chore(release): 2.234.0

.github/workflows/pr-linter.yml

@@ -33,7 +33,7 @@ jobs:
     steps:
       - name: 'Download workflow_run artifact'
         if: github.event_name == 'workflow_run'
-        uses: dawidd6/action-download-artifact@v11
+        uses: dawidd6/action-download-artifact@v12
         continue-on-error: true
         with:
           run_id: ${{ github.event.workflow_run.id }}

.github/workflows/security-report.yml

@@ -11,6 +11,9 @@ jobs:
       checks: write
       pull-requests: write
       actions: read
+    env:
+      CHECK_NAME_STATIC: 'Security Guardian Results'
+      CHECK_NAME_RESOLVED: 'Security Guardian Results with resolved templates'
     steps:
       - name: Download artifacts
         uses: actions/download-artifact@v7
@@ -28,11 +31,12 @@ jobs:
           echo "pr_sha=$(cat test-results/pr_sha)" >> "$GITHUB_OUTPUT"
           echo "PR: $(cat test-results/pr_number), SHA: $(cat test-results/pr_sha)"
       - name: Publish Security Test Results 
+        id: junit_static
         uses: mikepenz/action-junit-report@v6
         if: always()
         with:
           report_paths: 'test-results/**/cfn-guard-static.xml'
-          check_name: 'Security Guardian Results'
+          check_name: ${{ env.CHECK_NAME_STATIC }}
           exclude_sources: 'node_modules,dist'
           commit: ${{ steps.pr_info.outputs.pr_sha }}
           check_annotations: true
@@ -46,12 +50,46 @@ jobs:
           check_title_template: '{{TEST_NAME}}'
           include_empty_in_summary: false
 
+      - name: Add disclaimer to static results comment
+        uses: actions/github-script@v8
+        if: steps.junit_static.outcome == 'success'
+        env:
+          PR_NUMBER: ${{ steps.pr_info.outputs.pr_number }}
+          CHECK_NAME: ${{ env.CHECK_NAME_STATIC }}
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const prNumber = process.env.PR_NUMBER;
+            const checkName = process.env.CHECK_NAME;
+            const comments = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: prNumber,
+            });
+
+            const botComment = comments.data.find(comment => 
+              comment.user.type === 'Bot' && 
+              comment.body.includes(checkName) &&
+              !comment.body.includes('resolved templates')
+            );
+
+            if (botComment) {
+              const disclaimer = '⚠️ **Experimental Feature**: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined. \n**Please try `merge from main` to avoid findings unrelated to the PR.**\n\n---\n\n';
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: botComment.id,
+                body: disclaimer + botComment.body
+              });
+            }
+
       - name: Publish Security Test Results for resolved templates
+        id: junit_resolved
         uses: mikepenz/action-junit-report@v6
         if: always()
         with:
           report_paths: 'test-results/**/cfn-guard-resolved.xml'
-          check_name: 'Security Guardian Results with resolved templates'
+          check_name: ${{ env.CHECK_NAME_RESOLVED }}
           exclude_sources: 'node_modules,dist'
           commit: ${{ steps.pr_info.outputs.pr_sha }}
           check_annotations: true
@@ -64,3 +102,35 @@ jobs:
           include_skipped: false
           check_title_template: '{{TEST_NAME}}'
           include_empty_in_summary: false
+
+      - name: Add disclaimer to resolved results comment
+        uses: actions/github-script@v8
+        if: steps.junit_resolved.outcome == 'success'
+        env:
+          PR_NUMBER: ${{ steps.pr_info.outputs.pr_number }}
+          CHECK_NAME: ${{ env.CHECK_NAME_RESOLVED }}
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const prNumber = process.env.PR_NUMBER;
+            const checkName = process.env.CHECK_NAME;
+            const comments = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: prNumber,
+            });
+
+            const botComment = comments.data.find(comment => 
+              comment.user.type === 'Bot' && 
+              comment.body.includes(checkName)
+            );
+
+            if (botComment) {
+              const disclaimer = '⚠️ **Experimental Feature**: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined. \n**Please try `merge from main` to avoid findings unrelated to the PR.**\n\n---\n\n';
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: botComment.id,
+                body: disclaimer + botComment.body
+              });
+            }

