Bumps [yargs](https://github.com/yargs/yargs) from 15.3.0 to 15.3.1.
- [Release notes](https://github.com/yargs/yargs/releases)
- [Changelog](https://github.com/yargs/yargs/blob/master/CHANGELOG.md)
- [Commits](yargs/yargs@v15.3.0...v15.3.1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>

Centralize all logic about how templates, files and container assets
are built and uploaded in the `cdk-assets` tool.

We need this change first because it's on the critical path of the CLI
being able to deploy using the new convention mode roles (which requires
the CLI to use the asset publishing role for uploading the
CloudFormation templates), which is required for the pipeline
being able to do self-mutation using `cdk deploy`.

We can roll this change out independently of the framework emitting
the asset manifest (the CLI can generate it) and we don't need
to assume any roles, while we still get to test the new code path.

Also importing a number of improvements to `cdk-assets` from the
proof-of-concept branch.

-----------

In addition to the previous attempt at this feature: handle it
properly when asset manifest contains absolute instead of relative
paths.

Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>

…#5929)

Co-authored-by: Niranjan Jayakar <nija@amazon.com>

closes #5236

…4.0 (#6749)

Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 2.23.0 to 2.24.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/master/packages/eslint-plugin/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v2.24.0/packages/eslint-plugin)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>

Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.639.0 to 2.640.0.
- [Release notes](https://github.com/aws/aws-sdk-js/releases)
- [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md)
- [Commits](aws/aws-sdk-js@v2.639.0...v2.640.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>

…et (#6624)

Allow instances of ScheduledFargateTask and ScheduledEc2Task to run in a
*public* subnet via a configuration option.

The default remains that such instances are restricted to run on private
subnets, but it is now possible to allow them to run on public subnets
if the user is willing to sacrifice the extra security that a private
subnet provides in favour of a simpler/cheaper system that does not
require a NAT gateway or a NAT instance.

The new unit test schedules a Fargate task to run on a container in a
VPC with no private subnet. Before the changes to ScheduledTaskBase in
this commit, this test caused the following error:

    Error: There are no 'Private' subnet groups in this VPC. Available types: Public

fixes #6312

Co-authored-by: Wesley Pettit <wppttt@amazon.com>

Bumps [ts-mock-imports](https://github.com/EmandM/ts-mock-imports) from 1.2.6 to 1.3.0.
- [Release notes](https://github.com/EmandM/ts-mock-imports/releases)
- [Commits](https://github.com/EmandM/ts-mock-imports/commits/v1.3.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>

…#6371)

* SecretValue.secretManager validates non-ARN ids do not contain :

* Update packages/@aws-cdk/core/lib/secret-value.ts

Co-Authored-By: Elad Ben-Israel <benisrae@amazon.com>

* fix test

Co-authored-by: Elad Ben-Israel <benisrae@amazon.com>
Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>

…kens (#6727)

Prevents performing validation on the retention property for LogGroups
if the token is unresolved (e.g. a CloudFormation Parameter). Otherwise,
running the command `cdk synth` could fail with the following error
message:

```
retentionInDays must be positive, got -1.888154589708755e+289
```

The new unit test creates a LogGroup with a retention property that
refers to a CloudFormation parameter to ensure that the stack
synthesizes properly.

fixes #6690

availabilityZone attribute inside SubnetAttributes is only used for subnet selection.
AZ restrictions are not mandatory so making availabilityZone as optional.
Also as AZ is optional we should be able to search subnet using only subnet id.
Added fromSubnetId as well.

fixes #6607

Previously, MachineImages were dumb objects that maybe had UserData
given by the user, and maybe not. If the UserData object was absent,
downstream objects had to inspect the OS type of the MachineImage to
create the right type of UserData object.

That is pretty silly--polymorphism should take care of that unnecessary
`if` there. The MachineImage knows what type of OS it represents, and
should be the one generating the right type of UserData.

Move the responsibility from `Instance` and `AutoScalingGroup` to
`MachineImage`.

BREAKING CHANGE: if you implemented a custom subclass of `IMachineImage` it must now always return a `userData` object.

feat(core): the "constructs" module (#6623)

This commit extracts the constructs programming model into an independent library called `constructs` ([npm], [Maven], [PyPI], [NuGet]). This library includes the `Construct` base class (and satellites) as well as the token system. The main motivation is to enable projects like [CDK for Kubernetes] to reuse these building blocks and allow interoperability between the frameworks (hence they have to use the same base types).

To ensure backwards compatibility until we release v2.0 of the AWS CDK, the `construct-compat.ts` file implements shadow and wrapper types for types that are now in "constructs" so the AWS CDK code remains unchanged and fully passes API compatibility tests.

The token system and a bunch of types related to dependencies has been _duplicated_ since the effort of shadowing was too great and there is no major value (it would still be possible to interoperate even if we have two token systems).

Added an additional dependency on `constructs` to all AWS CDK modules.

MONOCDK: has been modified to take a `peerDependency` on this new module as this will be the final setup (users will have to depend on both `monocdk` and `constructs`), so we are not going to take shortcuts here.

TESTING: All relevant unit tests were *duplicated* from **@aws-cdk/core** to **constructs**, and intentionally maintained unchanged in core to ensure backwards compatibility.

[npm]: https://www.npmjs.com/package/constructs
[Maven]: https://search.maven.org/search?q=g:software.constructs
[PyPI]: https://pypi.org/project/constructs
[NuGet]: https://www.nuget.org/packages/Constructs/
[CDK for Kubernetes]: https://github.com/awslabs/cdk8s

)

BREAKING CHANGE: `UserPoolAttribute` has been removed. It is no longer
required to defined a `UserPool`.

closes #1747

Bumps [nock](https://github.com/nock/nock) from 12.0.2 to 12.0.3.
- [Release notes](https://github.com/nock/nock/releases)
- [Changelog](https://github.com/nock/nock/blob/master/CHANGELOG.md)
- [Commits](nock/nock@v12.0.2...v12.0.3)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>

Bumps [@types/uuid](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/uuid) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/uuid)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>

…oy` (#6684)

In the "CI/CD for CDK apps" epic,
we use the bootstrap action role to perform
`cdk deploy` (in the self-mutating stage).
To do that, we need 2 additional
read-only CloudFormation permissions that the CLI uses
(GetTemplate and DescribeStackEvents)
added to that role.

…6717)

Add support in user pool for configuring MFA, password policy and
settings for transmitted emails.

…5757)

In the original RFC for the modified cdk bootstrap command done in #4461,
we removed two options from the cdk bootstrap command-line utility:
`--toolkit-bucket-name` and `--bootstrap-kms-key-id`.
In this small revision to that RFC,
I propose we not remove them to preserve backwards compatibility for customers who already use those options,
and I show what changes that would require to our bootstrap CloudFormation template.

Accidentally used the parent scope for two of the SourceCredentials L2,
instead of the correct `this`.

Co-authored-by: Elad Ben-Israel <benisrae@amazon.com>