diff --git a/.github/workflows/close-stale-issues.yml b/.github/workflows/close-stale-issues.yml
index 5924ccd8b727e..61fa5967b2722 100644
--- a/.github/workflows/close-stale-issues.yml
+++ b/.github/workflows/close-stale-issues.yml
@@ -8,6 +8,8 @@ on:
 
 jobs:
   cleanup:
+    # this workflow will always fail in forks; bail if this isn't running in the upstream
+    if: github.repository == 'aws/aws-cdk'
     permissions:
       issues: write
       contents: read
diff --git a/.github/workflows/close-stale-prs.yml b/.github/workflows/close-stale-prs.yml
index d8543bc1725df..4fe804c13ad34 100644
--- a/.github/workflows/close-stale-prs.yml
+++ b/.github/workflows/close-stale-prs.yml
@@ -5,6 +5,8 @@ on:
   workflow_dispatch:
 jobs:
   close-stale-prs:
+    # this workflow will always fail in forks; bail if this isn't running in the upstream
+    if: github.repository == 'aws/aws-cdk'
     permissions:
       pull-requests: write
     runs-on: ubuntu-latest
diff --git a/.github/workflows/handle-stale-discussions.yml b/.github/workflows/handle-stale-discussions.yml
index 2b89f2da15f21..7a5ad637905f9 100644
--- a/.github/workflows/handle-stale-discussions.yml
+++ b/.github/workflows/handle-stale-discussions.yml
@@ -7,6 +7,8 @@ on:
 
 jobs:
   handle-stale-discussions:
+    # this workflow will always fail in forks; bail if this isn't running in the upstream
+    if: github.repository == 'aws/aws-cdk'
     name: Handle stale discussions
     runs-on: ubuntu-latest
     permissions:
@@ -15,4 +17,4 @@ jobs:
       - name: Stale discussions action
         uses: aws-github-ops/handle-stale-discussions@v1
         env:
-          GITHUB_TOKEN:  ${{secrets.GITHUB_TOKEN}}
\ No newline at end of file
+          GITHUB_TOKEN:  ${{secrets.GITHUB_TOKEN}}
diff --git a/CHANGELOG.v2.alpha.md b/CHANGELOG.v2.alpha.md
index 2cc2dd43068ee..55b2b51435beb 100644
--- a/CHANGELOG.v2.alpha.md
+++ b/CHANGELOG.v2.alpha.md
@@ -2,6 +2,21 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.89.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.88.0-alpha.0...v2.89.0-alpha.0) (2023-07-28)
+
+
+### Features
+
+* **app-staging-synthesizer:** option to specify staging stack name prefix ([#26324](https://github.com/aws/aws-cdk/issues/26324)) ([1b36124](https://github.com/aws/aws-cdk/commit/1b3612457078f8195fb5a73b9f0e44caf99fae96))
+* **apprunner:** make `Service` implement `IGrantable` ([#26130](https://github.com/aws/aws-cdk/issues/26130)) ([6033c9a](https://github.com/aws/aws-cdk/commit/6033c9a01322be74f8ae7ddd0a3856cc22e28975)), closes [#26089](https://github.com/aws/aws-cdk/issues/26089)
+* **neptune-alpha:** support for Neptune serverless ([#26445](https://github.com/aws/aws-cdk/issues/26445)) ([b42dbc8](https://github.com/aws/aws-cdk/commit/b42dbc800eabff64bc86cb8fb5629c2ce7496767)), closes [#26428](https://github.com/aws/aws-cdk/issues/26428)
+* **scheduler:** ScheduleGroup ([#26196](https://github.com/aws/aws-cdk/issues/26196)) ([27dc8ff](https://github.com/aws/aws-cdk/commit/27dc8ffd62d450154ab2574cc453bb5fcdd7c0b8))
+
+
+### Bug Fixes
+
+* **cli-lib:** set skipLibCheck on generateSchema to prevent intermittent test failures ([#26551](https://github.com/aws/aws-cdk/issues/26551)) ([1807f57](https://github.com/aws/aws-cdk/commit/1807f5754885e4b1b1c8d12ca7a1cc7efab9ef2c))
+
 ## [2.88.0-alpha.0](https://github.com/aws/aws-cdk/compare/v2.87.0-alpha.0...v2.88.0-alpha.0) (2023-07-20)
 
 
diff --git a/CHANGELOG.v2.md b/CHANGELOG.v2.md
index fb16bbb66d89b..38dcf7eac888c 100644
--- a/CHANGELOG.v2.md
+++ b/CHANGELOG.v2.md
@@ -2,6 +2,36 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [2.89.0](https://github.com/aws/aws-cdk/compare/v2.88.0...v2.89.0) (2023-07-28)
+
+
+### Features
+
