chore(release): 2.266.0 by aws-cdk-automation · Pull Request #38602 · aws/aws-cdk

aws-cdk-automation · 2026-08-19T13:20:10Z

### Reason for this change [Original PR](#36302) was closed and locked `controlPlaneScalingConfig` was an option added to EKS clusters recently. This was added to CFN and the level 1 structure. This PR adds it to the level 2 construct. ### Description of changes - Added controlPlaneScalingConfig to Cluster. - Added section to the README - Added unit tests for basic controlPlaneScalingConfig validation ### Describe any new or updated permissions being added None ### Description of how you validated changes Tested with unit tests. CFN side changes have been tested separately and this change is not doing anything more than just passing through the level 1 cfnCluster properties. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

… region SQS subscriptions (#38339) ### Issue # (if applicable) Closes #32526. ### Reason for this change When subscribing an SQS queue or Lambda function to an SNS topic where one or both regions are opt-in regions, `SqsSubscription` and `LambdaSubscription` generate policies with the global `sns.amazonaws.com` service principal. Per the [SNS cross-region delivery documentation](https://docs.aws.amazon.com/sns/latest/dg/sns-cross-region-delivery.html), a regionalized service principal is required when opt-in regions are involved, otherwise messages are silently dropped. ### Description of changes Added a `snsServicePrincipal()` helper in `aws-sns-subscriptions/lib/private/util.ts` that determines the correct SNS service principal based on the topic and subscriber regions: - **Default → opt-in region**: uses `sns.<subscriber-region>.amazonaws.com` - **Opt-in → default region**: uses `sns.<topic-region>.amazonaws.com` - **Opt-in → opt-in region**: uses `sns.<subscriber-region>.amazonaws.com` - **Default → default region**: uses `sns.amazonaws.com` (unchanged) - **Unresolved regions (tokens)**: falls back to `sns.amazonaws.com` (safe default) The helper uses `RegionInfo.get(region).isOptInRegion` to determine whether regionalization is needed, and `ServicePrincipal.fromStaticServicePrincipleName()` to construct the regionalized principal directly. We use `fromStaticServicePrincipleName` rather than `new ServicePrincipal('sns.amazonaws.com', { region })` because the standard `ServicePrincipal` region option relies on token resolution that compares the passed region against the stack's region at synth time — this fails when the policy lives in the same stack as the opt-in region (e.g., the subscriber is in the opt-in region), since `stack.region === opts.region` causes it to skip regionalization. Using the static method bypasses this entirely and makes the behavior deterministic. Updated both `SqsSubscription.bind()` and `LambdaSubscription.bind()` to use this helper. ### Description of how you validated changes Added unit tests covering all scenarios: - Topic in opt-in region, queue in default region → regionalized principal - Queue in opt-in region, topic in default region → regionalized principal - Same region (both opt-in) → global principal - Cross-region default-to-default → global principal - Unresolved topic ARN → global principal (fallback) - Lambda subscription with topic in opt-in region → regionalized principal Added integration test (`integ.sns-sqs-cross-opt-in-region.ts`) with snapshot verifying that a topic in `ap-southeast-4` (opt-in) subscribing to a queue in `us-east-1` produces the regionalized principal in the queue policy. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Glue tables have a storage descriptor, in which certain properties may be configured. One of them is `has_encrypted_data`, that is used by Athena do handle encryption when the data is client-side encrypted (server side encrypted data is encrypted and decrypted transparently). Currently, in `S3Table` and `ExternalTable` this value is hard-coded to `true`. Although there is a way to override this value, it's incidental (by adding a `has_encrypted_data` to the free-form `parameters` property). Add a type safe `hasEncryptedData` property to `TableBaseProps`. This is now the only way to override this value. BREAKING CHANGE: a differing/tokenized `has_encrypted_data` supplied via `parameters` now throws. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…7356) Bumps the uv group with 1 update in the /packages/@aws-cdk-testing/framework-integ/test/aws-lambda/test/integ.lambda-sourceKMSKeyArn.js.snapshot/asset.ae7adf6a3b333d1d72d9773a8e26b31f6934269d8b9d5ada4bf02331c04302de directory: [requests](https://github.com/psf/requests). Bumps the uv group with 1 update in the /packages/@aws-cdk-testing/framework-integ/test/aws-lambda/test/python-lambda-handler directory: [requests](https://github.com/psf/requests). Bumps the uv group with 1 update in the /packages/@aws-cdk/aws-lambda-python-alpha/test/lambda-handler directory: [requests](https://github.com/psf/requests). Bumps the uv group with 1 update in the /packages/@aws-cdk/aws-lambda-python-alpha/test/lambda-handler-custom-build directory: [requests](https://github.com/psf/requests). Bumps the uv group with 1 update in the /packages/@aws-cdk/aws-lambda-python-alpha/test/lambda-handler-project/lambda directory: [requests](https://github.com/psf/requests). Bumps the uv group with 1 update in the /packages/@aws-cdk/aws-lambda-python-alpha/test/lambda-handler-uv directory: [requests](https://github.com/psf/requests). Bumps the uv group with 1 update in the /packages/aws-cdk-lib/aws-lambda/test/python-lambda-handler directory: [requests](https://github.com/psf/requests). Updates `requests` from 2.32.4 to 2.33.0 <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>. <blockquote> <h2>v2.33.0</h2> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/M0d3v1"><code>@M0d3v1</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li> <li><a href="https://github.com/aminvakil"><code>@aminvakil</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li> <li><a href="https://github.com/E8Price"><code>@E8Price</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li> <li><a href="https://github.com/mitre88"><code>@mitre88</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li> <li><a href="https://github.com/magsen"><code>@magsen</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li> <li><a href="https://github.com/Rohan5commit"><code>@Rohan5commit</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li> </ul> Full Changelog: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a> <h2>v2.32.5</h2> <h2>2.32.5 (2025-08-18)</h2> Bugfixes <ul> <li>The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.</li> </ul> Deprecations <ul> <li>Added support for Python 3.14.</li> <li>Dropped support for Python 3.8 following its end of support.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>. <blockquote> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>2.32.5 (2025-08-18)</h2> Bugfixes <ul> <li>The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.</li> </ul> Deprecations <ul> <li>Added support for Python 3.14.</li> <li>Dropped support for Python 3.8 following its end of support.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a> v2.33.0</li> <li><a href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a> Merge commit from fork</li> <li><a href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a> Move badges to top of README (<a href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li> <li><a href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a> Remove unused extraction call (<a href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li> <li><a href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a> docs: fix FAQ grammar in httplib2 example</li> <li><a href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a> docs(socks): same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a> Bump github/codeql-action from 4.32.0 to 4.33.0</li> <li><a href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a> docs: exclude Response.is_permanent_redirect from API docs (<a href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li> <li><a href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a> docs: clarify Quickstart POST example (<a href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.32.4...v2.33.0">compare view</a></li> </ul> </details> Updates `requests` from 2.32.4 to 2.33.0 <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>. <blockquote> <h2>v2.33.0</h2> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/M0d3v1"><code>@M0d3v1</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li> <li><a href="https://github.com/aminvakil"><code>@aminvakil</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li> <li><a href="https://github.com/E8Price"><code>@E8Price</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li> <li><a href="https://github.com/mitre88"><code>@mitre88</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li> <li><a href="https://github.com/magsen"><code>@magsen</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li> <li><a href="https://github.com/Rohan5commit"><code>@Rohan5commit</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li> </ul> Full Changelog: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a> <h2>v2.32.5</h2> <h2>2.32.5 (2025-08-18)</h2> Bugfixes <ul> <li>The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.