Update all dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
aws-cdk-lib	2.146.0 -> 2.174.0						minor
docker	26.1.4 -> 27.4.1						major
nodejs/node	20.15.0 -> 22.12.0						major
pip (changelog)	24.0 -> 24.3.1						minor
poetry (source, changelog)	1.8.3 -> 2.0.0						major
python	3.12-slim -> 3.13-slim					final	minor

---

Release Notes

aws/aws-cdk (aws-cdk-lib)

v2.174.0

Compare Source

Features

• codebuild: add new environment types (#​32729) (a10c369), closes #​32728
• custom-resource: add serviceTimeout property for custom resources (#​30911) (d599900), closes #​30517
• update L1 CloudFormation resource definitions (#​32685) (fe3af93), closes /docs.aws.amazon.com/datasync/latest/userguide/create-s3-location.html#create-s3 /docs.aws.amazon.com/datasync/latest/userguide/create-s3-location.html#create-s3
• update L1 CloudFormation resource definitions (#​32712) (3170e1c)
• update L1 CloudFormation resource definitions (#​32726) (de04742)
• autoscaling: add availabilityZoneDistribution property to an AutoScalingGroup (#​32100) (ecfce7c)
• bedrock: additional foundation models (#​32684) (fcf4ecd)
• cli: support CloudFormation simplified resource import (#​32676) (ca33f0a), closes #​28060
• cli-plugin-contract: introduce a public contract between CLI and plugins (#​32111) (fbaab1d)
• rds: support 11.22-rds.20241121 for RDS PostgreSQL (#​32508) (491475a)
• rds: supports minors 11.4.4, 10.11.10, 10.6.20, 10.5.27 for RDS for MariaDB (#​32632) (b8e79b6)
• update L1 CloudFormation resource definitions (#​32582) (ff57cc3)
• update L1 CloudFormation resource definitions (#​32645) (a0525f5)
• update L1 CloudFormation resource definitions (#​32685) (fe3af93), closes /docs.aws.amazon.com/datasync/latest/userguide/create-s3-location.html#create-s3 /docs.aws.amazon.com/datasync/latest/userguide/create-s3-location.html#create-s3
• appconfig: add atDeploymentTick extension action point to L2 Constructs (#​32490) (225d261)
• cloudfront: distribution ARN property (#​32531) (b7e6141), closes #​32530
• codebuild: support auto retry limit for Project (#​32507) (2c109cf), closes #​32446
• ecs: machineImageType support AL2023 (#​32509) (4b696bc), closes #​32496 #​32469
• update L1 CloudFormation resource definitions (#​32540) (2e3b2ac)

Bug Fixes

• cli: notices don't work behind a proxy (#​32590) (3377c3b)
• cli: outdated dependency on @aws-cdk/cloud-assembly-schema (#​32704) (3b162fc)
• cli: unhandled nextToken returned by listImagesCommand in garbage collector for ECR (#​32679) (d9346bc), closes #​32498 /github.com/aws/aws-cdk/blob/v2.173.4/packages/aws-cdk/lib/api/garbage-collection/garbage-collector.ts#L621
• elasticloadbalancingv2: open, dual-stack-without-public-ipv4 ALB allows IPv6 inbound traffic (#​32203) (0731095), closes #​32197
• opensearch: add I4I and R7GD to list of OpenSearch nodes not requiring EBS volumes (#​32592) (e364d2b), closes #​32070 #​32138
• bump jsii 5.5 to 5.6 (#​32588) (57bba19)
• cdk: changed retry mechanism for hotswapping AppSync.function (#​32179) (d14d784)
• cli: allow credential plugins to return null for expiration (#​32554) (d4f6946)
• cli: cdk deploy -R does not disable rollback (#​32514) (2e75924), closes #​31850
• cli: doesn't support plugins that return initially empty credentials (#​32552) (38116b0)
• cli: getting credentials via SSO fails when the region is set in the profile (#​32520) (bf026bd)
• lambda: add @​deprecated tag to python3.8 (#​32162) (27619cc)
• route53-targets: deprecated method for dns name is used in userpool domain target (under feature flag) (#​31403) (5e73dd0)

Reverts

• "fix(elasticloadbalancingv2): open, dual-stack-without-public-ipv4 ALB allows IPv6 inbound traffic" (#​32690) (6c790fd), closes aws/aws-cdk#32203
• ecs: machineImageType support AL2023 (#​32550) (e8d8237), closes aws/aws-cdk#32509

---

Alpha modules (2.174.0-alpha.0)

Features

• glue: support AWS Glue 5.0 (#​32467) (ca01a25)
• ec2: add c8g and m8g instance classes (#​32528) (a81eec6), closes #​32522
• msk-alpha: new KafkaVersions 3_7_X and 3_7_X_KRAFT (#​32515) (cbacf4d)

Bug Fixes

• ec2-alpha: do not use string comparison in rangesOverlap (#​32269) (87e21d6), closes #​32145 #​32145
• redshift-alpha: extract tableName from custom resource functions (#​32452) (283edd6), closes PR#24308
• redshift-alpha: use same role for database-query singleton function (#​32363) (db950b3), closes #​32089

v2.173.4

Compare Source

Bug Fixes

• cli: cli still fails for some plugins returning expiration: null (#​32668) (4da2f65), closes #​32111

---

Alpha modules (2.173.4-alpha.0)

v2.173.3

Compare Source

Bug Fixes

• aspects: "localAspects is not iterable" error (#​32647) (8948ecb), closes #​32470

---

Alpha modules (2.173.3-alpha.0)

v2.173.2

Compare Source

Bug Fixes

• cli: allow credential plugins to return null for expiration (#​32554) (e59b1db)
• cli: doesn't support plugins that return initially empty credentials (#​32552) (7ee9b90)

---

Alpha modules (2.173.2-alpha.0)

v2.173.1

Compare Source

Bug Fixes

• cli: getting credentials via SSO fails when the region is set in the profile (#​32520) (01fec04)

---

Alpha modules (2.173.1-alpha.0)

v2.173.0

Compare Source

Features

• cognito: user pool feature plans (#​32367) (39c22de), closes #​32369
• dynamodb: add precision timestamp for kinesis stream (#​31863) (625c431), closes #​31761
• dynamodb: add warm-throughput to L2 constructs (#​32390) (496bc78), closes #​32127
• route53: added EvaluateTargetHealth to Route53 Alias targets (#​9481) (#​30664) (c23be8c), closes #​30739
• route53: added L2 construct for Route53's health checks (#​30739) (7fdd974), closes #​9481 #​30664
• stepfunctions-tasks: support dynamic values for Glue Job Worker Type (#​32453) (7df954c)
• update L1 CloudFormation resource definitions (#​32446) (093c540)

Bug Fixes

• autoscaling: AutoScalingGroup requireImdsv2 with launchTemplate or mixedInstancesPolicy throws unclear error (#​32220) (06cdaac), closes #​27586 #​27586
• cli: assuming a role from the INI file fails in non-commercial regions (#​32456) (7028242)
• cloudformation-include: string arrays inside unknown properties cannot be parsed (#​32461) (0c2f98b)
• cloudwatch: period of each metric in usingMetrics for MathExpression is ignored (#​30986) (59e96a3), closes /github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-cloudwatch/lib/metric.ts#L606-L608 /github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-cloudwatch/lib/metric.ts#L566
• elasticloadbalancingv2: cannot create UDP listener for dual-stack NLB (#​32184) (e9c6e23), closes /github.com/aws/aws-cdk/pull/32184#issuecomment-2510536270
• lambda: improve validation errors for lambda functions (#​32323) (2607eb3), closes #​32324
• rds: serverlessV2MaxCapacity can be set to 0.5, which is invalid (#​32232) (3fe229d), closes /docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/UserGuide/aws-properties-rds-dbcluster-serverlessv2scalingconfiguration.html#cfn-rds-dbcluster-serverlessv2
• stepfunctions-task: elasticloadbalancingv2 service policy (#​32419) (2677fce), closes #​32417 /github.com/aws/aws-cdk/blame/2607eb3a905f735b96713dda4f32d28d10d686fd/packages/aws-cdk-lib/aws-stepfunctions-tasks/lib/aws-sdk/call-aws-service.ts#L93-L97
• synthetics: canary name can be up to 255 characters (#​32385) (231e1bf), closes #​32376

---

Alpha modules (2.173.0-alpha.0)

Features

• redshift-alpha: add support for RA3.large node type (#​31637) (ce0e09f), closes #​31634

v2.172.0

Compare Source

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• apigateway: We will be removing deprecated APIGatewayV2 constructs from aws-apigateway module.

