### Issue

N/A (self-discovered spelling errors)

### Reason for this change

Several JSDoc comments contain spelling errors that could cause confusion when reading API documentation.

### Description of changes

Fixed spelling errors in JSDoc comments across four modules:
- `aws-apigateway/lib/integration.ts`: "acccount" → "account"
- `aws-appsync/lib/schema.ts`: "defintion" → "definition"
- `aws-events/lib/connection.ts`: "paramter" → "parameter"
- `aws-lambda/lib/schema-registry.ts`: "recieve" → "receive" (3 occurrences)

### Description of how you validated changes

Comment-only changes. No functional impact.

### Checklist

- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

### Issue # (if applicable)

Closes #37347

### Reason for this change

The `FoundationModelIdentifier` class is missing identifiers for MiniMax and Zhipu AI (GLM) models that are available in Amazon Bedrock via `ListFoundationModels`.

### Description of changes

Added all 6 missing model identifiers to `FoundationModelIdentifier`:

| Model ID | Constant |
|----------|----------|
| `minimax.minimax-m2` | `MINIMAX_MINIMAX_M2` |
| `minimax.minimax-m2.1` | `MINIMAX_MINIMAX_M2_1` |
| `minimax.minimax-m2.5` | `MINIMAX_MINIMAX_M2_5` |
| `zai.glm-4.7` | `ZAI_GLM_4_7` |
| `zai.glm-4.7-flash` | `ZAI_GLM_4_7_FLASH` |
| `zai.glm-5` | `ZAI_GLM_5` |

### Description of how you validated changes

These are purely additive static readonly fields — no logic changes. Each identifier maps directly to a model ID returned by the Bedrock `ListFoundationModels` API.

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

See [CHANGELOG](https://github.com/aws/aws-cdk/blob/merge-back/2.245.0/CHANGELOG.md)

### Reason for this change

Changelog did not label s3tables commits as part of alpha packages

### Description of changes

Correct labels for s3tables-alpha to include `s3tables` and `s3table`.

### Describe any new or updated permissions being added

No new permissions added

### Description of how you validated changes

Not validated locally, this is a CI change.

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…cipal (#37335)

### Issue # (if applicable)

Closes #37273.

### Reason for this change

After v2.222.0, calling `table.grantReadWriteData(new ServicePrincipal(...))` started generating DynamoDB resource-based policies containing service principals. This is a regression caused by the combination of [#35554](#35554) (which fixed `addToResourcePolicy` to actually take effect) and [#35817](#35817) (which enabled the grant framework to automatically discover DynamoDB resource policies). Previously, `addToResourcePolicy` was a no-op, so the grant silently did nothing.

For unsupported service principals (e.g. `myservice.amazonaws.com`), this produces an invalid resource policy that fails at CloudFormation deploy time with: *"Invalid policy document: Policy contains invalid service principal"*.

However, DynamoDB does support [specific service principals](#37273 (comment)) in resource policies:
- `redshift.amazonaws.com` — [Redshift zero-ETL integration](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/RedshiftforDynamoDB-zero-etl.html)
- `replication.dynamodb.amazonaws.com` — [Multi-account global tables](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/globaltables_MA_security.html)
- `glue.amazonaws.com` — [SageMaker Lakehouse zero-ETL via AWS Glue](https://docs.aws.amazon.com/glue/latest/dg/zero-etl-sources.html#zero-etl-config-source-dynamodb)

### Description of changes

1. **Throw `ValidationError` for unsupported service principals** — Grant methods (`grant`, `grantReadData`, `grantWriteData`, `grantReadWriteData`, `grantFullAccess`) on both `Table` and `TableV2` now detect `ServicePrincipal` grantees and throw a `ValidationError` at synth time, directing users to `table.addToResourcePolicy()` instead. This fails fast rather than producing an invalid template that fails at deploy time.

2. **Allowlist known-valid service principals** — Added `KNOWN_DYNAMODB_SERVICE_PRINCIPALS` allowlist in `private/principal-utils.ts` containing the three documented service principals. The new `isUnsupportedServicePrincipal()` function walks the principal wrapper chain (handling `PrincipalWithConditions`, `SessionTagsPrincipal`, etc.) to extract the service name and check it against the allowlist. Allowlisted principals pass through `grant*` methods normally.

3. **Integration test** — Added `integ.dynamodb.grant-service-principal` verifying the three allowlisted principals produce correct resource policies in the synthesized CloudFormation template.

### Describe any new or updated permissions being added

No new or updated IAM permissions. This change prevents invalid IAM resource policy statements from being generated for unsupported service principals, while allowing valid ones through.

### Description of how you validated changes

- Unit tests: `dynamodb.test.ts` (186 passing), `table-v2.test.ts` (135 passing)
  - Unsupported principals (`bedrock.amazonaws.com`, `lambda.amazonaws.com`) throw `ValidationError`
  - Allowlisted principals (`redshift`, `replication.dynamodb`, `glue`) succeed
  - Wrapped principals (via `.withConditions()`) handled correctly for both cases
- Integration test: `integ.dynamodb.grant-service-principal` deployed successfully with snapshot containing resource policy statements for all three allowlisted principals

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

### Reason for this change

Fix various misspellings in JSDoc comments and code comments.

### Description of changes

- `Wether` → `Whether` (aws-servicecatalog)
- `reqeust` → `request` (aws-elasticloadbalancingv2)
- `notifyOnPullRequstCreated` → `notifyOnPullRequestCreated` (aws-codecommit)
- `permisions` → `permissions` (aws-cloudtrail)
- `guarentee` → `guarantee` (core)

### Description of how you validated changes

Comment-only changes. No functional impact.

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

### Reason for this change

Several `@see` and `@link` annotations in alpha packages reference AWS documentation using `http://` instead of `https://`.

### Description of changes

Replace `http://docs.aws.amazon.com` with `https://docs.aws.amazon.com` across 10 source files in the following alpha packages:
- aws-bedrock-alpha
- aws-ec2-alpha
- aws-pipes-alpha
- aws-pipes-sources-alpha
- aws-pipes-targets-alpha
- aws-s3tables-alpha

### Description of how you validated changes

Comment/annotation-only changes. No functional impact.

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

### Issue

N/A (self-discovered)

### Reason for this change

The abbreviation "e.g." (Latin: *exempli gratia*) should include periods. The codebase consistently uses "e.g." but has a few instances of "eg." without periods.

### Description of changes

- `aws-cloudwatch/lib/dashboard.ts`: "eg." → "e.g." in JSDoc comment
- `aws-cloudwatch/README.md`: "eg." → "e.g."

### Description of how you validated changes

Comment and documentation-only changes. No functional impact.

### Checklist

- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

### Issue

N/A (self-discovered spelling inconsistency)

### Reason for this change

The CDK codebase consistently uses American English "dependent" (1000+ occurrences) but has 3 instances of British English "dependant". This PR aligns them.

### Description of changes

- `triggers/lib/trigger.ts`: "dependants" → "dependents"
- `aws-eks/README.md`: "dependant" → "dependent"
- `aws-eks-v2/README.md`: "dependant" → "dependent"

### Description of how you validated changes

Comment and documentation-only changes. No functional impact.

### Checklist

- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

### Issue

N/A (self-discovered grammar errors)

### Reason for this change

Several README files incorrectly use "it's" (contraction of "it is") where "its" (possessive form) is intended.

### Description of changes

- `aws-chatbot/README.md`: "it's expiration" → "its expiration"
- `aws-rds/README.md`: "it's utilization" → "its utilization"
- `custom-resources/README.md`: "it's value" → "its value", "it's last state" → "its last state"

### Description of how you validated changes

Documentation-only changes. No functional impact.

### Checklist

- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

### Issue

N/A (self-discovered typos)

### Reason for this change

Several README files contain spelling errors.

### Description of changes

- `aws-eks-v2/README.md`: "serivceToken" → "serviceToken"
- `aws-events/README.md`: "wether" → "whether"
- `aws-route53-targets/README.md`: "avaiable" → "available"
- `cx-api/README.md`: "unsecure connnections" → "insecure connections"

### Description of how you validated changes

Documentation-only changes. No functional impact.

### Checklist

- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

### Issue

N/A (self-discovered grammar errors)

### Reason for this change

Several JSDoc comments incorrectly use "it's" (contraction of "it is") where "its" (possessive form) is intended.

