[dependabot]

Bumps the cdk group with 3 updates in the / directory: @guardian/cdk, aws-cdk-lib and aws-cdk.

Updates @guardian/cdk from 65.1.0 to 65.1.1

Release notes

Sourced from @​guardian/cdk's releases.

v65.1.1

Patch Changes

• d81f193: Add optional allowS3Sync boolean (default false) to GuLoadBalancedAppExperimental pattern to add permissions necessary to use aws s3 sync in EC2 user-data blocks.

Changelog

Sourced from @​guardian/cdk's changelog.

65.1.1

Patch Changes

• d81f193: Add optional allowS3Sync boolean (default false) to GuLoadBalancedAppExperimental pattern to add permissions necessary to use aws s3 sync in EC2 user-data blocks.

Commits

• 04c89e4 Merge pull request #2987 from guardian/changeset-release/main
• 8cc67d0 Bump package version
• 1ee35c9 Merge pull request #2986 from guardian/allow-ec2-to-s3-sync
• e466e3c Update .changeset/sparkly-lands-swim.md
• d81f193 Create sparkly-lands-swim.md
• b23ec2f Add allowS3Sync flag to instance role and ec2props
• See full diff in compare view

Updates aws-cdk-lib from 2.272.0 to 2.273.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.273.0

⚠ BREAKING CHANGES

• ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

aws-appstream: AWS::AppStream::StackFleetAssociation: FleetName property is now immutable. aws-appstream: AWS::AppStream::StackFleetAssociation: StackName property is now immutable. aws-appsync: AWS::AppSync::ApiCache: AtRestEncryptionEnabled property is now immutable. aws-appsync: AWS::AppSync::ApiCache: TransitEncryptionEnabled property is now immutable. aws-bedrockagentcore: AWS::BedrockAgentCore::OnlineEvaluationConfig: OutputConfig attribute removed. aws-cloud9: AWS::Cloud9::EnvironmentEC2: Id attribute removed. aws-config: AWS::Config::ConfigurationRecorder: Id attribute removed. aws-config: AWS::Config::OrganizationConfigRule: Id attribute removed. aws-datazone: AWS::DataZone::PolicyGrant: Detail property is now required. aws-datazone: AWS::DataZone::PolicyGrant: Principal property is now required. aws-directoryservice: AWS::DirectoryService::MicrosoftAD: Id attribute removed. aws-lambda: AWS::Lambda::NetworkConnector: VpcEgressConfiguration.NetworkProtocol property is now required. aws-lambda: AWS::Lambda::NetworkConnector: VpcEgressConfiguration.SecurityGroupIds property is now required.

Features

• update L1 CloudFormation resource definitions (#38969) (ed0df78)
• batch: add ConsumableResource L2 construct (#36971) (a12f3a1)
• bedrockagentcore: support runtime platformVersion (#38924) (227423f)
• cloudfront: default Distribution behaviors to redirect HTTP to HTTPS (#38721) (6ede006), closes #38599
• opensearchservice: add useLatestServiceSoftwareForBlueGreen support (#38499) (6aa03e5), closes #38664 #38664
• pipelines: add executionMode support in CodePipeline L3 construct (#35022) (7283d38), closes #35014

Bug Fixes

• bump bundled brace-expansion to 5.0.12 (#38929) (ff25def), closes #38932
• applicationautoscaling: target tracking silently ignores custom metric account and region (#36503) (5d10288), closes #36401
• bedrockagentcore: accept aws-cn ECR image URIs in Runtime container URI validation (#38948) (49ac618), closes #38947
• cloudfront-origins: missing OAC permissions for Function URL (#35919) (d213cc7), closes #35872 /github.com/aws/aws-cdk/blob/75139b2145010bc74e8017b23450d7af95327f49/packages/aws-cdk-lib/aws-cloudfront-origins/lib/function-url-origin.ts#L144-L153 /github.com/aws/aws-cdk/blob/75139b2145010bc74e8017b23450d7af95327f49/packages/aws-cdk-lib/aws-cloudfront-origins/lib/function-url-origin.ts#L144-L153 /github.com/aws/aws-cdk/blob/75139b2145010bc74e8017b23450d7af95327f49/packages/aws-cdk-lib/aws-lambda/lib/function-base.ts#L577 #35725
• core: validation E2001 inadvertently not enabled (#38920) (0b763a7)
• eks: allow access policies on AccessEntryType.EC2 access entries (#38782) (e507e07), closes #37496
• s3-deployment: Source.data objectKey can write outside the staging directory (#38921) (53439f9)

