chore(deps): update dependency aws-cdk-lib to v2.267.0

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
aws-cdk-lib	2.149.0 → 2.267.0

---

Release Notes

aws/aws-cdk (aws-cdk-lib)

v2.267.0

Compare Source

⚠ BREAKING CHANGES

• kinesisfirehose: After this change, specifying an unsupported timeZone on the Firehose S3Bucket destination now throws a ValidationError during synthesis instead of failing at CloudFormation deployment. Affected values: 3-letter IANA abbreviations (e.g. EST), Etc/UTC, Etc/GMT, Factory, and strings containing characters outside [a-zA-Z/_]+. Use a supported standard IANA identifier (e.g. America/New_York) or UTC for synth to pass.

Features

• backup: add indexActions prop to BackupPlanRule (#​34051) (b8be853), closes #​34050
• bedrockagentcore: add manageDeliveryResourcePolicy opt-out for runtime observability (#​38372) (5fb086b), closes #​38342
• ci: integration test deployment on maintainer approval (#​38519) (c5f6b4f), closes #​37333
• core: Size objects now properly stringify (#​38662) (90fe151)
• sqs: metricApproximateNumberOfMessagesOutstanding (#​38661) (f29b27b)

Bug Fixes

• assets: SymlinkFollowMode.BLOCK_EXTERNAL will throw errors while bundling (#​38506) (a11e451)
• bedrockagentcore: least-privilege browser recording S3 grant (#​38604) (7e11d11)
• ci: add environment for Atmosphere variables access (#​38625) (785773e), closes #​38519
• cloudfront-origins: readTimeout and keepaliveTimeout reject valid values (#​38432) (6251e1a), closes #​38433 #​18628
• core: performance counters use too much memory (#​38620) (d0ce23c)
• core: single file bundled output should be file (#​38548) (9e22774)
• core: stack.node.addDependency gets slower as stacks grow (#​38597) (2ab9be4), closes #​38522
• core: symlinks in directory bundling output (#​38665) (8d8ae2c)
• core: validation plugin check adds too much overhead (#​38619) (df15b9f)
• dynamodb: TableV2.grants.*Data does not include index resources (#​37892) (e48a97f), closes #​37569
• dynamodb: TableV2MultiAccountReplica rejects imported tables with tokenized ARNs (#​38365) (08f05e5), closes #​38354
• dynamodb: avoid TableGrantsProps deprecation warnings for TableV2 (#​38399) (fb5c25b), closes #​37221
• ec2: NatInstanceProvider and NatInstanceProviderV2 always trigger the keyName deprecation warning (#​38347) (47f2151), closes #​30806
• kinesisfirehose: add validation for customTimeZone in S3BucketProps (#​38514) (8cf9f90), closes #​36089
• lambda: allow SnapStart for container image functions (#​38680) (a5adc00), closes #​38281 #​38281 #​38265
• rds: serverlessV2 capacity props reject tokens at synth time (#​38044) (b7880de), closes #​38043 #​9044 #​31810 #​32905
• s3-deployment: increase default memory limit from 128MB to 1024MB (#​35501) (7a04f32), closes #​35487
• stepfunctions-tasks: resolve EvaluateExpression paths via a values lookup (#​38682) (02301ea)
• stack.availabilityZones are not stable strings (#​38580) (f89474a)

---

Alpha modules (2.267.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: schema Type is now an opaque class; construct column types via the Schema factories or Schema.custom(...) rather than { isPrimitive, inputString } literals. StorageParameter.custom(key, value) requires a string value, and StorageParameter.writeKmsKeyId takes a kms.IKey instead of a string.
• glue-alpha: S3TableProps.bucket/encryption/encryptionKey are removed. Use storage: S3TableStorage.managedBucket(S3TableEncryption.kms(key?)) / S3TableStorage.fromBucket(bucket) and clientSideEncryption: TableClientSideEncryption.kms(key?). S3Table.encryption/encryptionKey are removed (clientSideEncryptionKey exposes the client-side key; read bucket.encryptionKey for server-side). The TableEncryption enum and the deprecated Table/TableProps are removed — use S3Table.

