diff --git a/CHANGELOG.v2.alpha.md b/CHANGELOG.v2.alpha.md
index b78410095bcc4..b9f9d8ea565f9 100644
--- a/CHANGELOG.v2.alpha.md
+++ b/CHANGELOG.v2.alpha.md
@@ -2,6 +2,18 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.176.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.175.1-alpha.0...v2.176.0-alpha.0) (2025-01-15)
+
+
+### Features
+
+* **scheduler-targets:** add support for universal target ([#32341](https://github.com/aws/aws-cdk/issues/32341)) ([021e6d6](https://github.com/aws/aws-cdk/commit/021e6d6ca6c01ecece485f7a51620fd42e632f0b)), closes [#32328](https://github.com/aws/aws-cdk/issues/32328)
+
+
+### Bug Fixes
+
+* **msk:** clusterName validation in Cluster class is incorrect ([#32792](https://github.com/aws/aws-cdk/issues/32792)) ([41ddd46](https://github.com/aws/aws-cdk/commit/41ddd46dc17e0afd551cce2737ecc11ed343de04)), closes [/github.com/aws/aws-cdk/pull/32505#discussion_r1891027876](https://github.com/aws//github.com/aws/aws-cdk/pull/32505/issues/discussion_r1891027876)
+
 ## [2.175.1-alpha.0](https://github.com/aws/aws-cdk/compare/v2.175.0-alpha.0...v2.175.1-alpha.0) (2025-01-10)
 
 ## [2.175.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.174.1-alpha.0...v2.175.0-alpha.0) (2025-01-09)
diff --git a/CHANGELOG.v2.md b/CHANGELOG.v2.md
index 04cf6618a5414..6d654aea7ad03 100644
--- a/CHANGELOG.v2.md
+++ b/CHANGELOG.v2.md
@@ -2,6 +2,31 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.176.0](https://github.com/aws/aws-cdk/compare/v2.175.1...v2.176.0) (2025-01-15)
+
+
+### Features
+
+* **apigatewayv2-integrations:** `WebSocketMockIntegration` props ([#30622](https://github.com/aws/aws-cdk/issues/30622)) ([a5a0168](https://github.com/aws/aws-cdk/commit/a5a0168cdf0f6a3429d67cb8d300d3a3f987d0fe)), closes [#29661](https://github.com/aws/aws-cdk/issues/29661)
+* **codebuild:** add new BuildImages ([#32525](https://github.com/aws/aws-cdk/issues/32525)) ([a734841](https://github.com/aws/aws-cdk/commit/a73484142ce78dbf0a63ef5bfdb9603062916399))
+* **ecs:** enable Enhanced Observability for Container Insights ([#32622](https://github.com/aws/aws-cdk/issues/32622)) ([79ab137](https://github.com/aws/aws-cdk/commit/79ab137aa07337972d1da459db9b1a698a2d4513)), closes [#32618](https://github.com/aws/aws-cdk/issues/32618)
+* update L1 CloudFormation resource definitions ([#32847](https://github.com/aws/aws-cdk/issues/32847)) ([9317203](https://github.com/aws/aws-cdk/commit/93172033e4a8346a86ee00017acba57b57f22aab))
+* **appconfig:** environment deletion protection  ([#32737](https://github.com/aws/aws-cdk/issues/32737)) ([393e5c0](https://github.com/aws/aws-cdk/commit/393e5c0058560ff10acdc2892cc40ad542dc1629))
+
+
+### Bug Fixes
+
+* **cli:** "no stack found in the main cloud assembly" ([#32839](https://github.com/aws/aws-cdk/issues/32839)) ([3c0acce](https://github.com/aws/aws-cdk/commit/3c0acce39c6179ed18cc14d33622c69a4978ec97)), closes [aws/aws-cdk#32636](https://github.com/aws/aws-cdk/issues/32636) [#32836](https://github.com/aws/aws-cdk/issues/32836) [#32836](https://github.com/aws/aws-cdk/issues/32836)
+* **core:** use correct formatting for aggregate errors in `aws-cdk` ([#32817](https://github.com/aws/aws-cdk/issues/32817)) ([97af31b](https://github.com/aws/aws-cdk/commit/97af31b4562506570632c79bde79c0aaee31826a)), closes [#32237](https://github.com/aws/aws-cdk/issues/32237)
+* **elasticloadbalancingv2:** open, dual-stack-without-public-ipv4 ALB does not allow IPv6 inbound traffic (under feature flag) ([#32765](https://github.com/aws/aws-cdk/issues/32765)) ([aff160b](https://github.com/aws/aws-cdk/commit/aff160b62a067bcd89feb97e020287e614e39111)), closes [#32197](https://github.com/aws/aws-cdk/issues/32197)
+* **rds:** clusterScailabilityType is spelled wrong and should be clusterScalabilityType ([#32825](https://github.com/aws/aws-cdk/issues/32825)) ([d39e835](https://github.com/aws/aws-cdk/commit/d39e8356643ab89fec791df725af4ad8f0bbaecd)), closes [#32415](https://github.com/aws/aws-cdk/issues/32415) [#32415](https://github.com/aws/aws-cdk/issues/32415)
+* **rds:** incorrect version definition of MySQL 8.4.3 ([#32934](https://github.com/aws/aws-cdk/issues/32934)) ([3fbc785](https://github.com/aws/aws-cdk/commit/3fbc785522e25deb1a1167f2f655235ae3f2e762)), closes [#32933](https://github.com/aws/aws-cdk/issues/32933)
+
+
+### Reverts
+
+* **prlint:** fail prlinter on codecov failures, with exemption label ([#32867](https://github.com/aws/aws-cdk/issues/32867)) ([928d3bb](https://github.com/aws/aws-cdk/commit/928d3bb05da1be25159c58cb4f8b13c44a258ba1)), closes [aws/aws-cdk#32674](https://github.com/aws/aws-cdk/issues/32674)
+
 ## [2.175.1](https://github.com/aws/aws-cdk/compare/v2.175.0...v2.175.1) (2025-01-10)
 