---

Alpha modules (2.273.0-alpha.0)

⚠ BREAKING CHANGES

• redshift-alpha: PUBLIC in any ASCII letter case is rejected as the name of a created user, or of an imported user that is granted table privileges. Existing PUBLIC grants are not removed, but narrowing one is rejected. Migrating to an ordinary name still works.
• redshift-alpha: The loggingProperties prop on ClusterProps (and the LoggingProperties interface) has been removed from @aws-cdk/aws-redshift-alpha. Use the new logging prop with ClusterLogging.s3({ bucket, keyPrefix }) or ClusterLogging.cloudWatch({ logExports }) instead.

Features

• redshift-alpha: audit logging to cloudwatch (#36410) (f2bf5d3), closes #25755

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.273.0-alpha.0 (2026-10-08)

⚠ BREAKING CHANGES

• redshift-alpha: PUBLIC in any ASCII letter case is rejected as the name of a created user, or of an imported user that is granted table privileges. Existing PUBLIC grants are not removed, but narrowing one is rejected. Migrating to an ordinary name still works.
• redshift-alpha: The loggingProperties prop on ClusterProps (and the LoggingProperties interface) has been removed from @aws-cdk/aws-redshift-alpha. Use the new logging prop with ClusterLogging.s3({ bucket, keyPrefix }) or ClusterLogging.cloudWatch({ logExports }) instead.

Features

• redshift-alpha: audit logging to cloudwatch (#36410) (f2bf5d3), closes #25755

Bug Fixes

• redshift-alpha: reject PUBLIC user names (#38935) (3335407)

2.272.0-alpha.0 (2026-09-30)

2.271.0-alpha.0 (2026-09-25)

2.270.0-alpha.0 (2026-09-17)

2.269.0-alpha.0 (2026-09-10)

⚠ BREAKING CHANGES

• glue-alpha: Glue job constructs now reject construct-managed and Glue-reserved arguments passed through defaultArguments. Previously, a managed argument set via defaultArguments was silently honored in SparkJob and PythonShellJob (customer value won over the construct default) and silently ignored in RayJob (construct default won). Both behaviors let a caller bypass the construct's security and observability defaults with no error. Passing any of the following through defaultArguments now throws a ValidationError at synthesis time:
• construct-managed arguments — --enable-continuous-cloudwatch-log, --continuous-log-logGroup, --continuous-log-logStreamPrefix, --continuous-log-conversionPattern, --enable-continuous-log-filter, --enable-metrics, --enable-observability-metrics, --enable-spark-ui, --spark-event-logs-path, --job-language, --class, --extra-jars, --user-jars-first, --extra-py-files, --extra-files, library-set
• Glue-reserved arguments — --debug, --mode, --JOB_NAME, --endpoint

A managed argument is rejected whether or not the current configuration emits it, so a disabled feature (e.g. enableMetrics: false) cannot be re-enabled through defaultArguments. Configure these through their dedicated props instead

... (truncated)

Commits

• 22a8ee5 chore: update analytics metadata blueprints
• f911ee4 chore(release): 2.273.0
• ed0df78 feat: update L1 CloudFormation resource definitions (#38969)
• 07c059f docs(events): add examples for RuleTargetInput and EventField (#38470)
• 7292cc7 chore(bedrock): add Claude Opus 5, Mythos 5, and Fable 5 foundation models (#...
• 2915b0d chore(ec2): interface VPC endpoint for eks-proxy (#38385)
• a12f3a1 feat(batch): add ConsumableResource L2 construct (#36971)
• 6aa03e5 feat(opensearchservice): add useLatestServiceSoftwareForBlueGreen support (#3...
• 6ede006 feat(cloudfront): default Distribution behaviors to redirect HTTP to HTTPS (#...
• d615580 docs(core): correct arnFormat default description (#38888)
• Additional commits viewable in compare view

Updates aws-cdk from 2.1144.0 to 2.1145.0

Release notes

Sourced from aws-cdk's releases.