</li> </ul> Deprecations <ul> <li>Added support for Python 3.14.</li> <li>Dropped support for Python 3.8 following its end of support.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>. <blockquote> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>2.32.5 (2025-08-18)</h2> Bugfixes <ul> <li>The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.</li> </ul> Deprecations <ul> <li>Added support for Python 3.14.</li> <li>Dropped support for Python 3.8 following its end of support.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a> v2.33.0</li> <li><a href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a> Merge commit from fork</li> <li><a href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a> Move badges to top of README (<a href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li> <li><a href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a> Remove unused extraction call (<a href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li> <li><a href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a> docs: fix FAQ grammar in httplib2 example</li> <li><a href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a> docs(socks): same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a> Bump github/codeql-action from 4.32.0 to 4.33.0</li> <li><a href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a> docs: exclude Response.is_permanent_redirect from API docs (<a href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li> <li><a href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a> docs: clarify Quickstart POST example (<a href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.32.4...v2.33.0">compare view</a></li> </ul> </details> Updates `requests` from 2.32.4 to 2.33.0 <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>. <blockquote> <h2>v2.33.0</h2> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/M0d3v1"><code>@M0d3v1</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li> <li><a href="https://github.com/aminvakil"><code>@aminvakil</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li> <li><a href="https://github.com/E8Price"><code>@E8Price</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li> <li><a href="https://github.com/mitre88"><code>@mitre88</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li> <li><a href="https://github.com/magsen"><code>@magsen</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li> <li><a href="https://github.com/Rohan5commit"><code>@Rohan5commit</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li> </ul> Full Changelog: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a> <h2>v2.32.5</h2> <h2>2.32.5 (2025-08-18)</h2> Bugfixes <ul> <li>The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.</li> </ul> Deprecations <ul> <li>Added support for Python 3.14.</li> <li>Dropped support for Python 3.8 following its end of support.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>. <blockquote> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>2.32.5 (2025-08-18)</h2> Bugfixes <ul> <li>The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.</li> </ul> Deprecations <ul> <li>Added support for Python 3.14.</li> <li>Dropped support for Python 3.8 following its end of support.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a> v2.33.0</li> <li><a href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a> Merge commit from fork</li> <li><a href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a> Move badges to top of README (<a href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li> <li><a href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a> Remove unused extraction call (<a href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li> <li><a href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a> docs: fix FAQ grammar in httplib2 example</li> <li><a href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a> docs(socks): same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a> Bump github/codeql-action from 4.32.0 to 4.33.0</li> <li><a href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a> docs: exclude Response.is_permanent_redirect from API docs (<a href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li> <li><a href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a> docs: clarify Quickstart POST example (<a href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.32.4...v2.33.0">compare view</a></li> </ul> </details> Updates `requests` from 2.32.4 to 2.33.0 <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>. <blockquote> <h2>v2.33.0</h2> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/M0d3v1"><code>@M0d3v1</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li> <li><a href="https://github.com/aminvakil"><code>@aminvakil</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li> <li><a href="https://github.com/E8Price"><code>@E8Price</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li> <li><a href="https://github.com/mitre88"><code>@mitre88</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li> <li><a href="https://github.com/magsen"><code>@magsen</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li> <li><a href="https://github.com/Rohan5commit"><code>@Rohan5commit</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li> </ul> Full Changelog: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a> <h2>v2.32.5</h2> <h2>2.32.5 (2025-08-18)</h2> Bugfixes <ul> <li>The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.</li> </ul> Deprecations <ul> <li>Added support for Python 3.14.</li> <li>Dropped support for Python 3.8 following its end of support.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>. <blockquote> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>2.32.5 (2025-08-18)</h2> Bugfixes <ul> <li>The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.</li> </ul> Deprecations <ul> <li>Added support for Python 3.14.</li> <li>Dropped support for Python 3.8 following its end of support.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a> v2.33.0</li> <li><a href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a> Merge commit from fork</li> <li><a href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a> Move badges to top of README (<a href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li> <li><a href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a> Remove unused extraction call (<a href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li> <li><a href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a> docs: fix FAQ grammar in httplib2 example</li> <li><a href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a> docs(socks): same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a> Bump github/codeql-action from 4.32.0 to 4.33.0</li> <li><a href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a> docs: exclude Response.is_permanent_redirect from API docs (<a href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li> <li><a href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a> docs: clarify Quickstart POST example (<a href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.32.4...v2.33.0">compare view</a></li> </ul> </details> Updates `requests` from 2.32.4 to 2.33.0 <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>. <blockquote> <h2>v2.33.0</h2> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/M0d3v1"><code>@M0d3v1</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li> <li><a href="https://github.com/aminvakil"><code>@aminvakil</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li> <li><a href="https://github.com/E8Price"><code>@E8Price</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li> <li><a href="https://github.com/mitre88"><code>@mitre88</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li> <li><a href="https://github.com/magsen"><code>@magsen</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li> <li><a href="https://github.com/Rohan5commit"><code>@Rohan5commit</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li> </ul> Full Changelog: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a> <h2>v2.32.5</h2> <h2>2.32.5 (2025-08-18)</h2> Bugfixes <ul> <li>The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.