Features

• glue-alpha: default Flex jobs to Glue 5.0 (#​38543) (36d4976)
• glue-alpha: removal policy is RETAIN for Database by default (#​38535) (9669928)
• glue-alpha: warn on plaintext secrets (#​38538) (10bf0b5)

Bug Fixes

• glue-alpha: warn when S3Table grants cover a shared bucket (#​38542) (d81d2d6)
• mediaconnect-alpha: update validation to allow adding an underscore to name (#​38539) (7c85994)

v2.264.0

Compare Source

⚠ BREAKING CHANGES

• bedrockagentcore: Gateway metric helpers now emit corrected CloudWatch dimensions per-gateway
  metrics use { Operation, Protocol, Resource } (was { Resource }). Alarms/dashboards built on the
  old dimensions must be updated.
• bedrockagentcore: RuntimeBase metric helpers now emit corrected CloudWatch dimensions per-resource metrics use { Operation, Name, Resource } (was { Resource }) and aggregated metrics use { AggregateOperation } (was { Resource: 'All' }). Alarms/dashboards built on the old dimensions must be updated.

Features

• update L1 CloudFormation resource definitions (#​38526) (b5693cb)
• cloudwatch: support alarm mute rules (#​37504) (c3540bb), closes #​37502
• update L1 CloudFormation resource definitions (#​38479) (279340d)

Bug Fixes

• bedrockagentcore: gateway metrics emit correct CloudWatch dimension (#​38487) (5a7d360)
• bedrockagentcore: runtime metrics emit correct CloudWatch dimensions (#​38486) (4e44f24)
• cloudfront: warn when minimumProtocolVersion is set without a certificate (#​37250) (52ec5f7), closes #​35404
• ec2: allow EBS gp3 and io2 volumes up to 64 TiB (#​37049) (10711ba), closes #​37045
• stepfunctions-tasks: call-rest-api CallApiGatewayRestApiEndpoint does not support JsonATA for api_path (#​37738) (9f0afdc), closes #​37728 /github.com/aws/aws-cdk/blob/e207b76cc2503701b3c4e2c87023617b485b2fde/packages/aws-cdk-lib/aws-stepfunctions/lib/private/jsonata.ts#L1

---

Alpha modules (2.264.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: IDatabase.catalogArn and IDatabase.catalogId were removed in factor of a type
  safe ICatalog, which has catalogArn and catalogId. Consumers and implementations were updated
  accordingly.

Features

• glue-alpha: new Catalog L2 (#​38443) (6a8ba8e)
• glue-alpha: strengthen data encryption for S3Table (#​38501) (eb81d5e), closes /docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-5

Bug Fixes

• glue-alpha: enable key rotation for security configuration encryption (#​38512) (18560e0)
• mediaconnect-alpha: addOutput options and simplified VPC interface referencing (#​38515) (3c71466), closes #​38517

v2.263.0

Compare Source

Features

• autoscaling: add support for AutoScalingInstanceRefresh UpdatePolicy (#​38277) (434157f), closes #​38276
• docdb: support per-instance maintenance window on DatabaseCluster (#​38315) (5390624), closes #​30391
• ecs: add support for using existing Cloud Map namespaces in ECS clusters (#​36812) (bda00bf), closes #​26698
• eks: add Provisioned Control Plane support with controlPlaneScalingTier property (#​36651) (5ea1054), closes #​36650
• eks: add support for Kubernetes version 1.36 (#​38441) (da27b6c), closes #​38411
• lambda: add Java8AL2023, Java11AL2023 and Java17AL2023 runtime for Lambda #​38418 (#​38419) (1e55176)
• lambda: add logGroup and systemLogLevel to CapacityProvider (#​38183) (61a2e2d), closes #​38182
• lambda: add PropagateTags to CapacityProvider for tag propagation (#​38180) (6f86f97), closes #​38181

Bug Fixes

• core: upgrade cloudformation-validate library (#​38444) (d26e507), closes #​38412
• bump brace-expansion to 5.0.8 to address CVE-2026-14257 (#​38410) (5aaa395), closes #​38409 #​38063

---

Alpha modules (2.263.0-alpha.0)

⚠ BREAKING CHANGES

• mediaconnect: removalPolicy prop removed from FlowProps, GatewayProps, and BridgeProps. These resources now follow CloudFormation's default deletion behaviour (Delete).