CHANGELOG.v2.alpha.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.234.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.233.0-alpha.0...v2.234.0-alpha.0) (2026-01-08)
+
+
+### Features
+
+* **msk-alpha:** support express broker for Kafka v3.9 ([#36450](https://github.com/aws/aws-cdk/issues/36450)) ([afcc953](https://github.com/aws/aws-cdk/commit/afcc95362cbf1dff56f2a3d96f37915dc877d01b))
+
+
+### Bug Fixes
+
+* **elasticache-alpha:** deployment fails when serverlessCacheName or userGroupId is not specified ([#36459](https://github.com/aws/aws-cdk/issues/36459)) ([b3f62f7](https://github.com/aws/aws-cdk/commit/b3f62f7acd935176d540d6c4e227a4c660fc7481)), closes [#36458](https://github.com/aws/aws-cdk/issues/36458)
+
 ## [2.233.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.232.2-alpha.0...v2.233.0-alpha.0) (2025-12-18)
 
 

CHANGELOG.v2.md

@@ -2,6 +2,50 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.234.0](https://github.com/aws/aws-cdk/compare/v2.233.0...v2.234.0) (2026-01-08)
+
+
+### ⚠ BREAKING CHANGES
+
+* **batch:** unfortunately `JobQueue` exposes `public readonly computeEnvironments: OrderedComputeEnvironment[]`. The `computeEnvironment` member of that structure now fewer guarantees, and needs casting. This should not have been exposed, and we assume the use of the exposed property here is rare.
+* **backup:** unfortunately `BackupPlanRule` exposes `public readonly props: BackupPlanRuleProps`. The `backupVault` member of that structure now guarantees less, and needs casting. This should never have been exposed, and we assume the use of the exposed property here is rare.
+* ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:
+
+aws-securityhub: AWS::SecurityHub::ConnectorV2: Provider.JiraCloud.AuthStatus attribute removed.  
+aws-securityhub: AWS::SecurityHub::ConnectorV2: Provider.JiraCloud.AuthUrl attribute removed.  
+aws-securityhub: AWS::SecurityHub::ConnectorV2: Provider.JiraCloud.CloudId attribute removed.  
+aws-securityhub: AWS::SecurityHub::ConnectorV2: Provider.JiraCloud.Domain attribute removed.  
+aws-securityhub: AWS::SecurityHub::ConnectorV2: Provider.ServiceNow.AuthStatus attribute removed.  
+aws-securityhub: AWS::SecurityHub::ConnectorV2: JiraCloud type removed, replaced by JiraCloudProviderConfiguration.  
+aws-securityhub: AWS::SecurityHub::ConnectorV2: ServiceNow type removed, replaced by ServiceNowProviderConfiguration.  
+aws-ssm: AWS::SSM::MaintenanceWindowTarget: Id attribute removed.
+
+### Features
+
+* **ecs:** automatically create ec2InstanceProfile for ManagedInstancesCapacityProvider ([#35796](https://github.com/aws/aws-cdk/issues/35796)) ([9218ea8](https://github.com/aws/aws-cdk/commit/9218ea8356f43dacab177e1ae74c7bb7c4aceedd))
+* **rds:** add name property to option group ([#36319](https://github.com/aws/aws-cdk/issues/36319)) ([708d0ac](https://github.com/aws/aws-cdk/commit/708d0acce8e5c9339a9c8b2574d8b6e2556eebd8)), closes [#35720](https://github.com/aws/aws-cdk/issues/35720)
+* **stepfunctions-tasks:** allow EcsRunTask on fargate and ec2 to set capacity provider strategy ([#35465](https://github.com/aws/aws-cdk/issues/35465)) ([63ca2ae](https://github.com/aws/aws-cdk/commit/63ca2ae07507c0726c28c990931cca748eb0dcda)), closes [#20013](https://github.com/aws/aws-cdk/issues/20013) [#30171](https://github.com/aws/aws-cdk/issues/30171) [#7967](https://github.com/aws/aws-cdk/issues/7967)
