chore(deps): update aws-cdk-lib

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
aws-cdk (source)	2.1114.1 → 2.1117.0
aws-cdk-lib (source)	2.245.0 → 2.248.0

---

Release Notes

aws/aws-cdk-cli (aws-cdk)

v2.1117.0

Compare Source

2.1117.0 (2026-04-03)

Features

• deps: upgrade aws-cdk-lib (#​1304) (03daeb6)

v2.1116.0

Compare Source

2.1116.0 (2026-04-01)

Features

• cli: add publish-assets command for asset publishing without deployment (#​1020) (7c079da)
• deps: upgrade aws-cdk-lib (#​1297) (4da5e25)
• display CloudFormation Guard Hook failures (#​1198) (ae062a9)

Bug Fixes

• security changes in nested stacks are not shown for cdk diff --security-only (#​1295) (8f7e1aa)

v2.1115.1

Compare Source

2.1115.1 (2026-03-31)

Bug Fixes

• CDK apps do not print colors anymore (#​1294) (e979d8d)
• error annotations are not collected (#​1262) (5f96e59)

v2.1115.0

Compare Source

2.1115.0 (2026-03-30)

Features

• cli: new cdk diff --method flag to allow enforcing change set usage (#​1266) (23bc301)
• deps: upgrade aws-cdk-lib (#​1275) (4111d4d)

aws/aws-cdk (aws-cdk-lib)

v2.248.0

Compare Source

Bug Fixes

• eks: downgrade isolated subnet validation from error to warning (#​37500) (470856c), closes #​37491

---

Alpha modules (2.248.0-alpha.0)

v2.247.0

Compare Source

⚠ BREAKING CHANGES

• ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

aws-bedrockagentcore: AWS::BedrockAgentCore::OnlineEvaluationConfig: ExecutionStatus attribute removed.
aws-appstream: AWS::AppStream::ImageBuilder: Name property is now immutable.
aws-eks: AWS::EKS::Capability: EKS_CAPABILITY_ACK_S3_LOGS vended log type removed.

Features

• update L1 CloudFormation resource definitions (#​37410) (bd2c318)
• apigatewayv2: add role support for lambda authorizers (#​35706) (2fb2f16), closes #​35696
• batch: skip unregister job definition on update (#​36011) (2fb2240)
• elasticloadbalancingv2: jwt verification for application load balancer (#​36099) (aacd28a), closes #​36096

Bug Fixes

• bump brace-expansion from 5.0.3 to 5.0.5 to address CVE-2026-33750 (#​37379) (69cf4c9)
• prevent prototype pollution in 2 APIs (#​37453) (1016537)
• aws-cdk-lib: condensed stack trace hides namespaced package name (#​37413) (cb8e7fb)

---

Alpha modules (2.247.0-alpha.0)

Features

• mediapackagev2-alpha: new L2 construct (#​37279) (7debfb9)

v2.246.0

Compare Source

Features

• bedrock: add MiniMax and GLM foundation model identifiers (#​37348) (2015344), closes #​37347

Bug Fixes

• dynamodb: throw error when grantee is an unsupported ServicePrincipal (#​37335) (d12754f), closes #​35817 /github.com/aws/aws-cdk/issues/37273#issuecomment-4099645443
• lambda-nodejs: use powershell for spawn steps on Windows (#​37412) (a92105c), closes #​37387
• core: noisy property deprecation warnings (#​37415) (4fd0002), closes #​37407

Reverts

• core: add source tracing for L1 construct property mutations (#​37415) (4fd0002), closes aws/aws-cdk#37285

---

Alpha modules (2.246.0-alpha.0)

---

Configuration

📅 Schedule: Branch creation - "on saturday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Diff for stage: DefaultStage

Warning

1 Destructive Changes

Diff for stack: GitHubOidcStack - 0 to add, 1 to update, 0 to destroy 🟡

Details

Resources
[~] Custom::AWSCDKOpenIdConnectProvider GitHubOidcProvider7EBF861F
 ├─ [~] CodeHash
 │   ├─ [-] 62fa02efcaa700e1c247e1d3cc2aa0cd07a0808a9a3e3d2230e51f57a02233fb
 │   └─ [+] d75c48c9f82cde63e9bf414df335e84e8ac24f11eb34889be255b702aec71e50
 └─ [~] RejectUnauthorized
[~] AWS::Lambda::Function CustomAWSCDKOpenIdConnectProviderCustomResourceProviderHandlerF2C543E0
 ├─ [~] Code
 │   └─ [~] .S3Key:
 │       ├─ [-] 62fa02efcaa700e1c247e1d3cc2aa0cd07a0808a9a3e3d2230e51f57a02233fb.zip
 │       └─ [+] d75c48c9f82cde63e9bf414df335e84e8ac24f11eb34889be255b702aec71e50.zip
 └─ [~] Metadata
     └─ [~] .aws:asset:path:
         ├─ [-] asset.62fa02efcaa700e1c247e1d3cc2aa0cd07a0808a9a3e3d2230e51f57a02233fb
         └─ [+] asset.d75c48c9f82cde63e9bf414df335e84e8ac24f11eb34889be255b702aec71e50

No Changes for stack: Service-prod ✅

Diff for stack: Frontend-prod - 0 to add, 1 to update, 0 to destroy ❌

Details

[!WARNING]
Destructive Changes ‼️
Stack: Frontend-prod - Resource: DeployFrontendAwsCliLayerD774ED8F - Impact: WILL_REPLACE

Resources
[~] AWS::Lambda::LayerVersion DeployFrontendAwsCliLayerD774ED8F replace
 ├─ [~] Content (requires replacement)
 │   └─ [~] .S3Key:
 │       ├─ [-] 0cfdecad2260a3a84ad0c2d08a77e03c9d25e26c7b52f26b1e1faf97aef92f18.zip
 │       └─ [+] e2659170a0721541efa761a8d5d04d5e36cbbf691c4b15a9053002b7c825055d.zip
 └─ [~] Metadata
     └─ [~] .aws:asset:path:
         ├─ [-] asset.0cfdecad2260a3a84ad0c2d08a77e03c9d25e26c7b52f26b1e1faf97aef92f18.zip
         └─ [+] asset.e2659170a0721541efa761a8d5d04d5e36cbbf691c4b15a9053002b7c825055d.zip

No Changes for stack: Monitoring-prod ✅

Generated for commit 5d54b82 at 2026-04-04T02:02:57.473Z