</li> </ul> Deprecations <ul> <li>Added support for Python 3.14.</li> <li>Dropped support for Python 3.8 following its end of support.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>. <blockquote> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>2.32.5 (2025-08-18)</h2> Bugfixes <ul> <li>The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.</li> </ul> Deprecations <ul> <li>Added support for Python 3.14.</li> <li>Dropped support for Python 3.8 following its end of support.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a> v2.33.0</li> <li><a href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a> Merge commit from fork</li> <li><a href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a> Move badges to top of README (<a href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li> <li><a href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a> Remove unused extraction call (<a href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li> <li><a href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a> docs: fix FAQ grammar in httplib2 example</li> <li><a href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a> docs(socks): same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a> Bump github/codeql-action from 4.32.0 to 4.33.0</li> <li><a href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a> docs: exclude Response.is_permanent_redirect from API docs (<a href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li> <li><a href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a> docs: clarify Quickstart POST example (<a href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.32.4...v2.33.0">compare view</a></li> </ul> </details> Updates `requests` from 2.32.4 to 2.32.5 <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>. <blockquote> <h2>v2.33.0</h2> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/M0d3v1"><code>@M0d3v1</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li> <li><a href="https://github.com/aminvakil"><code>@aminvakil</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li> <li><a href="https://github.com/E8Price"><code>@E8Price</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li> <li><a href="https://github.com/mitre88"><code>@mitre88</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li> <li><a href="https://github.com/magsen"><code>@magsen</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li> <li><a href="https://github.com/Rohan5commit"><code>@Rohan5commit</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li> </ul> Full Changelog: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a> <h2>v2.32.5</h2> <h2>2.32.5 (2025-08-18)</h2> Bugfixes <ul> <li>The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.</li> </ul> Deprecations <ul> <li>Added support for Python 3.14.</li> <li>Dropped support for Python 3.8 following its end of support.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>. <blockquote> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>2.32.5 (2025-08-18)</h2> Bugfixes <ul> <li>The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.</li> </ul> Deprecations <ul> <li>Added support for Python 3.14.</li> <li>Dropped support for Python 3.8 following its end of support.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a> v2.33.0</li> <li><a href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a> Merge commit from fork</li> <li><a href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a> Move badges to top of README (<a href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li> <li><a href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a> Remove unused extraction call (<a href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li> <li><a href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a> docs: fix FAQ grammar in httplib2 example</li> <li><a href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a> docs(socks): same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a> Bump github/codeql-action from 4.32.0 to 4.33.0</li> <li><a href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a> docs: exclude Response.is_permanent_redirect from API docs (<a href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li> <li><a href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a> docs: clarify Quickstart POST example (<a href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.32.4...v2.33.0">compare view</a></li> </ul> </details> Updates `requests` from 2.32.4 to 2.33.0 <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>. <blockquote> <h2>v2.33.0</h2> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/M0d3v1"><code>@M0d3v1</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li> <li><a href="https://github.com/aminvakil"><code>@aminvakil</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li> <li><a href="https://github.com/E8Price"><code>@E8Price</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li> <li><a href="https://github.com/mitre88"><code>@mitre88</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li> <li><a href="https://github.com/magsen"><code>@magsen</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li> <li><a href="https://github.com/Rohan5commit"><code>@Rohan5commit</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li> </ul> Full Changelog: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a> <h2>v2.32.5</h2> <h2>2.32.5 (2025-08-18)</h2> Bugfixes <ul> <li>The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.</li> </ul> Deprecations <ul> <li>Added support for Python 3.14.</li> <li>Dropped support for Python 3.8 following its end of support.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>. <blockquote> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>2.32.5 (2025-08-18)</h2> Bugfixes <ul> <li>The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.</li> </ul> Deprecations <ul> <li>Added support for Python 3.14.</li> <li>Dropped support for Python 3.8 following its end of support.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a> v2.33.0</li> <li><a href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a> Merge commit from fork</li> <li><a href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a> Move badges to top of README (<a href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li> <li><a href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a> Remove unused extraction call (<a href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li> <li><a href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a> docs: fix FAQ grammar in httplib2 example</li> <li><a href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a> docs(socks): same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a> Bump github/codeql-action from 4.32.0 to 4.33.0</li> <li><a href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a> docs: exclude Response.is_permanent_redirect from API docs (<a href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li> <li><a href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a> docs: clarify Quickstart POST example (<a href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.32.4...v2.33.0">compare view</a></li> </ul> </details> You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/aws/aws-cdk/network/alerts). </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