+* support max-buffer-size for AWSLogs driver ([#26396](https://github.com/aws/aws-cdk/issues/26396)) ([a74536b](https://github.com/aws/aws-cdk/commit/a74536b030a6050ee7fdae289abdbe5a1226ba19))
+* update AWS Service Spec ([#26541](https://github.com/aws/aws-cdk/issues/26541)) ([b1ca3c0](https://github.com/aws/aws-cdk/commit/b1ca3c09e68a2c1f5bf5ce4c9c40f12db7f1767f))
+* **cli:** add diff message on the number of stacks with differences ([#26297](https://github.com/aws/aws-cdk/issues/26297)) ([a9e2789](https://github.com/aws/aws-cdk/commit/a9e2789d2f927c26db0aee4ce7cb2cc073a99bc5)), closes [#10417](https://github.com/aws/aws-cdk/issues/10417)
+* **logs:** configure custom subscription filter name ([#26498](https://github.com/aws/aws-cdk/issues/26498)) ([7ddb305](https://github.com/aws/aws-cdk/commit/7ddb3059915fb3bd05d9d59eee46f90833c62861)), closes [#26485](https://github.com/aws/aws-cdk/issues/26485)
+* **opensearchservice:** L2 properties for offPeakWindowOptions and softwareUpdateOptions ([#26403](https://github.com/aws/aws-cdk/issues/26403)) ([02e8d58](https://github.com/aws/aws-cdk/commit/02e8d5892a35f9e5a467e32413a0532b217ca3bc)), closes [#26388](https://github.com/aws/aws-cdk/issues/26388)
+* **rds:** `isFromLegacyInstanceProps` migration flag with `ClusterInstance.serverlessV2` ([#26472](https://github.com/aws/aws-cdk/issues/26472)) ([6ec9829](https://github.com/aws/aws-cdk/commit/6ec9829ac2d20855a35dad03c4110c46dd89cba8)), closes [/github.com/aws/aws-cdk/issues/20197#issuecomment-1284485844](https://github.com/aws//github.com/aws/aws-cdk/issues/20197/issues/issuecomment-1284485844) [#25942](https://github.com/aws/aws-cdk/issues/25942)
+* **rds:** support aurora mysql 3.03.1 ([#26507](https://github.com/aws/aws-cdk/issues/26507)) ([7fa74c4](https://github.com/aws/aws-cdk/commit/7fa74c48d77461c5305e00f68127621abe975086))
+* **route53:** support geolocation routing ([#26383](https://github.com/aws/aws-cdk/issues/26383)) ([6bd9a2d](https://github.com/aws/aws-cdk/commit/6bd9a2d1293b94e83cb6fe9b3768155f646d9066)), closes [#9478](https://github.com/aws/aws-cdk/issues/9478)
+* **stepfunctions:** add stateMachineRevisionId property to StateMachine ([#26443](https://github.com/aws/aws-cdk/issues/26443)) ([3e47d1b](https://github.com/aws/aws-cdk/commit/3e47d1b2e82bdb156bcac797ead5d9f2e522a018)), closes [#26440](https://github.com/aws/aws-cdk/issues/26440)
+
+
+### Bug Fixes
+
+* **autoscaling:** StepScalingPolicy intervals not checked for going over allowable maximum ([#26490](https://github.com/aws/aws-cdk/issues/26490)) ([58b004e](https://github.com/aws/aws-cdk/commit/58b004ef7385cfb42910b6978b4b5b836cbb69f7)), closes [/github.com/aws/aws-cdk/blob/bc029fe5ac69a8b7fd2dfdbcd8834e9a2cf8e000/packages/aws-cdk-lib/aws-autoscaling/lib/step-scaling-policy.ts#L136-L166](https://github.com/aws//github.com/aws/aws-cdk/blob/bc029fe5ac69a8b7fd2dfdbcd8834e9a2cf8e000/packages/aws-cdk-lib/aws-autoscaling/lib/step-scaling-policy.ts/issues/L136-L166) [/github.com/aws/aws-cdk/blob/bc029fe5ac69a8b7fd2dfdbcd8834e9a2cf8e000/packages/aws-cdk-lib/aws-autoscaling/lib/step-scaling-policy.ts#L105-L134](https://github.com/aws//github.com/aws/aws-cdk/blob/bc029fe5ac69a8b7fd2dfdbcd8834e9a2cf8e000/packages/aws-cdk-lib/aws-autoscaling/lib/step-scaling-policy.ts/issues/L105-L134) [#26215](https://github.com/aws/aws-cdk/issues/26215)
+* **cdk:** allow bootstrap with policy names with a path ([#26378](https://github.com/aws/aws-cdk/issues/26378)) ([1820fc9](https://github.com/aws/aws-cdk/commit/1820fc902c6f37faed0538305bd701103dae43ff)), closes [#26320](https://github.com/aws/aws-cdk/issues/26320)
+* **core:** policy validation trace incorrect for larger constructs ([#26466](https://github.com/aws/aws-cdk/issues/26466)) ([fd181c7](https://github.com/aws/aws-cdk/commit/fd181c70f3668b2f0ec0ccbca38a5ef9100eb86b))
+* **ecs:** deployment alarm configurations are being added in isolated partitions ([#26458](https://github.com/aws/aws-cdk/issues/26458)) ([eea223b](https://github.com/aws/aws-cdk/commit/eea223b52f4445e6084b1fa1fa15a3a78f83fa18)), closes [#26456](https://github.com/aws/aws-cdk/issues/26456)
+* **ecs-patterns:** `minHealthyPercent` and `maxHealthyPercent` props validation ([#26193](https://github.com/aws/aws-cdk/issues/26193)) ([bdfdc91](https://github.com/aws/aws-cdk/commit/bdfdc91b1b8f86104290a9fb6899013617e307ef)), closes [#26158](https://github.com/aws/aws-cdk/issues/26158)
+* **lambda:** bundling fails with pnpm >= 8.4.0 ([#26478](https://github.com/aws/aws-cdk/issues/26478)) ([#26479](https://github.com/aws/aws-cdk/issues/26479)) ([1df243a](https://github.com/aws/aws-cdk/commit/1df243a0130ed15034f53d95e6544935de911a88))
+* **rds:** Add missing Aurora engine 8.0.mysql_aurora.3.02.3 ([#26462](https://github.com/aws/aws-cdk/issues/26462)) ([ac9bb1a](https://github.com/aws/aws-cdk/commit/ac9bb1a27c704f5bcb4d8ca15dc5a224a592bd27))
+* **secretsmanager:** `arnForPolicies` evaluates to the partial ARN if accessed from a cross-env stack ([#26308](https://github.com/aws/aws-cdk/issues/26308)) ([0e808d8](https://github.com/aws/aws-cdk/commit/0e808d81d8a6b4b860f9dbf6be6bdf85429eaf77))
+* **sns-subscriptions:** SQS queue encrypted by AWS managed KMS key is allowed to be specified as subscription and dead-letter queue ([#26110](https://github.com/aws/aws-cdk/issues/26110)) ([0531492](https://github.com/aws/aws-cdk/commit/0531492451b4f99fe469380ba926f22addbfc492)), closes [#19796](https://github.com/aws/aws-cdk/issues/19796)
+* **stepfunctions-tasks:** Default Retry policy for `LambdaInvoke` does not include `Lambda.ClientExecutionTimeoutException` default Retry settings ([#26474](https://github.com/aws/aws-cdk/issues/26474)) ([f22bd4e](https://github.com/aws/aws-cdk/commit/f22bd4e2b1914b42450ffa061d27009039469b2b)), closes [#26470](https://github.com/aws/aws-cdk/issues/26470)
+* **stepfunctions-tasks:** specify tags in BatchSubmitJob properties ([#26349](https://github.com/aws/aws-cdk/issues/26349)) ([f24ece1](https://github.com/aws/aws-cdk/commit/f24ece1dba43e1a0fda3cc917e04af61d90040fc)), closes [#26336](https://github.com/aws/aws-cdk/issues/26336)
+
 ## [2.88.0](https://github.com/aws/aws-cdk/compare/v2.87.0...v2.88.0) (2023-07-20)
 
 
diff --git a/allowed-breaking-changes.txt b/allowed-breaking-changes.txt
index 7568e050d7ecd..99fbbed4cc359 100644
--- a/allowed-breaking-changes.txt
+++ b/allowed-breaking-changes.txt
@@ -164,3 +164,12 @@ removed:aws-cdk-lib.triggers.TriggerProps.timeout
 change-return-type:aws-cdk-lib.aws_ec2.SecurityGroup.determineRuleScope
 # broken only in non-JS/TS, where that was not previously usable
 strengthened:aws-cdk-lib.aws_s3_deployment.BucketDeploymentProps
+
+# Fix for non-working property
+# loadBalancerName is used to idenitfy a Classic Load Balancer
+# However TaskSet only works with modern Application or Network LBs
+removed:aws-cdk-lib.aws_ecs.CfnTaskSet.LoadBalancerProperty.loadBalancerName
+
+# Introduction of a new feature
+# Previously only BlueGreenUpdatePolicy could be set, now BlueGreenUpdatePolicy or new RollingUpdatePolicy can be provided
+weakened:aws-cdk-lib.aws_sagemaker.CfnEndpoint.DeploymentConfigProperty
diff --git a/packages/@aws-cdk-testing/framework-integ/README.md b/packages/@aws-cdk-testing/framework-integ/README.md
new file mode 100644
index 0000000000000..443c349ed6b02
--- /dev/null
+++ b/packages/@aws-cdk-testing/framework-integ/README.md
@@ -0,0 +1,40 @@
+# AWS CDK Framework Integration Test Suite
+
+Run the full test suite with `yarn integ`.
+
+See `integ-runner` package or `yarn integ --help` for detailed instructions.
+
+## Common Errors
+
+### Error: For this test you must provide your own HostedZoneId/HostedZoneName/DomainName
+
+Some test cases require a publicly available domain name attached to a Amazon Route 53 Hosted Zone to work.
+These test cases need to add DNS records that are then retrieved via the public internet infrastructure. This can be a subdomain to an existing domain, but it must have a Hosted Zone configured and nameservers delegated to it.
+
+If you haven't got one ready, see the [Route 53 guide](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/CreatingHostedZone.html) to manually create a hosted zone.
+
+AWS CDK core team members, please check our team internal docs for guidance on how to configure domains for testing.
+
+#### How to correctly run these tests
+
+**A) Each test needs exclusive access to the Hosted Zone.**\
+You can only run one test at a time.
+
+**B) Must be run with `--disable-update-workflow`**\
+The checked-in snapshot uses dummy values that will not deploy.
+
+- Go to your Hosted Zone and write down the values for `HostedZoneId`, `HostedZoneName` and `DomainName`.
+   All values must related to the **same** Hosted Zone.
+- In your terminal run the following commands:
+
+```console
+export HOSTED_ZONE_ID=your_hosted_zone_id
+export HOSTED_ZONE_NAME=your_hosted_zone_name
+export DOMAIN_NAME=your_domain_name
+```
+
+- Finally, in the same terminal run your specific test case with the **update workflow disabled**. For example:
+
+```console
+yarn integ --disable-update-workflow aws-certificatemanager/test/integ.certificate-name
+```
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-certificatemanager/test/integ.certificate-name.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-certificatemanager/test/integ.certificate-name.ts
index 90130972b64c1..82858439c05ad 100644
--- a/packages/@aws-cdk-testing/framework-integ/test/aws-certificatemanager/test/integ.certificate-name.ts
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-certificatemanager/test/integ.certificate-name.ts
@@ -9,11 +9,11 @@ import { Certificate, CertificateValidation } from 'aws-cdk-lib/aws-certificatem
  *
 */
 const hostedZoneId = process.env.CDK_INTEG_HOSTED_ZONE_ID ?? process.env.HOSTED_ZONE_ID;
-if (!hostedZoneId) throw new Error('For this test you must provide your own HostedZoneId as an env var "HOSTED_ZONE_ID"');
+if (!hostedZoneId) throw new Error('For this test you must provide your own HostedZoneId as an env var "HOSTED_ZONE_ID". See framework-integ/README.md for details.');
 const hostedZoneName = process.env.CDK_INTEG_HOSTED_ZONE_NAME ?? process.env.HOSTED_ZONE_NAME;
-if (!hostedZoneName) throw new Error('For this test you must provide your own HostedZoneName as an env var "HOSTED_ZONE_NAME"');
+if (!hostedZoneName) throw new Error('For this test you must provide your own HostedZoneName as an env var "HOSTED_ZONE_NAME". See framework-integ/README.md for details.');
 const domainName = process.env.CDK_INTEG_DOMAIN_NAME ?? process.env.DOMAIN_NAME;
-if (!domainName) throw new Error('For this test you must provide your own Domain Name as an env var "DOMAIN_NAME"');
+if (!domainName) throw new Error('For this test you must provide your own DomainName as an env var "DOMAIN_NAME". See framework-integ/README.md for details.');
 
 const app = new App();
 const stack = new Stack(app, 'integ-certificate-name');
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-certificatemanager/test/integ.dns-validated-certificate.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-certificatemanager/test/integ.dns-validated-certificate.ts
index 1b10daa642f7b..602dde1f57303 100644
--- a/packages/@aws-cdk-testing/framework-integ/test/aws-certificatemanager/test/integ.dns-validated-certificate.ts
