v1.139.0

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• apigatewayv2-authorizers: WebSocketLambdaAuthorizerProps.identitySource default changes from ['$request.header.Authorization'] to ['route.request.header.Authorization'].
• cfn2ts: some "complex" property types within the generated
  CloudFormation interfaces (i.e: properties of Cfn* constructs) with
  names starting with a capital letter I followed by another capital
  letter are no longer incorrectly treated as behavioral interfaces, and
  might hence have different usage patterns in non-TypeScript languages.
  Such interfaces were previously very difficult to use in non-TypeScript
  languages, and required convoluted workarounds, which can now be removed.

Features

• aws-ecs: support runtime platform property for create fargate windows runtime. (#17622) (fa8f2e2), closes #17242
• bootstrap: ECR ScanOnPush is now enabled by default (#17994) (7588b51)
• cfnspec: cloudformation spec v51.0.0 (#18274) (c208e60)
• cli: diff now uses the lookup Role for new-style synthesis (#18277) (2256680)
• eks: cluster tagging (#4995) (#18109) (304f5b6)
• iam: generate AccessKeys (#18180) (beb5706), closes #8432
• lambda-event-sources: adds AuthenticationMethod.CLIENT_CERTIFICATE_TLS_AUTH to kafka (#17920) (93cd776)
• pipelines: step dependencies (#18256) (e3359e0), closes #17945
• pipelines: support timeout in CodeBuildStep (#17351) (2aa3b8e)
• s3: add EventBridge bucket notifications (#18150) (912aeda), closes #18076
• sqs: add DLQ readonly property to Queue (#18232) (caa6788), closes #18083

Bug Fixes

• apigatewayv2-authorizers: incorrect identitySource default for WebSocketLambdaAuthorizer (#18315) (74eee1e), closes #18307
• appmesh: allow a Virtual Node have as a backend a Virtual Service whose provider is that Node (#18265) (272b6b1), closes #17322
• aws-kinesis: remove default shard count when stream mode is on-demand and set default mode to provisioned (#18221) (cac11bb), closes #18139
• aws-lambda-event-sources: unsupported properties for SelfManagedKafkaEventSource and ManagedKafkaEventSource (#17965) (5ddaef4), closes #17934
• cfn2ts: some property times have behavioral-interface names (#18275) (6359c12)
• cli: assets are KMS-encrypted using wrong key (#18340) (64ae9f3), closes #17668 #18262
• cli: breaks due to faulty version of colors (#18324) (ddc2bc6)
• codebuild: setting Cache.none() renders nothing in the template (#18194) (cd51a5d), closes #18165
• lambda: imported Function still has region and account from its Stack, instead of its ARN (#18255) (01bbe4c), closes #18228
• lambda-python: asset files are generated inside the 'asset-input' folder (#18306) (aff607a)
• lambda-python: bundle asset files correctly (#18335) (3822c85), closes #18301
• logs: respect region when importing log group (#18215) (be909bc), closes #18214
• pipelines: DockerCredential.dockerHub() silently fails auth (#18313) (c2c87d9), closes #15737
• route53: support multiple cross account DNS delegations (#17837) (76b5c0d), closes #17836