chore(deps): update dependency aws-cdk-lib to v2.267.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
aws-cdk-lib (source)	2.266.0 → 2.267.0

---

Release Notes

aws/aws-cdk (aws-cdk-lib)

v2.267.0

Compare Source

⚠ BREAKING CHANGES

• kinesisfirehose: After this change, specifying an unsupported timeZone on the Firehose S3Bucket destination now throws a ValidationError during synthesis instead of failing at CloudFormation deployment. Affected values: 3-letter IANA abbreviations (e.g. EST), Etc/UTC, Etc/GMT, Factory, and strings containing characters outside [a-zA-Z/_]+. Use a supported standard IANA identifier (e.g. America/New_York) or UTC for synth to pass.

Features

• backup: add indexActions prop to BackupPlanRule (#​34051) (b8be853), closes #​34050
• bedrockagentcore: add manageDeliveryResourcePolicy opt-out for runtime observability (#​38372) (5fb086b), closes #​38342
• ci: integration test deployment on maintainer approval (#​38519) (c5f6b4f), closes #​37333
• core: Size objects now properly stringify (#​38662) (90fe151)
• sqs: metricApproximateNumberOfMessagesOutstanding (#​38661) (f29b27b)

Bug Fixes

• assets: SymlinkFollowMode.BLOCK_EXTERNAL will throw errors while bundling (#​38506) (a11e451)
• bedrockagentcore: least-privilege browser recording S3 grant (#​38604) (7e11d11)
• ci: add environment for Atmosphere variables access (#​38625) (785773e), closes #​38519
• cloudfront-origins: readTimeout and keepaliveTimeout reject valid values (#​38432) (6251e1a), closes #​38433 #​18628
• core: performance counters use too much memory (#​38620) (d0ce23c)
• core: single file bundled output should be file (#​38548) (9e22774)
• core: stack.node.addDependency gets slower as stacks grow (#​38597) (2ab9be4), closes #​38522
• core: symlinks in directory bundling output (#​38665) (8d8ae2c)
• core: validation plugin check adds too much overhead (#​38619) (df15b9f)
• dynamodb: TableV2.grants.*Data does not include index resources (#​37892) (e48a97f), closes #​37569
• dynamodb: TableV2MultiAccountReplica rejects imported tables with tokenized ARNs (#​38365) (08f05e5), closes #​38354
• dynamodb: avoid TableGrantsProps deprecation warnings for TableV2 (#​38399) (fb5c25b), closes #​37221
• ec2: NatInstanceProvider and NatInstanceProviderV2 always trigger the keyName deprecation warning (#​38347) (47f2151), closes #​30806
• kinesisfirehose: add validation for customTimeZone in S3BucketProps (#​38514) (8cf9f90), closes #​36089
• lambda: allow SnapStart for container image functions (#​38680) (a5adc00), closes #​38281 #​38281 #​38265
• rds: serverlessV2 capacity props reject tokens at synth time (#​38044) (b7880de), closes #​38043 #​9044 #​31810 #​32905
• s3-deployment: increase default memory limit from 128MB to 1024MB (#​35501) (7a04f32), closes #​35487
• stepfunctions-tasks: resolve EvaluateExpression paths via a values lookup (#​38682) (02301ea)
• stack.availabilityZones are not stable strings (#​38580) (f89474a)

---

Alpha modules (2.267.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: schema Type is now an opaque class; construct column types via the Schema factories or Schema.custom(...) rather than { isPrimitive, inputString } literals. StorageParameter.custom(key, value) requires a string value, and StorageParameter.writeKmsKeyId takes a kms.IKey instead of a string.
• glue-alpha: S3TableProps.bucket/encryption/encryptionKey are removed. Use storage: S3TableStorage.managedBucket(S3TableEncryption.kms(key?)) / S3TableStorage.fromBucket(bucket) and clientSideEncryption: TableClientSideEncryption.kms(key?). S3Table.encryption/encryptionKey are removed (clientSideEncryptionKey exposes the client-side key; read bucket.encryptionKey for server-side). The TableEncryption enum and the deprecated Table/TableProps are removed — use S3Table.

Features

• glue-alpha: add a typed secret input to Connection (#​38585) (ede4a1c)
• glue-alpha: add subnet selection to Connection (#​38561) (f9d7eac)
• glue-alpha: model S3Table storage/encryption as value objects (#​38591) (9990e16)
• glue-alpha: opaque Schema Type with Schema.custom, and stronger StorageParameter types (#​38592) (5c45eb0)
• msk-alpha: support Kafka 4.2 (#​38323) (97b181c)
• s3tables-alpha: add storage class configuration support (#​37339) (63ccf6d)

Bug Fixes

• glue-alpha: validate that DATE partition projection interval is set when required (#​38594) (0e2b582)
• lambda-python-alpha: escape Docker bundling command arguments (#​38583) (f7ce07b)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will error in a future major version of npm. See `npm help npmrc` for supported config options.
npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
npm error Refusing to fetch "https://registry.npmjs.org/aws-cdk-lib/-/aws-cdk-lib-2.267.0.tgz"
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-09-03T05_04_50_282Z-debug-0.log