### Description of changes

Fixed "it's" → "its" in possessive contexts across 7 files:
- `aws-apigateway`: "calculating it's hash" → "calculating its hash" (3 files)
- `aws-s3`: "bucket and it's contents" → "bucket and its contents" (2 files, 6 occurrences)
- `core/lib/stack.ts`: "reference to it's parent" → "reference to its parent"
- `cx-api/lib/cxapi.ts`: "Despite it's name" → "Despite its name"

### Description of how you validated changes

Comment-only changes. No functional impact.

### Checklist

- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

### Reason for this change

Fix a duplicate word typo and replace `http://` with `https://` for AWS links in README files.

### Description of changes

- `the the` → `the` (aws-ec2-alpha README)
- `http://aws.amazon.com/iam/` → `https://` (aws-cognito-identitypool README)
- `http://aws.amazon.com/cloudwatch/pricing/` → `https://` (aws-ec2 README)
- `http://docs.aws.amazon.com/mediaconvert/` → `https://` (aws-stepfunctions-tasks README)

### Description of how you validated changes

Documentation-only changes. No functional impact.

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

### Reason for this change

Fix repeated words in README files that serve as the official documentation landing pages.

### Description of changes

- `a a` → `a` (aws-cognito-identitypool)
- `the the` → `the` (aws-cognito, aws-ec2, aws-stepfunctions)
- `of of` → `of` (aws-ec2)
- `at at` → `at` (aws-ecr)

### Description of how you validated changes

Documentation-only changes. No functional impact.

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

### Issue

N/A (self-discovered typos)

### Reason for this change

Two typos in the cx-api README feature flag documentation.

### Description of changes

- "aws-lambda-nodejse" → "aws-lambda-nodejs"
- "environemnt" → "environment"

### Description of how you validated changes

Documentation-only changes. No functional impact.

### Checklist

- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

### Reason for this change

Fix various misspellings in JSDoc comments and code comments.

### Description of changes

- `paramter` → `parameter` (aws-events)
- `recieve` → `receive` (aws-lambda, 3 occurrences)
- `distribtuion` → `distribution` (aws-s3-deployment)
- `taskdefintion` → `task definition` (aws-ecs)
- `defintion` → `definition` (aws-appsync)
- `adresses` → `addresses` (aws-eks, aws-eks-v2, 4 occurrences)

### Description of how you validated changes

Comment-only changes. No functional impact.

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

… handlers (#37362)

### Reason for this change

Fix repeated words (stuttering typos) in comments across alpha packages and custom resource handlers.

### Description of changes

- `the the` → `the` (4 occurrences in app-staging-synthesizer-alpha, integ-tests-alpha, custom-resource-handlers)
- `an an` → `an` (1 occurrence in custom-resource-handlers)

### Description of how you validated changes

Comment-only changes. No functional impact.

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

### Reason for this change

TSLint has been replaced by ESLint in this project. A few leftover `tslint:disable` comments remain in the source code and serve no purpose.

### Description of changes

Remove 3 obsolete tslint disable comments from:
- `packages/aws-cdk-lib/aws-ec2/lib/vpc.ts` — `tslint:disable-next-line: max-line-length`
- `packages/aws-cdk-lib/aws-ecs/lib/cluster.ts` — `tslint:disable-next-line: max-line-length`
- `packages/@aws-cdk/aws-ec2-alpha/lib/util.ts` — `tslint:disable:no-bitwise`

### Description of how you validated changes

Comment-only changes. No functional impact.

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

### Reason for this change

Fix repeated words (stuttering typos) in JSDoc comments and code comments across multiple packages.

### Description of changes

- `the the` → `the` (6 occurrences)
- `of of` → `of`
- `be be` → `be`
- `is is` → `is`
- `to to` → `to`

### Description of how you validated changes

Comment-only changes. No functional impact.

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

### Reason for this change

Several `@see` and `@link` annotations in source code reference AWS documentation using `http://` instead of `https://`. AWS documentation fully supports HTTPS and all HTTP requests are redirected anyway.

