Chore(deps): Bump the cosmetology-python-minor-patch group across 7 directories with 13 updates

[dependabot]

Bumps the cosmetology-python-minor-patch group with 6 updates in the /backend/cosmetology-app directory:

Package	From	To
coverage	7.15.1	7.15.4
faker	40.28.1	40.36.0
pip-tools	7.5.3	7.6.0
ruff	0.15.21	0.16.2
aws-cdk-aws-lambda-python-alpha	2.261.0a0	2.263.0a0
constructs	10.6.0	10.8.1

Bumps the cosmetology-python-minor-patch group with 6 updates in the /backend/cosmetology-app/lambdas/python directory:

Package	From	To
faker	40.28.1	40.36.0
boto3	1.43.46	1.43.67
aws-lambda-powertools	3.31.0	3.31.1
boto3-stubs	1.43.46	1.43.67
marshmallow	4.3.0	4.3.1
statsig-python-core	0.19.8	0.20.2

Bumps the cosmetology-python-minor-patch group with 2 updates in the /backend/cosmetology-app/lambdas/python/cognito-backup directory: boto3 and aws-lambda-powertools.
Bumps the cosmetology-python-minor-patch group with 5 updates in the /backend/cosmetology-app/lambdas/python/common directory:

Package	From	To
faker	40.28.1	40.36.0
boto3	1.43.46	1.43.67
aws-lambda-powertools	3.31.0	3.31.1
boto3-stubs	1.43.46	1.43.67
marshmallow	4.3.0	4.3.1

Bumps the cosmetology-python-minor-patch group with 1 update in the /backend/cosmetology-app/lambdas/python/feature-flag directory: statsig-python-core.
Bumps the cosmetology-python-minor-patch group with 1 update in the /backend/cosmetology-app/lambdas/python/provider-data-v1 directory: faker.
Bumps the cosmetology-python-minor-patch group with 1 update in the /backend/cosmetology-app/lambdas/python/staff-users directory: faker.

Updates coverage from 7.15.1 to 7.15.4

Release notes

Sourced from coverage's releases.

7.15.4

Version 7.15.4 — 2026-08-06

• Fix: in the HTML report, a source file name containing a double quote (legal on POSIX) wasn’t escaped where it’s dropped into the href of the index and prev/next links, so it could close the attribute early and inject markup. Page URLs are now escaped. Thanks, Rajath Mohare.
• Fix: the LCOV report wrote file names and other fields into its line-oriented records without neutralizing control characters. A measured file whose name contained a newline (legal on POSIX) could forge extra records, inflating the coverage seen by tools that read the report. Control characters in a field are now replaced. Thanks, Rajath Mohare.
• Wheels are now provided for Python 3.15.

➡️  PyPI page: coverage 7.15.4. :arrow_right:  To install: python3 -m pip install coverage==7.15.4

7.15.3

Version 7.15.3 — 2026-08-02

• Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han. Closes issue 2200.
• A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios.
• Performance improvement in HTML reporting by reducing the number of times files have to be parsed, thanks to Kevin Turcios.

➡️  PyPI page: coverage 7.15.3. :arrow_right:  To install: python3 -m pip install coverage==7.15.3

7.15.2

Version 7.15.2 — 2026-07-15

• Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229.

➡️  PyPI page: coverage 7.15.2. :arrow_right:  To install: python3 -m pip install coverage==7.15.2

Changelog

Sourced from coverage's changelog.

Version 7.15.4 — 2026-08-06

• Fix: in the HTML report, a source file name containing a double quote (legal on POSIX) wasn't escaped where it's dropped into the href of the index and prev/next links, so it could close the attribute early and inject markup. Page URLs are now escaped. Thanks, Rajath Mohare <pull 2227_>_.

• Fix: the LCOV report wrote file names and other fields into its line-oriented records without neutralizing control characters. A measured file whose name contained a newline (legal on POSIX) could forge extra records, inflating the coverage seen by tools that read the report. Control characters in a field are now replaced. Thanks, Rajath Mohare <pull 2226_>_.

• Wheels are now provided for Python 3.15.

.. _pull 2226: coveragepy/coveragepy#2226 .. _pull 2227: coveragepy/coveragepy#2227

.. _changes_7-15-3:

Version 7.15.3 — 2026-08-02

• Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han <pull 2234_>. Closes issue 2200.

• A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios <pull 2239_>_.

