chore(deps): update dependency aws-cdk-lib to v2.196.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
aws-cdk-lib (source)	2.194.0 -> 2.196.0

---

Release Notes

aws/aws-cdk (aws-cdk-lib)

v2.196.0

Compare Source

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• cloudformation: Some L1 resources experienced breaking changes due to updated CloudFormation resources. Please check the notes for each specific module for more information.
• Logs: The type of property DeliveryDestinationPolicy of resource AWS::Logs::DeliveryDestination changed to be DestinationPolicy instead of JSON.

Features

• apigatewayv2: add dualstack support to domain name (#​34111) (8aa2f81), closes #​34054 /docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-apigatewayv2-domainname-domainnameconfiguration.html#cfn-apigatewayv2
• cloudformation: update L1 CloudFormation resource definitions (#​34425) (6460ffe)
• ecs: throw ValidationErrors instead of untyped errors (#​34427) (5cfea39), closes #​32569
• eks: throw ValidationErrors instead of untyped errors (#​34428) (2e7c55b), closes #​32569
• elasticloadbalancingv2: add support for multi-value headers in Lambda target groups (#​34298) (c8b98e7)
• elasticsearch: throw ValidationErrors instead of untyped errors (#​34429) (13d9645), closes #​32569
• events-targets: throw ValidationErrors instead of untyped errors (#​34430) (e493cc8), closes #​32569
• globalaccelerator: throw ValidationErrors instead of untyped errors (#​34426) (5ee092a), closes #​32569
• kms: throw ValidationErrors instead of untyped errors (#​34431) (10756c1), closes #​32569
• opensearchservice: throw ValidationErrors instead of untyped errors (#​34432) (5509923), closes #​32569
• rds: add Aurora MySQL versions 2.11.6, 2.12.5, 3.04.4 (#​34443) (d03e856)
• region-info: update Metadata regions (#​34414) (957d8e3)
• route53: add cidrRoutingConfig property (#​34301) (5cd82f5)
• s3-tables: add KMS support for TableBucket L2 construct (#​34281) (ac0e4ca)
• scheduler: throw ValidationErrors instead of untyped errors (#​34434) (bc7c4e8), closes #​32569
• servicediscovery: throw ValidationErrors instead of untyped errors (#​34435) (28048b3), closes #​32569
• ses: https policy for custom tracking domain (#​34314) (60d7aea)
• sns-subscriptions: throw ValidationErrors instead of untyped errors (#​34436) (98e352d), closes #​32569
• stepfunctions: ResultWriter support JSONPath/JSONata bucket (#​33793) (8a5aecb), closes #​32687
• stepfunctions: add parameters to parallel state (#​34131) (0f71ee1), closes #​32791
• property injectors and make all L2 Constructors injectable (#​34419) (4dc523f)
• stepfunctions: throw ValidationErrors instead of untyped errors (#​34438) (e828389), closes #​32569
• support healthCheckGracePeriod in QueueProcessingFargateService (#​34231) (ae0c7b7), closes #​34220
• synthetics: add 5.0 and 5.1 python canary runtimes (#​34254) (639b883), closes #​34252

Bug Fixes

• cloudwatch-actions: lambda permission use unique prefix id (#​34269) (9ddc00a), closes #​33958
• eks: eks cluster name exceeding the limit of 100 characters (#​34449) (5197882)
• s3: updating blockPublicAccess to enable default true settings (under feature flag) (#​33702) (904e3a3), closes #​32811 40aws-cdk-testing/framework-integ/test/aws-s3/test/integ.bucket-block-access.ts#L1-L42

---

Alpha modules (2.196.0-alpha.0)

Features

• msk: support Kafka versions 3.9.x and 3.9.x Kraft (#​34213) (a1226db)
• pipes-targets: add SNS (#​34159) (2f846b3)
• s3tables: server-side encryption by customer managed KMS key (#​34229) (488f0db)

Bug Fixes

• ec2: dual-stack vpc without private subnets creates EgressOnlyInternetGateway (under feature flag) (#​34437) (35e818b), closes #​30981
• ec2-alpha: fix resource id references and tags for migration behind feature flag (#​34377) (aa73534)

v2.195.0

Compare Source

Features

• publish 'app-staging-synthesizer-alpha' for Go (#​34364) (4e3df41)
• update L1 CloudFormation resource definitions (#​34357) (24a40a9)
• apigateway: dualstack REST API (#​34114) (efdcb9d)

Bug Fixes

• codepipeline: allow both pullRequestFilter and pushFilter (#​34267) (1cac5a0), closes #​34253
• route53-targets: beanstalk allow specifying hostedZoneId to support token endpoint with default value derived from stack region or endpointUrl (#​34122) (9e52752), closes #​31843
• s3-notifications: add a key policy to trust S3 for notifications to an SNS topic encrypted with a KMS key (under feature flag) (#​33858) (1e87861), closes #​16271

Reverts

• "chore: make all L2 Constructs property injectable during release" (#​34371) (1e722ad), closes aws/aws-cdk#34328
• "feat: property injection for 122 constructs" (#​34370) (2594f3c), closes aws/aws-cdk#33887

---

Alpha modules (2.195.0-alpha.0)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• iot: By default, deviceDertificateAgeCheck is automatically enabled.

Features

• iot: device certificate age check audit configuration (#​33816) (9ad383d)
• location: support L2 API Key Construct (#​32733) (d867878), closes #​30684

Bug Fixes

• amplify-alpha: example code for adding a custom rule is wrong (#​34353) (8ab2606), closes #​34351

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm.
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: @hello.nrfcloud.com/[email protected]
npm error Found: @aws-sdk/[email protected]
npm error node_modules/@aws-sdk/client-dynamodb
npm error   dev @aws-sdk/client-dynamodb@"3.799.0" from the root project
npm error
npm error Could not resolve dependency:
npm error peer @aws-sdk/client-dynamodb@"^3.812.0" from @hello.nrfcloud.com/[email protected]
npm error node_modules/@hello.nrfcloud.com/nrfcloud-api-helpers
npm error   @hello.nrfcloud.com/nrfcloud-api-helpers@"6.0.247" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry
npm error this command with --force or --legacy-peer-deps
npm error to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2025-05-19T21_10_48_526Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2025-05-19T21_10_48_526Z-debug-0.log