Bump the cdk group across 1 directory with 4 updates

[dependabot]

Bumps the cdk group with 4 updates in the / directory: @guardian/cdk, aws-cdk, aws-cdk-lib and constructs.

Updates @guardian/cdk from 62.3.5 to 62.6.1

Release notes

Sourced from @​guardian/cdk's releases.

v62.6.1

Patch Changes

• 0f9611e: Correctly add minInstancesInServiceParameters to a generated riff-raff.yaml file.

  The following experimental classes have an API change:

  • GuAutoScalingRollingUpdateTimeoutExperimental
  • GuHorizontallyScalingDeploymentPropertiesExperimental

  Specifically, they are no longer implemented as singletons. This means they're now instantiated differently:

  declare const stack: GuStack;
  // Before
  Aspects.of(stack).add(GuAutoScalingRollingUpdateTimeoutExperimental.getInstance(stack));
  Aspects.of(stack).add(GuHorizontallyScalingDeploymentPropertiesExperimental.getInstance(stack));
  // Now
  Aspects.of(stack).add(new GuAutoScalingRollingUpdateTimeoutExperimental());
  Aspects.of(stack).add(new GuHorizontallyScalingDeploymentPropertiesExperimental());

  NOTE: It is important to instantiate GuAutoScalingRollingUpdateTimeoutExperimental only once per GuStack to avoid incorrectly updating resources multiple times. To do this, either instantiate it in the constructor of your GuStack. Alternatively, check if it is present in the stack's aspects before adding it:

  declare const stack: GuStack;
  const allAspects = Aspects.of(stack).all;
  const maybeRollingUpdateTimeoutAspect = allAspects.find(
  (_) => _ instanceof GuAutoScalingRollingUpdateTimeoutExperimental,
  );
  if (!maybeRollingUpdateTimeoutAspect) {
  Aspects.of(stack).add(new GuAutoScalingRollingUpdateTimeoutExperimental());
  }

v62.6.0

Minor Changes

• 87b8f74: Remove redundant GuJanusAssumableRole now that it has been superseded by GuDeveloperPolicy. In principle a breaking change but this role is not in use anywhere so there needs to be no change to consuming code.

Patch Changes

• 4c43c08: Update fast-xml-parser and @aws-sdk/xml-builder transitive dependencies to address security vulnerabilities (CVE-2026-33036).

v62.5.4

... (truncated)

Changelog

Sourced from @​guardian/cdk's changelog.

62.6.1

Patch Changes

• 0f9611e: Correctly add minInstancesInServiceParameters to a generated riff-raff.yaml file.

  The following experimental classes have an API change:

  • GuAutoScalingRollingUpdateTimeoutExperimental
  • GuHorizontallyScalingDeploymentPropertiesExperimental

  Specifically, they are no longer implemented as singletons. This means they're now instantiated differently:

  declare const stack: GuStack;
  // Before
  Aspects.of(stack).add(GuAutoScalingRollingUpdateTimeoutExperimental.getInstance(stack));
  Aspects.of(stack).add(GuHorizontallyScalingDeploymentPropertiesExperimental.getInstance(stack));
  // Now
  Aspects.of(stack).add(new GuAutoScalingRollingUpdateTimeoutExperimental());
  Aspects.of(stack).add(new GuHorizontallyScalingDeploymentPropertiesExperimental());

  NOTE: It is important to instantiate GuAutoScalingRollingUpdateTimeoutExperimental only once per GuStack to avoid incorrectly updating resources multiple times. To do this, either instantiate it in the constructor of your GuStack. Alternatively, check if it is present in the stack's aspects before adding it:

  declare const stack: GuStack;
  const allAspects = Aspects.of(stack).all;
  const maybeRollingUpdateTimeoutAspect = allAspects.find(
  (_) => _ instanceof GuAutoScalingRollingUpdateTimeoutExperimental,
  );
  if (!maybeRollingUpdateTimeoutAspect) {
  Aspects.of(stack).add(new GuAutoScalingRollingUpdateTimeoutExperimental());
  }

62.6.0

Minor Changes

• 87b8f74: Remove redundant GuJanusAssumableRole now that it has been superseded by GuDeveloperPolicy. In principle a breaking change but this role is not in use anywhere so there needs to be no change to consuming code.

Patch Changes

• 4c43c08: Update fast-xml-parser and @aws-sdk/xml-builder transitive dependencies to address security vulnerabilities (CVE-2026-33036).