 ### Bug Fixes
diff --git a/packages/aws-cdk-lib/cx-api/FEATURE_FLAGS.md b/packages/aws-cdk-lib/cx-api/FEATURE_FLAGS.md
index df822c4f90c1f..c49d1f761ecf6 100644
--- a/packages/aws-cdk-lib/cx-api/FEATURE_FLAGS.md
+++ b/packages/aws-cdk-lib/cx-api/FEATURE_FLAGS.md
@@ -84,9 +84,9 @@ Flags come in three types:
 | [@aws-cdk/aws-ec2:bastionHostUseAmazonLinux2023ByDefault](#aws-cdkaws-ec2bastionhostuseamazonlinux2023bydefault) | When enabled, the BastionHost construct will use the latest Amazon Linux 2023 AMI, instead of Amazon Linux 2. | 2.172.0 | (default) |
 | [@aws-cdk/core:aspectStabilization](#aws-cdkcoreaspectstabilization) | When enabled, a stabilization loop will be run when invoking Aspects during synthesis. | 2.172.0 | (config) |
 | [@aws-cdk/aws-route53-targets:userPoolDomainNameMethodWithoutCustomResource](#aws-cdkaws-route53-targetsuserpooldomainnamemethodwithoutcustomresource) | When enabled, use a new method for DNS Name of user pool domain target without creating a custom resource. | 2.174.0 | (fix) |
-| [@aws-cdk/aws-ecs:disableEcsImdsBlocking](#aws-cdkaws-ecsdisableecsimdsblocking) | When set to true, CDK synth will throw exception if canContainersAccessInstanceRole is false. **IMPORTANT: See [details.](#aws-cdkaws-ecsdisableEcsImdsBlocking)** | V2NEXT | (temporary) |
-| [@aws-cdk/aws-ecs:enableImdsBlockingDeprecatedFeature](#aws-cdkaws-ecsenableimdsblockingdeprecatedfeature) | When set to true along with canContainersAccessInstanceRole=false in ECS cluster, new updated commands will be added to UserData to block container accessing IMDS. **Applicable to Linux only. IMPORTANT: See [details.](#aws-cdkaws-ecsenableImdsBlockingDeprecatedFeature)** | V2NEXT | (temporary) |
-| [@aws-cdk/aws-elasticloadbalancingV2:albDualstackWithoutPublicIpv4SecurityGroupRulesDefault](#aws-cdkaws-elasticloadbalancingv2albdualstackwithoutpublicipv4securitygrouprulesdefault) | When enabled, the default security group ingress rules will allow IPv6 ingress from anywhere | V2NEXT | (fix) |
+| [@aws-cdk/aws-ecs:disableEcsImdsBlocking](#aws-cdkaws-ecsdisableecsimdsblocking) | When set to true, CDK synth will throw exception if canContainersAccessInstanceRole is false. **IMPORTANT: See [details.](#aws-cdkaws-ecsdisableEcsImdsBlocking)** | 2.175.0 | (temporary) |
+| [@aws-cdk/aws-ecs:enableImdsBlockingDeprecatedFeature](#aws-cdkaws-ecsenableimdsblockingdeprecatedfeature) | When set to true along with canContainersAccessInstanceRole=false in ECS cluster, new updated commands will be added to UserData to block container accessing IMDS. **Applicable to Linux only. IMPORTANT: See [details.](#aws-cdkaws-ecsenableImdsBlockingDeprecatedFeature)** | 2.175.0 | (temporary) |
+| [@aws-cdk/aws-elasticloadbalancingV2:albDualstackWithoutPublicIpv4SecurityGroupRulesDefault](#aws-cdkaws-elasticloadbalancingv2albdualstackwithoutpublicipv4securitygrouprulesdefault) | When enabled, the default security group ingress rules will allow IPv6 ingress from anywhere | 2.176.0 | (fix) |
 
 <!-- END table -->
 
@@ -240,6 +240,7 @@ different environments). This means that the name of the synthesized template
 file will be based on the construct path and not on the defined `stackName`
 of the stack.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | 1.16.0 | `false` | `true` |
@@ -247,6 +248,7 @@ of the stack.
 
 **Compatibility with old behavior:** Pass stack identifiers to the CLI instead of stack names.
 
+
 ### aws-cdk:enableDiffNoFail
 
 *Make `cdk diff` not fail when there are differences* (default)
@@ -254,13 +256,14 @@ of the stack.
 Determines what status code `cdk diff` should return when the specified stack
 differs from the deployed stack or the local CloudFormation template:
 
-- `aws-cdk:enableDiffNoFail=true` => status code == 0
-- `aws-cdk:enableDiffNoFail=false` => status code == 1
+* `aws-cdk:enableDiffNoFail=true` => status code == 0
+* `aws-cdk:enableDiffNoFail=false` => status code == 1
 
 You can override this behavior with the --fail flag:
 
-- `--fail` => status code == 1
-- `--no-fail` => status code == 0
+* `--fail` => status code == 1
+* `--no-fail` => status code == 0
+
 
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
@@ -269,6 +272,7 @@ You can override this behavior with the --fail flag:
 
 **Compatibility with old behavior:** Specify `--fail` to the CLI.
 
+
 ### @aws-cdk/aws-ecr-assets:dockerIgnoreSupport
 
 *DockerImageAsset properly supports `.dockerignore` files by default* (default)
@@ -280,6 +284,7 @@ is standard Docker ignore semantics.
 This is a feature flag as the old behavior was technically incorrect but
 users may have come to depend on it.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | 1.73.0 | `false` | `true` |
@@ -287,6 +292,7 @@ users may have come to depend on it.
 
 **Compatibility with old behavior:** Update your `.dockerignore` file to match standard Docker ignore rules, if necessary.
 
+
 ### @aws-cdk/aws-secretsmanager:parseOwnedSecretName
 
 *Fix the referencing of SecretsManager names from ARNs* (default)
@@ -297,6 +303,7 @@ rather than the default full resource name, which includes the SecretsManager su
 If this flag is not set, Secret.secretName will include the SecretsManager suffix, which cannot be directly
 used by SecretsManager.DescribeSecret, and must be parsed by the user first (e.g., Fn:Join, Fn:Select, Fn:Split).
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | 1.77.0 | `false` | `true` |
@@ -304,6 +311,7 @@ used by SecretsManager.DescribeSecret, and must be parsed by the user first (e.g
 
 **Compatibility with old behavior:** Use `parseArn(secret.secretName).resourceName` to emulate the incorrect old parsing.
 
+
 ### @aws-cdk/aws-kms:defaultKeyPolicies
 
 *Tighten default KMS key policies* (default)
@@ -320,6 +328,7 @@ true, the policy matches what happens when this feature flag is set.
 Additionally, if this flag is not set and the user supplies a custom key policy, this will be appended
 to the key's default policy (rather than replacing it).
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | 1.78.0 | `false` | `true` |
@@ -327,6 +336,7 @@ to the key's default policy (rather than replacing it).
 
 **Compatibility with old behavior:** Pass `trustAccountIdentities: false` to `Key` construct to restore the old behavior.
 
+
 ### @aws-cdk/aws-s3:grantWriteWithoutAcl
 
 *Remove `PutObjectAcl` from Bucket.grantWrite* (default)
@@ -337,6 +347,7 @@ which could be used to grant read/write object access to IAM principals in other
 Use a feature flag to make sure existing customers who might be relying
 on the overly-broad permissions are not broken.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | 1.85.0 | `false` | `true` |
@@ -344,6 +355,7 @@ on the overly-broad permissions are not broken.
 
