Skip to content

build(deps): bump the infra-deps group in /infra with 6 updates - #237

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/infra/infra-deps-cf58624355
Closed

build(deps): bump the infra-deps group in /infra with 6 updates#237
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/infra/infra-deps-cf58624355

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 31, 2026

Copy link
Copy Markdown
Contributor

Bumps the infra-deps group in /infra with 6 updates:

Package From To
aws-cdk-lib 2.260.0 2.262.0
constructs 10.6.0 10.7.1
yaml 2.8.3 2.9.0
aws-cdk 2.1117.0 2.1133.0
typescript 5.7.3 7.0.2
@types/node 22.19.17 26.1.1

Updates aws-cdk-lib from 2.260.0 to 2.262.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.262.0

Features

  • ecs: add support ECS-optimized Amazon Linux 2023 (Neuron) AMI (#34689) (ad665c4)
  • mediaconnect: l2 construct (#37945) (8e9e001)
  • update L1 CloudFormation resource definitions (#38275) (2b1c632)
  • apigateway: alb integration (#36247) (20dbdd9), closes #36184
  • bedrockagentcore: support service/region in IAM credential provider for gateway targets (#37697) (08a2543), closes #37696
  • cloudfront: add Managed-HostHeaderOnly origin request policy (#38236) (0e66e47), closes #38234
  • core: templates are validated against a comprehensive default rule set (#38135) (023c5bf)

Bug Fixes

Reverts


Alpha modules (2.262.0-alpha.0)

Bug Fixes

  • redshift-alpha: quote identifiers and escape literals containing special characters (#38269) (3cb6844)

v2.261.0

⚠ BREAKING CHANGES

  • ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:
  • aws-cloudwatch: AWS::CloudWatch::LogAlarm: QueryLanguage property has been removed from the ScheduledQueryConfiguration type.
  • aws-elasticloadbalancing: AWS::ElasticLoadBalancing::LoadBalancer: Id attribute has been removed and the primary identifier is now LoadBalancerName.

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.262.2-alpha.0 (2026-07-29)

2.262.1-alpha.0 (2026-07-23)

2.262.0-alpha.0 (2026-07-22)

Bug Fixes

  • redshift-alpha: quote identifiers and escape literals containing special characters (#38269) (3cb6844)

2.261.0-alpha.0 (2026-07-02)

Features

  • metrics-facade-alpha: generate metrics facades (#37334) (aa9beb0)

2.260.0-alpha.0 (2026-06-16)

2.259.0-alpha.0 (2026-06-11)

2.258.1-alpha.0 (2026-06-08)

2.258.0-alpha.0 (2026-06-04)

Features

  • integ-tests-alpha: add option to set the provider log level (#38005) (c634a79)

Bug Fixes

  • custom-resource-handlers: deterministic asset hashes for generated lambdas (#37634) (6c3d5bc), closes #34307
  • glue-alpha: deprecate Ray Jobs (#38055) (3fa428b)
  • glue-alpha: restore notifyDelayAfter to PySpark and Scala Spark ETL jobs (#37815) (05be88a), closes #33839
  • integ-tests-alpha: assertion failures print too much unnecessary information (#37974) (bc0de1d)
  • mediapackagev2-alpha: cdnAuth on OriginEndpoint now generates the required policy (#38013) (1d56b46)

2.257.0-alpha.0 (2026-05-21)

2.256.1-alpha.0 (2026-05-20)

2.256.0-alpha.0 (2026-05-19)

... (truncated)

Commits
  • dd8ac9f Merge remote-tracking branch 'origin/v2-release' into bump/2.262.0
  • 7e00626 chore(release): 2.262.0
  • db98909 fix: cross-stack warnings are emitted for nested stacks (#38355)
  • 3f9422f fix(validation): incorrectly relative paths in Cloud Assemblies (#38352)
  • 0af7c34 fix(core): stack-related validation has an empty construct path (#38350)
  • 5d11d70 fix(validation): validation reports are not self-contained (#38333)
  • 813b790 chore(core): upgrade @​aws/cloudformation-validate to 1.5.0-beta and and updat...
  • 0728618 fix(core): stack.node.addDependency gets slower as stacks grow (#38314)
  • ad665c4 feat(ecs): add support ECS-optimized Amazon Linux 2023 (Neuron) AMI (#34689)
  • f0cfc5b fix(opensearchservice): allow gp3 ebs throughput up to 2000 MiB/s (#38001)
  • Additional commits viewable in compare view

Updates constructs from 10.6.0 to 10.7.1

Release notes

Sourced from constructs's releases.

v10.7.1

10.7.1 (2026-07-20)

Bug Fixes

  • Node.path takes a lot of time on deep construct trees (#2873) (857a94f)

v10.7.0

10.7.0 (2026-07-15)

Features

Commits

Updates yaml from 2.8.3 to 2.9.0

Release notes

Sourced from yaml's releases.

v2.9.0

The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

  • fix: Avoid calling Array.prototype.push.apply() with large source array
  • fix(lexer): Avoid recursive calls that may exhaust the call stack

v2.8.4

  • Disable alias resolution with maxAliasCount:0 (#677)
  • Handle invalid unicode escapes (e1a1a77)
  • Apply minFractionDigits only to decimal strings (#676)
Commits
  • ddb21b0 2.9.0
  • 167365b docs: Clarify that not all errors can be avoided
  • 6eca2a7 fix: Avoid calling Array.prototype.push.apply() with large source array
  • 0543cd5 fix(lexer): Avoid recursive calls that may exhaust the call stack
  • ccdf743 2.8.4
  • f625789 fix: Disable alias resolution with maxAliasCount:0 (#677)
  • e1a1a77 fix: Handle invalid unicode escapes
  • a163ea0 style: Satify Prettier
  • b2a5a6c fix: Apply minFractionDigits only to decimal strings (#676)
  • 93c951b chore: Bump JSR version to v2.8.3 (#673)
  • Additional commits viewable in compare view

Updates aws-cdk from 2.1117.0 to 2.1133.0

Release notes

Sourced from aws-cdk's releases.

aws-cdk@v2.1133.0

2.1133.0 (2026-07-23)

Features

  • cdk-explorer: advertise LSP feature and protocol manifest (#1750) (70cf0e3)
  • deps: upgrade aws-cdk-lib (#1752) (2810a54)

Bug Fixes

aws-cdk@v2.1132.1

2.1132.1 (2026-07-22)

Bug Fixes

  • cannot debug performance issues of internal projects (#1736) (56aea57)
  • cli: entire violation report is printed in red (#1742) (c670960)
  • toolkit-lib: support cdk orphan for resources inside a stage (#1733) (9398ed0), closes #1727

aws-cdk@v2.1132.0

2.1132.0 (2026-07-16)

Features

aws-cdk@v2.1131.0

2.1131.0 (2026-07-14)

Features

  • cli: typescript init templates use tsc + tsx and swc/jest, on typescript 7 (#1719) (9bf08e5)

aws-cdk@v2.1130.0

2.1130.0 (2026-07-10)

Features

... (truncated)

Commits
  • 712d792 fix(cli): forward --no-validation to the app process via CDK_VALIDATION (#1756)
  • 2810a54 feat(deps): upgrade aws-cdk-lib (#1752)
  • 09f70ce docs: update TypeScript examples from ts-node to tsx (#1749)
  • 70cf0e3 feat(cdk-explorer): advertise LSP feature and protocol manifest (#1750)
  • fbb26df docs(cli): document the cdk lsp command in the CLI README (#1743)
  • 56aea57 fix: cannot debug performance issues of internal projects (#1736)
  • c670960 fix(cli): entire violation report is printed in red (#1742)
  • 9398ed0 fix(toolkit-lib): support cdk orphan for resources inside a stage (#1733)
  • c4e4ee9 feat: integrate lsp feature branch (#1681)
  • 9bf08e5 feat(cli): typescript init templates use tsc + tsx and swc/jest, on typescrip...
  • Additional commits viewable in compare view

Updates typescript from 5.7.3 to 7.0.2

Release notes

Sourced from typescript's releases.

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

Downloads are available on:

TypeScript 6.0

For release notes, check out the release announcement blog post.

Downloads are available on:

TypeScript 6.0 Beta

For release notes, check out the release announcement.

Downloads are available on:

TypeScript 5.9.3

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

Downloads are available on:

TypeScript 5.9

Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.

For release notes, check out the release announcement

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.


Updates @types/node from 22.19.17 to 26.1.1

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the infra-deps group in /infra with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [aws-cdk-lib](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk-lib) | `2.260.0` | `2.262.0` |
| [constructs](https://github.com/aws/constructs) | `10.6.0` | `10.7.1` |
| [yaml](https://github.com/eemeli/yaml) | `2.8.3` | `2.9.0` |
| [aws-cdk](https://github.com/aws/aws-cdk-cli/tree/HEAD/packages/aws-cdk) | `2.1117.0` | `2.1133.0` |
| [typescript](https://github.com/microsoft/TypeScript) | `5.7.3` | `7.0.2` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.19.17` | `26.1.1` |


Updates `aws-cdk-lib` from 2.260.0 to 2.262.0
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.alpha.md)
- [Commits](https://github.com/aws/aws-cdk/commits/v2.262.0/packages/aws-cdk-lib)

Updates `constructs` from 10.6.0 to 10.7.1
- [Release notes](https://github.com/aws/constructs/releases)
- [Commits](aws/constructs@v10.6.0...v10.7.1)

Updates `yaml` from 2.8.3 to 2.9.0
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.3...v2.9.0)

Updates `aws-cdk` from 2.1117.0 to 2.1133.0
- [Release notes](https://github.com/aws/aws-cdk-cli/releases)
- [Commits](https://github.com/aws/aws-cdk-cli/commits/aws-cdk@v2.1133.0/packages/aws-cdk)

Updates `typescript` from 5.7.3 to 7.0.2
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

Updates `@types/node` from 22.19.17 to 26.1.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: aws-cdk-lib
  dependency-version: 2.262.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: infra-deps
- dependency-name: constructs
  dependency-version: 10.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: infra-deps
- dependency-name: yaml
  dependency-version: 2.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: infra-deps
- dependency-name: aws-cdk
  dependency-version: 2.1133.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: infra-deps
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: infra-deps
- dependency-name: "@types/node"
  dependency-version: 26.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: infra-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 31, 2026
@github-actions github-actions Bot added the blog:skip ブログ対象外 label Jul 31, 2026
@ShotaroKataoka

Copy link
Copy Markdown
Contributor

Closing: this group mixed semver-major bumps (typescript 5→7, eslint 9→10, etc.) that break the toolchain. dependabot.yml now ignores majors for npm groups — the next weekly run will recreate this group with minor/patch only. Majors will be migrated manually.

@dependabot @github

dependabot Bot commented on behalf of github Jul 31, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/infra/infra-deps-cf58624355 branch July 31, 2026 12:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

blog:skip ブログ対象外 dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant