chore(deps): bump the python-dependencies group across 1 directory with 3 updates

[dependabot]

Updates the requirements on aws-cdk-lib, constructs and pystac[validation] to permit the latest version.
Updates aws-cdk-lib from 2.224.0 to 2.266.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.266.0

Features

• adding controlPlaneScalingConfig to Cluster (#36863) (94e5c1a)
• update L1 CloudFormation resource definitions (#38578) (ccd2633)

Bug Fixes

• ec2: add DependsOn VPCGatewayAttachment to IPv6 default route (#37893) (ab272bc), closes #37853
• sns-subscriptions: use regionalized service principal for opt-in region SQS subscriptions (#38339) (67a7eb1), closes #32526

---

Alpha modules (2.266.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: DataQualityRulesetProps.rulesetDqdl: string is replaced by dqdl: Dqdl. Build it with Dqdl.fromString('Rules = [ ... ]').
• glue-alpha: s3Encryption, cloudWatchEncryption, and jobBookmarksEncryption are no longer object literals. Use S3Encryption.s3Managed() / S3Encryption.kms(key?), CloudWatchEncryption.kms(key?), and JobBookmarksEncryption.clientSideKms(key?). The CloudWatchEncryptionMode and JobBookmarksEncryptionMode enums are removed (their mode is now implicit); S3EncryptionMode is retained.
• glue-alpha: this is a corrective breaking change. Apps that leaned on the bug, and did things like InputFormat x = OutputFormat.AVRO; will get a compilation error in other jsii languages. The intended usage, on the other hand, was broken before and works now.
• glue-alpha: workerType and numberOfWorkers are no longer top-level job props. For Spark jobs, pass them together via workerConfiguration: { workerType, numberOfWorkers }. PythonShellJob no longer accepts them (it is sized by maxCapacity). RayJob no longer accepts workerType (it is fixed to Z.2X).
• glue-alpha: SparkJobProps.enableMetrics removed, which will cause a compilation error for any app using it. But there is no behavior change, since this is a dead prop.
• glue-alpha: a differing/tokenized has_encrypted_data supplied via parameters now throws.

Features

• glue-alpha: add warning for maxRetries when job run queuing is enabled (#38575) (09ae11e)
• glue-alpha: model SecurityConfiguration encryption as factory subtypes (#38586) (e37e7a6)
• glue-alpha: new hasEncryptedData property (#38511) (c977e36)
• glue-alpha: pair workerType and numberOfWorkers into a required workerConfiguration (#38576) (5f3b1b6)
• glue-alpha: wrap DataQualityRuleset DQDL in a typed value object (#38587) (fd01268)

Bug Fixes

• glue-alpha: correct OutputFormat.AVRO/ORC type and tidy GA-hygiene items (#38593) (35aefaf)
• glue-alpha: omit comments from struct type strings (#38008) (5f16a86), closes #26935
• mediapackagev2-alpha: add GetChannel grant on MediaPackageV2 (#38582) (74d922c), closes #38581

v2.265.0

Features

• bedrock-agentcore: add StreamDeliveryResources support to Memory L2 Construct (#37527) (817c50b)
• cloudwatch: support AT_LEAST expression for composite alarm rules (#37693) (974e43b), closes #37692 #36100
• docdb: add managed password support (#35711) (fcf54bf)
• ec2: add ipAddressType and dnsRecordIpType to GatewayVpcEndpoint (#37900) (000f532), closes #37883
• ec2: add volume initialization rate to ebs props for launchtemplate (#36451) (da4281e), closes #36374
• kinesisfirehose: add HTTP Endpoint and Datadog destination (#33657) (4c47171), closes #20354 #15502

Bug Fixes

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.270.0-alpha.0 (2026-09-17)

2.269.0-alpha.0 (2026-09-10)