Features

• aspects: priority-ordered aspect invocation (#​32097) (8ccdff4), closes #​21341
• cognito: new cloudFrontEndpoint method for user pool domain without custom resource (#​31402) (deeb2ad), closes #​31342
• cognito: support for ALLOW_USER_AUTH explicit auth flow (#​32273) (c5bcfdc)
• elasticloadbalancingv2: ip address type for both network and application target group (#​32189) (7cc5f30)
• events: add filter rules for prefixEqualsIgnoreCase, suffixEqualsIgnoreCase, wildcard, and anythingBut* matches (#​32063) (0ce71fc), closes #​28462
• lambda-nodejs: add bun support (#​31770) (aed8ad1), closes #​31753 #​31753
• rds: limitless database cluster (#​32151) (f4c19c7)
• ses: add support to disable account-level suppression list (#​32168) (bb50c1a), closes #​32149
• update L1 CloudFormation resource definitions (#​32272) (421d327)
• update L1 CloudFormation resource definitions (#​32356) (9e6bb24)
• route53-targets: add AppSync route53 target (#​31976) (dc7574a), closes #​26109

Bug Fixes

• apigateway: remove deprecated apigatewayv2 from aws-apigateway module (#​32297) (4db9565)
• appsync: appsync.HttpDataSourceProps erroneously extends BaseDataSourceProps (#​32065) (4e7f5c4), closes #​29689
• cli: assume role calls are skipping the proxy (#​32291) (6c0f74e)
• cli: lambda hotswap fails if lambda:GetFunctionConfiguration action is not allowed (#​32301) (be000a2), closes #​32219
• cli: mfa code is not requested when $AWS_PROFILE is used (#​32313) (6458439), closes #​32312
• cli: remove source maps (#​32317) (512cf95), closes #​19930 #​19930
• cli: short-lived credentials are not refreshed (#​32354) (058a0bf)
• cli: warns about missing --no-rollback flag that is present (#​32309) (559d676), closes #​32295
• cloudformation-include: drops unknown policy attributes (#​32321) (20edc7f)
• cloudfront: propagate originAccessControlId CloudFront Origin property to CloudFormation templates (#​32020) (f9708a6), closes #​32018
• iam: Role.addManagedPolicy() does not work for imported roles IRole (#​31212) (c78ef1b), closes #​8307

---

Alpha modules (2.172.0-alpha.0)

Features

• ec2: default BastionHostLinux to use Amazon Linux 2023 (under feature flag) (#​31996) (bf77e51), closes #​29493 #​29493
• ec2: instance support passing IAM instance profile (#​32073) (cf89d0f), closes #​8348
• neptune: auto minor version upgrade for an instance (#​31988) (d95db49)
• pipes: add LogDestination implementation (#​31672) (af5345e), closes #​31671
• pipes-targets: add API Gateway (#​31954) (c77536f)
• redshift: execute resource action (#​31995) (40835a0)

Bug Fixes

• scheduler-targets-alpha: incorrect validation of maximumEventAge (#​32284) (2eebc59)

v2.171.1

Compare Source

Bug Fixes

• cli: lambda hotswap fails if lambda:GetFunctionConfiguration action is not allowed (#​32301) (a073e93), closes /github.com/aws/aws-sdk-js-v3/blob/main/clients/client-lambda/src/waiters/waitForFunctionUpdatedV2.ts#L10 /github.com/aws/aws-sdk-js-v3/blob/main/clients/client-lambda/src/waiters/waitForFunctionUpdated.ts#L13

---

Alpha modules (2.171.1-alpha.0)

v2.171.0

Compare Source

Features

• rds: enhanced monitoring configuration at the cluster level (#​32157) (01f2dcd), closes #​32151
• rds: support zero ACU for Aurora Serverless V2 (#​32231) (d1b07d9)

Bug Fixes

• cli: sso with proxy fails (#​32261) (bedcf16)

---

Alpha modules (2.171.0-alpha.0)

v2.170.0

Compare Source

Features

• lambda: support for Provisioned Pollers (#​32205) (68b969e)
• vpcv2: vpc peering connection construct (#​31645) (e1195f9), closes RFC#507 1#L252

Bug Fixes

• cli: sts retry options are ignored (#​32227) (193ab8c)

Reverts

• "fix(ecr): allow creating repository uri to use tokens like cfn params" (#​32241) (b3e39a9), closes #​32238

---

Alpha modules (2.170.0-alpha.0)

v2.169.0

Compare Source

Features

• cloudfront: add attachWebAclId method for Distribution (#​30567) (cbe2bec)
• update L1 CloudFormation resource definitions (#​32223) (5d61a1b)
• sns: add delivery policy to sns subscriptions (#​30830) (27babe6), closes #​17576

Bug Fixes

• cli: cannot assume a doubly-chained role (#​32216) (8746e44)
• cli: proxy is not configured correctly (#​32213) (ec58c77)
• s3: key rotation is not enabled while creating KMS encrypted S3 buckets (#​32064) (e3024fc), closes #​31982

---

Alpha modules (2.169.0-alpha.0)

Features

• location: support Map (#​30648) (98b801c), closes #​30647
• scheduler: scheduler and scheduler-targets modules are now in Developer Preview (#​32207) (8776832), closes #​31785

Bug Fixes

• location: underscores are not allowed in the name (#​32046) (f6ad9c9)

v2.168.0

Compare Source

Features

• cloudfront: function URL origin access control L2 construct (#​31339) (b8f47c8), closes #​31629
• elasticloadbalancingv2: support target group level cross-zone settings for ALB and NLB (#​31814) (6b0b1e1), closes #​31790
• lambda: add NodeJS 22.x support (#​32104) (baa8561)
• lambda: support observability for ESM ( DDB, Kinesis, SQS) (#​32204) (6317a2a)
• lambda-destinations: support Lambda async S3 destination (#​31709) (e1a2f68)
• ses: maximum delivery time for emails (#​32102) (771eeff)
• update L1 CloudFormation resource definitions (#​32175) (6820c62)
• rds: support 8.0.40 engine version for RDS for MySQL (#​32117) (dcb5cf1)
• stepfunctions-tasks: create scheduler (#​29458) (d14a01c), closes #​29351

Bug Fixes

• cdk: remove source-map-support from typescript init templates (#​32113) (d5c0aa2), closes #​20754 #​30231
• cdk: use built-in source map support (#​32115) (5d499dc)
• cli: cdk diff always falls back to template only diff (#​32165) (089e9d8)
• cli: excessive stack event polling during deployment (#​32196) (a8bc46d), closes /github.com/aws/aws-cdk/blob/7bb9203eb95fe894c0d40942ff49c782a9fec251/packages/aws-cdk/lib/api/util/cloudformation/stack-event-poller.ts#L73-L74
• cli: externally managed stack notification arns are deleted on deploy (#​32163) (9966f57)
• cli: failure to get credentials when session token is not set (#​32134) (9ef4e72)
• cli: region specified in ~/.aws/credentials is ignored (#​32133) (d1b3c81), closes #​32130
• cli: the LoadBalancerProvider doesn't match LBs when querying by a subset of tags (#​32164) (f75dc72)
• eks: eks.AccessEntryType.STANDARD maps to a wrong value (#​31147) (1bbb456)

---

Alpha modules (2.168.0-alpha.0)

Bug Fixes

• scheduler-targets-alpha: imported target resources as schedule target throws synth error (#​32105) (1a8306f), closes #​31785 /github.com/aws/aws-cdk/pull/29615#issuecomment-2417858246
• scheduler-targets-alpha: kinesis data firehose target uses l1 instead of l2 (#​32150) (11384f0), closes #​31785
• scheduler-targets-alpha: scope down permissions for sqs and kinesis stream targets (#​32122) (6bb142e), closes #​31785

v2.167.2

Compare Source

Bug Fixes

• cli: cdk diff always falls back to template only diff (#​32165) (3fd9699)
• cli: externally managed stack notification arns are deleted on deploy (#​32163) (465da31)
• cli: the LoadBalancerProvider doesn't match LBs when querying by a subset of tags (#​32164) (a0b47c5)