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-certificatemanager/test/integ.dns-validated-certificate.ts
@@ -20,11 +20,11 @@ import { DnsValidatedCertificate, CertificateValidation } from 'aws-cdk-lib/aws-
  */
 
 const hostedZoneId = process.env.CDK_INTEG_HOSTED_ZONE_ID ?? process.env.HOSTED_ZONE_ID;
-if (!hostedZoneId) throw new Error('For this test you must provide your own HostedZoneId as an env var "HOSTED_ZONE_ID"');
+if (!hostedZoneId) throw new Error('For this test you must provide your own HostedZoneId as an env var "HOSTED_ZONE_ID". See framework-integ/README.md for details.');
 const hostedZoneName = process.env.CDK_INTEG_HOSTED_ZONE_NAME ?? process.env.HOSTED_ZONE_NAME;
-if (!hostedZoneName) throw new Error('For this test you must provide your own HostedZoneName as an env var "HOSTED_ZONE_NAME"');
+if (!hostedZoneName) throw new Error('For this test you must provide your own HostedZoneName as an env var "HOSTED_ZONE_NAME". See framework-integ/README.md for details.');
 const domainName = process.env.CDK_INTEG_DOMAIN_NAME ?? process.env.DOMAIN_NAME;
-if (!domainName) throw new Error('For this test you must provide your own Domain Name as an env var "DOMAIN_NAME"');
+if (!domainName) throw new Error('For this test you must provide your own DomainName as an env var "DOMAIN_NAME". See framework-integ/README.md for details.');
 
 const app = new App();
 const stack = new Stack(app, 'integ-dns-validated-certificate');
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.cloudfront-cross-region-cert.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.cloudfront-cross-region-cert.ts
index 0ce961ac1b94e..4fa205f29689b 100644
--- a/packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.cloudfront-cross-region-cert.ts
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-cloudfront/test/integ.cloudfront-cross-region-cert.ts
@@ -7,11 +7,11 @@ import * as cloudfront from 'aws-cdk-lib/aws-cloudfront';
 
 const account = process.env.CDK_INTEG_ACCOUNT ?? process.env.CDK_DEFAULT_ACCOUNT;
 const hostedZoneId = process.env.CDK_INTEG_HOSTED_ZONE_ID ?? process.env.HOSTED_ZONE_ID;
-if (!hostedZoneId) throw new Error('For this test you must provide your own HostedZoneId as an env var "HOSTED_ZONE_ID"');
+if (!hostedZoneId) throw new Error('For this test you must provide your own HostedZoneId as an env var "HOSTED_ZONE_ID". See framework-integ/README.md for details.');
 const hostedZoneName = process.env.CDK_INTEG_HOSTED_ZONE_NAME ?? process.env.HOSTED_ZONE_NAME;
-if (!hostedZoneName) throw new Error('For this test you must provide your own HostedZoneName as an env var "HOSTED_ZONE_NAME"');
+if (!hostedZoneName) throw new Error('For this test you must provide your own HostedZoneName as an env var "HOSTED_ZONE_NAME". See framework-integ/README.md for details.');
 const domainName = process.env.CDK_INTEG_DOMAIN_NAME ?? process.env.DOMAIN_NAME;
-if (!domainName) throw new Error('For this test you must provide your own Domain Name as an env var "DOMAIN_NAME"');
+if (!domainName) throw new Error('For this test you must provide your own DomainName as an env var "DOMAIN_NAME". See framework-integ/README.md for details.');
 
 const app = new cdk.App({
   treeMetadata: false,
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/ec2/integ.firelens-s3-config.js.snapshot/aws-ecs-integ.template.json b/packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/ec2/integ.firelens-s3-config.js.snapshot/aws-ecs-integ.template.json
index 1c7e8ce96faa9..802fbf44d2afd 100644
--- a/packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/ec2/integ.firelens-s3-config.js.snapshot/aws-ecs-integ.template.json
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/ec2/integ.firelens-s3-config.js.snapshot/aws-ecs-integ.template.json
@@ -955,7 +955,9 @@
         "awslogs-stream-prefix": "firelens",
         "awslogs-region": {
          "Ref": "AWS::Region"
-        }
+        },
+        "mode": "non-blocking",
+        "max-buffer-size": "26214400b"
        }
       },
       "MemoryReservation": 50,
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/ec2/integ.firelens-s3-config.js.snapshot/tree.json b/packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/ec2/integ.firelens-s3-config.js.snapshot/tree.json
index 93ef8a07804eb..090569a58d157 100644
--- a/packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/ec2/integ.firelens-s3-config.js.snapshot/tree.json
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/ec2/integ.firelens-s3-config.js.snapshot/tree.json
@@ -1526,7 +1526,9 @@
                             "awslogs-stream-prefix": "firelens",
                             "awslogs-region": {
                               "Ref": "AWS::Region"
-                            }
+                            },
+                            "mode": "non-blocking",
+                            "max-buffer-size": "26214400b"
                           }
                         },
                         "firelensConfiguration": {
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/ec2/integ.firelens-s3-config.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/ec2/integ.firelens-s3-config.ts
index ad8d1d87f56a6..d026759ee68e7 100644
--- a/packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/ec2/integ.firelens-s3-config.ts
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-ecs/test/ec2/integ.firelens-s3-config.ts
@@ -31,7 +31,11 @@ taskDefinition.addFirelensLogRouter('log_router', {
       configFileType: ecs.FirelensConfigFileType.S3,
     },
   },
-  logging: new ecs.AwsLogDriver({ streamPrefix: 'firelens' }),
+  logging: new ecs.AwsLogDriver({
+    streamPrefix: 'firelens',
+    mode: ecs.AwsLogDriverMode.NON_BLOCKING,
+    maxBufferSize: cdk.Size.mebibytes(25),
+  }),
   memoryReservationMiB: 50,
 });
 
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2-actions/test/integ.cognito.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2-actions/test/integ.cognito.ts
index 33d32f0016ee3..d90ccac951a14 100644
--- a/packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2-actions/test/integ.cognito.ts
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2-actions/test/integ.cognito.ts
@@ -175,11 +175,11 @@ class CognitoStack extends Stack {
  *
 */
 const hostedZoneId = process.env.CDK_INTEG_HOSTED_ZONE_ID ?? process.env.HOSTED_ZONE_ID;
-if (!hostedZoneId) throw new Error('For this test you must provide your own HostedZoneId as an env var "HOSTED_ZONE_ID"');
+if (!hostedZoneId) throw new Error('For this test you must provide your own HostedZoneId as an env var "HOSTED_ZONE_ID". See framework-integ/README.md for details.');
 const hostedZoneName = process.env.CDK_INTEG_HOSTED_ZONE_NAME ?? process.env.HOSTED_ZONE_NAME;
-if (!hostedZoneName) throw new Error('For this test you must provide your own HostedZoneName as an env var "HOSTED_ZONE_NAME"');
+if (!hostedZoneName) throw new Error('For this test you must provide your own HostedZoneName as an env var "HOSTED_ZONE_NAME". See framework-integ/README.md for details.');
 const domainName = process.env.CDK_INTEG_DOMAIN_NAME ?? process.env.DOMAIN_NAME;
-if (!domainName) throw new Error('For this test you must provide your own Domain Name as an env var "DOMAIN_NAME"');
+if (!domainName) throw new Error('For this test you must provide your own DomainName as an env var "DOMAIN_NAME". See framework-integ/README.md for details.');
 
 const app = new App();
 const testCase = new CognitoStack(app, 'integ-cognito', {