 **Compatibility with old behavior:** Call `bucket.grantPutAcl()` in addition to `bucket.grantWrite()` to grant ACL permissions.
 
+
 ### @aws-cdk/aws-ecs-patterns:removeDefaultDesiredCount
 
 *Do not specify a default DesiredCount for ECS services* (default)
@@ -358,6 +370,7 @@ If this flag is not set, the default behaviour for CfnService.desiredCount is to
 desiredCount of 1, if one is not provided. If true, a default will not be defined for
 CfnService.desiredCount and as such desiredCount will be undefined, if one is not provided.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | 1.92.0 | `false` | `true` |
@@ -365,12 +378,14 @@ CfnService.desiredCount and as such desiredCount will be undefined, if one is no
 
 **Compatibility with old behavior:** You can pass `desiredCount: 1` explicitly, but you should never need this.
 
+
 ### @aws-cdk/aws-efs:defaultEncryptionAtRest
 
 *Enable this feature flag to have elastic file systems encrypted at rest by default.* (default)
 
 Encryption can also be configured explicitly using the `encrypted` property.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | 1.98.0 | `false` | `true` |
@@ -378,6 +393,7 @@ Encryption can also be configured explicitly using the `encrypted` property.
 
 **Compatibility with old behavior:** Pass the `encrypted: false` property to the `FileSystem` construct to disable encryption.
 
+
 ### @aws-cdk/core:newStyleStackSynthesis
 
 *Switch to new stack synthesis method which enables CI/CD* (fix)
@@ -385,11 +401,13 @@ Encryption can also be configured explicitly using the `encrypted` property.
 If this flag is specified, all `Stack`s will use the `DefaultStackSynthesizer` by
 default. If it is not set, they will use the `LegacyStackSynthesizer`.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | 1.39.0 | `false` | `true` |
 | 2.0.0 | `true` | `true` |
 
+
 ### @aws-cdk/core:stackRelativeExports
 
 *Name exports based on the construct paths relative to the stack, rather than the global construct path* (fix)
@@ -399,11 +417,13 @@ ensure uniqueness, and makes the export names robust against refactoring
 the location of the stack in the construct tree (specifically, moving the Stack
 into a Stage).
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | 1.58.0 | `false` | `true` |
 | 2.0.0 | `true` | `true` |
 
+
 ### @aws-cdk/aws-rds:lowercaseDbIdentifier
 
 *Force lowercasing of RDS Cluster names in CDK* (fix)
@@ -418,11 +438,13 @@ Must be behind a permanent flag because changing a name from mixed case to lower
 would lead CloudFormation to think the name was changed and would trigger a cluster replacement
 (losing data!).
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | 1.97.0 | `false` | `true` |
 | 2.0.0 | `true` | `true` |
 
+
 ### @aws-cdk/aws-apigateway:usagePlanKeyOrderInsensitiveId
 
 *Allow adding/removing multiple UsagePlanKeys independently* (fix)
@@ -440,11 +462,13 @@ which again is disallowed.
 In effect, there is no way to get out of this mess in a backwards compatible way, while supporting existing stacks.
 This flag changes the logical id layout of UsagePlanKey to not be sensitive to order.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | 1.98.0 | `false` | `true` |
 | 2.0.0 | `true` | `true` |
 
+
 ### @aws-cdk/aws-lambda:recognizeVersionProps
 
 *Enable this feature flag to opt in to the updated logical id calculation for Lambda Version created using the  `fn.currentVersion`.* (fix)
@@ -454,22 +478,26 @@ not constitute creating a new Version.
 
 See 'currentVersion' section in the aws-lambda module's README for more details.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | 1.106.0 | `false` | `true` |
 | 2.0.0 | `true` | `true` |
 
+
 ### @aws-cdk/aws-cloudfront:defaultSecurityPolicyTLSv1.2_2021
 
 *Enable this feature flag to have cloudfront distributions use the security policy TLSv1.2_2021 by default.* (fix)
 
 The security policy can also be configured explicitly using the `minimumProtocolVersion` property.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | 1.117.0 | `false` | `true` |
 | 2.0.0 | `true` | `true` |
 
+
 ### @aws-cdk/core:target-partitions
 
 *What regions to include in lookup tables of environment agnostic stacks* (config)
@@ -479,11 +507,13 @@ of unnecessary regions included in stacks without a known region.
 
 The type of this value should be a list of strings.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | 1.137.0 | `false` | `["aws","aws-cn"]` |
 | 2.4.0 | `false` | `["aws","aws-cn"]` |
 
+
 ### @aws-cdk-containers/ecs-service-extensions:enableDefaultLogDriver
 
 *ECS extensions will automatically add an `awslogs` driver if no logging is specified* (default)
@@ -493,6 +523,7 @@ Enable this feature flag to configure default logging behavior for the ECS Servi
 
 This is a feature flag as the new behavior provides a better default experience for the users.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | 1.140.0 | `false` | `true` |
@@ -500,6 +531,7 @@ This is a feature flag as the new behavior provides a better default experience
 
 **Compatibility with old behavior:** Specify a log driver explicitly.
 
+
 ### @aws-cdk/aws-ec2:uniqueImdsv2TemplateName
 
 *Enable this feature flag to have Launch Templates generated by the `InstanceRequireImdsv2Aspect` use unique names.* (fix)
@@ -510,11 +542,13 @@ account and region, the deployments would always fail as the generated Launch Te
 
 The new implementation addresses this issue by generating the Launch Template name with the `Names.uniqueId` method.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | 1.140.0 | `false` | `true` |
 | 2.8.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-iam:minimizePolicies
 
 *Minimize IAM policies by combining Statements* (config)
@@ -523,11 +557,13 @@ Minimize IAM policies by combining Principals, Actions and Resources of two
 Statements in the policies, as long as it doesn't change the meaning of the
 policy.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | 1.150.0 | `false` | `true` |
 | 2.18.0 | `false` | `true` |
 
+
 ### @aws-cdk/core:checkSecretUsage
 
 *Enable this flag to make it impossible to accidentally use SecretValues in unsafe locations* (config)
@@ -536,11 +572,13 @@ With this flag enabled, `SecretValue` instances can only be passed to
 constructs that accept `SecretValue`s; otherwise, `unsafeUnwrap()` must be
 called to use it as a regular string.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | 1.153.0 | `false` | `true` |
 | 2.21.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-lambda:recognizeLayerVersion
 
 *Enable this feature flag to opt in to the updated logical id calculation for Lambda Version created using the `fn.currentVersion`.* (fix)
@@ -549,11 +587,13 @@ This flag correct incorporates Lambda Layer properties into the Lambda Function
 
 See 'currentVersion' section in the aws-lambda module's README for more details.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | 1.159.0 | `false` | `true` |
 | 2.27.0 | `false` | `true` |
 
+
 ### @aws-cdk/core:validateSnapshotRemovalPolicy
 
 *Error on snapshot removal policies on resources that do not support it.* (default)
@@ -563,6 +603,7 @@ If supplied on an unsupported resource, CloudFormation ignores the policy altoge
 This flag will reduce confusion and unexpected loss of data when erroneously supplying
 the snapshot removal policy.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
@@ -570,6 +611,7 @@ the snapshot removal policy.
 
 **Compatibility with old behavior:** The old behavior was incorrect. Update your source to not specify SNAPSHOT policies on resources that do not support it.
 
+
 ### @aws-cdk/aws-codepipeline:crossAccountKeyAliasStackSafeResourceName
 
 *Generate key aliases that include the stack name* (fix)
@@ -581,11 +623,13 @@ the KMS key alias name created for these pipelines may be the same due to how th
 
 This new implementation creates a stack safe resource name for the alias using the stack name instead of the stack ID.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.29.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-s3:createDefaultLoggingPolicy
 
 *Enable this feature flag to create an S3 bucket policy by default in cases where an AWS service would automatically create the Policy if one does not exist.* (fix)
@@ -599,13 +643,15 @@ and error indicating that a bucket policy already exists.
 In cases where we know what the required policy is we can go ahead and create the policy so we can
 remain in control of it.
 
-@see <https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html#AWS-logs-infrastructure-S3>
+@see https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html#AWS-logs-infrastructure-S3
+
 
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.31.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-sns-subscriptions:restrictSqsDescryption
 
 *Restrict KMS key policy for encrypted Queues a bit more* (fix)
@@ -617,11 +663,13 @@ Previously the decryption was only restricted to the SNS service principal. To m
 secure, it is a good practice to restrict the decryption further and only allow the connected SNS topic to decryption
 the subscribed queue.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.32.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-ecs:arnFormatIncludesClusterName
 
 *ARN format used by ECS. In the new ARN format, the cluster name is part of the resource ID.* (fix)
@@ -631,31 +679,35 @@ If this flag is set, the new ARN format (with cluster name) for ECS is used.
 
 This is a feature flag as the old format is still valid for existing ECS clusters.
 
-See <https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-account-settings.html#ecs-resource-ids>
+See https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-account-settings.html#ecs-resource-ids
+
 
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.35.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-apigateway:disableCloudWatchRole
 
 *Make default CloudWatch Role behavior safe for multiple API Gateways in one environment* (fix)
 
 Enable this feature flag to change the default behavior for aws-apigateway.RestApi and aws-apigateway.SpecRestApi
-to *not* create a CloudWatch role and Account. There is only a single ApiGateway account per AWS
+to _not_ create a CloudWatch role and Account. There is only a single ApiGateway account per AWS
 environment which means that each time you create a RestApi in your account the ApiGateway account
 is overwritten. If at some point the newest RestApi is deleted, the ApiGateway Account and CloudWatch
 role will also be deleted, breaking any existing ApiGateways that were depending on them.
 
 When this flag is enabled you should either create the ApiGateway account and CloudWatch role
-separately *or* only enable the cloudWatchRole on a single RestApi.
+separately _or_ only enable the cloudWatchRole on a single RestApi.
+
 
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.38.0 | `false` | `true` |
 
+
 ### @aws-cdk/core:enablePartitionLiterals
 
 *Make ARNs concrete if AWS partition is known* (fix)
@@ -684,11 +736,13 @@ Principal:
 The intrinsic function will still be used in Stacks where no region is defined or the region's partition
 is unknown.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.38.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreaker
 
 *Avoid setting the "ECS" deployment controller when adding a circuit breaker* (fix)
@@ -699,11 +753,13 @@ This does not change any behaviour as the default deployment controller when it
 
 This is a feature flag as the new behavior provides a better default experience for the users.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.51.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-events:eventsTargetQueueSameAccount
 
 *Event Rules may only push to encrypted SQS queues in the same account* (fix)
@@ -712,11 +768,13 @@ This flag applies to SQS Queues that are used as the target of event Rules. When
 from the same account as the Rule can send messages. If a queue is unencrypted, this restriction will
 always apply, regardless of the value of this flag.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.51.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName
 
 *Enable this feature to by default create default policy names for imported roles that depend on the stack the role is in.* (fix)
@@ -727,11 +785,13 @@ of a role using the same default policy name.
 
 This new implementation creates default policy names based on the constructs node path in their stack.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.60.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy
 
 *Use S3 Bucket Policy instead of ACLs for Server Access Logging* (fix)
@@ -743,13 +803,15 @@ enabled on the bucket.
 This flag uses a Bucket Policy statement to allow Server Access Log delivery, following best
 practices for S3.
 
-@see <https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html>
+@see https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-server-access-logging.html
+
 
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.60.0 | `false` | `true` |
 
+
 ### @aws-cdk/customresources:installLatestAwsSdkDefault
 
 *Whether to install the latest SDK by default in AwsCustomResource* (default)
@@ -761,6 +823,7 @@ do not have internet access, or in environments where 'npmjs.com' is not availab
 The recommended setting is to disable the default installation behavior, and pass the
 flag on a resource-by-resource basis to enable it if necessary.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
@@ -768,6 +831,7 @@ flag on a resource-by-resource basis to enable it if necessary.
 
 **Compatibility with old behavior:** Set installLatestAwsSdk: true on all resources that need it.
 
+
 ### @aws-cdk/aws-route53-patters:useCertificate
 
 *Use the official `Certificate` resource instead of `DnsValidatedCertificate`* (default)
@@ -777,6 +841,7 @@ of the deprecated `DnsValidatedCertificate` construct. If this flag is enabled a
 the stack in a region other than us-east-1 then you must also set `crossRegionReferences=true` on the
 stack.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
@@ -784,6 +849,7 @@ stack.
 
 **Compatibility with old behavior:** Define a `DnsValidatedCertificate` explicitly and pass in the `certificate` property
 
+
 ### @aws-cdk/aws-codedeploy:removeAlarmsFromDeploymentGroup
 
 *Remove CloudWatch alarms from deployment group* (fix)
@@ -792,11 +858,13 @@ Enable this flag to be able to remove all CloudWatch alarms from a deployment gr
 the alarms from the construct. If this flag is not set, removing all alarms from the construct
 will still leave the alarms configured for the deployment group.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.65.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-rds:databaseProxyUniqueResourceName
 
 *Use unique resource name for Database Proxy* (fix)
@@ -809,11 +877,13 @@ If this flag is set, the default behavior is to use unique resource names for ea
 
 This is a feature flag as the old behavior was technically incorrect, but users may have come to depend on it.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.65.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-apigateway:authorizerChangeDeploymentLogicalId
 
 *Include authorizer configuration in the calculation of the API deployment logical ID.* (fix)
@@ -823,11 +893,13 @@ the API configuration, including methods, and resources, etc. Enable this featur
 to also include the configuration of any authorizer attached to the API in the
 calculation, so any changes made to an authorizer will create a new deployment.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.66.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-ec2:launchTemplateDefaultUserData
 
 *Define user data for a launch template by default when a machine image is provided.* (fix)
@@ -836,11 +908,13 @@ The ec2.LaunchTemplate construct did not define user data when a machine image i
 provided despite the document. If this is set, a user data is automatically defined
 according to the OS of the machine image.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.67.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-secretsmanager:useAttachedSecretResourcePolicyForSecretTargetAttachments
 
 *SecretTargetAttachments uses the ResourcePolicy of the attached Secret.* (fix)
@@ -856,11 +930,13 @@ This won't be possible without intervention due to limitation outlined above.
 First remove all permissions granted to the Secret and deploy without the ResourcePolicies.
 Then you can re-add the permissions and deploy again.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.67.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-redshift:columnId
 
 *Whether to use an ID to track Redshift column changes* (fix)
@@ -877,11 +953,13 @@ than their `name`. This will prevent data loss when columns are renamed.
 initial deployment, the columns will be dropped and recreated, causing data loss. After the initial deployment
 of the `id`s, the `name`s of the columns can be changed without data loss.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.68.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-stepfunctions-tasks:enableEmrServicePolicyV2
 
 *Enable AmazonEMRServicePolicy_v2 managed policies* (fix)
@@ -895,11 +973,13 @@ managed policies.
 This is a feature flag as the old behavior will be deprecated, but some resources may require manual
 intervention since they might not have the appropriate tags propagated automatically.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.72.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-apigateway:requestValidatorUniqueId
 
 *Generate a unique id for each RequestValidator added to a method* (fix)
@@ -910,11 +990,13 @@ providing the `RequestValidatorOptions` in the `addMethod()` method.
 If the flag is not set then only a single RequestValidator can be added in this way.
 Any additional RequestValidators have to be created directly with `new RequestValidator`.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.78.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-ec2:restrictDefaultSecurityGroup
 
 *Restrict access to the VPC default security group* (default)
@@ -924,17 +1006,20 @@ VPC default security group.
 
 When a VPC is created, a default security group is created as well and this cannot
 be deleted. The default security group is created with ingress/egress rules that allow
-*all* traffic. [AWS Security best practices recommend](https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-2)
+_all_ traffic. [AWS Security best practices recommend](https://docs.aws.amazon.com/securityhub/latest/userguide/ec2-controls.html#ec2-2)
 removing these ingress/egress rules in order to restrict access to the default security group.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.78.0 | `false` | `true` |
 
-**Compatibility with old behavior:**
+**Compatibility with old behavior:** 
       To allow all ingress/egress traffic to the VPC default security group you
       can set the `restrictDefaultSecurityGroup: false`.
+    
+
 
 ### @aws-cdk/aws-kms:aliasNameRef
 
@@ -946,11 +1031,13 @@ when referencing key.aliasName or key.keyArn.
 If the flag is not set then a raw string is passed as the Alias name and no
 implicit dependencies will be set.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.83.0 | `false` | `true` |
 
+
 ### @aws-cdk/core:includePrefixInUniqueNameGeneration
 
 *Include the stack prefix in the stack name generation process* (fix)
@@ -964,11 +1051,13 @@ If the flag is not set, then the prefix of the stack is prepended to the generat
 feature flag can lead to a change in stacks' name. Changing a stack name mean recreating the whole stack, which
 is not viable in some productive setups.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.84.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-autoscaling:generateLaunchTemplateInsteadOfLaunchConfig
 
 *Generate a launch template when creating an AutoScalingGroup* (fix)
@@ -981,14 +1070,17 @@ will now create an equivalent 'launchTemplate'. Alternatively, users can provide
 attempt to set user data according to the OS of the machine image if explicit user data is not
 provided.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.88.0 | `false` | `true` |
 
-**Compatibility with old behavior:**
+**Compatibility with old behavior:** 
       If backwards compatibility needs to be maintained due to an existing autoscaling group
       using a launch config, set this flag to false.
+    
+
 
 ### @aws-cdk/aws-opensearchservice:enableOpensearchMultiAzWithStandby
 
@@ -997,6 +1089,7 @@ provided.
 If this is set, an opensearch domain will automatically be created with
 multi-az with standby enabled.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
@@ -1004,6 +1097,7 @@ multi-az with standby enabled.
 
 **Compatibility with old behavior:** Pass `capacity.multiAzWithStandbyEnabled: false` to `Domain` construct to restore the old behavior.
 
+
 ### @aws-cdk/aws-efs:denyAnonymousAccess
 
 *EFS denies anonymous clients accesses* (default)
@@ -1014,6 +1108,7 @@ access to `efs.FileSystem`.
 If this flag is not set, `efs.FileSystem` will allow all anonymous clients
 that can access over the network.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
@@ -1021,6 +1116,7 @@ that can access over the network.
 
 **Compatibility with old behavior:** You can pass `allowAnonymousAccess: true` so allow anonymous clients access.
 
+
 ### @aws-cdk/aws-efs:mountTargetOrderInsensitiveLogicalId
 
 *When enabled, mount targets will have a stable logicalId that is linked to the associated subnet.* (fix)
@@ -1032,11 +1128,13 @@ subnets changes.
 
 Set this flag to false for existing mount targets.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.93.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-lambda-nodejs:useLatestRuntimeVersion
 
 *Enables aws-lambda-nodejs.Function to use the latest available NodeJs runtime as the default* (default)
@@ -1046,6 +1144,7 @@ functions will us the latest version of the runtime provided by the Lambda
 service. Do not use this if you your lambda function is reliant on dependencies
 shipped as part of the runtime environment.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
@@ -1053,6 +1152,7 @@ shipped as part of the runtime environment.
 
 **Compatibility with old behavior:** Pass `runtime: lambda.Runtime.NODEJS_16_X` to `Function` construct to restore the previous behavior.
 