⚠ BREAKING CHANGES

• glue-alpha: Glue job constructs now reject construct-managed and Glue-reserved arguments passed through defaultArguments. Previously, a managed argument set via defaultArguments was silently honored in SparkJob and PythonShellJob (customer value won over the construct default) and silently ignored in RayJob (construct default won). Both behaviors let a caller bypass the construct's security and observability defaults with no error. Passing any of the following through defaultArguments now throws a ValidationError at synthesis time:
• construct-managed arguments — --enable-continuous-cloudwatch-log, --continuous-log-logGroup, --continuous-log-logStreamPrefix, --continuous-log-conversionPattern, --enable-continuous-log-filter, --enable-metrics, --enable-observability-metrics, --enable-spark-ui, --spark-event-logs-path, --job-language, --class, --extra-jars, --user-jars-first, --extra-py-files, --extra-files, library-set
• Glue-reserved arguments — --debug, --mode, --JOB_NAME, --endpoint

A managed argument is rejected whether or not the current configuration emits it, so a disabled feature (e.g. enableMetrics: false) cannot be re-enabled through defaultArguments. Configure these through their dedicated props instead (continuousLogging, enableMetrics, enableObservabilityMetrics, sparkUI, className, extraJars, extraJarsFirst, extraPythonFiles, extraFiles). For example, replace defaultArguments: { '--enable-continuous-cloudwatch-log': 'false' } with continuousLogging: { enabled: false }. Arguments without a dedicated prop (e.g. --enable-glue-datacatalog) are unaffected and remain settable via defaultArguments.

The checkNoReservedArgs(defaultArguments?) method on the Job base class was removed. It is replaced by two protected members: setManagedArgument(key, value?), which each job class calls to declare (and, when a value is present, emit) a managed argument, and mergeDefaultArguments(defaultArguments?), which validates the caller-supplied defaultArguments against the accumulated reserved set and returns the merged map.

• route53resolver-alpha: FirewallRuleGroupAssociation now honors the previously-ignored mutationProtection and name props. Stacks that set mutationProtection: true will enable mutation protection on redeploy (which blocks further CloudFormation update/delete until it is set back to false); stacks that set name will write it to the template, which may replace the association.
• glue-alpha: trigger Action and Condition are no longer plain objects — use Action.job(...) / Action.crawler(...) and Condition.job(...) / Condition.crawler(...). Jobs are referenced via IJobRef and crawlers via ICrawlerRef (a CfnCrawler instance or CfnCrawler.fromCrawlerName(...)) instead of a CfnCrawler field or crawler-name string; IJob now extends the generated IJobRef. addDailyScheduledTrigger/addWeeklyScheduledTrigger/addCustomScheduledTrigger are replaced by addScheduledTrigger(id, { schedule, ... }) (use TriggerSchedule.daily()/weekly()/cron(...)). addNotifyEventTrigger is renamed addEventTrigger (NotifyEventTriggerOptions → EventTriggerOptions). All addXxxTrigger methods now return ITriggerRef instead of CfnTrigger.
• glue-alpha: PartitionProjectionConfiguration's variant fields (integerRange, dateRange, interval, digits, format, intervalUnit, values) are no longer public; DATE projection now takes step: { interval, intervalUnit } instead of top-level interval/intervalUnit.
• glue-alpha: ConnectionOptions no longer has subnet, vpc, or vpcSubnets; use network: ConnectionNetwork.subnet(...) or network: ConnectionNetwork.vpc(...) instead.

Features

• glue-alpha: ensure job parameters consistency (#38480) (bc7dc0c)
• glue-alpha: model Connection VPC placement as a value object (#38729) (f72e9fe)
• glue-alpha: model partition projection variants as internal state (#38726) (16527cd)

... (truncated)

Commits

• e8d9160 chore(release): 2.266.0 (#38602)
• 0163b4c chore: update analytics metadata blueprints
• 317c276 chore(release): 2.266.0
• a2eafa0 chore(s3): add integ test for cross-account replication with an imported dest...
• 74d922c fix(mediapackagev2-alpha): add GetChannel grant on MediaPackageV2 (#38582)
• ccd2633 feat: update L1 CloudFormation resource definitions (#38578)
• fd01268 feat(glue-alpha): wrap DataQualityRuleset DQDL in a typed value object (#38587)
• e37e7a6 feat(glue-alpha): model SecurityConfiguration encryption as factory subtypes ...
• 35aefaf fix(glue-alpha): correct OutputFormat.AVRO/ORC type and tidy GA-hygiene items...
• 5f3b1b6 feat(glue-alpha): pair workerType and numberOfWorkers into a required workerC...
• Additional commits viewable in compare view

Updates constructs from 10.6.0 to 10.8.1

Release notes

Sourced from constructs's releases.

v10.8.1

10.8.1 (2026-08-03)

Bug Fixes

• dropping jsii.tsc.outDir breaks Java/Go transliteration for jsii-rosetta consumers (#2880) (740480f), closes aws/jsii-compiler#2740 #2879

v10.8.0

10.8.0 (2026-07-30)

Features

• constructs: restrict package exports to public API (#2878) (9f11c08)

v10.7.2

10.7.2 (2026-07-29)

Bug Fixes

• ids with a newline can produce duplicate addresses (#2876) (25edded)

v10.7.1

10.7.1 (2026-07-20)

Bug Fixes

• Node.path takes a lot of time on deep construct trees (#2873) (857a94f)

v10.7.0

10.7.0 (2026-07-15)

Features

• removeDependency (#2872) (67495a0)

Commits

• 740480f fix: dropping jsii.tsc.outDir breaks Java/Go transliteration for jsii-rosetta...
• 9f11c08 feat(constructs): restrict package exports to public API (#2878)
• 61a20b4 chore(deps): upgrade cdklabs-projen-project-types (#2877)
• 25edded fix: ids with a newline can produce duplicate addresses (#2876)
• b0d316d chore(deps): upgrade dev dependencies (#2875)
• 4756e27 chore(deps): upgrade dev dependencies (#2874)
• 857a94f fix: Node.path takes a lot of time on deep construct trees (#2873)
• 67495a0 feat: removeDependency (#2872)
• 34b862f chore(deps): upgrade dev dependencies (#2871)
• 9b63ef8 chore(deps): upgrade dev dependencies (#2870)
• Additional commits viewable in compare view

Updates pystac[validation] to 1.15.2

Release notes

Sourced from pystac[validation]'s releases.

v1.15.2

1.15.2 (2026-07-27)

Bug Fixes

• circular imports for extensions (#1764) (c82570e)

Changelog

Sourced from pystac[validation]'s changelog.

1.15.2 (2026-07-27)

Bug Fixes

• circular imports for extensions (#1764) (c82570e)

1.15.1 (2026-06-30)

Bug Fixes

• actually link pystac-core and pystac via release-please (207e38d)
• consolidate core and top-level package in release-please (#1760) (c6a9fbd)
• more release-please flailing (#1762) (bcf1062)
• remove invalid version specifier (#1756) (bc70651)

1.15.0 (2026-06-25)

Bug Fixes

• persist stac_io when reading items (#1745) (3df1cef)
• urllib3 raise on error status codes (#1739) (34352df)

Miscellaneous Chores

• manually set next versions (64fd083)

1.14.3 (2026-01-08)

Bug Fixes

• /vsi* paths are always absolute (#1625) (60eef08)
• doc string fixes (#1613) (61c3e14)
• typo nework --> network in test_summaries.py (#1624) (7a5e734)
• use broader iterable type (#1614) (b9422d8)
• use supertype parameter name (#1616) (0d2ec09)

1.14.2 (2025-12-17)

Bug Fixes

• Remove unused pystac.validation import (#1583)
• clone extra_fields for Item (#1601) (6ba7da1)
• make release-please two separate jobs (#1607) (bb6d289)
• Make extent not required for VerticalSpatialDimension (#1596)

... (truncated)

Commits

• af10871 chore(main): release 1.15.2 (#1775)
• 1f8d728 build(deps): bump actions/checkout in the actions-deps group (#1778)
• 70a6405 build(deps): bump setuptools from 82.0.1 to 83.0.0 (#1776)
• 6ec1e30 build(deps): bump soupsieve from 2.8.3 to 2.8.4 (#1766)
• 57b8d50 build(deps): bump mistune from 3.2.1 to 3.3.0 (#1767)
• c171db2 build(deps): bump jupyter-server from 2.18.0 to 2.20.0 (#1770)
• c82570e fix: circular imports for extensions (#1764)
• f0c30cc build(deps): bump cryptography from 46.0.7 to 48.0.1 (#1774)
• a448ffc build(deps-dev): bump jupyterlab from 4.5.7 to 4.5.9 (#1773)
• bb1d200 build(deps-dev): bump starlette from 1.0.1 to 1.3.1 (#1771)
• Additional commits viewable in compare view