... (truncated)

Commits

• ff20bb5 Merge pull request #2867 from guardian/changeset-release/main
• 7c45363 Bump package version
• 9045ef4 Merge pull request #2764 from guardian/aa/refactor-singleton
• 0f9611e chore: Add changeset
• d137aa1 fix(riff-raff-generator): Ensure all Aspects have evaluated before instanti...
• 0df8ac0 fix: Ensure Aspects are instantiated once per GuStack
• 984a0e6 refactor: Simplify instantiation of `GuAutoScalingRollingUpdateTimeoutExperim...
• 780a490 fix(riff-raff-generator): Correctly set minInstancesInServiceParameters
• 228b465 refactor: Use more reliable type guard
• 95b5298 refactor(riff-raff-generator): Improve readability
• Additional commits viewable in compare view

Updates aws-cdk from 2.1107.0 to 2.1112.0

Release notes

Sourced from aws-cdk's releases.

aws-cdk@v2.1112.0

2.1112.0 (2026-03-18)

Features

• cli: add --concurrency flag to cdk destroy (#1221) (403fe8e)
• deps: upgrade aws-cdk-lib (#1220) (cf3cd7d)

Bug Fixes

• collect metrics to help analyze performance problems (#1124) (ae037f9)

aws-cdk@v2.1111.0

2.1111.0 (2026-03-11)

Features

• deps: upgrade aws-cdk-lib (#1216) (093abd7)

aws-cdk@v2.1110.0

2.1110.0 (2026-03-09)

Features

• cli: --revert-drift option to bring actual resource states in line with template definitions (#1127) (693fe48)

Bug Fixes

• cli: trap errors from notices to prevent CLI breakage (#1205) (1cb6252), closes cdklabs/aws-cdk-notices#1044

aws-cdk@v2.1109.0

2.1109.0 (2026-03-04)

Features

• cli: concurrent asset builds (#983) (3a415c7), closes #226
• deps: upgrade aws-cdk-lib (#1193) (c8f40dc)

Bug Fixes

... (truncated)

Commits

• ae037f9 fix: collect metrics to help analyze performance problems (#1124)
• 403fe8e feat(cli): add --concurrency flag to cdk destroy (#1221)
• cf3cd7d feat(deps): upgrade aws-cdk-lib (#1220)
• 69089a7 chore(deps): bump @​aws-sdk/client-route-53 from 3.1000.0 to 3.1004.0 (#1211)
• 093abd7 feat(deps): upgrade aws-cdk-lib (#1216)
• 50624c3 chore(deps): bump @​aws-sdk/client-ssm from 3.1000.0 to 3.1004.0 (#1208)
• 35862e2 chore(deps): bump @​aws-sdk/client-codebuild from 3.1000.0 to 3.1004.0 (#1207)
• 56f10cc chore(deps): upgrade dependencies (#1206)
• 1cb6252 fix(cli): trap errors from notices to prevent CLI breakage (#1205)
• 693fe48 feat(cli): --revert-drift option to bring actual resource states in line wi...
• Additional commits viewable in compare view

Updates aws-cdk-lib from 2.240.0 to 2.244.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.244.0

Features

• codebuild: add support for macOS 26 runners (#37240) (1b7b292), closes #37241 #35836
• update L1 CloudFormation resource definitions (#37260) (40a5142)
• rds: add standalone resource creation for ParameterGroup (#37165) (5441a51), closes #9741
• ecs: add forceNewDeployment feature for ecs service (#35726) (d16dc7e), closes #27762
• mixins: helpers to convert between Aspects and Mixins (#37235) (4537f69)
• spec2cdk: add actions() method to Grants classes (#36987) (bbeaf5d)

Bug Fixes

• aws-cdk-lib: error annotations now have error codes (#37270) (0b9629e)
• eks: clear OCI repo/version after local pull for Helm v4 compatibility (#37142) (e6a8804), closes /github.com/helm/helm/blob/v3.19.0/pkg/action/install.go#L753-L769 /github.com/helm/helm/blob/main/pkg/action/install.go#L893-L909
• all errors now have error codes (#36934) (408c12f)

---

Alpha modules (2.244.0-alpha.0)

Bug Fixes

• kinesisanalytics-flink-alpha: mark deprecated flink runtimes as deprecated (#37155) (0a89447)

v2.243.0

Features

• update L1 CloudFormation resource definitions (#37201) (85daaf5)
• cfn-property-mixins: graduate to stable @​aws-cdk/cfn-property-mixins package (#37215) (f071e67)

Bug Fixes

• dynamodb: resource policies don't have the index ARNs when indexes are added after granting permissions (#37213) (eb37071)

---

Alpha modules (2.243.0-alpha.0)

v2.242.0

⚠ BREAKING CHANGES

• ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

  • aws-ssm: AWS::SSM::MaintenanceWindow: Id attribute removed.