Features

• glue-alpha: add a typed secret input to Connection (#​38585) (ede4a1c)
• glue-alpha: add subnet selection to Connection (#​38561) (f9d7eac)
• glue-alpha: model S3Table storage/encryption as value objects (#​38591) (9990e16)
• glue-alpha: opaque Schema Type with Schema.custom, and stronger StorageParameter types (#​38592) (5c45eb0)
• msk-alpha: support Kafka 4.2 (#​38323) (97b181c)
• s3tables-alpha: add storage class configuration support (#​37339) (63ccf6d)

Bug Fixes

• glue-alpha: validate that DATE partition projection interval is set when required (#​38594) (0e2b582)
• lambda-python-alpha: escape Docker bundling command arguments (#​38583) (f7ce07b)

v2.266.0

Compare Source

Features

• adding controlPlaneScalingConfig to Cluster (#​36863) (94e5c1a)
• update L1 CloudFormation resource definitions (#​38578) (ccd2633)

Bug Fixes

• ec2: add DependsOn VPCGatewayAttachment to IPv6 default route (#​37893) (ab272bc), closes #​37853
• sns-subscriptions: use regionalized service principal for opt-in region SQS subscriptions (#​38339) (67a7eb1), closes #​32526

---

Alpha modules (2.266.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: DataQualityRulesetProps.rulesetDqdl: string is replaced by
  dqdl: Dqdl. Build it with Dqdl.fromString('Rules = [ ... ]').
• glue-alpha: s3Encryption, cloudWatchEncryption, and jobBookmarksEncryption are no longer object literals. Use S3Encryption.s3Managed() / S3Encryption.kms(key?), CloudWatchEncryption.kms(key?), and JobBookmarksEncryption.clientSideKms(key?). The CloudWatchEncryptionMode and JobBookmarksEncryptionMode enums are removed (their mode is now implicit); S3EncryptionMode is retained.
• glue-alpha: this is a corrective breaking change. Apps that leaned on the bug, and did things like InputFormat x = OutputFormat.AVRO; will get a compilation error in other jsii languages. The intended usage, on the other hand, was broken before and works now.
• glue-alpha: workerType and numberOfWorkers are no longer top-level job props. For Spark jobs, pass them together via workerConfiguration: { workerType, numberOfWorkers }. PythonShellJob no longer accepts them (it is sized by maxCapacity). RayJob no longer accepts workerType (it is fixed to Z.2X).
• glue-alpha: SparkJobProps.enableMetrics removed, which will cause a compilation error for any app using it. But there is no behavior change, since this is a dead prop.
• glue-alpha: a differing/tokenized has_encrypted_data supplied via parameters now throws.

Features

• glue-alpha: add warning for maxRetries when job run queuing is enabled (#​38575) (09ae11e)
• glue-alpha: model SecurityConfiguration encryption as factory subtypes (#​38586) (e37e7a6)
• glue-alpha: new hasEncryptedData property (#​38511) (c977e36)
• glue-alpha: pair workerType and numberOfWorkers into a required workerConfiguration (#​38576) (5f3b1b6)
• glue-alpha: wrap DataQualityRuleset DQDL in a typed value object (#​38587) (fd01268)

Bug Fixes

• glue-alpha: correct OutputFormat.AVRO/ORC type and tidy GA-hygiene items (#​38593) (35aefaf)
• glue-alpha: omit comments from struct type strings (#​38008) (5f16a86), closes #​26935
• mediapackagev2-alpha: add GetChannel grant on MediaPackageV2 (#​38582) (74d922c), closes #​38581

v2.265.0

Compare Source

Features

• bedrock-agentcore: add StreamDeliveryResources support to Memory L2 Construct (#​37527) (817c50b)
• cloudwatch: support AT_LEAST expression for composite alarm rules (#​37693) (974e43b), closes #​37692 #​36100
• docdb: add managed password support (#​35711) (fcf54bf)
• ec2: add ipAddressType and dnsRecordIpType to GatewayVpcEndpoint (#​37900) (000f532), closes #​37883
• ec2: add volume initialization rate to ebs props for launchtemplate (#​36451) (da4281e), closes #​36374
• kinesisfirehose: add HTTP Endpoint and Datadog destination (#​33657) (4c47171), closes #​20354 #​15502