• Performance improvement in HTML reporting by reducing the number of times files have to be parsed, thanks to Kevin Turcios <pull 2240_>_.

.. _issue 2200: coveragepy/coveragepy#2200 .. _pull 2234: coveragepy/coveragepy#2234 .. _pull 2239: coveragepy/coveragepy#2239 .. _pull 2240: coveragepy/coveragepy#2240

.. _changes_7-15-2:

Version 7.15.2 — 2026-07-15

• Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically

... (truncated)

Commits

• 4c0e7ff docs: sample HTML for 7.15.4
• db4cc32 docs: prep for 7.15.4
• c33085c style: start gradual move to ruff 0.16
• 53a0fd5 fix: neutralize control characters in lcov report fields (#2226)
• b64d53d build: make 3.15 wheels
• 53792ab build: show the python version for kits
• f6b03c7 chore: make upgrade_one package=cibuildwheel
• d9b660a chore: make upgrade
• b128a31 docs: oops, move this entry to the correct place
• a7a2c15 fix: escape filename urls in html report href attributes (#2227)
• Additional commits viewable in compare view

Updates faker from 40.28.1 to 40.36.0

Release notes

Sourced from faker's releases.

Release v40.36.0

See CHANGELOG.md.

Release v40.35.0

See CHANGELOG.md.

Release v40.34.0

See CHANGELOG.md.

Release v40.33.2

See CHANGELOG.md.

Release v40.33.1

See CHANGELOG.md.

Release v40.33.0

See CHANGELOG.md.

Release v40.32.0

See CHANGELOG.md.

Release v40.31.0

See CHANGELOG.md.

Release v40.30.0

See CHANGELOG.md.

Release v40.29.0

See CHANGELOG.md.

Changelog

Sourced from faker's changelog.

v40.36.0 - 2026-07-24

• Fix: correct uk_UA bban_format to 6 digits + 19 letters so iban() generates valid Ukrainian IBANs (#2417). Thanks @​CedricConday.

v40.35.0 - 2026-07-22

• Fix: add correct bban_format so ru_RU iban() generates valid Russian IBANs (#2416). Thanks @​CedricConday.

v40.34.0 - 2026-07-22

• Fix: correct BBAN length so da_DK iban() generates valid Danish IBANs (#2409). Thanks @​CedricConday.

v40.33.2 - 2026-07-22

• Validate positive=True against a non-positive max_value in pydecimal (#2428). Thanks @​Sreekant13.

v40.33.1 - 2026-07-22

• Make uuid1() and uuid7() reproducible under a fixed seed (#2427). Thanks @​vidigoat.

v40.33.0 - 2026-07-22

• Add alphanumeric CNPJ support for pt_BR via flag (#2402). Thanks @​moohbr.

v40.32.0 - 2026-07-20

• Add allowed_path_traversal_elements option to file_path() (#2397). Thanks @​Ayushmann13479.
• Fix Windows file_path depth=3 test regex. Thanks @​fcurella.

v40.31.0 - 2026-07-14

• Fix: correct BBAN length so pt_BR iban() generates valid Brazilian IBANs (#2410). Thanks @​CedricConday.

v40.30.0 - 2026-07-14

• Fix: generate valid Belgian bank codes in nl_BE iban() (#2412). Thanks @​CedricConday.

v40.29.0 - 2026-07-14

• Fix: generate valid Spanish CCC control digits in es_ES iban() (#2404). Thanks @​CedricConday.

Commits

• 62d5a6a Bump version: 40.35.0 → 40.36.0
• 09c254a 📝 Update CHANGELOG.md
• ce45ebd fix(uk_UA): correct bban_format to 6 digits + 19 letters so iban() is valid (...
• 8ad78a6 Merge pull request #2434 from joke2k/joke2k-security-md
• ce3d3b1 Add SECURITY.md to the manifest file
• ac535cf Revise security policy for clarity and updates
• 4b7d4d7 💄 Lint code
• 2e83f45 Bump version: 40.34.0 → 40.35.0
• b1caba1 📝 Update CHANGELOG.md
• 706aaca 💄 Lint code
• Additional commits viewable in compare view

Updates pip-tools from 7.5.3 to 7.6.0

Release notes

Sourced from pip-tools's releases.

v7.6.0

2026-07-13

Features

• The --help output for pip-compile and pip-sync commands has been extended to include usage examples -- by @​Dzhud.

