Skip to content

chore(deps-dev): bump aws-cdk-lib from 2.220.0 to 2.253.0 in /samples/agentic-knowledge-discovery - #180

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/samples/agentic-knowledge-discovery/aws-cdk-lib-2.253.0
Open

chore(deps-dev): bump aws-cdk-lib from 2.220.0 to 2.253.0 in /samples/agentic-knowledge-discovery#180
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/samples/agentic-knowledge-discovery/aws-cdk-lib-2.253.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor

Bumps aws-cdk-lib from 2.220.0 to 2.253.0.

Release notes

Sourced from aws-cdk-lib's releases.

v2.253.0

Features

Bug Fixes

  • cloudfront: skip cachePolicyName length validation for unresolved tokens (#37751) (3b96e97), closes #23567 #34102
  • cloudwatch: remove false positive warning for CDK tokens in MathExpression (#36882) (c29dc17), closes #34977
  • codebuild: correct S3 log encryption boolean inversion (#37761) (4031918)
  • ecs: enabling the circuitBreaker is not recommended loudly enough (#37755) (a52af7d)
  • eks: add dependency from HelmChart custom resource to s3 chartAsset IAM policy (#37731) (99d0a5b), closes #19880

Alpha modules (2.253.0-alpha.0)

Features

  • bedrock-agentcore-alpha: add OnlineEvaluationConfig and Evaluator L2 constructs (#37615) (c13de04), closes #37614
  • glue-alpha: add extraPythonFiles support to PythonShellJob (#37130) (c9c6f9c), closes #34448

Bug Fixes

  • bedrock-agentcore-alpha: self-managed memory strategy validation throws on unresolved tokens (#37691) (7956537), closes #37197

v2.252.0

Features

Bug Fixes


Alpha modules (2.252.0-alpha.0)

v2.251.0

⚠ BREAKING CHANGES

  • ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

aws-elasticloadbalancing: AWS::ElasticLoadBalancing::LoadBalancer: SourceSecurityGroup attribute removed.

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.267.0-alpha.0 (2026-08-27)

⚠ BREAKING CHANGES

  • glue-alpha: schema Type is now an opaque class; construct column types via the Schema factories or Schema.custom(...) rather than { isPrimitive, inputString } literals. StorageParameter.custom(key, value) requires a string value, and StorageParameter.writeKmsKeyId takes a kms.IKey instead of a string.
  • glue-alpha: S3TableProps.bucket/encryption/encryptionKey are removed. Use storage: S3TableStorage.managedBucket(S3TableEncryption.kms(key?)) / S3TableStorage.fromBucket(bucket) and clientSideEncryption: TableClientSideEncryption.kms(key?). S3Table.encryption/encryptionKey are removed (clientSideEncryptionKey exposes the client-side key; read bucket.encryptionKey for server-side). The TableEncryption enum and the deprecated Table/TableProps are removed — use S3Table.

Features

  • glue-alpha: add a typed secret input to Connection (#38585) (ede4a1c)
  • glue-alpha: add subnet selection to Connection (#38561) (f9d7eac)
  • glue-alpha: model S3Table storage/encryption as value objects (#38591) (9990e16)
  • glue-alpha: opaque Schema Type with Schema.custom, and stronger StorageParameter types (#38592) (5c45eb0)
  • msk-alpha: support Kafka 4.2 (#38323) (97b181c)
  • s3tables-alpha: add storage class configuration support (#37339) (63ccf6d)

Bug Fixes

  • glue-alpha: validate that DATE partition projection interval is set when required (#38594) (0e2b582)
  • lambda-python-alpha: escape Docker bundling command arguments (#38583) (f7ce07b)

2.266.0-alpha.0 (2026-08-19)

⚠ BREAKING CHANGES

  • glue-alpha: DataQualityRulesetProps.rulesetDqdl: string is replaced by dqdl: Dqdl. Build it with Dqdl.fromString('Rules = [ ... ]').
  • glue-alpha: s3Encryption, cloudWatchEncryption, and jobBookmarksEncryption are no longer object literals. Use S3Encryption.s3Managed() / S3Encryption.kms(key?), CloudWatchEncryption.kms(key?), and JobBookmarksEncryption.clientSideKms(key?). The CloudWatchEncryptionMode and JobBookmarksEncryptionMode enums are removed (their mode is now implicit); S3EncryptionMode is retained.
  • glue-alpha: this is a corrective breaking change. Apps that leaned on the bug, and did things like InputFormat x = OutputFormat.AVRO; will get a compilation error in other jsii languages. The intended usage, on the other hand, was broken before and works now.
  • glue-alpha: workerType and numberOfWorkers are no longer top-level job props. For Spark jobs, pass them together via workerConfiguration: { workerType, numberOfWorkers }. PythonShellJob no longer accepts them (it is sized by maxCapacity). RayJob no longer accepts workerType (it is fixed to Z.2X).
  • glue-alpha: SparkJobProps.enableMetrics removed, which will cause a compilation error for any app using it. But there is no behavior change, since this is a dead prop.
  • glue-alpha: a differing/tokenized has_encrypted_data supplied via parameters now throws.

