build(deps): Bump aws-cdk-lib from 2.268.0 to 2.269.0 in /cdk

[dependabot]

Bumps aws-cdk-lib from 2.268.0 to 2.269.0.

Release notes

Sourced from aws-cdk-lib's releases.

v2.269.0

Features

• bedrockagentcore: graduate Policy submodule to stable (#38687) (2b95e32), closes #37219
• update L1 CloudFormation resource definitions (#38784) (1b5e2e0)
• logs: support DELIVERY log group class (#38703) (b7a057a), closes #34338
• s3-deployment: expose deployed object version IDs (#38766) (09342df), closes #38765

Bug Fixes

• awslint: use a default import for chalk (#38110) (36d14e0), closes #38109 #38058
• core: cdk-nag warnings cannot be suppressed (#38787) (211029f)
• core: cdk-nag's findings duplicated in multi-environment apps (#38707) (4b7b2e7), closes #38483 #38135
• core: tree.json generation is quadratic in the number of subtrees (#38761) (3d034b6), closes #38762
• core: unnecessary warnings around builtins and AZs (#38673) (6860777)
• core: upgrade CloudFormation validation to latest version (#38804) (d703eb6)
• dynamodb: TableV2 emits internal grants deprecation warnings (#38806) (57b3043), closes #38709 #38399 #37892
• ecs: allow ephemeralStorageGiB for Windows Fargate platform version 1.0.0 (#37589) (855dfeb), closes #37510
• ecs: removing the last target group from a service is not deployed (#38776) (73100f6), closes #35446 #35446 #35452
• lambda-go: escape generated go build path arguments (#38785) (279d101)
• s3-deployment: sanitize all log outputs to mitigate CWE-117/93 (#37670) (47a3a38), closes #37671 #30746 #28469 #30211

---

Alpha modules (2.269.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: Glue job constructs now reject construct-managed and Glue-reserved arguments passed through defaultArguments. Previously, a managed argument set via defaultArguments was silently honored in SparkJob and PythonShellJob (customer value won over the construct default) and silently ignored in RayJob (construct default won). Both behaviors let a caller bypass the construct's security and observability defaults with no error. Passing any of the following through defaultArguments now throws a ValidationError at synthesis time:
• construct-managed arguments — --enable-continuous-cloudwatch-log, --continuous-log-logGroup, --continuous-log-logStreamPrefix, --continuous-log-conversionPattern, --enable-continuous-log-filter, --enable-metrics, --enable-observability-metrics, --enable-spark-ui, --spark-event-logs-path, --job-language, --class, --extra-jars, --user-jars-first, --extra-py-files, --extra-files, library-set
• Glue-reserved arguments — --debug, --mode, --JOB_NAME, --endpoint

A managed argument is rejected whether or not the current configuration emits it, so a disabled feature (e.g. enableMetrics: false) cannot be re-enabled through defaultArguments. Configure these through their dedicated props instead (continuousLogging, enableMetrics, enableObservabilityMetrics, sparkUI, className, extraJars, extraJarsFirst, extraPythonFiles, extraFiles). For example, replace defaultArguments: { '--enable-continuous-cloudwatch-log': 'false' } with continuousLogging: { enabled: false }. Arguments without a dedicated prop (e.g. --enable-glue-datacatalog) are unaffected and remain settable via defaultArguments.

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.269.0-alpha.0 (2026-09-10)

⚠ BREAKING CHANGES

• glue-alpha: Glue job constructs now reject construct-managed and Glue-reserved arguments passed through defaultArguments. Previously, a managed argument set via defaultArguments was silently honored in SparkJob and PythonShellJob (customer value won over the construct default) and silently ignored in RayJob (construct default won). Both behaviors let a caller bypass the construct's security and observability defaults with no error. Passing any of the following through defaultArguments now throws a ValidationError at synthesis time:
• construct-managed arguments — --enable-continuous-cloudwatch-log, --continuous-log-logGroup, --continuous-log-logStreamPrefix, --continuous-log-conversionPattern, --enable-continuous-log-filter, --enable-metrics, --enable-observability-metrics, --enable-spark-ui, --spark-event-logs-path, --job-language, --class, --extra-jars, --user-jars-first, --extra-py-files, --extra-files, library-set
• Glue-reserved arguments — --debug, --mode, --JOB_NAME, --endpoint