+* **synthetics:** add puppeteer 12.0/13.0 runtime ([#36562](https://github.com/aws/aws-cdk/issues/36562)) ([5b74dd4](https://github.com/aws/aws-cdk/commit/5b74dd45abb700cebc33c811114c95f0b098aa6a)), closes [#36501](https://github.com/aws/aws-cdk/issues/36501)
+* update L1 CloudFormation resource definitions ([#36447](https://github.com/aws/aws-cdk/issues/36447)) ([a85eed7](https://github.com/aws/aws-cdk/commit/a85eed76bd16b700681dc7607857c4139948467c)), closes [/docs.aws.amazon.com/iotanalytics/latest/userguide/automate-create-dataset.html#automate-example6](https://github.com/aws//docs.aws.amazon.com/iotanalytics/latest/userguide/automate-create-dataset.html/issues/automate-example6) [/docs.aws.amazon.com/iotanalytics/latest/userguide/automate-create-dataset.html#automate-example6](https://github.com/aws//docs.aws.amazon.com/iotanalytics/latest/userguide/automate-create-dataset.html/issues/automate-example6)
+* update L1 CloudFormation resource definitions ([#36477](https://github.com/aws/aws-cdk/issues/36477)) ([06309fa](https://github.com/aws/aws-cdk/commit/06309fa4c3e91ae8cd0c975693d6546ce783416b))
+
+
+### Bug Fixes
+
+* **cloudwatch:** skip MathExpression validation when prop is a token ([#36487](https://github.com/aws/aws-cdk/issues/36487)) ([2845d47](https://github.com/aws/aws-cdk/commit/2845d47e074e3bf7e8d36bf655822c70ae53f094))
+* **core:** `App.of()` returns incorrect values ([#36475](https://github.com/aws/aws-cdk/issues/36475)) ([78034d3](https://github.com/aws/aws-cdk/commit/78034d32d0b120a4eabaf58d7a87a1c6649d1a8e))
+* **core:** `arnForXxxx()` helpers ignore environments from referenced resources ([#36599](https://github.com/aws/aws-cdk/issues/36599)) ([4744c59](https://github.com/aws/aws-cdk/commit/4744c5919b85a9943d704379a0413ddf242f97c0))
+* **core:** account for `{ Ref }` incompatibility between schema and CFN ([#36493](https://github.com/aws/aws-cdk/issues/36493)) ([3b06942](https://github.com/aws/aws-cdk/commit/3b069427f1e912b9deb8c237706c24833fd6fc04))
+* **ec2:** add proper handling for VPC endpoint service name prefix eu.amazonaws for new region eusc-de-east-1 for ECR & API Gateway services ([#36471](https://github.com/aws/aws-cdk/issues/36471)) ([d5561e0](https://github.com/aws/aws-cdk/commit/d5561e0a3f42e4e0c7ea49e2497bc3c5ced8355f))
+* **elasticache:** security group for `ServerlessCache` does not use default endpoint port ([#35738](https://github.com/aws/aws-cdk/issues/35738)) ([79d91ad](https://github.com/aws/aws-cdk/commit/79d91ad156452540525710b1c5049904bcbfc053))
+* **lambda:** add token resolution validation to capacity providers ([#36275](https://github.com/aws/aws-cdk/issues/36275)) ([c5fbd97](https://github.com/aws/aws-cdk/commit/c5fbd97c1496d1e4c1c8585cdf720bac2937e95c))
+
+
+### Miscellaneous Chores
+
+* **backup:** reference interfaces ([#36415](https://github.com/aws/aws-cdk/issues/36415)) ([4418612](https://github.com/aws/aws-cdk/commit/4418612ab36184bce45b827e8e5955dc00396853))
+* **batch:** reference interfaces ([#36522](https://github.com/aws/aws-cdk/issues/36522)) ([fefc7be](https://github.com/aws/aws-cdk/commit/fefc7be8f415edf3ee24e0f75768a6acdb12d391))
+
 ## [2.233.0](https://github.com/aws/aws-cdk/compare/v2.232.2...v2.233.0) (2025-12-18)
 
 ### ⚠ BREAKING CHANGES

CONTRIBUTING.md

@@ -530,15 +530,15 @@ CDK integration tests.
 We've added a watch feature to the CDK that builds your code as you type it. Start this by running `yarn watch` for
 each module that you are modifying.
 
-For example, watch the aws-cdk-lib and aws-cdk modules in a second terminal session:
+For example, watch the aws-cdk-lib module in a second terminal session:
 
 ```console
 $ cd packages/aws-cdk-lib
 $ yarn watch & # runs in the background
-$ cd packages/aws-cdk
-$ yarn watch & # runs in the background
 ```
 
+> **Note:** The AWS CDK CLI has been moved to a separate repository. If you need to watch the CLI package, please refer to the [AWS CDK CLI repository](https://github.com/aws/aws-cdk-cli).
+
 #### Verify your fix by deployment
 
 If your PR updates a specific library, you might want to write a simple CDK application and make sure it synthesizes and
@@ -1018,24 +1018,6 @@ grantAwesomePowerBeta1()
 When we decide it's time to graduate the API, the latest preview version will
 be deprecated and the final version - `grantAwesomePower` will be added.
 
-### Adding new experimental CLI features
-
-In order to move fast when developing new CLI features, we may decide to release 
-functionality as "experimental" or "incremental." In this scenario we can utilize
-explicit opt-in via an `--unstable` flag.
-
-Explicit opt-ins would look something like this:
-
-```bash
-cdk new-command --unstable='new-command'
-
-cdk bootstrap --unstable='new-funky-bootstrap'
-```
-
-And can be simply added as an additional flag on the CLI command that is being worked on.
-When the time comes to stabilize the command, we remove the requirement that such a flag
-is set.
-
 ## Documentation
 
 Every module's README is rendered as the landing page of the official documentation. For example, this is
@@ -1272,13 +1254,6 @@ $ cdk -a some.app.js synth | $awscdk/scripts/template-deps-to-dot | dot -Tpng >
 
 You can use `find-cycles` to print a list of internal dependency cycles:
 
-## Running CLI integration tests
-
-The CLI package (`packages/aws-cdk`) has some integration tests that aren't
-run as part of the regular build, since they have some particular requirements.
-See the [CLI CONTRIBUTING.md file](packages/aws-cdk/CONTRIBUTING.md) for
-more information on running those tests.
-
 ## Building and testing v2 -alpha packages
 
 Modules that are not stable are vended separately from `aws-cdk-lib`. These packages are found in the
@@ -1568,6 +1543,7 @@ The badges have the following meaning:
 
 ## Related Repositories
 
+* [AWS CDK CLI](https://github.com/aws/aws-cdk-cli): the AWS CDK command-line interface (moved to a separate repository)
 * [Samples](https://github.com/aws-samples/aws-cdk-examples): includes sample code in multiple languages
 * [Workshop](https://github.com/aws-samples/aws-cdk-intro-workshop): source for https://cdkworkshop.com
 * [Developer Guide](https://github.com/awsdocs/aws-cdk-guide): markdown source for developer guide

CONTRIBUTORS.md

@@ -23,10 +23,10 @@ Shout out to our top contributors!
 - [robertd](https://github.com/robertd)
 - [MrArnoldPalmer](https://github.com/MrArnoldPalmer)
 - [lpizzinidev](https://github.com/lpizzinidev)
+- [phuhung273](https://github.com/phuhung273)
 - [msambol](https://github.com/msambol)
 - [peterwoodworth](https://github.com/peterwoodworth)
-- [phuhung273](https://github.com/phuhung273)
 - [GavinZZ](https://github.com/GavinZZ)
 
 
-_Last updated: Mon, 01 Dec 25 00:16:16 +0000_
+_Last updated: Thu, 01 Jan 26 00:16:08 +0000_

LICENSE

@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2018-2025 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+   Copyright 2018-2026 Amazon.com, Inc. or its affiliates. All Rights Reserved.
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

MANUAL_INSTALLATION.md

@@ -15,11 +15,8 @@ After extracting the archive, follow the following instructions:
 
 ### Installing the CLI
 
-The CLI (the `cdk` command) is always installed using npm, regardless of your language.
-
-```
-npm install -g /path/to/zip/js/aws-cdk-1.2.3.tgz
-```
+The AWS CDK Toolkit CLI is developed in a separate repository and released independently from the AWS Construct libraries. For installation instructions, releases, and source code, see:
+[AWS CDK CLI repository](https://github.com/aws/aws-cdk-cli)
 
 ### TypeScript/JavaScript (npm)
 

allowed-breaking-changes.txt

@@ -4009,8 +4009,16 @@ weakened:aws-cdk-lib.aws_dynamodb.SchemaOptions
 # property unconfiguredBehavesLike is deprecated and had its type changed
 strengthened:aws-cdk-lib.cloud_assembly_schema.FeatureFlag
 weakened:aws-cdk-lib.cloud_assembly_schema.FeatureFlag
+
+# These shouldn't have been return values to begin with, but now that they're exposed we need the ability to change them
+weakened:aws-cdk-lib.aws_backup.BackupPlanCopyActionProps
+weakened:aws-cdk-lib.aws_backup.BackupPlanRuleProps
+
 # See https://github.com/aws/aws-cdk/discussions/32609
 removed:aws-cdk-lib.aws_ecs.AsgCapacityProvider.canContainersAccessInstanceRole
 removed:aws-cdk-lib.aws_ecs.AddAutoScalingGroupCapacityOptions.canContainersAccessInstanceRole
 removed:aws-cdk-lib.aws_ecs.AddCapacityOptions.canContainersAccessInstanceRole
 removed:aws-cdk-lib.aws_ecs.AsgCapacityProviderProps.canContainersAccessInstanceRole
+
+# Exposed struct with a ref interface
+weakened:aws-cdk-lib.aws_batch.OrderedComputeEnvironment