  PRs and issues: #1142

• Added --uploaded-prior-to as a passthrough option for pip-compile, allowing users to restrict package candidates to versions uploaded before a given datetime. Requires pip >= 26.0 -- by @​miettal.

  PRs and issues: #2288

• pip-tools is now compatible with pip 26.1 -- @​gaborbernat.

  PRs and issues: #2379

Improved documentation

• Fixed the contents sidebar for the index doc -- by @​sirosen.

  PRs and issues: #2169

• pip-tools now has a policy regarding LLM-generated contributions, noted in the contributing documentation -- by @​sirosen.

  Thanks to @​0cjs, @​gpshead, mr-@​c, @​samdoran, @​webknjaz, and everyone else in the broader community who helped us to craft a policy which is considerate of contributors and protective of the project and its maintainers.

  PRs and issues: #2318

• pip-tools' documentation now features a section titled "Reference" covering the CLI commands and configuration. Configuration documentation has been removed from the readme.

  -- by @​sirosen

Contributor-facing changes

• CI testing now runs on Intel and ARM macOS runners, and is pinned to a specific macOS version -- by @​sirosen.

  PRs and issues: #2079, #2132, #2348

• pip-tools now has a policy regarding LLM-generated contributions, noted in the contributing documentation -- by @​sirosen.

  Thanks to @​0cjs, @​gpshead, mr-@​c, @​samdoran, @​webknjaz, and everyone else in the broader community who helped us to craft a policy which is considerate of contributors and protective of the project and its maintainers.

  PRs and issues: #2278, #2318

• Started running {pypi}zizmor as a part of CI pipelines to improve security of how we configure GitHub Actions CI/CD -- by @​webknjaz.

  PRs and issues: #2327

• pip-tools docs now support GitHub Flavored Markdown admonition blocks -- by @​webknjaz.

... (truncated)

Changelog

Sourced from pip-tools's changelog.

v7.6.0

2026-07-13

Features

• The --help output for pip-compile and pip-sync commands has been extended to include usage examples -- by {user}Dzhud.

  PRs and issues: {issue}1142

• Added --uploaded-prior-to as a passthrough option for pip-compile, allowing users to restrict package candidates to versions uploaded before a given datetime. Requires pip >= 26.0 -- by {user}miettal.

  PRs and issues: {issue}2288

• pip-tools is now compatible with pip 26.1 -- {user}gaborbernat.

  PRs and issues: {issue}2379

Improved documentation

• Fixed the contents sidebar for the index doc -- by {user}sirosen.

  PRs and issues: {issue}2169

• pip-tools now has a policy regarding LLM-generated contributions, noted in the contributing documentation -- by {user}sirosen.

  Thanks to {user}0cjs, {user}gpshead, {user}mr-c, {user}samdoran, {user}webknjaz, and everyone else in the broader community who helped us to craft a policy which is considerate of contributors and protective of the project and its maintainers.

  PRs and issues: {issue}2318

• pip-tools' documentation now features a section titled "Reference" covering the CLI commands and configuration. Configuration documentation has been removed from the readme.

  -- by {user}sirosen

Contributor-facing changes

• CI testing now runs on Intel and ARM macOS runners, and is pinned to a specific macOS version -- by {user}sirosen.

  PRs and issues: {issue}2079, {issue}2132, {issue}2348

... (truncated)

Commits

• 27f6a96 Merge pull request #2420 from sirosen/release/v7.6.0
• cbe77f0 Apply suggestions from code review
• 015146e Update changelog for version 7.6.0
• 9a2d2c1 Merge pull request #2414 from jazzband/pre-commit-ci-update-config
• fc3f877 Merge pull request #2418 from jazzband/dependabot/pip/docs/soupsieve-2.8.4
• 5247a6b [pre-commit.ci] pre-commit autoupdate
• 3d1faf6 Bump soupsieve from 2.8.3 to 2.8.4 in /docs
• 57637db Merge pull request #2419 from sirosen/fix-test-failure
• 4695c37 Fix the fake_with_deps test package
• 24f4230 Merge pull request #2413 from webknjaz/maintenance/nested-zizmor-gha-workflow...
• Additional commits viewable in compare view

Updates ruff from 0.15.21 to 0.16.2

Release notes

Sourced from ruff's releases.

0.16.2

Release Notes

Released on 2026-08-06.

