fix(deps): update dependency aws-cdk-lib to v2.264.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
aws-cdk-lib (source)	2.260.0 → 2.264.0

---

Release Notes

aws/aws-cdk (aws-cdk-lib)

v2.264.0

Compare Source

⚠ BREAKING CHANGES

• bedrockagentcore: Gateway metric helpers now emit corrected CloudWatch dimensions per-gateway
  metrics use { Operation, Protocol, Resource } (was { Resource }). Alarms/dashboards built on the
  old dimensions must be updated.
• bedrockagentcore: RuntimeBase metric helpers now emit corrected CloudWatch dimensions per-resource metrics use { Operation, Name, Resource } (was { Resource }) and aggregated metrics use { AggregateOperation } (was { Resource: 'All' }). Alarms/dashboards built on the old dimensions must be updated.

Features

• update L1 CloudFormation resource definitions (#​38526) (b5693cb)
• cloudwatch: support alarm mute rules (#​37504) (c3540bb), closes #​37502
• update L1 CloudFormation resource definitions (#​38479) (279340d)

Bug Fixes

• bedrockagentcore: gateway metrics emit correct CloudWatch dimension (#​38487) (5a7d360)
• bedrockagentcore: runtime metrics emit correct CloudWatch dimensions (#​38486) (4e44f24)
• cloudfront: warn when minimumProtocolVersion is set without a certificate (#​37250) (52ec5f7), closes #​35404
• ec2: allow EBS gp3 and io2 volumes up to 64 TiB (#​37049) (10711ba), closes #​37045
• stepfunctions-tasks: call-rest-api CallApiGatewayRestApiEndpoint does not support JsonATA for api_path (#​37738) (9f0afdc), closes #​37728 /github.com/aws/aws-cdk/blob/e207b76cc2503701b3c4e2c87023617b485b2fde/packages/aws-cdk-lib/aws-stepfunctions/lib/private/jsonata.ts#L1

---

Alpha modules (2.264.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: IDatabase.catalogArn and IDatabase.catalogId were removed in factor of a type
  safe ICatalog, which has catalogArn and catalogId. Consumers and implementations were updated
  accordingly.

Features

• glue-alpha: new Catalog L2 (#​38443) (6a8ba8e)
• glue-alpha: strengthen data encryption for S3Table (#​38501) (eb81d5e), closes /docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-5

Bug Fixes

• glue-alpha: enable key rotation for security configuration encryption (#​38512) (18560e0)
• mediaconnect-alpha: addOutput options and simplified VPC interface referencing (#​38515) (3c71466), closes #​38517

v2.263.0

Compare Source

Features

• autoscaling: add support for AutoScalingInstanceRefresh UpdatePolicy (#​38277) (434157f), closes #​38276
• docdb: support per-instance maintenance window on DatabaseCluster (#​38315) (5390624), closes #​30391
• ecs: add support for using existing Cloud Map namespaces in ECS clusters (#​36812) (bda00bf), closes #​26698
• eks: add Provisioned Control Plane support with controlPlaneScalingTier property (#​36651) (5ea1054), closes #​36650
• eks: add support for Kubernetes version 1.36 (#​38441) (da27b6c), closes #​38411
• lambda: add Java8AL2023, Java11AL2023 and Java17AL2023 runtime for Lambda #​38418 (#​38419) (1e55176)
• lambda: add logGroup and systemLogLevel to CapacityProvider (#​38183) (61a2e2d), closes #​38182
• lambda: add PropagateTags to CapacityProvider for tag propagation (#​38180) (6f86f97), closes #​38181

Bug Fixes

• core: upgrade cloudformation-validate library (#​38444) (d26e507), closes #​38412
• bump brace-expansion to 5.0.8 to address CVE-2026-14257 (#​38410) (5aaa395), closes #​38409 #​38063

---

Alpha modules (2.263.0-alpha.0)

⚠ BREAKING CHANGES

• mediaconnect: removalPolicy prop removed from FlowProps, GatewayProps, and BridgeProps. These resources now follow CloudFormation's default deletion behaviour (Delete).

Bug Fixes

• glue-alpha: race condition when creating mutiple indices (#​38016) (18b1947), closes #​24813 #​34 #​34
• mediaconnect: jsdoc typo (#​38434) (7fe6d3d)
• mediaconnect: remove default removal policy (#​38437) (238193d)

v2.262.2

Compare Source

Bug Fixes

• revert "fix(core): stack.node.addDependency gets slower as stacks grow (#​38314)" (#​38417) (d97dd8d), closes #​38406 #​38406

---

Alpha modules (2.262.2-alpha.0)

v2.262.1

Compare Source

Bug Fixes

• core: bump @aws/cloudformation-validate to 1.5.1-beta to fix install on Node != 22.x (#​38382) (d409b96), closes #​38380
• core: env CDK_VALIDATION=false does not disable built-in template validation (#​38379) (cc4208c), closes #​38378

---

Alpha modules (2.262.1-alpha.0)

v2.262.0

Compare Source

Features

• ecs: add support ECS-optimized Amazon Linux 2023 (Neuron) AMI (#​34689) (ad665c4)
• mediaconnect: l2 construct (#​37945) (8e9e001)
• update L1 CloudFormation resource definitions (#​38275) (2b1c632)
• apigateway: alb integration (#​36247) (20dbdd9), closes #​36184
• bedrockagentcore: support service/region in IAM credential provider for gateway targets (#​37697) (08a2543), closes #​37696
• cloudfront: add Managed-HostHeaderOnly origin request policy (#​38236) (0e66e47), closes #​38234
• core: templates are validated against a comprehensive default rule set (#​38135) (023c5bf)