See [CHANGELOG](https://github.com/aws/aws-cdk/blob/merge-back/2.265.0/CHANGELOG.md)

Fixing a number of incorrect or inconsistent claims in the documentation. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…eaderEnabled (#38394) ### Issue # (if applicable) Closes #38367 ### Reason for this change Validation runs before LambdaTarget inference assigned, this cause error message "multiValueHeadersEnabled is only supported for Lambda targets". Lambda target type manual assignment can fix this issue. ### Description of changes No code change, only documentation update. ### Describe any new or updated permissions being added None ### Description of how you validated changes Tested locally, confirmed by @[pahud](https://github.com/pahud) ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Cover some missing cases for `DataQualityRuleset`, `Job` and `Workflow` ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

### Issue # (if applicable) Closes #<issue number here>. ### Reason for this change `@aws-cdk/service-spec-types` was temporarily pinned in the root `resolutions` block to unblock the service spec update workflow while `@aws-cdk/service-spec-importers` had an incorrect dependency range (PR: #38274). That importer dependency has since been corrected, so the root resolution is now stale. ### Description of changes Remove the root `@aws-cdk/service-spec-types` entry from both `resolutions` and `dependencies`, and regenerate `yarn.lock` so the remaining service spec consumers resolve their declared versions normally. ### Description of how you validated changes - `yarn install --frozen-lockfile` - `npx lerna run build --skip-nx-cache` ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…37893) ### Issue # (if applicable) Closes #37853 ### Reason for this change `addDefaultInternetRoute` (IPv4) adds a `DependsOn` on `VPCGatewayAttachment`, so CloudFormation waits for the gateway to attach before creating the route. `addIpv6DefaultInternetRoute` was missing the same dependency. CloudFormation can create the `::/0` route before the IGW is attached, and the deployment fails: ``` The gateway ID 'igw-xxx' does not exist ``` ### Description of changes - Added an optional `gatewayAttachment?: IDependable` parameter to `addIpv6DefaultInternetRoute`. - Inlined `CfnRoute` (matching the IPv4 approach) so `route.node.addDependency()` can be called on the result. - The one internal call site already had `att` available and now passes it. - The parameter is optional to preserve backward compatibility for any external callers who call `addIpv6DefaultInternetRoute` with just the gateway ID. ### Describe any new or updated permissions being added None. ### Description of how you validated changes Added a unit test (`dual-stack IPv6 default route has DependsOn VPCGatewayAttachment`) that synthesizes a dual-stack VPC with one AZ and asserts the `::/0` route has a `DependsOn` on the `VPCGatewayAttachment` resource, using `Match.stringLikeRegexp('VPCGW')` so it stays stable across logical ID changes. The test fails on the pre-fix code and passes with the fix applied. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