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.oidc.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.oidc.ts
index 2ba70d63fc1fd..d9cd5128261e1 100644
--- a/packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.oidc.ts
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-elasticloadbalancingv2/test/integ.alb.oidc.ts
@@ -155,11 +155,11 @@ class AlbOidcStack extends Stack {
  *
 */
 const hostedZoneId = process.env.CDK_INTEG_HOSTED_ZONE_ID ?? process.env.HOSTED_ZONE_ID;
-if (!hostedZoneId) throw new Error('For this test you must provide your own HostedZoneId as an env var "HOSTED_ZONE_ID"');
+if (!hostedZoneId) throw new Error('For this test you must provide your own HostedZoneId as an env var "HOSTED_ZONE_ID". See framework-integ/README.md for details.');
 const hostedZoneName = process.env.CDK_INTEG_HOSTED_ZONE_NAME ?? process.env.HOSTED_ZONE_NAME;
-if (!hostedZoneName) throw new Error('For this test you must provide your own HostedZoneName as an env var "HOSTED_ZONE_NAME"');
+if (!hostedZoneName) throw new Error('For this test you must provide your own HostedZoneName as an env var "HOSTED_ZONE_NAME". See framework-integ/README.md for details.');
 const domainName = process.env.CDK_INTEG_DOMAIN_NAME ?? process.env.DOMAIN_NAME;
-if (!domainName) throw new Error('For this test you must provide your own Domain Name as an env var "DOMAIN_NAME"');
+if (!domainName) throw new Error('For this test you must provide your own DomainName as an env var "DOMAIN_NAME". See framework-integ/README.md for details.');
 
 const app = new App();
 const testCase = new AlbOidcStack(app, 'IntegAlbOidc', {
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-route53-patterns/test/integ.hosted-redirect-same-region.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-route53-patterns/test/integ.hosted-redirect-same-region.ts
index ac3237157465f..d04bc17e69d96 100644
--- a/packages/@aws-cdk-testing/framework-integ/test/aws-route53-patterns/test/integ.hosted-redirect-same-region.ts
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-route53-patterns/test/integ.hosted-redirect-same-region.ts
@@ -4,11 +4,11 @@ import { Stack, App } from 'aws-cdk-lib';
 import { IntegTest } from '@aws-cdk/integ-tests-alpha';
 import { HttpsRedirect } from 'aws-cdk-lib/aws-route53-patterns';
 const hostedZoneId = process.env.CDK_INTEG_HOSTED_ZONE_ID ?? process.env.HOSTED_ZONE_ID;
-if (!hostedZoneId) throw new Error('For this test you must provide your own HostedZoneId as an env var "HOSTED_ZONE_ID"');
+if (!hostedZoneId) throw new Error('For this test you must provide your own HostedZoneId as an env var "HOSTED_ZONE_ID". See framework-integ/README.md for details.');
 const hostedZoneName = process.env.CDK_INTEG_HOSTED_ZONE_NAME ?? process.env.HOSTED_ZONE_NAME;
-if (!hostedZoneName) throw new Error('For this test you must provide your own HostedZoneName as an env var "HOSTED_ZONE_NAME"');
+if (!hostedZoneName) throw new Error('For this test you must provide your own HostedZoneName as an env var "HOSTED_ZONE_NAME". See framework-integ/README.md for details.');
 const domainName = process.env.CDK_INTEG_DOMAIN_NAME ?? process.env.DOMAIN_NAME;
-if (!domainName) throw new Error('For this test you must provide your own Domain Name as an env var "DOMAIN_NAME"');
+if (!domainName) throw new Error('For this test you must provide your own DomainName as an env var "DOMAIN_NAME". See framework-integ/README.md for details.');
 
 const app = new App({
   // uncomment this to test the old behavior
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-route53-patterns/test/integ.hosted-redirect.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-route53-patterns/test/integ.hosted-redirect.ts
index 190e1df05bc21..e6484d346314f 100644