+
 ### @aws-cdk/aws-appsync:useArnForSourceApiAssociationIdentifier
 
 *When enabled, will always use the arn for identifiers for CfnSourceApiAssociation in the GraphqlApi construct rather than id.* (fix)
@@ -1061,11 +1161,13 @@ When this feature flag is enabled, we use the IGraphqlApi ARN rather than ID whe
 the GraphqlApi construct. Using the ARN allows the association to support an association with a source api or merged api in another account.
 Note that for existing source api associations created with this flag disabled, enabling the flag will lead to a resource replacement.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.97.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-rds:auroraClusterChangeScopeOfInstanceParameterGroupWithEachParameters
 
 *When enabled, a scope of InstanceParameterGroup for AuroraClusterInstance with each parameters will change.* (fix)
@@ -1077,11 +1179,13 @@ from AuroraCluster.
 If the flag is set to false then it can only make one `AuroraClusterInstance`
 with each `InstanceParameterGroup` in the AuroraCluster.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.97.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-rds:preventRenderingDeprecatedCredentials
 
 *When enabled, creating an RDS database cluster from a snapshot will only render credentials for snapshot credentials.* (fix)
@@ -1099,11 +1203,13 @@ Set this flag to prevent rendering deprecated `credentials` and creating an
 extra database secret when only using `snapshotCredentials` to create an RDS
 database cluster from a snapshot.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.98.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-codepipeline-actions:useNewDefaultBranchForCodeCommitSource
 
 *When enabled, the CodeCommit source action is using the default branch name 'main'.* (fix)
@@ -1112,11 +1218,13 @@ When setting up a CodeCommit source action for the source stage of a pipeline, p
 default branch is 'master'.
 However, with the activation of this feature flag, the default branch is updated to 'main'.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.103.1 | `false` | `true` |
 
+
 ### @aws-cdk/aws-cloudwatch-actions:changeLambdaPermissionLogicalIdForLambdaAction
 
 *When enabled, the logical ID of a Lambda permission for a Lambda action includes an alarm ID.* (fix)
@@ -1128,11 +1236,13 @@ can be created with `LambdaAction`.
 If the flag is set to false then it can only make one alarm for the Lambda with
 `LambdaAction`.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.124.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-codepipeline:crossAccountKeysDefaultValueToFalse
 
 *Enables Pipeline to set the default value for crossAccountKeys to false.* (default)
@@ -1140,6 +1250,7 @@ If the flag is set to false then it can only make one alarm for the Lambda with
 When this feature flag is enabled, and the `crossAccountKeys` property is not provided in a `Pipeline`
 construct, the construct automatically defaults the value of this property to false.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
@@ -1147,6 +1258,7 @@ construct, the construct automatically defaults the value of this property to fa
 
 **Compatibility with old behavior:** Pass `crossAccountKeys: true` to `Pipeline` construct to restore the previous behavior.
 
+
 ### @aws-cdk/aws-codepipeline:defaultPipelineTypeToV2
 
 *Enables Pipeline to set the default pipeline type to V2.* (default)
@@ -1154,6 +1266,7 @@ construct, the construct automatically defaults the value of this property to fa
 When this feature flag is enabled, and the `pipelineType` property is not provided in a `Pipeline`
 construct, the construct automatically defaults the value of this property to `PipelineType.V2`.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
@@ -1161,6 +1274,7 @@ construct, the construct automatically defaults the value of this property to `P
 
 **Compatibility with old behavior:** Pass `pipelineType: PipelineType.V1` to `Pipeline` construct to restore the previous behavior.
 
+
 ### @aws-cdk/aws-kms:reduceCrossAccountRegionPolicyScope
 
 *When enabled, IAM Policy created from KMS key grant will reduce the resource scope to this key only.* (fix)
@@ -1168,11 +1282,13 @@ construct, the construct automatically defaults the value of this property to `P
 When this feature flag is enabled and calling KMS key grant method, the created IAM policy will reduce the resource scope from
 '*' to this specific granting KMS key.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.134.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-eks:nodegroupNameAttribute
 
 *When enabled, nodegroupName attribute of the provisioned EKS NodeGroup will not have the cluster name prefix.* (fix)
@@ -1180,17 +1296,20 @@ When this feature flag is enabled and calling KMS key grant method, the created
 When this feature flag is enabled, the nodegroupName attribute will be exactly the name of the nodegroup without
 any prefix.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.139.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-ec2:ebsDefaultGp3Volume
 
 *When enabled, the default volume type of the EBS volume will be GP3* (default)
 
 When this featuer flag is enabled, the default volume type of the EBS volume will be `EbsDeviceVolumeType.GENERAL_PURPOSE_SSD_GP3`.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
@@ -1198,6 +1317,7 @@ When this featuer flag is enabled, the default volume type of the EBS volume wil
 
 **Compatibility with old behavior:** Pass `volumeType: EbsDeviceVolumeType.GENERAL_PURPOSE_SSD` to `Volume` construct to restore the previous behavior.
 
+
 ### @aws-cdk/pipelines:reduceAssetRoleTrustScope
 
 *Remove the root account principal from PipelineAssetsFileRole trust policy* (default)
@@ -1205,6 +1325,7 @@ When this featuer flag is enabled, the default volume type of the EBS volume wil
 When this feature flag is enabled, the root account principal will not be added to the trust policy of asset role.
 When this feature flag is disabled, it will keep the root account principal in the trust policy.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
@@ -1212,12 +1333,14 @@ When this feature flag is disabled, it will keep the root account principal in t
 
 **Compatibility with old behavior:** Disable the feature flag to add the root account principal back
 
+
 ### @aws-cdk/aws-ecs:removeDefaultDeploymentAlarm
 
 *When enabled, remove default deployment alarm settings* (default)
 
 When this featuer flag is enabled, remove the default deployment alarm settings when creating a AWS ECS service.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
@@ -1225,6 +1348,7 @@ When this featuer flag is enabled, remove the default deployment alarm settings
 
 **Compatibility with old behavior:** Set AWS::ECS::Service 'DeploymentAlarms' manually to restore the previous behavior.
 
+
 ### @aws-cdk/custom-resources:logApiResponseDataPropertyTrueDefault
 
 *When enabled, the custom resource used for `AwsCustomResource` will configure the `logApiResponseData` property as true by default* (fix)
@@ -1232,17 +1356,19 @@ When this featuer flag is enabled, remove the default deployment alarm settings
 This results in 'logApiResponseData' being passed as true to the custom resource provider. This will cause the custom resource handler to receive an 'Update' event. If you don't
 have an SDK call configured for the 'Update' event and you're dependent on specific SDK call response data, you will see this error from CFN:
 
-CustomResource attribute error: Vendor response doesn't contain <attribute-name> attribute in object. See <https://github.com/aws/aws-cdk/issues/29949>) for more details.
+CustomResource attribute error: Vendor response doesn't contain <attribute-name> attribute in object. See https://github.com/aws/aws-cdk/issues/29949) for more details.
 