A managed argument is rejected whether or not the current configuration emits it, so a disabled feature (e.g. enableMetrics: false) cannot be re-enabled through defaultArguments. Configure these through their dedicated props instead (continuousLogging, enableMetrics, enableObservabilityMetrics, sparkUI, className, extraJars, extraJarsFirst, extraPythonFiles, extraFiles). For example, replace defaultArguments: { '--enable-continuous-cloudwatch-log': 'false' } with continuousLogging: { enabled: false }. Arguments without a dedicated prop (e.g. --enable-glue-datacatalog) are unaffected and remain settable via defaultArguments.

The checkNoReservedArgs(defaultArguments?) method on the Job base class was removed. It is replaced by two protected members: setManagedArgument(key, value?), which each job class calls to declare (and, when a value is present, emit) a managed argument, and mergeDefaultArguments(defaultArguments?), which validates the caller-supplied defaultArguments against the accumulated reserved set and returns the merged map.

• route53resolver-alpha: FirewallRuleGroupAssociation now honors the previously-ignored mutationProtection and name props. Stacks that set mutationProtection: true will enable mutation protection on redeploy (which blocks further CloudFormation update/delete until it is set back to false); stacks that set name will write it to the template, which may replace the association.
• glue-alpha: trigger Action and Condition are no longer plain objects — use Action.job(...) / Action.crawler(...) and Condition.job(...) / Condition.crawler(...). Jobs are referenced via IJobRef and crawlers via ICrawlerRef (a CfnCrawler instance or CfnCrawler.fromCrawlerName(...)) instead of a CfnCrawler field or crawler-name string; IJob now extends the generated IJobRef. addDailyScheduledTrigger/addWeeklyScheduledTrigger/addCustomScheduledTrigger are replaced by addScheduledTrigger(id, { schedule, ... }) (use TriggerSchedule.daily()/weekly()/cron(...)). addNotifyEventTrigger is renamed addEventTrigger (NotifyEventTriggerOptions → EventTriggerOptions). All addXxxTrigger methods now return ITriggerRef instead of CfnTrigger.
• glue-alpha: PartitionProjectionConfiguration's variant fields (integerRange, dateRange, interval, digits, format, intervalUnit, values) are no longer public; DATE projection now takes step: { interval, intervalUnit } instead of top-level interval/intervalUnit.
• glue-alpha: ConnectionOptions no longer has subnet, vpc, or vpcSubnets; use network: ConnectionNetwork.subnet(...) or network: ConnectionNetwork.vpc(...) instead.

Features

• glue-alpha: ensure job parameters consistency (#38480) (bc7dc0c)
• glue-alpha: model Connection VPC placement as a value object (#38729) (f72e9fe)
• glue-alpha: model partition projection variants as internal state (#38726) (16527cd)
• glue-alpha: overhaul the workflow trigger API (#38579) (c8f917d)

... (truncated)

Commits

• 5df21f1 chore: update analytics metadata blueprints
• 61bba72 chore(release): 2.269.0
• 2b95e32 feat(bedrockagentcore): graduate Policy submodule to stable (#38687)
• 57b3043 fix(dynamodb): TableV2 emits internal grants deprecation warnings (#38806)
• d703eb6 fix(core): upgrade CloudFormation validation to latest version (#38804)
• 1b5e2e0 feat: update L1 CloudFormation resource definitions (#38784)
• 855dfeb fix(ecs): allow ephemeralStorageGiB for Windows Fargate platform version 1.0....
• 1083ba5 docs(stepfunctions-tasks): clarify that fromStringSet only accepts static arr...
• 73100f6 fix(ecs): removing the last target group from a service is not deployed (#38776)
• 0749210 chore(bedrock-alpha): add OpenAI foundation models (#38760)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)