aws-cdk@v2.1145.0

2.1145.0 (2026-10-08)

Features

• cli: add --fail-on to cdk diff (#2020) (fba21bb), references #2010 #2011
• cli: add destructive to cdk deploy --require-approval (#2021) (4b8744e), references #2010 #2011 #2020 #2011 #2011
• cli: add destructive to cdk diff --fail-on (#2011) (a98947f), closes #2010
• deps: upgrade aws-cdk-lib (#2009) (32f9b4a)
• move validation report handling code into cloud-assembly-api (#2004) (d673ac1)

Bug Fixes

• aws-cdk: reject migrate filters with stack and path sources (#2017) (2f60b35), closes #1571
• cli: respect stack outputs in cdk watch (#2023) (59c3a70), closes #1649
• cli: unchanged stacks are not skipped on the change-set method (#2014) (d9696a4), closes #2013, references #1273 #1273 #1387

Commits

• 59c3a70 fix(cli): respect stack outputs in cdk watch (#2023)
• 4b8744e feat(cli): add destructive to cdk deploy --require-approval (#2021)
• d9696a4 fix(cli): unchanged stacks are not skipped on the change-set method (#2014)
• a98947f feat(cli): add destructive to cdk diff --fail-on (#2011)
• fba21bb feat(cli): add --fail-on to cdk diff (#2020)
• 2f60b35 fix(aws-cdk): reject migrate filters with stack and path sources (#2017)
• 71ebb9f chore(deps): upgrade dependencies (#2018)
• 32f9b4a feat(deps): upgrade aws-cdk-lib (#2009)
• d673ac1 feat: move validation report handling code into cloud-assembly-api (#2004)
• See full diff in compare view

---

Closes #16932.

[github-actions]

Hello 👋! When you're ready to run Chromatic, please apply the run_chromatic label to this PR.

You will need to reapply the label each time you want to run Chromatic.

Click here to see the Chromatic project.

[github-actions]

🚀 Image pushed to AWS ECR

Image digest: sha256:bc4a2aa83ae5582213a173637516ae03c4b7558446fd0eac523293c64bed2cfe

🐛 Run the image locally

The following can be used to run the image locally:

# Refer to image using the immutable digest. Find alternatives below.
IMAGE_IDENTIFIER="@sha256:bc4a2aa83ae5582213a173637516ae03c4b7558446fd0eac523293c64bed2cfe"

# Refer to image using branch tag
# IMAGE_IDENTIFIER=":branch-dependabot-npm_and_yarn-cdk-ab61f844d8"

# Refer to image using build tag
# IMAGE_IDENTIFIER=":build-32443"

# Set environment variables for the AWS CLI
AWS_PROFILE="<A_PROFILE_FROM_JANUS>"
AWS_DEFAULT_REGION="eu-west-1"

IMAGE_ACCOUNT_ID=$(aws ssm get-parameter --name /organisation/accounts/artifacts --query "Parameter.Value" --output text)
REGISTRY="${IMAGE_ACCOUNT_ID}.dkr.ecr.${AWS_DEFAULT_REGION}.amazonaws.com"
IMAGE="${REGISTRY}/guardian/dotcom-rendering/dotcom-rendering${IMAGE_IDENTIFIER}"

# Login to AWS ECR https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry_auth.html
aws ecr get-login-password | docker login --username AWS --password-stdin $REGISTRY

# Pull the image
docker pull $IMAGE

# Run the image. You'll likely need to set additional flags. See https://docs.docker.com/reference/cli/docker/container/run.
docker run $IMAGE

---

From guardian/actions-ecr.

[github-actions]

Deploy build 3732 of dotcom:ab-testing to CODE

All deployment options

• Deploy build 3732 of dotcom:ab-testing to CODE
• Deploy parts of build 3732 to CODE by previewing it first
• What's on CODE right now?

---

From guardian/actions-riff-raff.

[github-actions]

Deploy build 32443 of dotcom:rendering-all to CODE

All deployment options

• Deploy build 32443 of dotcom:rendering-all to CODE
• Deploy parts of build 32443 to CODE by previewing it first
• What's on CODE right now?

---

From guardian/actions-riff-raff.

[akash1810]

@dependabot rebase