### Description of changes

Replace `http://docs.aws.amazon.com` with `https://docs.aws.amazon.com` across 21 source files in the following packages:
- aws-apigateway
- aws-apigatewayv2
- aws-codebuild
- aws-dynamodb
- aws-ec2
- aws-efs
- aws-eks
- aws-events
- aws-fsx
- aws-iam
- aws-kinesisfirehose
- aws-ses
- core

### Description of how you validated changes

Comment/annotation-only changes. No functional impact.

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5 to 6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/codecov/codecov-action/releases">codecov/codecov-action's releases</a>.</em></p>
<blockquote>
<h2>v6.0.0</h2>
<h2>⚠️ This version introduces support for node24 which make cause breaking changes for systems that do not currently support node24. ⚠️</h2>
<h2>What's Changed</h2>
<ul>
<li>Revert &quot;Revert &quot;build(deps): bump actions/github-script from 7.0.1 to 8.0.0&quot;&quot; by <a href="https://github.com/thomasrockhu-codecov"><code>@​thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1929">codecov/codecov-action#1929</a></li>
<li>Th/6.0.0 by <a href="https://github.com/thomasrockhu-codecov"><code>@​thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1928">codecov/codecov-action#1928</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.4...v6.0.0">https://github.com/codecov/codecov-action/compare/v5.5.4...v6.0.0</a></p>
<h2>v5.5.4</h2>
<p>This is a mirror of <code>v5.5.2</code>. <code>v6</code> will be released which requires <code>node24</code></p>
<h2>What's Changed</h2>
<ul>
<li>Revert &quot;build(deps): bump actions/github-script from 7.0.1 to 8.0.0&quot; by <a href="https://github.com/thomasrockhu-codecov"><code>@​thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1926">codecov/codecov-action#1926</a></li>
<li>chore(release): 5.5.4 by <a href="https://github.com/thomasrockhu-codecov"><code>@​thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1927">codecov/codecov-action#1927</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.3...v5.5.4">https://github.com/codecov/codecov-action/compare/v5.5.3...v5.5.4</a></p>
<h2>v5.5.3</h2>
<h2>What's Changed</h2>
<ul>
<li>build(deps): bump actions/github-script from 7.0.1 to 8.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/codecov/codecov-action/pull/1874">codecov/codecov-action#1874</a></li>
<li>chore(release): bump to 5.5.3 by <a href="https://github.com/thomasrockhu-codecov"><code>@​thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1922">codecov/codecov-action#1922</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.2...v5.5.3">https://github.com/codecov/codecov-action/compare/v5.5.2...v5.5.3</a></p>
<h2>v5.5.2</h2>
<h2>What's Changed</h2>
<ul>
<li>check gpg only when skip-validation = false by <a href="https://github.com/maxweng-sentry"><code>@​maxweng-sentry</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1894">codecov/codecov-action#1894</a></li>
<li>chore: <code>disable_search</code> alignment by <a href="https://github.com/freemanzMrojo"><code>@​freemanzMrojo</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1881">codecov/codecov-action#1881</a></li>
<li>chore(release): 5.5.2 by <a href="https://github.com/thomasrockhu-codecov"><code>@​thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1902">codecov/codecov-action#1902</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/maxweng-sentry"><code>@​maxweng-sentry</code></a> made their first contribution in <a href="https://redirect.github.com/codecov/codecov-action/pull/1894">codecov/codecov-action#1894</a></li>
<li><a href="https://github.com/freemanzMrojo"><code>@​freemanzMrojo</code></a> made their first contribution in <a href="https://redirect.github.com/codecov/codecov-action/pull/1881">codecov/codecov-action#1881</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.1...v5.5.2">https://github.com/codecov/codecov-action/compare/v5.5.1...v5.5.2</a></p>
<h2>v5.5.1</h2>
<h2>What's Changed</h2>
<ul>
<li>build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/codecov/codecov-action/pull/1833">codecov/codecov-action#1833</a></li>
<li>build(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/codecov/codecov-action/pull/1861">codecov/codecov-action#1861</a></li>
<li>Document a <code>codecov-cli</code> version reference example by <a href="https://github.com/webknjaz"><code>@​webknjaz</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1774">codecov/codecov-action#1774</a></li>
<li>docs: fix typo in README by <a href="https://github.com/datalater"><code>@​datalater</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1866">codecov/codecov-action#1866</a></li>
<li>fix: update to use local app/ dir by <a href="https://github.com/thomasrockhu-codecov"><code>@​thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1872">codecov/codecov-action#1872</a></li>
<li>build(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/codecov/codecov-action/pull/1867">codecov/codecov-action#1867</a></li>
<li>build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/codecov/codecov-action/pull/1868">codecov/codecov-action#1868</a></li>
<li>fix: overwrite pr number on fork by <a href="https://github.com/thomasrockhu-codecov"><code>@​thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1871">codecov/codecov-action#1871</a></li>
</ul>