### Issue # (if applicable) Closes #26935. ### Reason for this change `Schema.struct()` rendered `COMMENT '...'` inside the generated nested struct type string when a struct field had a `comment`. Glue/Athena do not support `COMMENT` inside nested type definitions, so the resulting `inputString` could not be used for nested schemas. ### Description of changes This removes comment rendering from the `Schema.struct()` type string. Column comments remain available on `Column` objects for top-level table columns, where they are represented separately by Glue's `Comment` property rather than embedded in a nested type string. The existing schema unit test now covers the reported case by asserting that comments on struct fields are not emitted into nested `inputString` values. ### Describe any new or updated permissions being added None. ### Description of how you validated changes Before the implementation change, `yarn test` in `packages/@aws-cdk/aws-glue-alpha` failed in `test/schema.test.ts` because the struct `inputString` still included nested `COMMENT` clauses. Commands run: - `yarn install --frozen-lockfile` - `npx lerna run build --scope @aws-cdk/aws-glue-alpha --include-dependencies --skip-nx-cache` - `yarn build` from `packages/@aws-cdk/aws-glue-alpha` - `yarn test` from `packages/@aws-cdk/aws-glue-alpha` - `git diff --check` Note: I used Codex while preparing this change and reviewed the final diff and local verification. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…enabled (#38575) Also delete the `enableProfilingMetrics` prop, that is not used anywhere, and semantically overlaps with `SparkJobProps.enableMetrics`, with opposite default BREAKING CHANGE: `SparkJobProps.enableMetrics` removed, which will cause a compilation error for any app using it. But there is no behavior change, since this is a dead prop. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

### Issue # (if applicable) Closes #35825. Clarify how to configure S3 cross-account replication when replica ownership should transfer to the destination account. The L2 already supports this through `ReplicationRule.accessControlTransition` and `Bucket.addReplicationPolicy()`, but the generated API documentation did not connect the complete workflow and incorrectly implied that the policy helper's account argument was the destination account. ```text Source account Destination account +------------------------+ +--------------------------+ | replicationRules | | destination bucket | | accessControlTransition|-----------> | addReplicationPolicy() | | true | | principal: source account| +------------------------+ +--------------------------+ ``` This change: - documents that `ReplicationDestination.Account` identifies the destination account while `addReplicationPolicy(..., account)` expects the source bucket owner's account; - expands the S3 README with a complete managed-destination example, referenced-bucket limitations, existing-bucket import account guidance, Object Ownership guidance, and cross-account KMS guidance; - updates the existing two-account S3 integration test to synthesize `AccessControlTranslation.Owner: Destination` and the matching destination bucket policy; - replaces the integration fixture's deprecated `Stack.addDependency()` call with `Stack.addStackDependency()`. No production logic or public API shape changes. ### Testing - `env NX_DAEMON=false npx lerna run build --scope=aws-cdk-lib --stream` - `env NX_DAEMON=false npx lerna run build --scope=@aws-cdk-testing/framework-integ --stream` - `npx jest aws-s3/test/bucket.test.ts --coverage=false` - `yarn lint --fix` in `packages/aws-cdk-lib` - `yarn lint --fix` in `packages/@aws-cdk-testing/framework-integ` - `yarn integ aws-s3/test/integ.bucket-cross-account-replication.js --update-on-failed --dry-run` - targeted `jsii-rosetta extract --compile --fail` for the changed S3 README snippet A two-account deployment was also completed in `us-east-1`. The full source and destination application stacks deployed successfully. A source object was replicated with `ReplicationStatus: REPLICA`, and its canonical owner ID matched the destination account. The test object versions and both application stacks were deleted afterward. The `integ-runner` wrapper encountered an internal existing-stack diff assertion with real account IDs. The same assertion was reproduced from the unmodified pre-change test, so the complete application was deployed with the CDK CLI and the S3 behavior was verified directly. [comment]: <> (by cdk-contribution-skill)

… workerConfiguration (#38576) Worker sizing was modeled as two independent optional props (`workerType`, `numberOfWorkers`) on the base `JobProps`. This let subtypes that cannot honor them inherit them (`PythonShellJob` dropped them silently; `RayJob` accepted `workerType` only to reject anything but `Z.2X`), and left the pair's co-dependency validated in only two of the six Spark job types, with two different error codes. Move the pair onto a `WorkerConfiguration` value object exposed as the optional `workerConfiguration` prop on `SparkJobProps`, so a Spark job can never be given one field without the other -- the illegal state is now a compile error instead of a synth-time throw, and the duplicated/divergent validation is removed. Remove `workerType`/`numberOfWorkers` from the base `JobProps`: `PythonShellJob` (DPU-sized via `maxCapacity`) no longer surfaces them, and `RayJob` keeps its own `numberOfWorkers` while dropping the fixed-value `workerType`. BREAKING CHANGE: `workerType` and `numberOfWorkers` are no longer top-level job props. For Spark jobs, pass them together via `workerConfiguration: { workerType, numberOfWorkers }`. `PythonShellJob` no longer accepts them (it is sized by `maxCapacity`). `RayJob` no longer accepts `workerType` (it is fixed to `Z.2X`). ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…ne items (#38593) `OutputFormat.AVRO` and `OutputFormat.ORC` were constructed as `InputFormat` instances — they compiled only because the two classes are structurally identical. They are now `OutputFormat` instances; the emitted Hadoop class-name strings are unchanged, so synthesized output is identical. Also: - `renderColumns` typed as the malformed `Array<Column | Column>` -> `Column[]` in both `S3Table` and `ExternalTable`. - `Database.locationUri` is now `readonly` (it is assigned only at construction). BREAKING CHANGE: this is a corrective breaking change. Apps that leaned on the bug, and did things like `InputFormat x = OutputFormat.AVRO;` will get a compilation error in other jsii languages. The intended usage, on the other hand, was broken before and works now. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…ubtypes (#38586) The three encryption blocks were co-optional `{ mode, kmsKey? }` structs. For S3, this let an illegal combination be expressed — `{ mode: S3_MANAGED, kmsKey }` — and the key was then silently dropped (SSE-S3 was applied with no error), a security-relevant silent failure. The `mode` field on the CloudWatch and Job Bookmarks blocks was also a mandatory single-value enum carrying no information. Replace the structs with factory classes that pair the mode with its key correct-by-construction: - S3Encryption.s3Managed() / S3Encryption.kms(key?) - CloudWatchEncryption.kms(key?) - JobBookmarksEncryption.clientSideKms(key?) `s3Managed()` takes no key, so a key can never be paired with S3-managed encryption — the silent-drop is now unrepresentable. The single-value `mode` field is gone (the factory name encodes it), which removes the now-dead `CloudWatchEncryptionMode` and `JobBookmarksEncryptionMode` enums. `kms()` still auto-creates a key when one is omitted, and the existing shared-key behavior is unchanged, so synthesized output for all valid inputs is identical. Addresses the SecurityConfiguration encryption-blocks finding from the aws-glue-alpha pre-GA API review. BREAKING CHANGE: `s3Encryption`, `cloudWatchEncryption`, and `jobBookmarksEncryption` are no longer object literals. Use `S3Encryption.s3Managed()` / `S3Encryption.kms(key?)`, `CloudWatchEncryption.kms(key?)`, and `JobBookmarksEncryption.clientSideKms(key?)`. The `CloudWatchEncryptionMode` and `JobBookmarksEncryptionMode` enums are removed (their mode is now implicit); `S3EncryptionMode` is retained. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