Bug Fixes

• glue-alpha: race condition when creating mutiple indices (#​38016) (18b1947), closes #​24813 #​34 #​34
• mediaconnect: jsdoc typo (#​38434) (7fe6d3d)
• mediaconnect: remove default removal policy (#​38437) (238193d)

v2.262.2

Compare Source

Bug Fixes

• revert "fix(core): stack.node.addDependency gets slower as stacks grow (#​38314)" (#​38417) (d97dd8d), closes #​38406 #​38406

---

Alpha modules (2.262.2-alpha.0)

v2.262.1

Compare Source

Bug Fixes

• core: bump @aws/cloudformation-validate to 1.5.1-beta to fix install on Node != 22.x (#​38382) (d409b96), closes #​38380
• core: env CDK_VALIDATION=false does not disable built-in template validation (#​38379) (cc4208c), closes #​38378

---

Alpha modules (2.262.1-alpha.0)

v2.262.0

Compare Source

Features

• ecs: add support ECS-optimized Amazon Linux 2023 (Neuron) AMI (#​34689) (ad665c4)
• mediaconnect: l2 construct (#​37945) (8e9e001)
• update L1 CloudFormation resource definitions (#​38275) (2b1c632)
• apigateway: alb integration (#​36247) (20dbdd9), closes #​36184
• bedrockagentcore: support service/region in IAM credential provider for gateway targets (#​37697) (08a2543), closes #​37696
• cloudfront: add Managed-HostHeaderOnly origin request policy (#​38236) (0e66e47), closes #​38234
• core: templates are validated against a comprehensive default rule set (#​38135) (023c5bf)

Bug Fixes

• cross-stack warnings are emitted for nested stacks (#​38355) (db98909)
• apigateway: revert alb integration that breaks jsii go packaging (#​38305) (18158a4), closes #​36247 #​36247 #​36247 #​36247
• aws-cdk-lib: fatal validations don't show plugin name (#​38273) (a88d1ba)
• aws-cdk-lib: validation namespaces for annotations are inconsistent (#​38256) (75893d9)
• backup: lifecycle and vault lock validations reject tokenized durations (#​38264) (0ff20a3), closes #​38263 #​38246 #​37751 #​25943 #​38246 #​37751 #​25943
• certificatemanager: use hasOwnProperty in apexDomain to prevent prototype collision (#​37195) (ec38947), closes #​37193
• cloudfront-origins: validate httpPort and httpsPort range in HttpOrigin (#​37872) (8a62b58)
• core: stack-related validation has an empty construct path (#​38350) (0af7c34)
• core: stack.node.addDependency gets slower as stacks grow (#​38314) (0728618)
• core: synth crashes with EISDIR on a symlink-to-directory when a validation plugin is registered (#​38299) (be0fdc4), closes #​38295
• elasticloadbalancingv2: improve handling for dropInvalidHeaderFields in case of default or switching from true to false (#​36483) (208b9db), closes #​36409
• lambda: allow SnapStart for container image functions (#​38265) (586dc4f), closes #​30898
• lambda: validations reject tokenized provisioned concurrency and async invoke config values (#​38246) (4aa7e78), closes #​38245 #​37197 #​36275 #​37197
• opensearchservice: allow gp3 ebs throughput up to 2000 MiB/s (#​38001) (f0cfc5b), closes #​38000 #​36074
• spec2cdk: add IVS to event pattern method name prefixes (#​38322) (d6d1e8d)
• validation: incorrectly relative paths in Cloud Assemblies (#​38352) (3f9422f), closes #​38333
• validation: validation reports are not self-contained (#​38333) (5d11d70)

Reverts

• lambda: revert SnapStart for container image functions (#​38265) (#​38281) (3b92863)

---

Alpha modules (2.262.0-alpha.0)

Bug Fixes

• redshift-alpha: quote identifiers and escape literals containing special characters (#​38269) (3cb6844)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
npm error Refusing to fetch "https://registry.npmjs.org/aws-cdk-lib/-/aws-cdk-lib-2.265.0.tgz"
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-08-16T21_47_38_742Z-debug-0.log