Bug fixes

• [flake8-pyi] Avoid false positives on singledispatch functions (PYI041) (#27335)

Server

• Register formatting capabilities dynamically to exclude TOML files (#27332)

Contributors

• @​MeGaGiGaGon
• @​charliermarsh
• @​epage
• @​sharkdp
• @​ntBre

Install ruff 0.16.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-installer.ps1 | iex"

Download ruff 0.16.2

File	Platform	Checksum
ruff-aarch64-apple-darwin.tar.gz	Apple Silicon macOS	checksum
ruff-x86_64-apple-darwin.tar.gz	Intel macOS	checksum
ruff-aarch64-pc-windows-msvc.zip	ARM64 Windows	checksum
ruff-i686-pc-windows-msvc.zip	x86 Windows	checksum
ruff-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
ruff-aarch64-unknown-linux-gnu.tar.gz	ARM64 Linux	checksum
ruff-i686-unknown-linux-gnu.tar.gz	x86 Linux	checksum
ruff-powerpc64-unknown-linux-gnu.tar.gz	PPC64 Linux	checksum
ruff-powerpc64le-unknown-linux-gnu.tar.gz	PPC64LE Linux	checksum
ruff-riscv64gc-unknown-linux-gnu.tar.gz	RISCV Linux	checksum
ruff-s390x-unknown-linux-gnu.tar.gz	S390x Linux	checksum

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.2

Released on 2026-08-06.

Bug fixes

• [flake8-pyi] Avoid false positives on singledispatch functions (PYI041) (#27335)

Server

• Register formatting capabilities dynamically to exclude TOML files (#27332)

Contributors

• @​MeGaGiGaGon
• @​charliermarsh
• @​epage
• @​sharkdp
• @​ntBre

0.16.1

Released on 2026-07-30.

Preview features

• Add an option to opt out of human-readable names (#27160)
• [flake8-pytest-style] Make fixes safe by default and unsafe only when comments are present (PT018) (#27201)
• [pyupgrade] Skip fix when a defaulted TypeVar precedes a non-defaulted one (UP040, UP046, UP047) (#27133)
• [ruff] Fix false positive with unpacked arguments (RUF065) (#26959)

Bug fixes

• Bump gen-lsp-types to gracefully handle unknown enumeration values in LSP messages (#27230)
• [flake8-bugbear] Mark range as immutable (B008) (#27247)
• [flake8-comprehensions] NFKC-normalize keyword names in C408 fix (#26813)
• [flake8-return] Fix false positive when variable is read in finally clause (RET504) (#25441)
• [pydocstyle] Skip section detection inside RST directive bodies (D214, D405, D413) (#23635)
• [refurb] Parenthesize yield arguments in the FURB192 fix (#27192)

Rule changes

• [flake8-pytest-style] Mark PT022 fixes as unsafe (#26440)
• [refurb] Mark fixes that remove unknown separators as unsafe (FURB105) (#27200)

Server

• Fix indexing of excluded nested Ruff workspaces (#27303)
• Lint TOML files in the LSP (#26862)

... (truncated)

Commits

• 5b48a04 Bump 0.16.2 (#27555)
• 1b9e5fc Update Swatinem/rust-cache action to v2.9.2 (#27568)
• c4e86fc [ty] Add helper extension methods for half-range and equality constraints (#2...
• 17a00de [ty] Reuse primer commands in memory reports (#27553)
• 6ea296b [ty] Normalize type labels in structured docstrings (#26923)
• 2fc445f [ty] Diagnose invalid getattr calls (#27502)
• 22c7823 [ty] Enable (but downrank) auto-import completion suggestions from stub-only ...
• 05160d5 [ty] Diagnose invalid descriptor __get__ calls (#27400)
• baea3d0 [ty] Expose strict analysis options in the playground (#27543)
• c88946e [ty] Bump ecosystem-analyzer for strict project settings (#27542)
• Additional commits viewable in compare view

Updates aws-cdk-aws-lambda-python-alpha from 2.261.0a0 to 2.263.0a0

Release notes

Sourced from aws-cdk-aws-lambda-python-alpha's releases.

v2.262.2

Bug Fixes

• revert "fix(core): stack.node.addDependency gets slower as stacks grow (#38314)" (#38417) (d97dd8d), closes #38406 #38406

---

Alpha modules (2.262.2-alpha.0)

v2.262.1

Bug Fixes

• core: bump @aws/cloudformation-validate to 1.5.1-beta to fix install on Node != 22.x (#38382) (d409b96), closes #38380
• core: env CDK_VALIDATION=false does not disable built-in template validation (#38379) (cc4208c), closes #38378

---

Alpha modules (2.262.1-alpha.0)

v2.262.0

Features

• ecs: add support ECS-optimized Amazon Linux 2023 (Neuron) AMI (#34689) (ad665c4)
• mediaconnect: l2 construct (#37945) (8e9e001)
• update L1 CloudFormation resource definitions (#38275) (2b1c632)
• apigateway: alb integration (#36247) (20dbdd9), closes #36184
• bedrockagentcore: support service/region in IAM credential provider for gateway targets (#37697) (08a2543), closes #37696
• cloudfront: add Managed-HostHeaderOnly origin request policy (#38236) (0e66e47), closes #38234
• core: templates are validated against a comprehensive default rule set (#38135) (023c5bf)

Bug Fixes

• cross-stack warnings are emitted for nested stacks (#38355) (db98909)
• apigateway: revert alb integration that breaks jsii go packaging (#38305) (18158a4), closes #36247 #36247 #36247 #36247
• aws-cdk-lib: fatal validations don't show plugin name (#38273) (a88d1ba)
• aws-cdk-lib: validation namespaces for annotations are inconsistent (#38256) (75893d9)
• backup: lifecycle and vault lock validations reject tokenized durations (#38264) (0ff20a3), closes #38263 #38246 #37751 #25943 #38246 #37751 #25943
• certificatemanager: use hasOwnProperty in apexDomain to prevent prototype collision (#37195) (ec38947), closes #37193
• cloudfront-origins: validate httpPort and httpsPort range in HttpOrigin (#37872) (8a62b58)
• core: stack-related validation has an empty construct path (#38350) (0af7c34)
• core: stack.node.addDependency gets slower as stacks grow (#38314) (0728618)
• core: synth crashes with EISDIR on a symlink-to-directory when a validation plugin is registered (#38299) (be0fdc4), closes #38295
• elasticloadbalancingv2: improve handling for dropInvalidHeaderFields in case of default or switching from true to false (#36483) (208b9db), closes #36409
• lambda: allow SnapStart for container image functions (#38265) (586dc4f), closes #30898
• lambda: validations reject tokenized provisioned concurrency and async invoke config values (#38246) (4aa7e78), closes #38245 #37197 #36275 #37197
• opensearchservice: allow gp3 ebs throughput up to 2000 MiB/s (#38001) (f0cfc5b), closes #38000 #36074
• spec2cdk: add IVS to event pattern method name prefixes (#38322) (d6d1e8d)
• validation: incorrectly relative paths in Cloud Assemblies (#38352) (3f9422f), closes #38333
• validation: validation reports are not self-contained (#38333) (5d11d70)

Reverts

... (truncated)

Commits

• See full diff in compare view

Updates aws-cdk-lib from 2.261.0 to 2.265.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.265.0

Features

• bedrock-agentcore: add StreamDeliveryResources support to Memory L2 Construct (#37527) (817c50b)
• cloudwatch: support AT_LEAST expression for composite alarm rules (#37693) (974e43b), closes #37692 #36100
• docdb: add managed password support (#35711) (fcf54bf)
• ec2: add ipAddressType and dnsRecordIpType to GatewayVpcEndpoint (#37900) (000f532), closes #37883
• ec2: add volume initialization rate to ebs props for launchtemplate (#36451) (da4281e), closes #36374
• kinesisfirehose: add HTTP Endpoint and Datadog destination (#33657) (4c47171), closes #20354 #15502

Bug Fixes

• cloudwatch: make concrete widgets assignable to widget interface (#37695) (e322035), closes #37600
• core: cdk validate can hang indefinitely (#38510) (0a238f3), closes #38498 #38425
• secretsmanager: correct SAR rotation app versions for GovCloud (#38462) (a29b5c0)
• bump brace-expansion to 5.0.9 to address CVE-2026-69152 (#38520) (8764b7b), closes #38496 #38410

---

Alpha modules (2.265.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: PySparkFlexEtlJob and ScalaSparkFlexEtlJob now default to GlueVersion.V5_0 instead of V3_0. Set glueVersion explicitly to keep the previous behavior.
• glue-alpha: removal policy of existing Database resources will change to RETAIN.