#38587) The ruleset's primary payload was a bare `rulesetDqdl: string` passed straight to the L1 with no type identity. Introduce a `Dqdl` value object built via `Dqdl.fromString(...)` and take it as the `dqdl` prop, so the DQDL document is a named, discoverable type with a clear escape hatch rather than an anonymous string. Glue still parses and validates the DQDL at deploy time; the rendered string is unchanged, so synthesized output is identical. This is the minimal (escape-hatch-only) shape; modeling individual rules as typed objects was considered and deliberately deferred — the service is the source of truth for DQDL validation and the language is large and evolving, so `fromString` gives full coverage today. Addresses the DataQualityRuleset.rulesetDqdl finding from the aws-glue-alpha pre-GA API review. BREAKING CHANGE: `DataQualityRulesetProps.rulesetDqdl: string` is replaced by `dqdl: Dqdl`. Build it with `Dqdl.fromString('Rules = [ ... ]')`. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Updates the L1 CloudFormation resource definitions with the latest changes from `@aws-cdk/aws-service-spec` **L1 CloudFormation resource definition changes:** ``` ├[~] service aws-datapipeline │ └ resources │ └[~] resource AWS::DataPipeline::Pipeline │ └ - arnTemplate: arn:${Partition}:datapipeline:${Region}:${Account}:pipeline/${PipelineID} │ + arnTemplate: arn:${Partition}:datapipeline:${Region}:${Account}:pipeline/${PipelineId} ├[~] service aws-devicefarm │ └ resources │ └[~] resource AWS::DeviceFarm::Project │ └ - arnTemplate: arn:${Partition}:devicefarm:${Region}:${Account}:project:${ResourceId} │ + arnTemplate: arn:${Partition}:devicefarm:${Region}:${Account}:project:${ProjectId} ├[~] service aws-networkfirewall │ └ resources │ └[~] resource AWS::NetworkFirewall::RuleGroup │ └ - arnTemplate: arn:${Partition}:network-firewall:${Region}:${Account}:stateful-rulegroup/${Name} │ + arnTemplate: arn:${Partition}:network-firewall:${Region}:${Account}:stateless-rulegroup/${Name} ├[~] service aws-networkmanager │ └ resources │ └[~] resource AWS::NetworkManager::CoreNetwork │ └ - arnTemplate: arn:${Partition}:networkmanager::${Account}:core-network/${ResourceId} │ + arnTemplate: arn:${Partition}:networkmanager::${Account}:core-network/${CoreNetworkId} ├[~] service aws-pinpoint │ └ resources │ ├[~] resource AWS::Pinpoint::InAppTemplate │ │ └ - arnTemplate: arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/PUSH │ │ + arnTemplate: arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/SMS │ └[~] resource AWS::Pinpoint::PushTemplate │ └ - arnTemplate: arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/PUSH │ + arnTemplate: arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/SMS ├[~] service aws-rekognition │ └ resources │ └[~] resource AWS::Rekognition::StreamProcessor │ └ - arnTemplate: arn:${Partition}:rekognition:${Region}:${Account}:streamprocessor/${StreamprocessorId} │ + arnTemplate: arn:${Partition}:rekognition:${Region}:${Account}:streamprocessor/${Name} └[~] service aws-resiliencehub └ resources └[~] resource AWS::ResilienceHub::ResiliencyPolicy └ - arnTemplate: arn:${Partition}:resiliencehub:${Region}:${Account}:resiliency-policy/${ResiliencyPolicyId} + arnTemplate: arn:${Partition}:resiliencehub:${Region}:${Account}:resiliency-policy/${PolicyId} ```

…8582) ### Issue # (if applicable) Closes #38581 ### Reason for this change ### Description of changes Add GetChannel to grants.json Updated unit tests ### Describe any new or updated permissions being added ### Description of how you validated changes Tested by hand through adding permission manually to .grants() consumer ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…ted destination bucket (#38564) ### Issue # (if applicable) Relates to #35825. Follow-up to #38349 — requested by a maintainer in #38349 (comment). ### Reason for this change #38349 documented how to replicate to a cross-account destination bucket that is *imported* into the source stack (`Bucket.fromBucketAttributes()` with the `account` attribute, plus a bucket policy configured separately in the destination account because CDK cannot modify a referenced bucket's policy). That workflow had no integration test; the existing `integ.bucket-cross-account-replication` test only covers a destination bucket that is a full `s3.Bucket` construct where `addReplicationPolicy()` can be used. ### Description of changes New fixture `integ.bucket-cross-account-replication-imported.ts` with three stacks: 1. `destination-bucket-stack` (destination account): creates the destination bucket (versioned, `ObjectOwnership.OBJECT_WRITER`). 2. `source-bucket-stack` (source account): imports the destination with `Bucket.fromBucketAttributes({ bucketName, account })` and configures a replication rule with `accessControlTransition: true`. This exercises the `account`-attribute-driven cross-account detection: the synthesized rule carries `Destination.Account` and `AccessControlTranslation.Owner: Destination`. 3. `destination-policy-stack` (destination account): creates the destination bucket policy explicitly, mirroring the statements `addReplicationPolicy()` would add ([replication walkthrough](https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-walkthrough-2.html)). It deploys *after* the source stack, so the replication role already exists when the policy references it as a principal — unlike the sibling fixture, no statements need to be commented out on the first deployment. The app pins `@aws-cdk/aws-s3:setUniqueReplicationRoleName` to `true` (recommended value), which also avoids clashing with the sibling fixture's fixed `CDKReplicationRole` role name when both are deployed in the same accounts. Like `integ.bucket-cross-account-replication`, this is a manual two-account test driven by `CDK_INTEG_ACCOUNT` / `CDK_INTEG_CROSS_ACCOUNT` (run instructions are in the fixture header). The committed snapshot uses the fallback dummy account IDs, and the automated integration test deployment workflow cannot deploy it because it provisions only a single account (see the discussion in #38349). ### Describe any new or updated permissions being added Test fixture only — no library IAM behavior changes. The fixture's destination bucket policy grants the source replication role `s3:GetBucketVersioning`/`s3:PutBucketVersioning` on the bucket and `s3:ReplicateObject`/`s3:ReplicateDelete` on objects, and grants the source account `s3:ObjectOwnerOverrideToBucketOwner` on objects, exactly as documented for S3 cross-account replication with ownership translation. ### Description of how you validated changes - **Unit tests**: not applicable (no library change); the `aws-s3` suite passes unchanged (486 passed, 1 skipped). - **Integration tests**: snapshot generated with `yarn integ aws-s3/test/integ.bucket-cross-account-replication-imported.js --update-on-failed --dry-run` and verified self-consistent. Manual two-account deployment performed with real bootstrapped accounts: all four stacks deployed in order without any first-deploy workaround, the putObject assertion passed, the replicated object arrived in the destination bucket, and its owner canonical ID matched the destination account — confirming the `accessControlTransition` ownership transfer. Stacks were cleaned up afterwards and the committed snapshot re-verified UNCHANGED. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license* 🤖 Generated with [Claude Code](https://claude.com/claude-code) [comment]: <> (by cdk-contribution-skill)

github-actions · 2026-08-19T13:21:41Z

⚠️ This pull request description does not follow the correct template structure.

PRs without a linked issue will receive lower priority for review and merging. Please update the description to follow the PR template and include a line like Closes #123 in the Issue section. If no existing issue matches your change, create one first.

mergify · 2026-08-19T14:26:35Z

Thank you for contributing! Your pull request will be automatically updated and merged without squashing (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2026-08-19T14:26:41Z

Merge Queue Status

✅ Entered queue — 2026-08-19 14:26 UTC · Rule: default-merge · triggered by rule automatic merge (no-squash)
✅ Checks skipped · PR is already up-to-date
✅ Merged — 2026-08-19 14:26 UTC · at 0163b4c07b1c082aedbbdbfbfc16c0eb10883f6d · merge

This pull request spent 21 seconds in the queue, including 2 seconds running CI.

Required conditions to merge

github-review-approved [🛡 GitHub branch protection]
- chore(release): 2.266.0 #38602
any of [🛡 GitHub branch protection]:
- check-success = build
- check-neutral = build
- check-skipped = build
any of [🛡 GitHub branch protection]:
- check-success = validate-pr
- check-neutral = validate-pr
- check-skipped = validate-pr

github-actions · 2026-08-19T14:27:04Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

notSoWiseOldMan and others added 23 commits August 13, 2026 08:54

Merge branch 'main' into merge-back/2.265.0

ebb622f

chore(merge-back): 2.265.0 (#38566)

25b5abc

See [CHANGELOG](https://github.com/aws/aws-cdk/blob/merge-back/2.265.0/CHANGELOG.md)

docs(glue-alpha): update module documentation (#38562)

7675604

Fixing a number of incorrect or inconsistent claims in the documentation. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

chore(glue-alpha): add tests (#38568)

c26b584

Cover some missing cases for `DataQualityRuleset`, `Job` and `Workflow` ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

docs: nuance regarding flat interfaces (#38584)

8e37c8d

---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

chore(release): 2.266.0

317c276

aws-cdk-automation added auto-approve pr/no-squash This PR should be merged instead of squash-merging it labels Aug 19, 2026

aws-cdk-automation temporarily deployed to automation August 19, 2026 13:20 — with GitHub Actions Inactive

github-actions Bot added the p2 label Aug 19, 2026

aws-cdk-automation requested a review from a team August 19, 2026 13:20

github-actions Bot approved these changes Aug 19, 2026

View reviewed changes

aws-cdk-automation temporarily deployed to automation August 19, 2026 13:20 — with GitHub Actions Inactive

chore: update analytics metadata blueprints

0163b4c

github-actions Bot requested a review from a team as a code owner August 19, 2026 13:22

abidhasan-aws added the pr/do-not-merge This PR should not be merged at this time. label Aug 19, 2026

abidhasan-aws temporarily deployed to automation August 19, 2026 13:22 — with GitHub Actions Inactive

abidhasan-aws removed the pr/do-not-merge This PR should not be merged at this time. label Aug 19, 2026

abidhasan-aws temporarily deployed to automation August 19, 2026 13:25 — with GitHub Actions Inactive

mergify Bot merged commit e8d9160 into v2-release Aug 19, 2026
22 of 23 checks passed

mergify Bot deleted the bump/2.266.0 branch August 19, 2026 14:26

github-actions Bot locked as resolved and limited conversation to collaborators Aug 19, 2026

Navigation Menu

Uh oh!

chore(release): 2.266.0 - #38602

chore(release): 2.266.0#38602
mergify[bot] merged 24 commits into
v2-releasefrom
bump/2.266.0

aws-cdk-automation commented Aug 19, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 19, 2026

Uh oh!

mergify Bot commented Aug 19, 2026

Uh oh!

mergify Bot commented Aug 19, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented Aug 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

Uh oh!

Conversation

aws-cdk-automation commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 19, 2026

Uh oh!

mergify Bot commented Aug 19, 2026

Uh oh!

mergify Bot commented Aug 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Queue Status

Uh oh!

Uh oh!

github-actions Bot commented Aug 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

aws-cdk-automation commented Aug 19, 2026 •

edited

Loading

mergify Bot commented Aug 19, 2026 •

edited

Loading