Features

• core: support PropertyMergeStrategy to merge arbitrary CFN property objects (#37206) (793ad97)
• ecr: add RepositoryAutoDeleteImages mixin (#37176) (3189116)
• s3 and ecs service mixins are now available in aws-cdk-lib (#37151) (52c99da)
• update L1 CloudFormation resource definitions (#37173) (1dfaf5f), closes #37BFF5 #37BFF5
• apigateway: add TLS 1.3 security policies for domain names (#36303) (9d0300b), closes #36280
• appsync: add EnhancedMetricsConfigProperty for GraphQL api (#35328) (ebfaf89), closes #29933

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.244.0-alpha.0 (2026-03-19)

Bug Fixes

• kinesisanalytics-flink-alpha: mark deprecated flink runtimes as deprecated (#37155) (0a89447)

2.243.0-alpha.0 (2026-03-11)

2.242.0-alpha.0 (2026-03-10)

Features

• mixins-preview: allow passing resource objects into properties in CFN Property mixins (#37148) (f238629)
• mixins-preview: generate EventBridge pattern for all events (#37081) (f30e836)
• mixins-preview: support custom merge strategies via IMergeStrategy (#37170) (0dec011)

2.241.0-alpha.0 (2026-03-02)

Features

• mixins-preview: add recordFields and outputFormat to Vended Logs Mixin (#37042) (dd94c31)
• mixins-preview: cross account delivery destinations (#36827) (a759eb6)

2.240.0-alpha.0 (2026-02-23)

2.239.0-alpha.0 (2026-02-19)

⚠ BREAKING CHANGES

redshift-alpha: update default node type from DC2_LARGE to RA3_LARGE

Features

• bedrock-agentcore-alpha: add fromCodeAsset method to create runtime artifact with local code assets (#36472) (c5a87e6), closes #36473
• bedrock-agentcore-alpha: added new target type (api gateway) in agentcore gateway target. (#36841) (0842754), closes #36817
• mixins-preview: add ECS ClusterSettingsMixin (#36796) (b8ab5be)
• mixins-preview: add s3 bucket mixin for publicAccessBlock (#36905) (feed4b2)
• mixins-preview: send Vended Logs to pre-created DeliveryDestination using toDestination() (#36896) (48f1fe6)

Bug Fixes

• redshift-alpha: update default node type from DC2_LARGE to RA3_LARGE (#36516) (ea19e5c), closes #36416

... (truncated)

Commits

• ce693ac chore: update analytics metadata blueprints
• 1b7b292 feat(codebuild): add support for macOS 26 runners (#37240)
• 40a5142 feat: update L1 CloudFormation resource definitions (#37260)
• ac4e2d4 chore(dynamodb): fix 5 failing integration tests (#36961)
• 5441a51 feat(rds): add standalone resource creation for ParameterGroup (#37165)
• 0b9629e fix(aws-cdk-lib): error annotations now have error codes (#37270)
• 2a21279 feat: bitrate utility function (#37244)
• a74b144 docs(s3): fix typo (#37267)
• 22b3ef6 docs(dynamodb): fix typo (#37056)
• 4f0d32e chore(mixins-preview): update Vended Logs to use Facades and Traits and add `...
• Additional commits viewable in compare view

Updates constructs from 10.5.1 to 10.6.0

Release notes

Sourced from constructs's releases.

v10.6.0

10.6.0 (2026-03-23)

Features

• add stackTraceOverride option to MetadataOptions (#2853) (f1fd286)

Commits

• f1fd286 feat: add stackTraceOverride option to MetadataOptions (#2853)
• 809d63a chore(deps): upgrade dev dependencies (#2852)
• c2298f1 chore(deps): upgrade dev dependencies (#2851)
• eb0d022 chore(deps): upgrade dev dependencies (#2850)
• 780040f chore(deps): upgrade dev dependencies (#2849)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Hello 👋! When you're ready to run Chromatic, please apply the run_chromatic label to this PR.

You will need to reapply the label each time you want to run Chromatic.

Click here to see the Chromatic project.

[github-actions]

Deploy build 25829 of dotcom:rendering-all to CODE

All deployment options

• Deploy build 25829 of dotcom:rendering-all to CODE
• Deploy parts of build 25829 to CODE by previewing it first
• What's on CODE right now?

---

From guardian/actions-riff-raff.