 Unlike most feature flags, we don't recommend setting this feature flag to true. However, if you're using the 'AwsCustomResource' construct with 'logApiResponseData' as true in
 the event object, then setting this feature flag will keep this behavior. Otherwise, setting this feature flag to false will trigger an 'Update' event by removing the 'logApiResponseData'
 property from the event object.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.145.0 | `false` | `false` |
 
+
 ### @aws-cdk/aws-s3:keepNotificationInImportedBucket
 
 *When enabled, Adding notifications to a bucket in the current stack will not remove notification from imported stack.* (fix)
@@ -1252,11 +1378,13 @@ Currently, adding notifications to a bucket where it was created by ourselves wi
 When this feature flag is enabled, adding notifications to a bucket in the current stack will only update notification defined in this stack.
 Other notifications that are not managed by this stack will be kept.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.155.0 | `false` | `false` |
 
+
 ### @aws-cdk/aws-stepfunctions-tasks:useNewS3UriParametersForBedrockInvokeModelTask
 
 *When enabled, use new props for S3 URI field in task definition of state machine for bedrock invoke model.* (fix)
@@ -1267,6 +1395,7 @@ of State Machine Task definition.
 When this feature flag is enabled, specify newly introduced props 's3InputUri' and
 's3OutputUri' to populate S3 uri under input and output fields in state machine task definition for Bedrock invoke model.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
@@ -1274,6 +1403,7 @@ When this feature flag is enabled, specify newly introduced props 's3InputUri' a
 
 **Compatibility with old behavior:** Disable the feature flag to use input and output path fields for s3 URI
 
+
 ### @aws-cdk/aws-ecs:reduceEc2FargateCloudWatchPermissions
 
 *When enabled, we will only grant the necessary permissions when users specify cloudwatch log group through logConfiguration* (fix)
@@ -1283,6 +1413,7 @@ specified as logConfiguration and it will grant 'Resources': ['*'] to the task r
 
 When this feature flag is enabled, we will only grant the necessary permissions when users specify cloudwatch log group.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
@@ -1290,6 +1421,7 @@ When this feature flag is enabled, we will only grant the necessary permissions
 
 **Compatibility with old behavior:** Disable the feature flag to continue grant permissions to log group when no log group is specified
 
+
 ### @aws-cdk/aws-ec2:ec2SumTImeoutEnabled
 
 *When enabled, initOptions.timeout and resourceSignalTimeout values will be summed together.* (fix)
@@ -1299,11 +1431,13 @@ only the value from 'resourceSignalTimeout' will be used.
 
 When this feature flag is enabled, if both initOptions.timeout and resourceSignalTimeout are specified, the values will to be summed together.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.160.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-appsync:appSyncGraphQLAPIScopeLambdaPermission
 
 *When enabled, a Lambda authorizer Permission created when using GraphqlApi will be properly scoped with a SourceArn.* (fix)
@@ -1315,11 +1449,13 @@ it allows invocations from any source.
 When this feature flag is enabled, the AWS::Lambda::Permission will be properly scoped with the SourceArn corresponding to the
 specific AppSync GraphQL API.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.161.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-lambda-nodejs:sdkV3ExcludeSmithyPackages
 
 *When enabled, both `@aws-sdk` and `@smithy` packages will be excluded from the Lambda Node.js 18.x runtime to prevent version mismatches in bundled applications.* (fix)
@@ -1330,11 +1466,13 @@ However, this can cause version mismatches between the '@aws-sdk/*' and '@smithy
 When this feature flag is enabled, both '@aws-sdk/*' and '@smithy/*' packages will be excluded during the bundling process. This ensures that no mismatches
 occur between these tightly coupled dependencies when using the AWS SDK v3 in Lambda functions.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.161.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-rds:setCorrectValueForDatabaseInstanceReadReplicaInstanceResourceId
 
 *When enabled, the value of property `instanceResourceId` in construct `DatabaseInstanceReadReplica` will be set to the correct value which is `DbiResourceId` instead of currently `DbInstanceArn`* (fix)
@@ -1343,6 +1481,7 @@ Currently, the value of the property 'instanceResourceId' in construct 'Database
 
 When this feature flag is enabled, the value of that property will be as expected set to 'DbiResourceId' attribute, and that will fix the grantConnect method.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
@@ -1350,6 +1489,7 @@ When this feature flag is enabled, the value of that property will be as expecte
 
 **Compatibility with old behavior:** Disable the feature flag to use `DbInstanceArn` as value for property `instanceResourceId`
 
+
 ### @aws-cdk/core:cfnIncludeRejectComplexResourceUpdateCreatePolicyIntrinsics
 
 *When enabled, CFN templates added with `cfn-include` will error if the template contains Resource Update or Create policies with CFN Intrinsics that include non-primitive values.* (fix)
@@ -1358,11 +1498,13 @@ Without enabling this feature flag, `cfn-include` will silently drop resource up
 
 Enabling this feature flag will make `cfn-include` throw on these templates, unless you specify the logical ID of the resource in the 'unhydratedResources' property.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.161.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-stepfunctions-tasks:fixRunEcsTaskPolicy
 
 *When enabled, the resource of IAM Run Ecs policy generated by SFN EcsRunTask will reference the definition, instead of constructing ARN.* (fix)
@@ -1372,11 +1514,13 @@ The revision number at the end will be replaced with a wildcard which it shouldn
 
 When this feature flag is enabled, if the task definition is created in the stack, the 'Resource' section will 'Ref' the taskDefinition.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.163.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-dynamodb:resourcePolicyPerReplica
 
 *When enabled will allow you to specify a resource policy per replica, and not copy the source table policy to all replicas* (fix)
@@ -1388,11 +1532,13 @@ This will prevent you from creating a new table which has an additional replica
 
 This is a feature flag as the old behavior was technically incorrect but users may have come to depend on it.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.164.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-ec2:bastionHostUseAmazonLinux2023ByDefault
 
 *When enabled, the BastionHost construct will use the latest Amazon Linux 2023 AMI, instead of Amazon Linux 2.* (default)
@@ -1404,6 +1550,7 @@ and secure option.
 When this feature flag is enabled, if you do not pass the machineImage property to the BastionHost construct,
 the latest Amazon Linux 2023 version will be used instead of Amazon Linux 2.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
@@ -1411,6 +1558,7 @@ the latest Amazon Linux 2023 version will be used instead of Amazon Linux 2.
 
 **Compatibility with old behavior:** Disable the feature flag or explicitly pass an Amazon Linux 2 machine image to the BastionHost construct.
 
