chore(deps): update dependency aws-cdk-lib to v2.222.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
aws-cdk-lib (source)	2.219.0 -> 2.222.0

---

Release Notes

aws/aws-cdk (aws-cdk-lib)

v2.222.0

Compare Source

⚠ BREAKING CHANGES

• bedrock-agentcore: The signature of RuntimeAuthorizerConfiguration.usingCognito() has changed to accept IUserPool and IUserPoolClient constructs instead of string parameters, and now supports multiple clients.

Features

• apigateway: add binaryMediaTypes property to SpecRestApi (#​35502) (bf10d94), closes #​35498
• apigatewayv2: WebSocketStage support accessLogSettings (#​34766) (dad112e), closes #​21935
• bedrock-agentcore: use IUserPool and IUserPoolClient interfaces instead of string identifiers (#​35860) (a38afc9), closes #​35854
• core: IEnvironmentAware interface to retrieve a construct's environment (#​35817) (8ee5d4b)
• elasticloadbalancingv2: create security group settings for NLB by default (under feature flag) (#​34675) (ff83cfd), closes #​34606 /github.com/aws/aws-cdk/issues/34606#issuecomment-2931313249
• events-targets: support Amazon Data Firehose target using Firehose's IDeliveryStream (#​33798) (a374b6b), closes #​33757 #​33758
• kinesisfirehose: add built-in data processors to decompress CloudWatch logs and extract messages (#​33749) (5dec21e), closes #​33691 #​20242 /github.com/aws/aws-cdk/issues/33691#issuecomment-2713012245
• lambda: add Java25 runtime for Lambda (#​35867) (db71fac)
• lambda: add Python 3.14 runtime for Lambda (#​35869) (ebef303)
• memory: add agentcore memory l2 construct (#​35757) (6a2e17e)
• msk: support Express brokers (#​34741) (0a69e5f), closes #​32923

Bug Fixes

• agentcore: addToRolePolicy for runtime with imported role destroys and recreates policies on every deployment (#​35842) (92525e4), closes #​35844 40aws-cdk/aws-bedrock-agentcore-alpha/agentcore/runtime/runtime-base.ts#L253
• agentcore: custom execution role policy for runtime lacks proper permissions (#​35849) (ee94b63), closes #​35852 40aws-cdk/aws-bedrock-agentcore-alpha/agentcore/runtime/runtime-artifact.ts#L65 40aws-cdk/aws-bedrock-agentcore-alpha/agentcore/runtime/runtime.ts#L252-L259 /github.com/aws/aws-cdk/blob/v2.221.0/packages/aws-cdk-lib/aws-codepipeline/lib/pipeline.ts#L693 /github.com/aws/aws-cdk/blob/v2.221.0/packages/aws-cdk-lib/aws-lambda/lib/function.ts#L1468 /github.com/aws/aws-cdk/blob/v2.221.0/packages/aws-cdk-lib/aws-ecs/lib/base/base-service.ts#L1161
• dynamodb: addToResourcePolicy has no effect (#​35554) (94d7e34), closes #​35062
• ecs: remove empty CfnClusterCapacityProviderAssociations resource (#​35783) (c8a131b), closes #​35699 #​35742
• iam: cannot grant lambda:InvokeFunction on ManagedPolicy or Policy via grantInvoke() method (#​32984) (a07d75a), closes #​32980 /github.com/aws/aws-cdk/pull/32984#pullrequestreview-2863553504
• compilation failure in Go (#​35871) (5e4f603), closes aws/aws-cdk#35770 #​35862
• ec2: remove PassRole policy emitted by cloudwatch vpc flow destination (#​35762) (c4b80df), closes #​35729

---

Alpha modules (2.222.0-alpha.0)

Features

• eks-v2-alpha: eks-v2-alpha is now in developer preview (#​35801) (32afc0f)

Bug Fixes

• bedrock-alpha: apply permission dependency to existing and non-existing roles (#​35123) (b39ccf3), closes #​35120
• eks-v2-alpha: remove hyphen from Go package name (#​35927) (2cdfc8a)

v2.221.1

Compare Source

Bug Fixes

• compilation failure in Go (#​35871) (4379f66), closes aws/aws-cdk#35770 #​35862

---

Alpha modules (2.221.1-alpha.0)

v2.221.0

Compare Source

⚠ BREAKING CHANGES

• ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

• aws-datazone: AWS::DataZone::ProjectProfile: Id property removed.
• aws-logs: AWS::Logs::DeliveryDestination: DeliveryDestinationType attribute removed.
• aws-s3: AWS::S3::AccessGrantsLocation: IamRoleArn property is now required.
• aws-s3: AWS::S3::AccessGrantsLocation: LocationScope property is now required.
• aws-servicecatalog: AWS::ServiceCatalog::TagOptionAssociation: Id attribute removed.

