Update dependency aws-cdk-lib to v2.254.0

[mend-for-github-com]

This PR contains the following updates:

Package	Type	Update	Change
aws-cdk-lib (source)	dependencies	minor	2.253.1 → 2.254.0

By merging this PR, the issue #6919 will be automatically resolved and closed:

Severity	CVSS Score	Vulnerability
High	7.5	CVE-2026-6321
High	7.5	CVE-2026-6322

---

Release Notes

aws/aws-cdk (aws-cdk-lib)

v2.254.0

Compare Source

⚠ BREAKING CHANGES

• ** L1 resources are automatically generated from public CloudFormation Resource Schemas. They are built to closely reflect the real state of CloudFormation. Sometimes these updates can contain changes that are incompatible with previous types, but more accurately reflect reality. In this release we have changed:

aws-elasticache: AWS::ElastiCache::CacheCluster: Id attribute removed.
aws-sagemaker: AWS::SageMaker::Model: Id attribute removed.
aws-vpclattice: AWS::VpcLattice::AuthPolicy: State attribute enum values changed from ACTIVE|INACTIVE to Active|Inactive.

Features

• update L1 CloudFormation resource definitions (#​37826) (fb4197e)
• cloudwatch: add PromQL Alarm L2 construct (#​37793) (13a4924)
• core: PropertyMergeStrategy now supports array merge strategies (#​37841) (701305d)
• core: plugin violations can be suppressed (#​37808) (a47ad39), closes #​37781
• core: weak cross environment references (#​37800) (fe23dce)
• core: weak cross-stack references in the same environment (#​37824) (167ff3c)
• dynamodb: resource policies for streams (#​37254) (7e5679c)
• lambda: add SQS provisionedPollerConfig support with validation and fix type mismatch (#​37550) (086738b), closes #​37197 /github.com/aws/aws-cdk/pull/37197#pullrequestreview-2772143562 #​37197
• ses: auto email validation for configuration sets (#​36679) (3a58641)

Bug Fixes

• file fingerprinting is now ~33% faster (#​37802) (b871018)
• core: "exports cannot be updated" for cross-region references (#​37790) (af11f00)
• rds: add lower bound validation for ClusterInstance promotionTier (#​37519) (16c0a29), closes #​37518
• s3deploy: empty sources leads to deployment error (#​37786) (d28ad30)
• bundled jsonschema in @​aws-cdk/cloud-assembly-api causes ELSPROBLEMS (#​37774) (64651d3), closes #​37756

---

Alpha modules (2.254.0-alpha.0)

Features

• bedrock-agentcore-alpha: add tags support to Evaluator and OnlineEvaluationConfig (#​37804) (adbf88f)
• bedrock-agentcore-alpha: add identity L2 constructs (#​37610) (67c3af2)
• mediapackagev2-alpha: add OAC integration between CloudFront and MediaPackageV2 (#​37701) (654f59c)

Bug Fixes

• bedrock-agentcore-alpha: fix cedar policy bug (#​37782) (e678d5c), closes #​37828
• custom-resource-handlers: deployment fails when parameter already exists (#​37852) (025c38c)

---

• If you want to rebase/retry this PR, check this box