</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md">codecov/codecov-action's changelog</a>.</em></p>
<blockquote>
<h2>v5.5.2</h2>
<h3>What's Changed</h3>
<p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2">https://github.com/codecov/codecov-action/compare/v5.5.1..v5.5.2</a></p>
<h2>v5.5.1</h2>
<h3>What's Changed</h3>
<ul>
<li>fix: overwrite pr number on fork by <a href="https://github.com/thomasrockhu-codecov"><code>@​thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1871">codecov/codecov-action#1871</a></li>
<li>build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by <code>@​app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1868">codecov/codecov-action#1868</a></li>
<li>build(deps): bump github/codeql-action from 3.29.9 to 3.29.11 by <code>@​app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1867">codecov/codecov-action#1867</a></li>
<li>fix: update to use local app/ dir by <a href="https://github.com/thomasrockhu-codecov"><code>@​thomasrockhu-codecov</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1872">codecov/codecov-action#1872</a></li>
<li>docs: fix typo in README by <a href="https://github.com/datalater"><code>@​datalater</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1866">codecov/codecov-action#1866</a></li>
<li>Document a <code>codecov-cli</code> version reference example by <a href="https://github.com/webknjaz"><code>@​webknjaz</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1774">codecov/codecov-action#1774</a></li>
<li>build(deps): bump github/codeql-action from 3.28.18 to 3.29.9 by <code>@​app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1861">codecov/codecov-action#1861</a></li>
<li>build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by <code>@​app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1833">codecov/codecov-action#1833</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1">https://github.com/codecov/codecov-action/compare/v5.5.0..v5.5.1</a></p>
<h2>v5.5.0</h2>
<h3>What's Changed</h3>
<ul>
<li>feat: upgrade wrapper to 0.2.4 by <a href="https://github.com/jviall"><code>@​jviall</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1864">codecov/codecov-action#1864</a></li>
<li>Pin actions/github-script by Git SHA by <a href="https://github.com/martincostello"><code>@​martincostello</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1859">codecov/codecov-action#1859</a></li>
<li>fix: check reqs exist by <a href="https://github.com/joseph-sentry"><code>@​joseph-sentry</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1835">codecov/codecov-action#1835</a></li>
<li>fix: Typo in README by <a href="https://github.com/spalmurray"><code>@​spalmurray</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1838">codecov/codecov-action#1838</a></li>
<li>docs: Refine OIDC docs by <a href="https://github.com/spalmurray"><code>@​spalmurray</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1837">codecov/codecov-action#1837</a></li>
<li>build(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by <code>@​app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1829">codecov/codecov-action#1829</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0">https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0</a></p>
<h2>v5.4.3</h2>
<h3>What's Changed</h3>
<ul>
<li>build(deps): bump github/codeql-action from 3.28.13 to 3.28.17 by <code>@​app/dependabot</code> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1822">codecov/codecov-action#1822</a></li>
<li>fix: OIDC on forks by <a href="https://github.com/joseph-sentry"><code>@​joseph-sentry</code></a> in <a href="https://redirect.github.com/codecov/codecov-action/pull/1823">codecov/codecov-action#1823</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3">https://github.com/codecov/codecov-action/compare/v5.4.2..v5.4.3</a></p>
<h2>v5.4.2</h2>