+
 ### @aws-cdk/core:aspectStabilization
 
 *When enabled, a stabilization loop will be run when invoking Aspects during synthesis.* (config)
@@ -1420,11 +1568,13 @@ This means that the Aspects that create other Aspects are not run and Aspects th
 
 When this feature flag is enabled, a stabilization loop is run to recurse the construct tree multiple times when invoking Aspects.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.172.0 | `true` | `true` |
 
+
 ### @aws-cdk/aws-route53-targets:userPoolDomainNameMethodWithoutCustomResource
 
 *When enabled, use a new method for DNS Name of user pool domain target without creating a custom resource.* (fix)
@@ -1434,22 +1584,25 @@ creates a custom resource internally, but the new method doesn't need a custom r
 
 If the flag is set to false then a custom resource will be created when using `UserPoolDomainTarget`.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
 | 2.174.0 | `false` | `true` |
 
+
 ### @aws-cdk/aws-ecs:disableEcsImdsBlocking
 
 *When set to true, CDK synth will throw exception if canContainersAccessInstanceRole is false. **IMPORTANT: See [details.](#aws-cdkaws-ecsdisableEcsImdsBlocking)*** (temporary)
 
 In an ECS Cluster with `MachineImageType.AMAZON_LINUX_2`, the canContainersAccessInstanceRole=false option attempts to add commands to block containers from
 accessing IMDS. CDK cannot guarantee the correct execution of the feature in all platforms. Setting this feature flag
-to true will ensure CDK does not attempt to implement IMDS blocking. By <ins>**end of 2025**</ins>, CDK will remove the
+to true will ensure CDK does not attempt to implement IMDS blocking. By <ins>**end of 2025**</ins>, CDK will remove the 
 IMDS blocking feature. See [Github discussion](https://github.com/aws/aws-cdk/discussions/32609) for more information.
 
 It is recommended to follow ECS documentation to block IMDS for your specific platform and cluster configuration.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
@@ -1457,16 +1610,18 @@ It is recommended to follow ECS documentation to block IMDS for your specific pl
 
 **Compatibility with old behavior:** It is strongly recommended to set this flag to true. However, if necessary, set this flag to false to continue using the old implementation.
 
+
 ### @aws-cdk/aws-ecs:enableImdsBlockingDeprecatedFeature
 
 *When set to true along with canContainersAccessInstanceRole=false in ECS cluster, new updated commands will be added to UserData to block container accessing IMDS. **Applicable to Linux only. IMPORTANT: See [details.](#aws-cdkaws-ecsenableImdsBlockingDeprecatedFeature)*** (temporary)
 
 In an ECS Cluster with `MachineImageType.AMAZON_LINUX_2`, the canContainersAccessInstanceRole=false option attempts to add commands to block containers from
-accessing IMDS. Set this flag to true in order to use new and updated commands. Please note that this
-feature alone with this feature flag will be deprecated by <ins>**end of 2025**</ins> as CDK cannot
+accessing IMDS. Set this flag to true in order to use new and updated commands. Please note that this 
+feature alone with this feature flag will be deprecated by <ins>**end of 2025**</ins> as CDK cannot 
 guarantee the correct execution of the feature in all platforms. See [Github discussion](https://github.com/aws/aws-cdk/discussions/32609) for more information.
 It is recommended to follow ECS documentation to block IMDS for your specific platform and cluster configuration.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
@@ -1474,6 +1629,7 @@ It is recommended to follow ECS documentation to block IMDS for your specific pl
 
 **Compatibility with old behavior:** Set this flag to false in order to continue using old and outdated commands. However, it is **not** recommended.
 
+
 ### @aws-cdk/aws-elasticloadbalancingV2:albDualstackWithoutPublicIpv4SecurityGroupRulesDefault
 
 *When enabled, the default security group ingress rules will allow IPv6 ingress from anywhere* (fix)
@@ -1484,11 +1640,13 @@ will allow IPv6 ingress from anywhere (::/0). Previously, the default security g
 Using a feature flag to make sure existing customers who might be relying
 on the overly restrictive permissions are not broken.
 
+
 | Since | Default | Recommended |
 | ----- | ----- | ----- |
 | (not in v1) |  |  |
-| V2NEXT | `false` | `true` |
+| 2.176.0 | `false` | `true` |
 
 **Compatibility with old behavior:** Disable the feature flag to only allow IPv4 ingress in the default security group rules.
 
+
 <!-- END details -->
diff --git a/packages/aws-cdk-lib/cx-api/lib/features.ts b/packages/aws-cdk-lib/cx-api/lib/features.ts
index b50c93df54da0..446ebfc12a244 100644
--- a/packages/aws-cdk-lib/cx-api/lib/features.ts
+++ b/packages/aws-cdk-lib/cx-api/lib/features.ts
@@ -1351,7 +1351,7 @@ export const FLAGS: Record<string, FlagInfo> = {
 
       Using a feature flag to make sure existing customers who might be relying
       on the overly restrictive permissions are not broken.`,
-    introducedIn: { v2: 'V2NEXT' },
+    introducedIn: { v2: '2.176.0' },
     recommendedValue: true,
     compatibilityWithOldBehaviorMd: 'Disable the feature flag to only allow IPv4 ingress in the default security group rules.',
   },
diff --git a/packages/aws-cdk-lib/recommended-feature-flags.json b/packages/aws-cdk-lib/recommended-feature-flags.json
index 71285e804b547..4bb94bf0c6921 100644
--- a/packages/aws-cdk-lib/recommended-feature-flags.json
+++ b/packages/aws-cdk-lib/recommended-feature-flags.json
@@ -61,5 +61,6 @@
   "@aws-cdk/aws-lambda-nodejs:sdkV3ExcludeSmithyPackages": true,
   "@aws-cdk/aws-stepfunctions-tasks:fixRunEcsTaskPolicy": true,
   "@aws-cdk/aws-ec2:bastionHostUseAmazonLinux2023ByDefault": true,
-  "@aws-cdk/aws-route53-targets:userPoolDomainNameMethodWithoutCustomResource": true
+  "@aws-cdk/aws-route53-targets:userPoolDomainNameMethodWithoutCustomResource": true,
+  "@aws-cdk/aws-elasticloadbalancingV2:albDualstackWithoutPublicIpv4SecurityGroupRulesDefault": true
 }
\ No newline at end of file
diff --git a/version.v2.json b/version.v2.json
index 74e9177f93265..43fab08d1a826 100644
--- a/version.v2.json
+++ b/version.v2.json
@@ -1,4 +1,4 @@
 {
-  "version": "2.175.1",
-  "alphaVersion": "2.175.1-alpha.0"
+  "version": "2.176.0",
+  "alphaVersion": "2.176.0-alpha.0"
 }
\ No newline at end of file