build(deps): Bump aws-cdk-lib from 2.257.0 to 2.260.0 in /infra in the production-dependencies group across 1 directory

[dependabot]

Bumps the production-dependencies group with 1 update in the /infra directory: aws-cdk-lib.

Updates aws-cdk-lib from 2.257.0 to 2.260.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.260.0

Features

• update L1 CloudFormation resource definitions (#38151) (f266a47), closes /docs.aws.amazon.com/AmazonS3/latest/userguide/s3-files-prereq-policies.html#s3
• core: add external traces to ConstructError (#38131) (e360dd9)
• core: append external stack traces to metadata if available (#38124) (c77a08c)

Bug Fixes

• bundling: docker build can be skipped if already performed (#38134) (2f9ae95)
• core: stack traces contain decorator paths (#38130) (318f645)
• core: weak cross-stack references fail for list attributes (#37948) (6bb9d75), closes #37910
• lambda-nodejs: reuse posixShellEscape for Docker bundling file operations (#38133) (baa9e1d)

---

Alpha modules (2.260.0-alpha.0)

v2.259.0

⚠ BREAKING CHANGES

• lambda: Runtime.NODEJS_LATEST now resolves to nodejs24.x in every region. Customers who pin to a concrete runtime (Runtime.NODEJS_22_X, useLatestRuntimeVersion: false in aws-lambda-nodejs.NodejsFunction) are unaffected. Existing AWS::Lambda::Function resources synthesized with NODEJS_LATEST will see Runtime: nodejs22.x → Runtime: nodejs24.x on next deploy. Lambda accepts runtime updates in place.

  Customer-code compatibility — IMPORTANT: Node.js 24 removes support for callback-style asynchronous handlers ((event, context, callback) => {...}) per the launch blog. Customers whose Lambda code still uses callback-based handlers will see runtime errors after the bump. Customers should migrate to async (event, context) => {...} or pin to Runtime.NODEJS_22_X explicitly.

Features

• core: recommend the use of weak references if no choice has been made (#38070) (6e74e5e)
• ecs: add forceNewDeployment option for Fargate and EC2 services (#36797) (3d9c4df), closes #27762
• eks: use the recommended AL2023 instead of AL2 AMI type (under feature flag) (#37850) (6a2dcb7), closes #32211
• lambda: upgrade lambda and custom resource default runtime to nodejs24.x (#38031) (36c84c6)

Bug Fixes

• spec2cdk: sanitize hyphens in EventBridge event namespace names (#38088) (b8f41bf), closes 40aws-cdk/spec2cdk/lib/naming/conventions.ts#L195

Reverts

• "chore(bundling): check if docker image is cached before building" (#38116) (359f2fb), closes aws/aws-cdk#37951

---

Alpha modules (2.259.0-alpha.0)

v2.258.1

Reverts

• "chore(bundling): check if docker image is cached before building" (#38116) (8ec236c), closes aws/aws-cdk#37951

---

Alpha modules (2.258.1-alpha.0)

... (truncated)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.260.0-alpha.0 (2026-06-16)

2.259.0-alpha.0 (2026-06-11)

2.258.1-alpha.0 (2026-06-08)

2.258.0-alpha.0 (2026-06-04)

Features

• integ-tests-alpha: add option to set the provider log level (#38005) (c634a79)

Bug Fixes

• custom-resource-handlers: deterministic asset hashes for generated lambdas (#37634) (6c3d5bc), closes #34307
• glue-alpha: deprecate Ray Jobs (#38055) (3fa428b)
• glue-alpha: restore notifyDelayAfter to PySpark and Scala Spark ETL jobs (#37815) (05be88a), closes #33839
• integ-tests-alpha: assertion failures print too much unnecessary information (#37974) (bc0de1d)
• mediapackagev2-alpha: cdnAuth on OriginEndpoint now generates the required policy (#38013) (1d56b46)

2.257.0-alpha.0 (2026-05-21)

2.256.1-alpha.0 (2026-05-20)

2.256.0-alpha.0 (2026-05-19)

2.255.0-alpha.0 (2026-05-18)

Features

• bedrock-agentcore-alpha: Graduation of the library to stable. The Policy submodule is the only submodule that remains in alpha. All other constructs have graduated to stable in aws-cdk-lib/aws-bedrockagentcore and we recommend migrating to the stable versions (#37876) (00cf601)

2.254.0-alpha.0 (2026-05-13)

Features

• bedrock-agentcore-alpha: add tags support to Evaluator and OnlineEvaluationConfig (#37804) (adbf88f)
• bedrock-agentcore-alpha: add identity L2 constructs (#37610) (67c3af2)
• mediapackagev2-alpha: add OAC integration between CloudFront and MediaPackageV2 (#37701) (654f59c)

Bug Fixes

... (truncated)

Commits

• f266a47 feat: update L1 CloudFormation resource definitions (#38151)
• 318f645 fix(core): stack traces contain decorator paths (#38130)
• 2f9ae95 fix(bundling): docker build can be skipped if already performed (#38134)
• aeafa63 docs(pipelines): clarify format of DockerHub creds (#38132)
• baa9e1d fix(lambda-nodejs): reuse posixShellEscape for Docker bundling file operation...
• e360dd9 feat(core): add external traces to ConstructError (#38131)
• 5619d43 Merge branch 'main' into merge-back/2.259.0
• 6bb9d75 fix(core): weak cross-stack references fail for list attributes (#37948)
• c77a08c feat(core): append external stack traces to metadata if available (#38124)
• 772eeba chore: update analytics metadata blueprints
• Additional commits viewable in compare view

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.79%. Comparing base (5b4b28e) to head (c6f25ba).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2216   +/-   ##
=======================================
  Coverage   73.79%   73.79%           
=======================================
  Files          36       36           
  Lines         477      477           
  Branches       71       63    -8     
=======================================
  Hits          352      352           
  Misses        125      125           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud