See [CHANGELOG](https://github.com/aws/aws-cdk/blob/merge-back/1.141.0/CHANGELOG.md)

We recently changed the cfnspec bump to always succeed, and simply
record which specs have been held back because they contain errors.

Except we didn't do it completely right, and now it complains on
every single run about specs that are outdated, instead of only
when the spec actually gets bumped.

Fix that.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Fixes erroneous examples in these modules and turn on strict mode for each.

- cloudformation
- region-info
- elasticloadbalancing
- apigatewayv2
- codestarnotifications
- codestar
- chatbot
- panorama
- rekognition
- efs
- lambda-layer-node-proxy-agent
- dynamodb-global
- amplify
- cloudwatch-actions
- app-delivery

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

I wrote a script that turns on strict mode everywhere (didn't do this by hand :) ). Hopefully this is the direction that we want to go down.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

… of DetectorModel (#18644)

This PR is about #17711 (but out of the roadmap).
This PR (especially `key` property) make it easier to test the features we will implement.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

We implemented TagOptions as a full construct, and created its own unit test suite. We are moving
some of the basic validation tests out of the other resources unit tests, and then the cross resource association
tests as well.  The only TagOption tests that remain in portfolio/product are for testing the association and adding
as a prop, validation and multi resource tests will be in the `tag-option` test suite.

The removed validation tests are already in the `tag-option` test suite. 

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

The autolabeler will now do different things depending on how the issue comes in. If it's guidance, it's automatically assigned to OSDS. If it's a PR, the autolabeler will not continue to work if the PR has `contribution/core`. For issues, the autolabeler will not continue to work on the issue if `needs-triage` is removed.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Co-authored-by: AWS CDK Team <aws-cdk@amazon.com>

…pOriginProps` (#18697)

This pull request extends the maximum value of the `readTimeout` property for `HttpOriginProps` up to 180 seconds. This allows the use of the construct also in the case that a limit increase has been approved for CloudFront [origin request timeout quota](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cloudfront-limits.html#limits-web-distributions).

The 180 seconds cap should be AWS hard limit for that quota.

Closes #18628

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…18635)

While using the Python Lambda with Code Artifact, discovered that Code Artifact was still inaccessible because bundling occurs at _run_ time, which can only access env vars, not build args.

This is not a security issue because bundled output doesn't contain any of the secret values.

**Note:** Without this, using Code Artifact (or any other private packaging for Python Lambdas) is currently broken.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

…8062)

Revamped the logic of running `tsc`, previously we were running `tsc` once for the whole project and due to this logic, `tsc` was not running as on the first run as `createBundlingCommand` first prepare command to execute on Docker and then for local bundling and on the first run we already updated the flag to not run `tsc` now.

Closes [#18002](#18002)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

A dependency cycle was inadvertently introduced to CDK Pipelines in #18492.

Fix that dependency cycle, and also one in Cognito IdentityPools.

Add facilities to the `assertions` library to automatically detect this in the future,
to stop errors like this from slipping in.

We could make it a separate assertion method
(`Template.fromStack().assertNoCycles()`), but the only thing that will
do is give you an opportunity to forget to put the test in.

Instead, we just check it by default for every generated template.

Fixes #18673.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Publishing our internal migration script written by @rix0rrr for others to benefit.

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Fixes #4159

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

`Pillow` is an image processing library that we don't need at all,
but our tests use.

It has a high priority CVE reported against it.

Since we don't actually need it, away it goes.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

The version of PyYAML that comes wit the AWS CLI we use has
a CVE reported against it: CVE-2020-14343

Upgrade to a version of AWS CLI that has PyYAML >= 5.4.


----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*