chore(deps): update dependency aws-cdk-lib to v2.220.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
aws-cdk-lib (source)	2.219.0 -> 2.220.0

---

Release Notes

aws/aws-cdk (aws-cdk-lib)

v2.220.0

Compare Source

⚠ BREAKING CHANGES

---

L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

• aws-neptune: AWS::Neptune::EventSubscription: SnsTopicArn property is now required.
• aws-neptune: AWS::Neptune::EventSubscription: Id attribute removed.
• aws-servicecatalog: AWS::ServiceCatalog::PortfolioShare: Id attribute removed.
• aws-lex: AWS::Lex::ResourcePolicy: ResourceArn property is now immutable.

Co-authored-by: aws-cdk-automation [email protected]

---

Features

• batch: ec2 Managed Compute Environment support default instance classes, deprecate useOptimalInstanceClasses (#​35537) (9d59dd8), closes #​35515
• kinesis: shard-level metrics for stream (#​34963) (ce9b3a8)
• lambda: refactor Function URL permissions (#​35725) (d38d015)
• update L1 CloudFormation resource definitions (#​35679) (dec6e6a)
• update L1 CloudFormation resource definitions (#​35695) (8a6cf46)
• update L1 CloudFormation resource definitions (#​35712) (27a8760)
• amplify: support build compute type (#​34796) (a02c656)
• cloudfront-origins: add ipAddressType property to Lambda Function URL origins (#​35458) (6cf6dc8), closes #​35450
• ec2: add BEDROCK_AGENTCORE and BEDROCK_AGENTCORE_GATEWAY to InterfaceVpcEndpointAwsService (#​35667) (6966c03)
• ec2: support for automatic VPN session reconnect on client VPN endpoint (#​35538) (9536472)
• eks: add removal policy support for EKS cluster construct (#​35560) (4b4e322), closes #​25544
• logs: add parameter to allow metric filter on transformed logs (#​35359) (effa46d)
• opensearch: add OpenSearch 3.1 engine version (#​35477) (3bd7cf9), closes #​35471
• route53: add fromPrivateHostedZoneAttributes function to PrivateHostedZone (#​35552) (c8d7a79), closes #​23268
• synthetics: allow root level canary scripts files for Puppeteer versions 11 and greater (#​35426) (46fb2dc)

Bug Fixes

• cloudwatch: metric period in AnomalyDetectionAlarm is not being respected (#​35319) (c7d8004), closes #​34614 /github.com/aws/aws-cdk/blob/6966c03b1a7aece0846f5a91bbeb825cd7491689/packages/aws-cdk-lib/aws-cloudwatch/lib/private/alarm-options.ts#L16-L18 /github.com/aws/aws-cdk/blob/86638f6daca6ead382d0b9c1cf65bb04f70d4b3d/packages/aws-cdk-lib/package.json#L32 /github.com/aws/aws-cdk/pull/35319#discussion_r2407134489
• ecs: update task definition validations for managed instances (#​35684) (8638a78), closes #​35644
• lambda-nodejs: bump bun to 1.2.23 for ARM64 support (#​35702) (3aa186c), closes #​35534
• s3: resolve synthesis error in BucketPolicy.fromCfnBucketPolicy() (#​35633) (d9085cc), closes #​34322
• s3tables: s3 table bucket read access role uses incorrect permission for s3tables:ListNamespaces (#​35420) (eb949bb)

---

Alpha modules (2.220.0-alpha.0)

Bug Fixes

• amplify-alpha: handle empty customResponseHeaders array (#​35700) (57f9068), closes #​35693

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm.
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: @hello.nrfcloud.com/[email protected]
npm error Found: @aws-sdk/[email protected]
npm error node_modules/@aws-sdk/client-dynamodb
npm error   dev @aws-sdk/client-dynamodb@"3.902.0" from the root project
npm error
npm error Could not resolve dependency:
npm error peer @aws-sdk/client-dynamodb@"^3.908.0" from @hello.nrfcloud.com/[email protected]
npm error node_modules/@hello.nrfcloud.com/nrfcloud-api-helpers
npm error   @hello.nrfcloud.com/nrfcloud-api-helpers@"6.0.375" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry
npm error this command with --force or --legacy-peer-deps
npm error to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2025-10-18T01_54_53_074Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2025-10-18T01_54_53_074Z-debug-0.log