Bug Fixes

• cloudwatch: make concrete widgets assignable to widget interface (#​37695) (e322035), closes #​37600
• core: cdk validate can hang indefinitely (#​38510) (0a238f3), closes #​38498 #​38425
• secretsmanager: correct SAR rotation app versions for GovCloud (#​38462) (a29b5c0)
• bump brace-expansion to 5.0.9 to address CVE-2026-69152 (#​38520) (8764b7b), closes #​38496 #​38410

---

Alpha modules (2.265.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: PySparkFlexEtlJob and ScalaSparkFlexEtlJob now default to GlueVersion.V5_0 instead of V3_0. Set glueVersion explicitly to keep the previous behavior.
• glue-alpha: removal policy of existing Database resources will change to RETAIN.

Features

• glue-alpha: default Flex jobs to Glue 5.0 (#​38543) (36d4976)
• glue-alpha: removal policy is RETAIN for Database by default (#​38535) (9669928)
• glue-alpha: warn on plaintext secrets (#​38538) (10bf0b5)

Bug Fixes

• glue-alpha: warn when S3Table grants cover a shared bucket (#​38542) (d81d2d6)
• mediaconnect-alpha: update validation to allow adding an underscore to name (#​38539) (7c85994)

v2.264.0

Compare Source

⚠ BREAKING CHANGES

• bedrockagentcore: Gateway metric helpers now emit corrected CloudWatch dimensions per-gateway
  metrics use { Operation, Protocol, Resource } (was { Resource }). Alarms/dashboards built on the
  old dimensions must be updated.
• bedrockagentcore: RuntimeBase metric helpers now emit corrected CloudWatch dimensions per-resource metrics use { Operation, Name, Resource } (was { Resource }) and aggregated metrics use { AggregateOperation } (was { Resource: 'All' }). Alarms/dashboards built on the old dimensions must be updated.

Features

• update L1 CloudFormation resource definitions (#​38526) (b5693cb)
• cloudwatch: support alarm mute rules (#​37504) (c3540bb), closes #​37502
• update L1 CloudFormation resource definitions (#​38479) (279340d)

Bug Fixes

• bedrockagentcore: gateway metrics emit correct CloudWatch dimension (#​38487) (5a7d360)
• bedrockagentcore: runtime metrics emit correct CloudWatch dimensions (#​38486) (4e44f24)
• cloudfront: warn when minimumProtocolVersion is set without a certificate (#​37250) (52ec5f7), closes #​35404
• ec2: allow EBS gp3 and io2 volumes up to 64 TiB (#​37049) (10711ba), closes #​37045
• stepfunctions-tasks: call-rest-api CallApiGatewayRestApiEndpoint does not support JsonATA for api_path (#​37738) (9f0afdc), closes #​37728 /github.com/aws/aws-cdk/blob/e207b76cc2503701b3c4e2c87023617b485b2fde/packages/aws-cdk-lib/aws-stepfunctions/lib/private/jsonata.ts#L1

---

Alpha modules (2.264.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: IDatabase.catalogArn and IDatabase.catalogId were removed in factor of a type
  safe ICatalog, which has catalogArn and catalogId. Consumers and implementations were updated
  accordingly.

Features

• glue-alpha: new Catalog L2 (#​38443) (6a8ba8e)
• glue-alpha: strengthen data encryption for S3Table (#​38501) (eb81d5e), closes /docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-5

Bug Fixes

• glue-alpha: enable key rotation for security configuration encryption (#​38512) (18560e0)
• mediaconnect-alpha: addOutput options and simplified VPC interface referencing (#​38515) (3c71466), closes #​38517

v2.263.0

Compare Source

Features

• autoscaling: add support for AutoScalingInstanceRefresh UpdatePolicy (#​38277) (434157f), closes #​38276
• docdb: support per-instance maintenance window on DatabaseCluster (#​38315) (5390624), closes #​30391
• ecs: add support for using existing Cloud Map namespaces in ECS clusters (#​36812) (bda00bf), closes #​26698
• eks: add Provisioned Control Plane support with controlPlaneScalingTier property (#​36651) (5ea1054), closes #​36650
• eks: add support for Kubernetes version 1.36 (#​38441) (da27b6c), closes #​38411
• lambda: add Java8AL2023, Java11AL2023 and Java17AL2023 runtime for Lambda #​38418 (#​38419) (1e55176)
• lambda: add logGroup and systemLogLevel to CapacityProvider (#​38183) (61a2e2d), closes #​38182
• lambda: add PropagateTags to CapacityProvider for tag propagation (#​38180) (6f86f97), closes #​38181

Bug Fixes

• core: upgrade cloudformation-validate library (#​38444) (d26e507), closes #​38412
• bump brace-expansion to 5.0.8 to address CVE-2026-14257 (#​38410) (5aaa395), closes #​38409 #​38063

---

Alpha modules (2.263.0-alpha.0)

⚠ BREAKING CHANGES

• mediaconnect: removalPolicy prop removed from FlowProps, GatewayProps, and BridgeProps. These resources now follow CloudFormation's default deletion behaviour (Delete).

Bug Fixes

• glue-alpha: race condition when creating mutiple indices (#​38016) (18b1947), closes #​24813 #​34 #​34
• mediaconnect: jsdoc typo (#​38434) (7fe6d3d)
• mediaconnect: remove default removal policy (#​38437) (238193d)

v2.262.2

Compare Source

Bug Fixes

• revert "fix(core): stack.node.addDependency gets slower as stacks grow (#​38314)" (#​38417) (d97dd8d), closes #​38406 #​38406

---

Alpha modules (2.262.2-alpha.0)

v2.262.1

Compare Source

Bug Fixes

• core: bump @aws/cloudformation-validate to 1.5.1-beta to fix install on Node != 22.x (#​38382) (d409b96), closes #​38380
• core: env CDK_VALIDATION=false does not disable built-in template validation (#​38379) (cc4208c), closes #​38378

---

Alpha modules (2.262.1-alpha.0)

v2.262.0

Compare Source

Features

• ecs: add support ECS-optimized Amazon Linux 2023 (Neuron) AMI (#​34689) (ad665c4)
• mediaconnect: l2 construct (#​37945) (8e9e001)
• update L1 CloudFormation resource definitions (#​38275) (2b1c632)
• apigateway: alb integration (#​36247) (20dbdd9), closes #​36184
• bedrockagentcore: support service/region in IAM credential provider for gateway targets (#​37697) (08a2543), closes #​37696
• cloudfront: add Managed-HostHeaderOnly origin request policy (#​38236) (0e66e47), closes #​38234
• core: templates are validated against a comprehensive default rule set (#​38135) (023c5bf)

Bug Fixes

• cross-stack warnings are emitted for nested stacks (#​38355) (db98909)
• apigateway: revert alb integration that breaks jsii go packaging (#​38305) (18158a4), closes #​36247 #​36247 #​36247 #​36247
• aws-cdk-lib: fatal validations don't show plugin name (#​38273) (a88d1ba)
• aws-cdk-lib: validation namespaces for annotations are inconsistent (#​38256) (75893d9)
• backup: lifecycle and vault lock validations reject tokenized durations (#​38264) (0ff20a3), closes #​38263 #​38246 #​37751 #​25943 #​38246 #​37751 #​25943
• certificatemanager: use hasOwnProperty in apexDomain to prevent prototype collision (#​37195) (ec38947), closes #​37193
• cloudfront-origins: validate httpPort and httpsPort range in HttpOrigin (#​37872) (8a62b58)
• core: stack-related validation has an empty construct path (#​38350) (0af7c34)
• core: stack.node.addDependency gets slower as stacks grow (#​38314) (0728618)
• core: synth crashes with EISDIR on a symlink-to-directory when a validation plugin is registered (#​38299) (be0fdc4), closes #​38295
• elasticloadbalancingv2: improve handling for dropInvalidHeaderFields in case of default or switching from true to false (#​36483) (208b9db), closes #​36409
• lambda: allow SnapStart for container image functions (#​38265) (586dc4f), closes #​30898
• lambda: validations reject tokenized provisioned concurrency and async invoke config values (#​38246) (4aa7e78), closes #​38245 #​37197 #​36275 #​37197
• opensearchservice: allow gp3 ebs throughput up to 2000 MiB/s (#​38001) (f0cfc5b), closes #​38000 #​36074
• spec2cdk: add IVS to event pattern method name prefixes (#​38322) (d6d1e8d)
• validation: incorrectly relative paths in Cloud Assemblies (#​38352) (3f9422f), closes #​38333
• validation: validation reports are not self-contained (#​38333) (5d11d70)

Reverts

• lambda: revert SnapStart for container image functions (#​38265) (#​38281) (3b92863)

---

Alpha modules (2.262.0-alpha.0)

Bug Fixes

• redshift-alpha: quote identifiers and escape literals containing special characters (#​38269) (3cb6844)

v2.261.0

Compare Source

⚠ BREAKING CHANGES

• ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

• aws-cloudwatch: AWS::CloudWatch::LogAlarm: QueryLanguage property has been removed from the ScheduledQueryConfiguration type.
• aws-elasticloadbalancing: AWS::ElasticLoadBalancing::LoadBalancer: Id attribute has been removed and the primary identifier is now LoadBalancerName.

Features

• update L1 CloudFormation resource definitions (#​38189) (5aabd32)
• core: add git source metadata to CloudFormation templates (#​37368) (765271b)
• rds: support native Secrets Manager integration for RDS Cluster and Instance (#​35734) (07d5623), closes #​29239

Bug Fixes

• improve internal path detection (#​38205) (6a1934d)
• ecr-assets: tarball asset build command not escaped (#​38171) (bad8a3a)
• print validation errors according to new style (#​38166) (031aba8)

---

Alpha modules (2.261.0-alpha.0)

Features

• metrics-facade-alpha: generate metrics facades (#​37334) (aa9beb0)

v2.260.0

Compare Source

Features

• update L1 CloudFormation resource definitions (#​38151) (f266a47), closes /docs.aws.amazon.com/AmazonS3/latest/userguide/s3-files-prereq-policies.html#s3
• core: add external traces to ConstructError (#​38131) (e360dd9)
• core: append external stack traces to metadata if available (#​38124) (c77a08c)

Bug Fixes

• bundling: docker build can be skipped if already performed (#​38134) (2f9ae95)
• core: stack traces contain decorator paths (#​38130) (318f645)
• core: weak cross-stack references fail for list attributes (#​37948) (6bb9d75), closes #​37910
• lambda-nodejs: reuse posixShellEscape for Docker bundling file operations (#​38133) (baa9e1d)

---

Alpha modules (2.260.0-alpha.0)

v2.259.0

Compare Source

⚠ BREAKING CHANGES

• lambda: Runtime.NODEJS_LATEST now resolves to nodejs24.x in every region. Customers who pin to a concrete runtime (Runtime.NODEJS_22_X, useLatestRuntimeVersion: false in aws-lambda-nodejs.NodejsFunction) are unaffected. Existing AWS::Lambda::Function resources synthesized with NODEJS_LATEST will see Runtime: nodejs22.x → Runtime: nodejs24.x on next deploy. Lambda accepts runtime updates in place.

  Customer-code compatibility — IMPORTANT: Node.js 24 removes support for callback-style asynchronous handlers ((event, context, callback) => {...}) per the launch blog. Customers whose Lambda code still uses callback-based handlers will see runtime errors after the bump. Customers should migrate to async (event, context) => {...} or pin to Runtime.NODEJS_22_X explicitly.