</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/codecov/codecov-action/commit/57e3a136b779b570ffcdbf80b3bdc90e7fab3de2"><code>57e3a13</code></a> Th/6.0.0 (<a href="https://redirect.github.com/codecov/codecov-action/issues/1928">#1928</a>)</li>
<li><a href="https://github.com/codecov/codecov-action/commit/f67d33dda8a42b51c42a8318a1f66468119e898b"><code>f67d33d</code></a> Revert &quot;Revert &quot;build(deps): bump actions/github-script from 7.0.1 to 8.0.0&quot;&quot;...</li>
<li>See full diff in <a href="https://github.com/codecov/codecov-action/compare/v5...v6">compare view</a></li>
</ul>
</details>
<br />

<details>
<summary>Most Recent Ignore Conditions Applied to This Pull Request</summary>

| Dependency Name | Ignore Conditions |
| --- | --- |
| codecov/codecov-action | [>= 5.a, < 6] |
</details>


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=codecov/codecov-action&package-manager=github_actions&previous-version=5&new-version=6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

**Note:** Dependabot was ignoring updates to this dependency, but since you've updated it yourself we've started tracking it for you again. 🤖

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

…update (#37411)

Bumps the npm_and_yarn group with 1 update in the /packages/@aws-cdk-testing/framework-integ/test/aws-route53-targets/test/integ.elastic-beanstalk-environment-target-assets directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp).
Bumps the npm_and_yarn group with 1 update in the /packages/@aws-cdk-testing/framework-integ/test/aws-route53-targets/test/integ.elastic-beanstalk-environment-target.js.snapshot/asset.fdbbabeab76a41188fbdf182a8c09848a1ea72525524d7bc2c373c6e1eb2c1c4.elastic-beanstalk-environment-target-assets directory: [path-to-regexp](https://github.com/pillarjs/path-to-regexp).

Updates `path-to-regexp` from 0.1.12 to 0.1.13
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/pillarjs/path-to-regexp/releases">path-to-regexp's releases</a>.</em></p>
<blockquote>
<h2>0.1.13</h2>
<h2>Important</h2>
<ul>
<li>Fix <a href="https://www.cve.org/CVERecord?id=CVE-2026-4867">CVE-2026-4867</a> (<a href="https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-37ch-88jc-xwx2">GHSA-37ch-88jc-xwx2</a>)</li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/pillarjs/path-to-regexp/compare/v0.1.12...v.0.1.13">https://github.com/pillarjs/path-to-regexp/compare/v0.1.12...v.0.1.13</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md">path-to-regexp's changelog</a>.</em></p>
<blockquote>
<h1>0.1.13 / 2026-03-26</h1>
<ul>
<li>Fix <a href="https://www.cve.org/CVERecord?id=CVE-2026-4867">CVE-2026-4867</a> (<a href="https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-37ch-88jc-xwx2">GHSA-37ch-88jc-xwx2</a>)</li>
</ul>
<h1>0.1.7 / 2015-07-28</h1>
<ul>
<li>Fixed regression with escaped round brackets and matching groups.</li>
</ul>
<h1>0.1.6 / 2015-06-19</h1>
<ul>
<li>Replace <code>index</code> feature by outputting all parameters, unnamed and named.</li>
</ul>
<h1>0.1.5 / 2015-05-08</h1>
<ul>
<li>Add an index property for position in match result.</li>
</ul>
<h1>0.1.4 / 2015-03-05</h1>
<ul>
<li>Add license information</li>
</ul>
<h1>0.1.3 / 2014-07-06</h1>
<ul>
<li>Better array support</li>
<li>Improved support for trailing slash in non-ending mode</li>
</ul>
<h1>0.1.0 / 2014-03-06</h1>
<ul>
<li>add options.end</li>
</ul>
<h1>0.0.2 / 2013-02-10</h1>
<ul>
<li>Update to match current express</li>
<li>add .license property to component.json</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/pillarjs/path-to-regexp/commit/9fd0c879f232c2464591f56dd7c7edad7f45b4e0"><code>9fd0c87</code></a> 0.1.13 (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/425">#425</a>)</li>
<li><a href="https://github.com/pillarjs/path-to-regexp/commit/7ccf02cee33402f06ed2125085992ee9cd3a7c45"><code>7ccf02c</code></a> fix: CVE-2026-4867</li>
<li>See full diff in <a href="https://github.com/pillarjs/path-to-regexp/compare/v0.1.12...v.0.1.13">compare view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a href="https://www.npmjs.com/~ulisesgascon">ulisesgascon</a>, a new releaser for path-to-regexp since your current version.</p>
</details>
<br />

Updates `path-to-regexp` from 0.1.12 to 0.1.13
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/pillarjs/path-to-regexp/releases">path-to-regexp's releases</a>.</em></p>
<blockquote>
<h2>0.1.13</h2>
<h2>Important</h2>
<ul>
<li>Fix <a href="https://www.cve.org/CVERecord?id=CVE-2026-4867">CVE-2026-4867</a> (<a href="https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-37ch-88jc-xwx2">GHSA-37ch-88jc-xwx2</a>)</li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/pillarjs/path-to-regexp/compare/v0.1.12...v.0.1.13">https://github.com/pillarjs/path-to-regexp/compare/v0.1.12...v.0.1.13</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md">path-to-regexp's changelog</a>.</em></p>
<blockquote>
<h1>0.1.13 / 2026-03-26</h1>
<ul>
<li>Fix <a href="https://www.cve.org/CVERecord?id=CVE-2026-4867">CVE-2026-4867</a> (<a href="https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-37ch-88jc-xwx2">GHSA-37ch-88jc-xwx2</a>)</li>
</ul>
<h1>0.1.7 / 2015-07-28</h1>
<ul>
<li>Fixed regression with escaped round brackets and matching groups.</li>
</ul>
<h1>0.1.6 / 2015-06-19</h1>
<ul>
<li>Replace <code>index</code> feature by outputting all parameters, unnamed and named.</li>
</ul>
<h1>0.1.5 / 2015-05-08</h1>
<ul>
<li>Add an index property for position in match result.</li>
</ul>
<h1>0.1.4 / 2015-03-05</h1>
<ul>
<li>Add license information</li>
</ul>
<h1>0.1.3 / 2014-07-06</h1>
<ul>
<li>Better array support</li>
<li>Improved support for trailing slash in non-ending mode</li>
</ul>
<h1>0.1.0 / 2014-03-06</h1>
<ul>
<li>add options.end</li>
</ul>
<h1>0.0.2 / 2013-02-10</h1>
<ul>
<li>Update to match current express</li>
<li>add .license property to component.json</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/pillarjs/path-to-regexp/commit/9fd0c879f232c2464591f56dd7c7edad7f45b4e0"><code>9fd0c87</code></a> 0.1.13 (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/425">#425</a>)</li>
<li><a href="https://github.com/pillarjs/path-to-regexp/commit/7ccf02cee33402f06ed2125085992ee9cd3a7c45"><code>7ccf02c</code></a> fix: CVE-2026-4867</li>
<li>See full diff in <a href="https://github.com/pillarjs/path-to-regexp/compare/v0.1.12...v.0.1.13">compare view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a href="https://www.npmjs.com/~ulisesgascon">ulisesgascon</a>, a new releaser for path-to-regexp since your current version.</p>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/aws/aws-cdk/network/alerts).

</details>

### Issue

Closes #37387

### Reason for this change

CDK 2.245.0 introduced direct `spawnSync` for local bundling ([9bf4263](9bf4263)). On Windows with Node 22+, `spawnSync npx.cmd` fails with `EINVAL` because Node's spawn implementation on Windows cannot resolve `.cmd` shims through the direct spawn path.

### Description of changes

For `spawn` steps on `win32`, route the command through `powershell.exe -NoProfile -Command` instead of calling the executable directly. Shell steps (`cmd /c`) remain unchanged.

### Description of how you validated changes

- Reproduced the original EINVAL error on a Windows EC2 instance
- Applied the fix and confirmed bundling succeeds as integ tests `aws-lambda-nodejs\test\integ.compilations.ts` and `aws-lambda-nodejs\test\integ.function.ts`
- Added unit tests:
  - `Local bundling on Windows uses powershell for spawn steps` — verifies esbuild invocation goes through powershell with properly escaped args
  - `Local bundling on Windows uses cmd for shell steps` — verifies shell hooks still use `cmd` while spawn steps use powershell

### Checklist

- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)
- [x] Is this fix a breaking change? No

---

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…37415)

Reverts #37285

Closes #37407

Add noisy deprecation warning fix