Features

• glue-alpha: default Flex jobs to Glue 5.0 (#38543) (36d4976)
• glue-alpha: removal policy is RETAIN for Database by default (#38535) (9669928)
• glue-alpha: warn on plaintext secrets (#38538) (10bf0b5)

Bug Fixes

• glue-alpha: warn when S3Table grants cover a shared bucket (#38542) (d81d2d6)
• mediaconnect-alpha: update validation to allow adding an underscore to name (#38539) (7c85994)

v2.264.0

⚠ BREAKING CHANGES

• bedrockagentcore: Gateway metric helpers now emit corrected CloudWatch dimensions per-gateway metrics use { Operation, Protocol, Resource } (was { Resource }). Alarms/dashboards built on the old dimensions must be updated.
• bedrockagentcore: RuntimeBase metric helpers now emit corrected CloudWatch dimensions per-resource metrics use { Operation, Name, Resource } (was { Resource }) and aggregated metrics use { AggregateOperation } (was { Resource: 'All' }). Alarms/dashboards built on the old dimensions must be updated.

Features

• update L1 CloudFormation resource definitions (#38526) (b5693cb)
• cloudwatch: support alarm mute rules (#37504) (c3540bb), closes #37502
• update L1 CloudFormation resource definitions (#38479) (279340d)

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.265.0-alpha.0 (2026-08-13)

⚠ BREAKING CHANGES

• glue-alpha: PySparkFlexEtlJob and ScalaSparkFlexEtlJob now default to GlueVersion.V5_0 instead of V3_0. Set glueVersion explicitly to keep the previous behavior.
• glue-alpha: removal policy of existing Database resources will change to RETAIN.

Features

• glue-alpha: default Flex jobs to Glue 5.0 (#38543) (36d4976)
• glue-alpha: removal policy is RETAIN for Database by default (#38535) (9669928)
• glue-alpha: warn on plaintext secrets (#38538) (10bf0b5)

Bug Fixes

• glue-alpha: warn when S3Table grants cover a shared bucket (#38542) (d81d2d6)
• mediaconnect-alpha: update validation to allow adding an underscore to name (#38539) (7c85994)

2.264.0-alpha.0 (2026-08-10)

⚠ BREAKING CHANGES

• glue-alpha: IDatabase.catalogArn and IDatabase.catalogId were removed in factor of a type safe ICatalog, which has catalogArn and catalogId. Consumers and implementations were updated accordingly.

Features

• glue-alpha: new Catalog L2 (#38443) (6a8ba8e)
• glue-alpha: strengthen data encryption for S3Table (#38501) (eb81d5e), closes /docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-5

Bug Fixes

• glue-alpha: enable key rotation for security configuration encryption (#38512) (18560e0)
• mediaconnect-alpha: addOutput options and simplified VPC interface referencing (#38515) (3c71466), closes #38517

2.263.0-alpha.0 (2026-07-31)

⚠ BREAKING CHANGES

• mediaconnect: removalPolicy prop removed from FlowProps, GatewayProps, and BridgeProps. These resources now follow CloudFormation's default deletion behaviour (Delete).

... (truncated)

Commits

• 3ea03cf chore(deps): upgrade jsii packaging toolchain to 1.139.0 (#38560)
• 49d4eab chore(release): 2.265.0 (#38559)
• 3c8d99e chore: update analytics metadata blueprints
• 4009a44 chore(release): 2.265.0
• a29b5c0 fix(secretsmanager): correct SAR rotation app versions for GovCloud (#38462)
• 974e43b feat(cloudwatch): support AT_LEAST expression for composite alarm rules (#37693)
• e322035 fix(cloudwatch): make concrete widgets assignable to widget interface (#37695)
• b98477b chore(core): update feature flag documentation for @​aws-cdk/core:defaultCross...
• 000f532 feat(ec2): add ipAddressType and dnsRecordIpType to GatewayVpcEndpoint (#37900)
• 6e05a63 chore: yarn upgrade dependencies requiring intervention (#38125)
• Additional commits viewable in compare view

Updates constructs from 10.6.0 to 10.8.1

Release notes

Sourced from constructs's releases.

v10.8.1

10.8.1 (2026-08-03)

Bug Fixes

• dropping jsii.tsc.outDir breaks Java/Go transliteration for jsii-rosetta consumers (#2880) (740480f), closes aws/jsii-compiler#2740 #2879

v10.8.0

10.8.0 (2026-07-30)

Features

• constructs: restrict package exports to public API (#2878) (9f11c08)

v10.7.2

...

Description has been truncated