Bug Fixes

• cross-stack warnings are emitted for nested stacks (#​38355) (db98909)
• apigateway: revert alb integration that breaks jsii go packaging (#​38305) (18158a4), closes #​36247 #​36247 #​36247 #​36247
• aws-cdk-lib: fatal validations don't show plugin name (#​38273) (a88d1ba)
• aws-cdk-lib: validation namespaces for annotations are inconsistent (#​38256) (75893d9)
• backup: lifecycle and vault lock validations reject tokenized durations (#​38264) (0ff20a3), closes #​38263 #​38246 #​37751 #​25943 #​38246 #​37751 #​25943
• certificatemanager: use hasOwnProperty in apexDomain to prevent prototype collision (#​37195) (ec38947), closes #​37193
• cloudfront-origins: validate httpPort and httpsPort range in HttpOrigin (#​37872) (8a62b58)
• core: stack-related validation has an empty construct path (#​38350) (0af7c34)
• core: stack.node.addDependency gets slower as stacks grow (#​38314) (0728618)
• core: synth crashes with EISDIR on a symlink-to-directory when a validation plugin is registered (#​38299) (be0fdc4), closes #​38295
• elasticloadbalancingv2: improve handling for dropInvalidHeaderFields in case of default or switching from true to false (#​36483) (208b9db), closes #​36409
• lambda: allow SnapStart for container image functions (#​38265) (586dc4f), closes #​30898
• lambda: validations reject tokenized provisioned concurrency and async invoke config values (#​38246) (4aa7e78), closes #​38245 #​37197 #​36275 #​37197
• opensearchservice: allow gp3 ebs throughput up to 2000 MiB/s (#​38001) (f0cfc5b), closes #​38000 #​36074
• spec2cdk: add IVS to event pattern method name prefixes (#​38322) (d6d1e8d)
• validation: incorrectly relative paths in Cloud Assemblies (#​38352) (3f9422f), closes #​38333
• validation: validation reports are not self-contained (#​38333) (5d11d70)

Reverts

• lambda: revert SnapStart for container image functions (#​38265) (#​38281) (3b92863)

---

Alpha modules (2.262.0-alpha.0)

Bug Fixes

• redshift-alpha: quote identifiers and escape literals containing special characters (#​38269) (3cb6844)

v2.261.0

Compare Source

⚠ BREAKING CHANGES

• ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

• aws-cloudwatch: AWS::CloudWatch::LogAlarm: QueryLanguage property has been removed from the ScheduledQueryConfiguration type.
• aws-elasticloadbalancing: AWS::ElasticLoadBalancing::LoadBalancer: Id attribute has been removed and the primary identifier is now LoadBalancerName.

Features

• update L1 CloudFormation resource definitions (#​38189) (5aabd32)
• core: add git source metadata to CloudFormation templates (#​37368) (765271b)
• rds: support native Secrets Manager integration for RDS Cluster and Instance (#​35734) (07d5623), closes #​29239

Bug Fixes

• improve internal path detection (#​38205) (6a1934d)
• ecr-assets: tarball asset build command not escaped (#​38171) (bad8a3a)
• print validation errors according to new style (#​38166) (031aba8)

---

Alpha modules (2.261.0-alpha.0)

Features

• metrics-facade-alpha: generate metrics facades (#​37334) (aa9beb0)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm warn ERESOLVE overriding peer dependency
npm warn While resolving: @aws-sdk/dynamodb-codec@3.972.5
npm warn Found: @aws-sdk/client-dynamodb@3.981.0
npm warn node_modules/@aws-sdk/client-dynamodb
npm warn   @aws-sdk/client-dynamodb@"3.981.0" from the root project
npm warn   1 more (@aws-sdk/util-dynamodb)
npm warn
npm warn Could not resolve dependency:
npm warn peer @aws-sdk/client-dynamodb@"3.980.0" from @aws-sdk/dynamodb-codec@3.972.5
npm warn node_modules/@aws-sdk/dynamodb-codec
npm warn   @aws-sdk/dynamodb-codec@"^3.972.5" from @aws-sdk/client-dynamodb@3.981.0
npm warn   node_modules/@aws-sdk/client-dynamodb
npm warn
npm warn Conflicting peer dependency: @aws-sdk/client-dynamodb@3.980.0
npm warn node_modules/@aws-sdk/client-dynamodb
npm warn   peer @aws-sdk/client-dynamodb@"3.980.0" from @aws-sdk/dynamodb-codec@3.972.5
npm warn   node_modules/@aws-sdk/dynamodb-codec
npm warn     @aws-sdk/dynamodb-codec@"^3.972.5" from @aws-sdk/client-dynamodb@3.981.0
npm warn     node_modules/@aws-sdk/client-dynamodb
npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
npm error Refusing to fetch "https://registry.npmjs.org/aws-cdk-lib/-/aws-cdk-lib-2.264.0.tgz"
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-08-14T16_58_51_413Z-debug-0.log