Features

• core: recommend the use of weak references if no choice has been made (#​38070) (6e74e5e)
• ecs: add forceNewDeployment option for Fargate and EC2 services (#​36797) (3d9c4df), closes #​27762
• eks: use the recommended AL2023 instead of AL2 AMI type (under feature flag) (#​37850) (6a2dcb7), closes #​32211
• lambda: upgrade lambda and custom resource default runtime to nodejs24.x (#​38031) (36c84c6)

Bug Fixes

• spec2cdk: sanitize hyphens in EventBridge event namespace names (#​38088) (b8f41bf), closes 40aws-cdk/spec2cdk/lib/naming/conventions.ts#L195

Reverts

• "chore(bundling): check if docker image is cached before building" (#​38116) (359f2fb), closes aws/aws-cdk#37951

---

Alpha modules (2.259.0-alpha.0)

v2.258.1

Compare Source

Reverts

• "chore(bundling): check if docker image is cached before building" (#​38116) (8ec236c), closes aws/aws-cdk#37951

---

Alpha modules (2.258.1-alpha.0)

v2.258.0

Compare Source

⚠ BREAKING CHANGES

• ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

• aws-pcaconnectorad: AWS::PCAConnectorAD::ServicePrincipalName: ConnectorArn property is now required.
• aws-pcaconnectorad: AWS::PCAConnectorAD::ServicePrincipalName: DirectoryRegistrationArn property is now required.
• aws-pcaconnectorad: AWS::PCAConnectorAD::TemplateGroupAccessControlEntry: GroupSecurityIdentifier property is now required.
• aws-pcaconnectorad: AWS::PCAConnectorAD::TemplateGroupAccessControlEntry: TemplateArn property is now required.

Features

• core: trace property assignments in CfnResource.addPropertyOverride (#​38072) (a226372)
• update L1 CloudFormation resource definitions (#​37993) (664a878)
• aws-cdk-lib: emits performance counters if synthesis is slow (#​38004) (cb03794), closes #​37919 #​37843
• bedrockagentcore: expose default endpoint application log group on Runtime (#​37812) (8e25d78), closes #​37796
• core: add scope to IPolicyValidationContext (#​38006) (cae7456)
• core: allow validation plugins to create new files in cloud assembly (#​38007) (d9f38a9)
• core: fine-grained control over cross-stack reference strength (#​37840) (bddcd44)
• core: include suppressed violations in validation-report.json (#​38009) (f396892)
• core: new validation report schema (#​37970) (4e09b52), closes aws/aws-cdk-cli#1515
• eks: add AlbControllerVersion support for v2.8.3 through v3.2.2 (#​37752) (20abc6a), closes #​37414
• eks: add deletionProtection property to Cluster construct (#​36474) (5b19ac5), closes #​36460
• elasticache: replace CacheEngine/UserEngine enums with enum-like classes (#​37816) (6ad84b3), closes #​37813

Bug Fixes

• autoscaling: use of ScheduledAction.endTime is dangerous (#​38014) (109fae7)
• aws-cdk-lib: make token resolution ~25% faster (#​37920) (87483dc)
• bedrockagentcore: relax allowlistedHeaders pattern to match CFN schema (#​37969) (e0d6c8a), closes #​37964
• cloudwatch: metric math validation reports quoted strings as unknown identifiers (#​37977) (59bae38)
• core: cross-region SSM writer orphans parameters when resource is replaced during stack update (#​38059) (f130388)
• core: handle string "false" for boolean context values in validation (#​37989) (a26ed73)
• integ-tests: responseURL logged in onTimeout (#​37972) (b9259dd)
• lambda-nodejs: bundling rejects entry paths containing ".." (#​38022) (a7cc53c), closes #​38017 #​37572 #​37572
• lambda-nodejs: perf counters e2e test uses incorrect filename (#​38033) (d88637f)

---

Alpha modules (2.258.0-alpha.0)

Features

• integ-tests-alpha: add option to set the provider log level (#​38005) (c634a79)

Bug Fixes

• custom-resource-handlers: deterministic asset hashes for generated lambdas (#​37634) (6c3d5bc), closes #​34307
• glue-alpha: deprecate Ray Jobs (#​38055) (3fa428b)
• glue-alpha: restore no

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!