Features

• update L1 CloudFormation resource definitions (#​35816) (82bef28)
• agentcore: add agentcore L2 constructs for 1p tools (#​35577) (3087ffa)
• agentcore: add agentcore runtime L2 construct (#​35623) (c57484a)
• ecr: image tag mutability exclusion filters (#​35246) (f6dd5cf), closes #​35454
• ecs: implement IConnectable interface for ManagedInstancesCapacityProvider (#​35745) (fd5ff76)
• kinesisfirehose: support DeliveryStream record format conversion for S3 Bucket Destination (#​35410) (79bcba2), closes #​15501 /github.com/aws/aws-cdk/issues/15501#issuecomment-3255582302
• update L1 CloudFormation resource definitions (#​35769) (a165905)

Bug Fixes

• ecs-patterns: resolve target group conflict when updating ALB internetFacing or loadBalancerName (under feature flag) (#​35508) (69b9c03), closes #​33253 #​33253 #​33253
• lambda: can't find entry file under ESM module system (#​35797) (7becd79), closes #​21630
• lambda-runtime: change fallback for latest lambda node runtime to node 22.x (#​35764) (10fcb1b)
• opensearchservice: add i8g nodes validation without EBS (#​35668) (9594842), closes #​35666
• s3-deployment: handle empty string in Source.data() (#​35824) (95c8d73), closes #​35809
• stepfunctions-tasks: allow passing apiEndpoint as intrinsic function (under feature flag) (#​32139) (ddfef06), closes #​29925 #​29925 #​30749

---

Alpha modules (2.221.0-alpha.0)

Features

• msk-alpha: support Kafka 4.1 (#​35759) (67539de)

Bug Fixes

• elasticache-alpha: cannot import Redis 7 serverless cache (#​35629) (2bde1a0)

v2.220.0

Compare Source

⚠ BREAKING CHANGES

---

L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

• aws-neptune: AWS::Neptune::EventSubscription: SnsTopicArn property is now required.
• aws-neptune: AWS::Neptune::EventSubscription: Id attribute removed.
• aws-servicecatalog: AWS::ServiceCatalog::PortfolioShare: Id attribute removed.
• aws-lex: AWS::Lex::ResourcePolicy: ResourceArn property is now immutable.

Co-authored-by: aws-cdk-automation aws-cdk-automation@users.noreply.github.com

---

Features

• batch: ec2 Managed Compute Environment support default instance classes, deprecate useOptimalInstanceClasses (#​35537) (9d59dd8), closes #​35515
• kinesis: shard-level metrics for stream (#​34963) (ce9b3a8)
• lambda: refactor Function URL permissions (#​35725) (d38d015)
• update L1 CloudFormation resource definitions (#​35679) (dec6e6a)
• update L1 CloudFormation resource definitions (#​35695) (8a6cf46)
• update L1 CloudFormation resource definitions (#​35712) (27a8760)
• amplify: support build compute type (#​34796) (a02c656)
• cloudfront-origins: add ipAddressType property to Lambda Function URL origins (#​35458) (6cf6dc8), closes #​35450
• ec2: add BEDROCK_AGENTCORE and BEDROCK_AGENTCORE_GATEWAY to InterfaceVpcEndpointAwsService (#​35667) (6966c03)
• ec2: support for automatic VPN session reconnect on client VPN endpoint (#​35538) (9536472)
• eks: add removal policy support for EKS cluster construct (#​35560) (4b4e322), closes #​25544
• logs: add parameter to allow metric filter on transformed logs (#​35359) (effa46d)
• opensearch: add OpenSearch 3.1 engine version (#​35477) (3bd7cf9), closes #​35471
• route53: add fromPrivateHostedZoneAttributes function to PrivateHostedZone (#​35552) (c8d7a79), closes #​23268
• synthetics: allow root level canary scripts files for Puppeteer versions 11 and greater (#​35426) (46fb2dc)

Bug Fixes

• cloudwatch: metric period in AnomalyDetectionAlarm is not being respected (#​35319) (c7d8004), closes #​34614 /github.com/aws/aws-cdk/blob/6966c03b1a7aece0846f5a91bbeb825cd7491689/packages/aws-cdk-lib/aws-cloudwatch/lib/private/alarm-options.ts#L16-L18 /github.com/aws/aws-cdk/blob/86638f6daca6ead382d0b9c1cf65bb04f70d4b3d/packages/aws-cdk-lib/package.json#L32 /github.com/aws/aws-cdk/pull/35319#discussion_r2407134489
• ecs: update task definition validations for managed instances (#​35684) (8638a78), closes #​35644
• lambda-nodejs: bump bun to 1.2.23 for ARM64 support (#​35702) (3aa186c), closes #​35534
• s3: resolve synthesis error in BucketPolicy.fromCfnBucketPolicy() (#​35633) (d9085cc), closes #​34322
• s3tables: s3 table bucket read access role uses incorrect permission for s3tables:ListNamespaces (#​35420) (eb949bb)

---

Alpha modules (2.220.0-alpha.0)

Bug Fixes

• amplify-alpha: handle empty customResponseHeaders array (#​35700) (57f9068), closes #​35693

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm.
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: @hello.nrfcloud.com/map-backend@0.0.0-development
npm error Found: @aws-sdk/client-dynamodb@3.902.0
npm error node_modules/@aws-sdk/client-dynamodb
npm error   dev @aws-sdk/client-dynamodb@"3.902.0" from the root project
npm error
npm error Could not resolve dependency:
npm error peer @aws-sdk/client-dynamodb@"^3.913.0" from @hello.nrfcloud.com/nrfcloud-api-helpers@6.0.388
npm error node_modules/@hello.nrfcloud.com/nrfcloud-api-helpers
npm error   @hello.nrfcloud.com/nrfcloud-api-helpers@"6.0.388" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry
npm error this command with --force or --legacy-peer-deps
npm error to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2025-11-08T21_13_14_586Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2025-11-08T21_13_14_586Z-debug-0.log