build(deps-dev): bump the nodejs-other group across 3 directories with 10 updates

[dependabot]

Bumps the nodejs-other group with 10 updates in the /nodejs directory:

Package	From	To
bestzip	3.0.2	3.0.3
eslint	10.8.1	10.9.1
typescript	6.0.3	7.0.2
typescript-eslint	8.67.0	8.68.0
@types/sinon	21.0.1	22.0.0
webpack	5.109.2	5.110.1
webpack-cli	7.2.2	7.2.3
@aws-sdk/client-sts	3.1115.0	3.1121.0
@types/node	25.9.5	26.4.0
aws-cdk-lib	2.266.0	2.267.0

Bumps the nodejs-other group with 3 updates in the /nodejs/packages/layer directory: @types/sinon, webpack and webpack-cli.
Bumps the nodejs-other group with 5 updates in the /nodejs/sample-apps/aws-sdk directory:

Package	From	To
bestzip	3.0.2	3.0.3
typescript	6.0.3	7.0.2
@aws-sdk/client-sts	3.1115.0	3.1121.0
@types/node	25.9.5	26.4.0
aws-cdk-lib	2.266.0	2.267.0

Updates bestzip from 3.0.2 to 3.0.3

Commits

• 9640123 3.0.3
• 2adb637 Fix: prevent native zip destination from being interpereted as a flag (#99)
• 7c565c6 make old tests store file in temp dir instead of test folder, because it was ...
• 54dcfc8 Bump js-yaml from 4.2.0 to 4.3.1 (#98)
• 998534b test with both shorthand and full params for unzip command injection
• See full diff in compare view

Updates eslint from 10.8.1 to 10.9.1

Release notes

Sourced from eslint's releases.

v10.9.1

Bug Fixes

• 1e641c9 fix: no-loss-of-precision false positive with trailing decimal point (#21251) (Aleksandr Shoronov)

Documentation

• ad74a8d docs: add deprecation steps for EOL package versions (#21248) (Francesco Trotta)

Chores

• 3c3ae53 chore: update ecosystem plugins (#21249) (ESLint Bot)

v10.9.0

Features

• 08de88e feat: handle underflow in no-loss-of-precision (#21218) (Rithish S)
• 55db479 feat: add checkConditionalExpressions to no-unmodified-loop-condition (#21175) (sethamus)

Bug Fixes

• 2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#21213) (sethamus)
• 8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204) (Yang Hyeonjong)
• 684b579 fix: prefer-template invalid autofix creates a tagged template call (#21207) (김채영)

Documentation

• 9ef407a docs: use eslint.config.* wherever config file names are listed (#21216) (Marry (Subin Yang))
• 87f66f4 docs: Update README (GitHub Actions Bot)
• 585ef37 docs: update architecture documentation (#21112) (Francesco Trotta)
• f3993b0 docs: Update README (GitHub Actions Bot)
• ffc87d6 docs: fix broken links in Further Reading sections (#21203) (Minsu)
• 1a761e1 docs: update moved JSX specification links (#21198) (Imran Mustafa)
• 4d00ca4 docs: update ESLint peer dependency to ^10.0.0 in shareable configs (#21202) (lumir)
• 510d1a2 docs: Update README (GitHub Actions Bot)

Chores

• 899dbf1 chore: update github/codeql-action action to v4.37.7 (#21243) (renovate[bot])
• 9aa3873 chore: update ecosystem plugins (#21235) (ESLint Bot)
• dc1e7a8 chore: update ecosystem plugins (#21208) (ESLint Bot)
• f878d21 ci: bump pnpm/action-setup from 6.0.9 to 6.0.10 (#21200) (dependabot[bot])
• 4891e50 ci: bump github/codeql-action from 4.37.4 to 4.37.6 (#21199) (dependabot[bot])

Commits

• 5c8c241 10.9.1
• a7f3b7d Build: changelog update for 10.9.1
• 1e641c9 fix: no-loss-of-precision false positive with trailing decimal point (#21251)
• ad74a8d docs: add deprecation steps for EOL package versions (#21248)
• 3c3ae53 chore: update ecosystem plugins (#21249)
• c27bc92 10.9.0
• fa831d9 Build: changelog update for 10.9.0
• 899dbf1 chore: update github/codeql-action action to v4.37.7 (#21243)
• 08de88e feat: handle underflow in no-loss-of-precision (#21218)
• 9ef407a docs: use eslint.config.* wherever config file names are listed (#21216)
• Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 7.0.2

https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/

This tag was originally released at: https://github.com/microsoft/typescript-go/releases/tag/typescript%2Fv7.0.2

Commits

• 1e4744d Merge branch 'main' into ts7-release
• a5a219cmicrosoft/typescript-go#4558
• ecfe30d Update status localization
• 5de25b5 Hide executable name in TypeScript status
• d7ce74a Show bundled TypeScript version for packaged servers
• 29be66a Correct TS 7 release version to 7.0.2
• ed2bd1b Merge branch 'main' into ts7-release
• 8873075 Bump the github-actions group across 1 directory with 3 updates (microsoft/ty...
• 9427131 Set up stable / nightly extension split, other prep (microsoft/typescript-go#...
• d4eaca5microsoft/typescript-go#4549
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

Updates typescript-eslint from 8.67.0 to 8.68.0

Release notes

Sourced from typescript-eslint's releases.

v8.68.0

8.68.0 (2026-08-24)

🚀 Features

• eslint-plugin: [strict-void-return] add fix suggestions (#12086)
• utils: support ESLint rule meta.languages (#12663)

🩹 Fixes

• eslint-plugin: [unified-signatures] deduplicate types in report (#12656)
• eslint-plugin: [return-await] prevent autofix from breaking code in arrow-functions (#12707)
• eslint-plugin: [unified-signatures] report identical signatures (#12678)
• eslint-plugin: [no-unnecessary-type-assertion] prevent stack overflow in recursive types (#12711)
• eslint-plugin: [no-floating-promises] setting ignoreVoid: false results in false negative in ArrowFunctionExpression (#12646)
• eslint-plugin: [no-empty-object-type] ignore suggestions that result in invalid interfaces and export defaults (#12739)
• website: playground crashes on extends configs (#12608)
• website: account for thanks.dev and out-of-band donors in sponsors list (#12735)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Hugo @​hugop95
• Josh Goldberg ✨
• Niki @​phaux
• Thiago Barbosa
• Younsang Na @​nayounsang

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.68.0 (2026-08-24)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 8f4e00a chore(release): publish 8.68.0
• 55f6d5d chore: enable source maps (#12677)
• See full diff in compare view

Updates @types/sinon from 21.0.1 to 22.0.0

Commits

• See full diff in compare view

Updates webpack from 5.109.2 to 5.110.1

Release notes

Sourced from webpack's releases.

v5.110.1

Patch Changes

• Fix a capture-group-less snapshot.managedPaths RegExp; speed up cache writes. (by @​alexander-akait in #21843)

• Throw SyntaxError, or WebAssembly.CompileError, from an unparsable module. (by @​alexander-akait in #21847)

• Accept the optimization.minimize: true shorthand set by a plugin in apply(). (by @​AgentEnder in #21845)

v5.110.0

Minor Changes

• Wrap concatenated modules in lazy __webpack_require__.cw accessors and inline require(), keeping a wrapped body's names and side effects intact. (by @​hai-x in #21519)

• Add performance hints reporting what a build costs: duplicate packages and modules, circular dependencies, broad contexts, large modules and chunks, hotspots, eval, missing PURE annotations, polyfills, redundant dynamic imports, OS-dependent rules, cache effectiveness, how chunks load, what splitting refused, why an optimization was skipped, and rules, defines, externals, aliases and barrel reexports nothing uses. An oversized asset names its largest modules, and an entrypoint carrying the runtime recommends optimization.runtimeChunk. Enable every check not set individually with performance.all, report hints in stats only with performance.hints: "stats", and get them in a stable order that leaves the build hashes unchanged. (by @​alexander-akait in #21841)

• Add the descriptionRelativePath module rule condition. (by @​alexander-akait in #21705)

• Add OS-independent glob matching to module rules. (by @​alexander-akait in #21771)

• Report inner-graph, AMD and bare module bailouts in optimizationBailout. (by @​alexander-akait in #21740)

• Allow marking externals as side-effect-free with a sideEffects flag. (by @​alexander-akait in #21712)

• Give externals the original request of a context module element. (by @​alexander-akait in #21780)

• Add the externalsPresets.nodeModules preset with an allowlist option to externalize installed packages, replacing the webpack-node-externals plugin. (by @​alexander-akait in #21569)

• Add output.library.umdAmdContainer for an AMD-style loader branch in UMD. (by @​hai-x in #21770)

• Resolve @custom-media values that are true / false or name another custom media. (by @​alexander-akait in #21624)

• Add the __webpack_css_server_styles__ module variable to read the CSS collected while rendering without a DOM, and keep that CSS in the order the styles were applied. (by @​alexander-akait in #21576)

• Patch the HTML <head> in place on hot update instead of forcing a full reload, including when a <script> that never executed is removed. (by @​alexander-akait in #21624)

• Scope counter names in CSS modules; fix the counter() counter-style and animation timeline keywords. (by @​alexander-akait in #21600)

• Derive import defer / import source from the target and fix the source phase. (by @​alexander-akait in #21810)

• Emit analyzable ESM urls for chunks, assets, styles, workers and wasm. (by @​alexander-akait in #21788)

• Tree shake CommonJS: module.exports object literals, exports destructured from a require() binding, unused method requires, and unused side-effect-free require() calls and reexports. (by @​alexander-akait in #21841)

• Resolve relative entry baseUri values and bake one side of a hash cycle. (by @​alexander-akait in #21750)

• Minify CSS further, only where the document is unchanged: shorthands and box longhands, font-weight, <position> and font-stretch keywords, colors (polar, Lab and hsl() converted to hex), numbers, times, zero units, calc() and every math function the spec names folded over constants, selector lists, An+B, keyframe selectors, media-feature ranges, unicode-range, transition layers, display, transforms, gradients, font families, identical repeated declarations, and rules an identical later one makes dead. Abilities are read off the target browsers, vendorPrefixes adds and drops vendor prefixes for them, and rewriteCustomProperties shortens custom property values. Minification never changes whether a declaration parses, and beautifying keeps every rule. (by @​alexander-akait in #21841)

• Safely minify CSS (with source maps) and HTML assets when optimization.minimize is enabled, unless a minimizer is already configured for them, making only transformations an engine cannot tell apart. Every rewrite is named as an option, so it can be switched off. (by @​alexander-akait in #21841)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.110.1

Patch Changes

• Fix a capture-group-less snapshot.managedPaths RegExp; speed up cache writes. (by @​alexander-akait in #21843)

• Throw SyntaxError, or WebAssembly.CompileError, from an unparsable module. (by @​alexander-akait in #21847)

• Accept the optimization.minimize: true shorthand set by a plugin in apply(). (by @​AgentEnder in #21845)

5.110.0

Minor Changes

• Wrap concatenated modules in lazy __webpack_require__.cw accessors and inline require(), keeping a wrapped body's names and side effects intact. (by @​hai-x in #21519)

• Add performance hints reporting what a build costs: duplicate packages and modules, circular dependencies, broad contexts, large modules and chunks, hotspots, eval, missing PURE annotations, polyfills, redundant dynamic imports, OS-dependent rules, cache effectiveness, how chunks load, what splitting refused, why an optimization was skipped, and rules, defines, externals, aliases and barrel reexports nothing uses. An oversized asset names its largest modules, and an entrypoint carrying the runtime recommends optimization.runtimeChunk. Enable every check not set individually with performance.all, report hints in stats only with performance.hints: "stats", and get them in a stable order that leaves the build hashes unchanged. (by @​alexander-akait in #21841)

• Add the descriptionRelativePath module rule condition. (by @​alexander-akait in #21705)

• Add OS-independent glob matching to module rules. (by @​alexander-akait in #21771)

• Report inner-graph, AMD and bare module bailouts in optimizationBailout. (by @​alexander-akait in #21740)

• Allow marking externals as side-effect-free with a sideEffects flag. (by @​alexander-akait in #21712)

• Give externals the original request of a context module element. (by @​alexander-akait in #21780)

• Add the externalsPresets.nodeModules preset with an allowlist option to externalize installed packages, replacing the webpack-node-externals plugin. (by @​alexander-akait in #21569)

• Add output.library.umdAmdContainer for an AMD-style loader branch in UMD. (by @​hai-x in #21770)

• Resolve @custom-media values that are true / false or name another custom media. (by @​alexander-akait in #21624)

• Add the __webpack_css_server_styles__ module variable to read the CSS collected while rendering without a DOM, and keep that CSS in the order the styles were applied. (by @​alexander-akait in #21576)

• Patch the HTML <head> in place on hot update instead of forcing a full reload, including when a <script> that never executed is removed. (by @​alexander-akait in #21624)

• Scope counter names in CSS modules; fix the counter() counter-style and animation timeline keywords. (by @​alexander-akait in #21600)

• Derive import defer / import source from the target and fix the source phase. (by @​alexander-akait in #21810)

• Emit analyzable ESM urls for chunks, assets, styles, workers and wasm. (by @​alexander-akait in #21788)

• Tree shake CommonJS: module.exports object literals, exports destructured from a require() binding, unused method requires, and unused side-effect-free require() calls and reexports. (by @​alexander-akait in #21841)

• Resolve relative entry baseUri values and bake one side of a hash cycle. (by @​alexander-akait in #21750)

• Minify CSS further, only where the document is unchanged: shorthands and box longhands, font-weight, <position> and font-stretch keywords, colors (polar, Lab and hsl() converted to hex), numbers, times, zero units, calc() and every math function the spec names folded over constants, selector lists, An+B, keyframe selectors, media-feature ranges, unicode-range, transition layers, display, transforms, gradients, font families, identical repeated declarations, and rules an identical later one makes dead. Abilities are read off the target browsers, vendorPrefixes adds and drops vendor prefixes for them, and rewriteCustomProperties shortens custom property values. Minification never changes whether a declaration parses, and beautifying keeps every rule. (by @​alexander-akait in #21841)

... (truncated)

Commits

• 0b2952e chore(release): new release (#21846)
• 2a1fda4 fix: throw a SyntaxError from a module that failed to parse (#21847)
• 281efa6 test(css): cover a loader-added BOM in the css pipeline (#21848)
• 36ded2c fix: accept the optimization.minimize true shorthand after normalization (#21...
• c150225 fix(cache): accept a managedPaths RegExp without a capture group, and speed u...
• 3a7c0e6 chore(release): new release (#21545)
• 75891c8 chore(changesets): union same-subject entries (#21841)
• 6b96de7 feat(config): emit no development source map for library builds (#21839)
• ff0c832 feat(css,html): reach embedded source from cssMinify and htmlMinify (#21838)
• 06bedfb chore(deps): bump test/wpt in the dependencies group (#21836)
• Additional commits viewable in compare view

Updates webpack-cli from 7.2.2 to 7.2.3

Release notes

Sourced from webpack-cli's releases.

webpack-cli@7.2.3

Patch Changes

• fix: resolve the webpack-dev-server type from its default export, so the types work with both v5 and v6 (by @​bjohansebas in #4834)

• feat: allow toml@5 as a peer dependency for TOML configuration files (by @​alexander-akait in #4837)

Changelog

Sourced from webpack-cli's changelog.

7.2.3

Patch Changes

• fix: resolve the webpack-dev-server type from its default export, so the types work with both v5 and v6 (by @​bjohansebas in #4834)

• feat: allow toml@5 as a peer dependency for TOML configuration files (by @​alexander-akait in #4837)

Commits

• 7d40e4e chore(release): new release (#4839)
• 1f6593a ci: use the input names changesets/action v2 expects (#4838)
• 99cfc4f build(deps): update dependencies (#4837)
• 11be634 feat(create-webpack-app): stop asking about HTML and CSS (#4836)
• a2418aa feat(create-webpack-app): use webpack's native CSS and HTML support in init t...
• 3664b9d chore: update webpack-dev-server to v6 and test against v5 and v6 (#4834)
• ce1a219 ci: node 26 (#4763)
• 0cfc077 chore(deps): bump changesets/action in the dependencies group (#4831)
• ef262eb chore(deps): bump changesets/action in the dependencies group (#4830)
• d90f5ab chore: add gitignore to ignore autogenerated build & fix codecov option (#4828)
• Additional commits viewable in compare view

Updates @aws-sdk/client-sts from 3.1115.0 to 3.1121.0

Release notes

Sourced from @​aws-sdk/client-sts's releases.

v3.1121.0

3.1121.0(2026-08-28)

New Features

• client-ecs: Amazon Elastic Container Service - This release adds support for early success criteria on ECS rolling deployments, letting deployment complete once a configurable percentage of tasks are healthy, with configurable BLOCKING (required) or DEFERRED (asynchronous) cleanup of previous service revisions. (ef22d750)
• client-healthlake: New HealthLake API, RestoreFHIRDatastore, providing the capability to restore active datastores to a point in time within the last 30 days or recover a deleted datastore from the delete snapshot. (62491742)
• client-bedrock-agentcore: AgentCore Memory now supports direct ingestion into long-term memory via IngestData API (20d652de)
• client-partnercentral-selling: Releasing PARC, new APN Program that lets sellers add solftware revenue details to aws opportunity summary (2b6350f0)
• client-cognito-identity-provider: Adds two new operations - GetClientToken which allows M2M auth through the SDK, and DescribeTermsByClient to find which Terms are associated with a user-pool client without knowing the Terms resource id. (86dffd28)
• client-bedrock-agent: Adds an optional syncSchedule field to CreateDataSource and UpdateDataSource for Managed Knowledge Bases data source connectors, so a data source can sync automatically on a daily, weekly, or monthly schedule. (a8d3714a)

---

For list of updated packages, view updated-packages.md in assets-3.1121.0.zip

v3.1120.0

3.1120.0(2026-08-27)

Documentation Changes

• client-opensearch: Updating SDK and CLI documentation for AttachDataSource API. (d696fe76)

New Features

• client-lambda-microvms: Added InsufficientCapacityException to RunMicrovm for capacity-related failures. Added lifecycle status field (AVAILABLE, DEPRECATED) to ListManagedMicrovmImageVersions. Added ConflictException to CreateMicrovmAuthToken and CreateMicrovmShellAuthToken for unregistered MicroVMs. (72a8ff80)
• client-codedeploy: Added a deploymentMode parameter to CreateDeployment. Set it to RESTART to restart an EC2 and on-premises fleet, using the last successful revision, honoring Deployment Configuration. (78d4f964)
• client-cloudwatch-logs: Added resultCount to QueryStatistics in GetQueryResults. This field returns the total number of output rows in the final result set, helping customers programmatically determine whether a query produced results after all operations including post-aggregation filters. (0e4d242b)
• client-datazone: Add cascadeDelete to DeleteDomain. When specified, DataZone recursively deletes all projects, environments, subscriptions, and their underlying AWS resources before removing the domain. Deletion progress is reported via deleteProgress and resource failures via failureReasons on GetDomain. (3a74dc4b)
• client-rds: Adding support for the full snapshot size, in bytes, of DB instance snapshots. (ab2f66f5)
• client-ec2: EC2 allows AMI owners to define compatible instance types on their AMIs, blocking RunInstances calls automatically for launches on non-permitted instance types. (311b3b26)
• client-cognito-identity-provider: Adds the AdminDeleteSoftwareToken API operation, enabling administrators to remove a user's registered TOTP (software token) MFA configuration from a user pool. (f661bebc)

---

For list of updated packages, view updated-packages.md in assets-3.1120.0.zip

v3.1119.0

3.1119.0(2026-08-26)

Chores

• codegen: smithy-aws-typescript-codegen 0.53.0 (#8276) (dffb383b)

New Features

• client-sagemaker: Amazon SageMaker AI now supports ml.g7 instances for model optimization. You can now run model optimization jobs on ml.g7 instances, in supported AWS Regions. (6d5e1066)
• client-devops-agent: AWS DevOps Agent now supports trigger filter groups for Release Readiness Review, letting you control when the capability auto-triggers based on webhook events and target branches. (bc3d53d5)

... (truncated)

Changelog

Sourced from @​aws-sdk/client-sts's changelog.

3.1121.0 (2026-08-28)

Note: Version bump only for package @​aws-sdk/client-sts

3.1120.0 (2026-08-27)

Note: Version bump only for package @​aws-sdk/client-sts

3.1119.0 (2026-08-26)

Note: Version bump only for package @​aws-sdk/client-sts

3.1118.0 (2026-08-25)

Note: Version bump only for package @​aws-sdk/client-sts

3.1117.0 (2026-08-24)

Note: Version bump only for package @​aws-sdk/client-sts

3.1116.0 (2026-08-21)

Note: Version bump only for package @​aws-sdk/client-sts

Commits

• e53a25a Publish v3.1121.0
• d6be6f8 Publish v3.1120.0
• ba4e449 Publish v3.1119.0
• c65dd65 Publish v3.1118.0
• 78b069a Publish v3.1117.0
• d760a00 Publish v3.1116.0
• 8369ada chore(codegen): update to sync with the latest smithy-ts (#8272)
• See full diff in compare view

Updates @types/node from 25.9.5 to 26.4.0

Commits

• See full diff in compare view

Updates aws-cdk-lib from 2.266.0 to 2.267.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.267.0

⚠ BREAKING CHANGES

• kinesisfirehose: After this change, specifying an unsupported timeZone on the Firehose S3Bucket destination now throws a ValidationError during synthesis instead of failing at CloudFormation deployment. Affected values: 3-letter IANA abbreviations (e.g. EST), Etc/UTC, Etc/GMT, Factory, and strings containing characters outside [a-zA-Z/_]+. Use a supported standard IANA identifier (e.g. America/New_York) or UTC for synth to pass.

Features

• backup: add indexActions prop to BackupPlanRule (#34051) (b8be853), closes #34050
• bedrockagentcore: add manageDeliveryResourcePolicy opt-out for runtime observability (#38372) (5fb086b), closes #38342
• ci: integration test deployment on maintainer approval (#38519) (c5f6b4f), closes #37333
• core: Size objects now properly stringify (#38662) (90fe151)
• sqs: metricApproximateNumberOfMessagesOutstanding (#38661) (f29b27b)

Bug Fixes

• assets: SymlinkFollowMode.BLOCK_EXTERNAL will throw errors while bundling (#38506) (a11e451)
• bedrockagentcore: least-privilege browser recording S3 grant (#38604) (7e11d11)
• ci: add environment for Atmosphere variables access (#38625) (785773e), closes #38519
• cloudfront-origins: readTimeout and keepaliveTimeout reject valid values (#38432) (6251e1a), closes #38433 #18628
• core: performance counters use too much memory (#38620) (d0ce23c)
• core: single file bundled output should be file (#38548) (9e22774)
• core: stack.node.addDependency gets slower as stacks grow (#38597) (2ab9be4), closes #38522
• core: symlinks in directory bundling output (#38665) (8d8ae2c)
• core: validation plugin check adds too much overhead (#38619) (df15b9f)
• dynamodb: TableV2.grants.*Data does not include index resources (#37892) (e48a97f), closes #37569
• dynamodb: TableV2MultiAccountReplica rejects imported tables with tokenized ARNs (#38365) (08f05e5), closes #38354
• dynamodb: avoid TableGrantsProps deprecation warnings for TableV2 (#38399) (fb5c25b), closes #37221
• ec2: NatInstanceProvider and NatInstanceProviderV2 always trigger the keyName deprecation warning (#38347) (47f2151), closes #30806
• kinesisfirehose: add validation for customTimeZone in S3BucketProps (#38514) (8cf9f90), closes #36089
• lambda: allow SnapStart for container image functions (#38680) (a5adc00), closes #38281 #38281 #38265
• rds: serverlessV2 capacity props reject tokens at synth time (#38044) (b7880de), closes #38043 #9044 #31810 #32905
• s3-deployment: increase default memory limit from 128MB to 1024MB (#35501) (7a04f32), closes #35487
• stepfunctions-tasks: resolve EvaluateExpression paths via a values lookup (#38682) (02301ea)
• stack.availabilityZones are not stable strings (#38580) (f89474a)

---

Alpha modules (2.267.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: schema Type is now an opaque class; construct column types via the Schema factories or Schema.custom(...) rather than { isPrimitive, inputString } literals. StorageParameter.custom(key, value) requires a string value, and StorageParameter.writeKmsKeyId takes a kms.IKey instead of a string.
• glue-alpha: S3TableProps.bucket/encryption/encryptionKey are removed. Use storage: S3TableStorage.managedBucket(S3TableEncryption.kms(key?)) / S3TableStorage.fromBucket(bucket) and clientSideEncryption: TableClientSideEncryption.kms(key?). S3Table.encryption/encryptionKey are removed (clientSideEncryptionKey exposes the client-side key; read bucket.encryptionKey for server-side). The TableEncryption enum and the deprecated Table/TableProps are removed — use S3Table.

Features

• glue-alpha: add a typed secret input to Connection (#38585) (ede4a1c)
• glue-alpha: add subnet selection to Connection (#38561) (f9d7eac)
• glue-alpha: model S3Table storage/encryption as value objects (#38591) (9990e16)
• glue-alpha: opaque Schema Type with Schema.custom, and stronger StorageParameter types (#38592) (5c45eb0)
• msk-alpha: support Kafka 4.2 (#38323) (97b181c)
• s3tables-alpha: add storage class configuration support (#37339) (63ccf6d)

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.267.0-alpha.0 (2026-08-27)

⚠ BREAKING CHANGES

• glue-alpha: schema Type is now an opaque class; construct column types via the Schema factories or Schema.custom(...) rather than { isPrimitive, inputString } literals. StorageParameter.custom(key, value) requires a string value, and StorageParameter.writeKmsKeyId takes a kms.IKey instead of a string.
• glue-alpha: S3TableProps.bucket/encryption/encryptionKey are removed. ...

  Description has been truncated

[thompson-tomo]

Need to wait for #2567 to see what diff remains & if it can be closed.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.