---

Alpha modules (2.167.2-alpha.0)

v2.167.1

Compare Source

Bug Fixes

• cli: failure to get credentials when session token is not set (#​32134) (425efbc), closes #​32120
• cli: region specified in ~/.aws/credentials is ignored (#​32133) (9859f33), closes #​32130

---

Alpha modules (2.167.1-alpha.0)

v2.167.0

Compare Source

Features

• cli: upgrade aws-sdk to sdkv3 (#​31702) (5bc0662), closes #​25870 #​26292 #​20956 #​24744 #​27265
• elasticloadbalancingv2: enable zonal shift for network load balancer (#​31990) (497abdc), closes #​31983
• kms: support KEY_AGREEMENT for keyUsage (#​30993) (2323877), closes #​30989
• lambda: add Python 3.13 runtime (#​32054) (e0ebcfe)
• lambda: add supportsSnapStart config to dotnet8 and python 3.12 (#​32112) (53f4713)
• lambda: support for customer managed encryption (CMCMK) (#​32072) (2f16415)
• update L1 CloudFormation resource definitions (#​32090) (6303b72)
• rds: support minor engine versions for oracle (#​32058) (3d72b63)
• rds: support minor versions for RDS for SQL Server (#​32055) (8c80bf8)
• service-catalog: allow Product Stack to override analytics reporting and stack descriptions (#​31985) (d8ad02a), closes #​31924

Bug Fixes

• ecr: allow creating repository uri to use tokens like cfn params (#​32053) (5648199), closes #​31860

---

Alpha modules (2.167.0-alpha.0)

Features

• ivs: support recording configuration for channel (#​31899) (8a3734d), closes #​31780
• redshift: relocating a cluster (#​31993) (b763d86)

Bug Fixes

• scheduler-targets-alpha: add dlq policy to execution role instead of queue policy (#​32032) (b953b2a), closes #​31785

v2.166.0

Compare Source

Features

• cli: automatically roll back stacks if necessary (#​31920) (2f9fb1e), closes #​30546
• kinesis: support resource policy for a data stream (#​31909) (18fbd6d), closes #​28814
• rds: configure autoMinorVersionUpgrade for a database cluster (#​31962) (0fb6106)
• route53: support HTTPS, SSHFP, SVCB, and TLSA DNS resource record (#​31955) (afc2b0d), closes /docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/UserGuide/aws-resource-route53-recordset.html#cfn-route53
• synthetics: add artifactS3Encryption property to the Canary Construct. (#​30197) (1f39cb9), closes #​30190
• update L1 CloudFormation resource definitions (#​32007) (be6a964)

Bug Fixes

• deploy-time stack tags cause synthesis to fail (#​32041) (18c19fd), closes #​32040
• aws_route53: cannot use CfnParameter.valueAsNumber for L2 RecordSet weight (#​31823) (14561ac), closes #​31810
• cli: asset uploads fail if Object Lock is enabled on access bucket (#​31937) (ab1e91d)
• dynamoDB: make TableV2 taggable (#​31867) (796c6d1), closes #​30631
• opensearch: add I4G to list of OpenSearch nodes not requiring EBS volumes (#​31948) (73378f2)

---

Alpha modules (2.166.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• scheduler-targets-alpha: Schedule Target will reuse role if target is re-used across schedules. This change triggered replacement of existing roles for Schedule as logical ID of the roles are changed.

Features

• glue-alpha: add job run queuing to Glue job (#​31830) (5fca268), closes #​31826

Bug Fixes

• scheduler-targets-alpha: create a role per target instead of singleton schedule target role (#​31895) (aee1b30), closes #​31785

v2.165.0

Compare Source

Features

• bootstrap: add lifecycle rule to abort multipart uploads after 7 days (#​31956) (b800da8), closes #​29045
• bootstrap: delete noncurrent versions after 30 days (#​31949) (579041e)
• cli: garbage collect ecr assets (under --unstable flag) (#​31841) (da85e54), closes #​31611
• **codebuild:

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.