Features

  • glue-alpha: add warning for maxRetries when job run queuing is enabled (#38575) (09ae11e)
  • glue-alpha: model SecurityConfiguration encryption as factory subtypes (#38586) (e37e7a6)
  • glue-alpha: new hasEncryptedData property (#38511) (c977e36)
  • glue-alpha: pair workerType and numberOfWorkers into a required workerConfiguration (#38576) (5f3b1b6)
  • glue-alpha: wrap DataQualityRuleset DQDL in a typed value object (#38587) (fd01268)

Bug Fixes

... (truncated)

Commits
  • a6eb4e1 chore(release): 2.253.0 (#37770)
  • 10d65f9 chore: trigger build
  • 55a4299 chore: update analytics metadata blueprints
  • e9c0b5a chore(release): 2.253.0
  • a52af7d fix(ecs): enabling the circuitBreaker is not recommended loudly enough (#37755)
  • a661c2d feat: update L1 CloudFormation resource definitions (#37753)
  • c29dc17 fix(cloudwatch): remove false positive warning for CDK tokens in MathExpressi...
  • dedf99b chore: replace Lazy with IBox (#37739)
  • 4031918 fix(codebuild): correct S3 log encryption boolean inversion (#37761)
  • 99d0a5b fix(eks): add dependency from HelmChart custom resource to s3 chartAsset IAM ...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [aws-cdk-lib](https://github.com/aws/aws-cdk) from 2.220.0 to 2.253.0.
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](aws/aws-cdk@v2.220.0...v2.253.0)

---
updated-dependencies:
- dependency-name: aws-cdk-lib
  dependency-version: 2.253.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 31, 2026
@github-actions

Copy link
Copy Markdown

Latest scan for commit: 0321c89 | Updated: 2026-08-31 16:46:03 UTC

Security Scan Results

Scan Metadata

  • Project: ASH
  • Scan executed: 2026-08-31T16:45:17+00:00
  • ASH version: 3.2.2

Summary

Scanner Results

The table below shows findings by scanner, with status based on severity thresholds and dependencies:

Column Explanations:

Severity Levels (S/C/H/M/L/I):

  • Suppressed (S): Security findings that have been explicitly suppressed/ignored and don't affect the scanner's pass/fail status
  • Critical (C): The most severe security vulnerabilities requiring immediate remediation (e.g., SQL injection, remote code execution)
  • High (H): Serious security vulnerabilities that should be addressed promptly (e.g., authentication bypasses, privilege escalation)
  • Medium (M): Moderate security risks that should be addressed in normal development cycles (e.g., weak encryption, input validation issues)
  • Low (L): Minor security concerns with limited impact (e.g., information disclosure, weak recommendations)
  • Info (I): Informational findings for awareness with minimal security risk (e.g., code quality suggestions, best practice recommendations)

Other Columns:

  • Time: Duration taken by each scanner to complete its analysis
  • Action: Total number of actionable findings at or above the configured severity threshold that require attention

Scanner Results:

  • PASSED: Scanner found no security issues at or above the configured severity threshold - code is clean for this scanner
  • FAILED: Scanner found security vulnerabilities at or above the threshold that require attention and remediation
  • MISSING: Scanner could not run because required dependencies/tools are not installed or available
  • SKIPPED: Scanner was intentionally disabled or excluded from this scan
  • ERROR: Scanner encountered an execution error and could not complete successfully

Severity Thresholds (Thresh Column):

  • CRITICAL: Only Critical severity findings cause scanner to fail
  • HIGH: High and Critical severity findings cause scanner to fail
  • MEDIUM (MED): Medium, High, and Critical severity findings cause scanner to fail
  • LOW: Low, Medium, High, and Critical severity findings cause scanner to fail
  • ALL: Any finding of any severity level causes scanner to fail

Threshold Source: Values in parentheses indicate where the threshold is configured:

  • (g) = global: Set in the global_settings section of ASH configuration
  • (c) = config: Set in the individual scanner configuration section
  • (s) = scanner: Default threshold built into the scanner itself

Statistics calculation:

  • All statistics are calculated from the final aggregated SARIF report
  • Suppressed findings are counted separately and do not contribute to actionable findings
  • Scanner status is determined by comparing actionable findings to the threshold
Scanner S C H M L I Time Action Result Thresh
bandit 0 0 0 0 0 0 753ms 0 PASSED MED (g)
cdk-nag 0 0 0 0 0 0 6.6s 0 PASSED MED (g)
cfn-nag 0 0 0 0 0 0 6ms 0 PASSED MED (g)
checkov 0 0 0 0 0 0 4.6s 0 PASSED MED (g)
detect-secrets 0 0 0 0 0 0 666ms 0 PASSED MED (g)
grype 0 0 0 0 0 0 46.4s 0 PASSED MED (g)
npm-audit 0 0 0 0 0 0 114ms 0 PASSED MED (g)
opengrep 0 0 0 0 0 0 11.7s 0 PASSED MED (g)
semgrep 0 0 0 0 0 0 <1ms 0 MISSING MED (g)
syft 0 0 0 0 0 0 1.6s 0 PASSED MED (g)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants