Upgrade: [dependabot] - bump aws-cdk-lib from 2.221.1 to 2.223.0 (#350)

Bumps
[aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib)
from 2.221.1 to 2.223.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/aws/aws-cdk/releases">aws-cdk-lib's
releases</a>.</em></p>
<blockquote>
<h2>v2.223.0</h2>
<h3>⚠ BREAKING CHANGES</h3>
<p>L1 resources are automatically generated from public CloudFormation
Resource Schemas. They are built to closely reflect the real state of
CloudFormation. Sometimes these updates can contain changes that are
incompatible with previous types, but more accurately reflect reality.
In this release we have changed:</p>
<ul>
<li><strong>aws-dynamodb</strong>: AWS::DynamoDB::GlobalTable:
GlobalTableSettingsReplicationMode property removed.</li>
<li><strong>aws-dynamodb</strong>: AWS::DynamoDB::GlobalTable:
GlobalTableSourceArn property removed.</li>
<li><strong>aws-dynamodb</strong>: AWS::DynamoDB::Table:
GlobalTableSettingsReplicationMode property removed.</li>
<li><strong>aws-events</strong>: AWS::Events::EventBusPolicy: Id
attribute removed.</li>
</ul>
<h3>Features</h3>
<ul>
<li>update L1 CloudFormation resource definitions (<a
href="https://redirect.github.com/aws/aws-cdk/issues/35926">#35926</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/3f4d58548be8022660f62a99e43061fa54bd8588">3f4d585</a>)</li>
<li><strong>ec2:</strong> support for Cloud Wan Core Network routes (<a
href="https://redirect.github.com/aws/aws-cdk/issues/35008">#35008</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/fba027bf2039c90265f4632bd76619f4bcde6f81">fba027b</a>)</li>
<li><strong>s3-deployment:</strong> support securityGroups in
BucketDeploymentProps (<a
href="https://redirect.github.com/aws/aws-cdk/issues/33233">#33233</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/f2a31666fa92d284f6e8602e475aa0b7fca05ef7">f2a3166</a>),
closes <a
href="https://redirect.github.com/aws/aws-cdk/issues/33229">#33229</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>stepfunctions:</strong> <code>DistributedMap</code>
ResultWriter correct query language selection (<a
href="https://redirect.github.com/aws/aws-cdk/issues/35834">#35834</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/75b8eadb3761f02798061fe5578af82f785f687a">75b8ead</a>),
closes <a
href="https://redirect.github.com/aws/aws-cdk/issues/35403">#35403</a></li>
<li>onEvent function to pass all the options to rule resource (<a
href="https://redirect.github.com/aws/aws-cdk/issues/35829">#35829</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/3d7023d4c6ee29b945034e56fd94b228f6e313f2">3d7023d</a>)</li>
</ul>
<hr />
<h2>Alpha modules (2.223.0-alpha.0)</h2>
<h2>v2.222.0</h2>
<h3>⚠ BREAKING CHANGES</h3>
<ul>
<li><strong>bedrock-agentcore:</strong> The signature of
<code>RuntimeAuthorizerConfiguration.usingCognito()</code> has changed
to accept IUserPool and IUserPoolClient constructs instead of string
parameters, and now supports multiple clients.</li>
</ul>
<h3>Features</h3>
<ul>
<li><strong>apigateway:</strong> add <code>binaryMediaTypes</code>
property to SpecRestApi (<a
href="https://redirect.github.com/aws/aws-cdk/issues/35502">#35502</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/bf10d94484c5a78a86a5a38db093b48eec0b42d7">bf10d94</a>),
closes <a
href="https://redirect.github.com/aws/aws-cdk/issues/35498">#35498</a></li>
<li><strong>apigatewayv2:</strong> <code>WebSocketStage</code> support
accessLogSettings (<a
href="https://redirect.github.com/aws/aws-cdk/issues/34766">#34766</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/dad112e27b0326746c84cab574ee1b2109d5afdd">dad112e</a>),
closes <a
href="https://redirect.github.com/aws/aws-cdk/issues/21935">#21935</a></li>
<li><strong>bedrock-agentcore:</strong> use IUserPool and
IUserPoolClient interfaces instead of string identifiers (<a
href="https://redirect.github.com/aws/aws-cdk/issues/35860">#35860</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/a38afc9bdc57143c971e4654fae2fd3c3a0dbef6">a38afc9</a>),
closes <a
href="https://redirect.github.com/aws/aws-cdk/issues/35854">#35854</a></li>
<li><strong>core:</strong> <code>IEnvironmentAware</code> interface to
retrieve a construct's environment (<a
href="https://redirect.github.com/aws/aws-cdk/issues/35817">#35817</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/8ee5d4b012b2d6a157b0e4915976e0a487cde115">8ee5d4b</a>)</li>
<li><strong>elasticloadbalancingv2:</strong> create security group
settings for NLB by default (under feature flag) (<a
href="https://redirect.github.com/aws/aws-cdk/issues/34675">#34675</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/ff83cfd883ab04a5137ca6d9f28629fc2f5676ad">ff83cfd</a>),
closes <a
href="https://redirect.github.com/aws/aws-cdk/issues/34606">#34606</a>
<a
href="https://redirect.github.com/aws//redirect.github.com/aws/aws-cdk/issues/34606/issues/issuecomment-2931313249">aws/aws-cdk#34606</a></li>
<li><strong>events-targets:</strong> support Amazon Data Firehose target
using Firehose's <code>IDeliveryStream</code> (<a
href="https://redirect.github.com/aws/aws-cdk/issues/33798">#33798</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/a374b6b2dd071bbd15b3a824e1aaa1002d0dc018">a374b6b</a>),
closes <a
href="https://redirect.github.com/aws/aws-cdk/issues/33757">#33757</a>
<a
href="https://redirect.github.com/aws/aws-cdk/issues/33758">#33758</a></li>
<li><strong>kinesisfirehose:</strong> add built-in data processors to
decompress CloudWatch logs and extract messages (<a
href="https://redirect.github.com/aws/aws-cdk/issues/33749">#33749</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/5dec21e882f0e33b3ed436ac4ce82f0c290c06a4">5dec21e</a>),
closes <a
href="https://redirect.github.com/aws/aws-cdk/issues/33691">#33691</a>
<a
href="https://redirect.github.com/aws/aws-cdk/issues/20242">#20242</a>
<a
href="https://redirect.github.com/aws//redirect.github.com/aws/aws-cdk/issues/33691/issues/issuecomment-2713012245">aws/aws-cdk#33691</a></li>
<li><strong>lambda:</strong> add Java25 runtime for Lambda (<a
href="https://redirect.github.com/aws/aws-cdk/issues/35867">#35867</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/db71facb53f3024d68d5497befe39989cd55d593">db71fac</a>)</li>
<li><strong>lambda:</strong> add Python 3.14 runtime for Lambda (<a
href="https://redirect.github.com/aws/aws-cdk/issues/35869">#35869</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/ebef303ea22c6eab7ea33505961ecce0b2c99a7a">ebef303</a>)</li>
<li><strong>memory:</strong> add agentcore memory l2 construct (<a
href="https://redirect.github.com/aws/aws-cdk/issues/35757">#35757</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/6a2e17e8280affd152ad4e24d505bc4593b790eb">6a2e17e</a>)</li>
<li><strong>msk:</strong> support Express brokers (<a
href="https://redirect.github.com/aws/aws-cdk/issues/34741">#34741</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/0a69e5f165c20d5106d0d159ce6b023d228e5fea">0a69e5f</a>),
closes <a
href="https://redirect.github.com/aws/aws-cdk/issues/32923">#32923</a></li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>agentcore:</strong> <code>addToRolePolicy</code> for runtime
with imported role destroys and recreates policies on every deployment
(<a
href="https://redirect.github.com/aws/aws-cdk/issues/35842">#35842</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/92525e45e4f8688ddd4892e43885e33e9d812c6c">92525e4</a>),
closes <a
href="https://redirect.github.com/aws/aws-cdk/issues/35844">#35844</a>
<a
href="https://github.com/40aws-cdk/aws-bedrock-agentcore-alpha/agentcore/runtime/runtime-base.ts/issues/L253">40aws-cdk/aws-bedrock-agentcore-alpha/agentcore/runtime/runtime-base.ts#L253</a></li>
<li><strong>agentcore:</strong> custom execution role policy for runtime
lacks proper permissions (<a
href="https://redirect.github.com/aws/aws-cdk/issues/35849">#35849</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/ee94b63161b6ff2a930ef4acb1e65e01d1ac570a">ee94b63</a>),
closes <a
href="https://redirect.github.com/aws/aws-cdk/issues/35852">#35852</a>
<a
href="https://github.com/40aws-cdk/aws-bedrock-agentcore-alpha/agentcore/runtime/runtime-artifact.ts/issues/L65">40aws-cdk/aws-bedrock-agentcore-alpha/agentcore/runtime/runtime-artifact.ts#L65</a>
<a
href="https://github.com/40aws-cdk/aws-bedrock-agentcore-alpha/agentcore/runtime/runtime.ts/issues/L252-L259">40aws-cdk/aws-bedrock-agentcore-alpha/agentcore/runtime/runtime.ts#L252-L259</a>
<a
href="https://github.com/aws//github.com/aws/aws-cdk/blob/v2.221.0/packages/aws-cdk-lib/aws-codepipeline/lib/pipeline.ts/issues/L693">/github.com/aws/aws-cdk/blob/v2.221.0/packages/aws-cdk-lib/aws-codepipeline/lib/pipeline.ts#L693</a>
<a
href="https://github.com/aws//github.com/aws/aws-cdk/blob/v2.221.0/packages/aws-cdk-lib/aws-lambda/lib/function.ts/issues/L1468">/github.com/aws/aws-cdk/blob/v2.221.0/packages/aws-cdk-lib/aws-lambda/lib/function.ts#L1468</a>
<a
href="https://github.com/aws//github.com/aws/aws-cdk/blob/v2.221.0/packages/aws-cdk-lib/aws-ecs/lib/base/base-service.ts/issues/L1161">/github.com/aws/aws-cdk/blob/v2.221.0/packages/aws-cdk-lib/aws-ecs/lib/base/base-service.ts#L1161</a></li>
<li><strong>dynamodb:</strong> addToResourcePolicy has no effect (<a
href="https://redirect.github.com/aws/aws-cdk/issues/35554">#35554</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/94d7e34ebff8f8dbd17ee712d724974179fe7076">94d7e34</a>),
closes <a
href="https://redirect.github.com/aws/aws-cdk/issues/35062">#35062</a></li>
<li><strong>ecs:</strong> remove empty
CfnClusterCapacityProviderAssociations resource (<a
href="https://redirect.github.com/aws/aws-cdk/issues/35783">#35783</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/c8a131b935af27726131fb670ee84b15152296e0">c8a131b</a>),
closes <a
href="https://redirect.github.com/aws/aws-cdk/issues/35699">#35699</a>
<a
href="https://redirect.github.com/aws/aws-cdk/issues/35742">#35742</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md">aws-cdk-lib's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this project will be documented in this file.
See <a
href="https://github.com/conventional-changelog/standard-version">standard-version</a>
for commit guidelines.</p>
<h2><a
href="https://github.com/aws/aws-cdk/compare/v2.222.0-alpha.0...v2.223.0-alpha.0">2.223.0-alpha.0</a>
(2025-11-10)</h2>
<h2><a
href="https://github.com/aws/aws-cdk/compare/v2.221.1-alpha.0...v2.222.0-alpha.0">2.222.0-alpha.0</a>
(2025-11-04)</h2>
<h3>Features</h3>
<ul>
<li><strong>eks-v2-alpha:</strong> eks-v2-alpha is now in developer
preview (<a
href="https://redirect.github.com/aws/aws-cdk/issues/35801">#35801</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/32afc0ff940394da737714e599ddc3c25ff738e3">32afc0f</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>bedrock-alpha:</strong> apply permission dependency to
existing and non-existing roles (<a
href="https://redirect.github.com/aws/aws-cdk/issues/35123">#35123</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/b39ccf3a874401c2a0a7ae0806f1be02b9b75d5e">b39ccf3</a>),
closes <a
href="https://redirect.github.com/aws/aws-cdk/issues/35120">#35120</a></li>
<li><strong>eks-v2-alpha:</strong> remove hyphen from Go package name
(<a
href="https://redirect.github.com/aws/aws-cdk/issues/35927">#35927</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/2cdfc8a909ce3752833e46dd2ed0106fee0e785a">2cdfc8a</a>)</li>
</ul>
<h2><a
href="https://github.com/aws/aws-cdk/compare/v2.221.0-alpha.0...v2.221.1-alpha.0">2.221.1-alpha.0</a>
(2025-10-29)</h2>
<h2><a
href="https://github.com/aws/aws-cdk/compare/v2.220.0-alpha.0...v2.221.0-alpha.0">2.221.0-alpha.0</a>
(2025-10-24)</h2>
<h3>Features</h3>
<ul>
<li><strong>msk-alpha:</strong> support Kafka 4.1 (<a
href="https://redirect.github.com/aws/aws-cdk/issues/35759">#35759</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/67539de15ee70a61629fa8dfc7f7b42b187a82e0">67539de</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>elasticache-alpha:</strong> cannot import Redis 7 serverless
cache (<a
href="https://redirect.github.com/aws/aws-cdk/issues/35629">#35629</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/2bde1a02ecb1fc3439249eb1bb756bf335ec3553">2bde1a0</a>)</li>
</ul>
<h2><a
href="https://github.com/aws/aws-cdk/compare/v2.219.0-alpha.0...v2.220.0-alpha.0">2.220.0-alpha.0</a>
(2025-10-14)</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>amplify-alpha:</strong> handle empty customResponseHeaders
array (<a
href="https://redirect.github.com/aws/aws-cdk/issues/35700">#35700</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/57f90687d56ebe2cdc3fd5cff1dc35329c502ee4">57f9068</a>),
closes <a
href="https://redirect.github.com/aws/aws-cdk/issues/35693">#35693</a></li>
</ul>
<h2><a
href="https://github.com/aws/aws-cdk/compare/v2.218.0-alpha.0...v2.219.0-alpha.0">2.219.0-alpha.0</a>
(2025-10-01)</h2>
<h2><a
href="https://github.com/aws/aws-cdk/compare/v2.217.0-alpha.0...v2.218.0-alpha.0">2.218.0-alpha.0</a>
(2025-09-29)</h2>
<ul>
<li><strong>elasticache-alpha:</strong> implement Serverless ElastiCache
L2 Construct (<a
href="https://redirect.github.com/aws/aws-cdk/issues/35424">#35424</a>)
(<a
href="https://github.com/aws/aws-cdk/commit/0e08c8ccc17f45a9023433c17c22a951b23cad43">0e08c8c</a>)</li>
</ul>
<h2><a
href="https://github.com/aws/aws-cdk/compare/v2.216.0-alpha.0...v2.217.0-alpha.0">2.217.0-alpha.0</a>
(2025-09-25)</h2>
<h2><a
href="https://github.com/aws/aws-cdk/compare/v2.215.0-alpha.0...v2.216.0-alpha.0">2.216.0-alpha.0</a>
(2025-09-22)</h2>
<h2><a
href="https://github.com/aws/aws-cdk/compare/v2.214.0-alpha.0...v2.215.0-alpha.0">2.215.0-alpha.0</a>
(2025-09-15)</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/aws/aws-cdk/commit/3f4d58548be8022660f62a99e43061fa54bd8588"><code>3f4d585</code></a>
feat: update L1 CloudFormation resource definitions (<a
href="https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib/issues/35926">#35926</a>)</li>
<li><a
href="https://github.com/aws/aws-cdk/commit/75b8eadb3761f02798061fe5578af82f785f687a"><code>75b8ead</code></a>
fix(stepfunctions): <code>DistributedMap</code> ResultWriter correct
query language sele...</li>
<li><a
href="https://github.com/aws/aws-cdk/commit/93af88715af7ad245b5b54b3f14caf19e70dc3ae"><code>93af887</code></a>
chore(ec2): add r8a instance class (<a
href="https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib/issues/35964">#35964</a>)</li>
<li><a
href="https://github.com/aws/aws-cdk/commit/fda6e13be540cca53499ed19a79a84ef3a0a706a"><code>fda6e13</code></a>
chore(spec2cdk): ensure strings are passed to attributes (<a
href="https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib/issues/35911">#35911</a>)</li>
<li><a
href="https://github.com/aws/aws-cdk/commit/23caef9399dd434eac6abf503fd7074e93984657"><code>23caef9</code></a>
chore(codebuild): add new enum values for codebuild (<a
href="https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib/issues/35861">#35861</a>)</li>
<li><a
href="https://github.com/aws/aws-cdk/commit/f2a31666fa92d284f6e8602e475aa0b7fca05ef7"><code>f2a3166</code></a>
feat(s3-deployment): support securityGroups in BucketDeploymentProps (<a
href="https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib/issues/33233">#33233</a>)</li>
<li><a
href="https://github.com/aws/aws-cdk/commit/af1868ce5959c86bcc2e64fc1a789eeb747a11d3"><code>af1868c</code></a>
chore(events-targets): correct typos in comments (<a
href="https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib/issues/35954">#35954</a>)</li>
<li><a
href="https://github.com/aws/aws-cdk/commit/b61923c1966ab713900b81c5ca0cd1f6cd602ebc"><code>b61923c</code></a>
chore(codebuild): remove unnecessary line from README (<a
href="https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib/issues/35942">#35942</a>)</li>
<li><a
href="https://github.com/aws/aws-cdk/commit/fba027bf2039c90265f4632bd76619f4bcde6f81"><code>fba027b</code></a>
feat(ec2): support for Cloud Wan Core Network routes (<a
href="https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib/issues/35008">#35008</a>)</li>
<li><a
href="https://github.com/aws/aws-cdk/commit/4763a76a58b2a9c55eabaf1b3f2e872c74f988e4"><code>4763a76</code></a>
chore: update analytics metadata blueprints</li>
<li>Additional commits viewable in <a
href="https://github.com/aws/aws-cdk/commits/v2.223.0/packages/aws-cdk-lib">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=aws-cdk-lib&package-manager=npm_and_yarn&previous-version=2.221.1&new-version=2.223.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Author: dependabot[bot]

package-lock.json

@@ -35,7 +35,7 @@
   },
   "dependencies": {
     "aws-cdk": "^2.1031.2",
-    "aws-cdk-lib": "^2.219.0",
+    "aws-cdk-lib": "^2.223.0",
     "cdk-nag": "^2.37.52",
     "constructs": "^10.4.2",
     "esbuild": "^0.27.0"

package.json

@@ -21,7 +21,7 @@
     "type": "module",
     "dependencies": {
         "aws-cdk": "^2.1031.2",
-        "aws-cdk-lib": "^2.219.0",
+        "aws-cdk-lib": "^2.223.0",
         "cdk-nag": "^2.37.52",
         "constructs": "^10.4.2"
     },