--- a/packages/@aws-cdk-testing/framework-integ/test/aws-route53-patterns/test/integ.hosted-redirect.ts
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-route53-patterns/test/integ.hosted-redirect.ts
@@ -4,11 +4,11 @@ import { Stack, App } from 'aws-cdk-lib';
 import { IntegTest } from '@aws-cdk/integ-tests-alpha';
 import { HttpsRedirect } from 'aws-cdk-lib/aws-route53-patterns';
 const hostedZoneId = process.env.CDK_INTEG_HOSTED_ZONE_ID ?? process.env.HOSTED_ZONE_ID;
-if (!hostedZoneId) throw new Error('For this test you must provide your own HostedZoneId as an env var "HOSTED_ZONE_ID"');
+if (!hostedZoneId) throw new Error('For this test you must provide your own HostedZoneId as an env var "HOSTED_ZONE_ID". See framework-integ/README.md for details.');
 const hostedZoneName = process.env.CDK_INTEG_HOSTED_ZONE_NAME ?? process.env.HOSTED_ZONE_NAME;
-if (!hostedZoneName) throw new Error('For this test you must provide your own HostedZoneName as an env var "HOSTED_ZONE_NAME"');
+if (!hostedZoneName) throw new Error('For this test you must provide your own HostedZoneName as an env var "HOSTED_ZONE_NAME". See framework-integ/README.md for details.');
 const domainName = process.env.CDK_INTEG_DOMAIN_NAME ?? process.env.DOMAIN_NAME;
-if (!domainName) throw new Error('For this test you must provide your own Domain Name as an env var "DOMAIN_NAME"');
+if (!domainName) throw new Error('For this test you must provide your own DomainName as an env var "DOMAIN_NAME". See framework-integ/README.md for details.');
 
 const app = new App({
   // uncomment this to test the old behavior
diff --git a/packages/aws-cdk-lib/aws-ecs/README.md b/packages/aws-cdk-lib/aws-ecs/README.md
index c050947d2c93e..09b02d1605fdb 100644
--- a/packages/aws-cdk-lib/aws-ecs/README.md
+++ b/packages/aws-cdk-lib/aws-ecs/README.md
@@ -966,7 +966,11 @@ const taskDefinition = new ecs.Ec2TaskDefinition(this, 'TaskDef');
 taskDefinition.addContainer('TheContainer', {
   image: ecs.ContainerImage.fromRegistry('example-image'),
   memoryLimitMiB: 256,
-  logging: ecs.LogDrivers.awsLogs({ streamPrefix: 'EventDemo' }),
+  logging: ecs.LogDrivers.awsLogs({ 
+    streamPrefix: 'EventDemo',
+    mode: ecs.AwsLogDriverMode.NON_BLOCKING,
+    maxBufferSize: Size.mebibytes(25), 
+  }),
 });
 ```
 
diff --git a/packages/aws-cdk-lib/aws-ecs/lib/log-drivers/aws-log-driver.ts b/packages/aws-cdk-lib/aws-ecs/lib/log-drivers/aws-log-driver.ts
index 54b729985da31..02f6d3a9b6c80 100644
--- a/packages/aws-cdk-lib/aws-ecs/lib/log-drivers/aws-log-driver.ts
+++ b/packages/aws-cdk-lib/aws-ecs/lib/log-drivers/aws-log-driver.ts
@@ -2,6 +2,7 @@ import { Construct } from 'constructs';
 import { LogDriver, LogDriverConfig } from './log-driver';
 import { removeEmpty } from './utils';
 import * as logs from '../../../aws-logs';
+import { Size, SizeRoundingBehavior } from '../../../core';
 import { ContainerDefinition } from '../container-definition';
 
 /**
@@ -82,6 +83,16 @@ export interface AwsLogDriverProps {
    * @default - AwsLogDriverMode.BLOCKING
    */
   readonly mode?: AwsLogDriverMode;
+
+  /**
+   * When AwsLogDriverMode.NON_BLOCKING is configured, this parameter
+   * controls the size of the non-blocking buffer used to temporarily
+   * store messages. This parameter is not valid with
+   * AwsLogDriverMode.BLOCKING.
+   *
+   * @default - 1 megabyte if driver mode is non-blocking, otherwise this property is not set
+   */
+  readonly maxBufferSize?: Size;
 }
 
 /**
@@ -106,6 +117,10 @@ export class AwsLogDriver extends LogDriver {
     if (props.logGroup && props.logRetention) {
       throw new Error('Cannot specify both `logGroup` and `logRetentionDays`.');
     }
+
+    if (props.maxBufferSize && props.mode !== AwsLogDriverMode.NON_BLOCKING) {
+      throw new Error('Cannot specify `maxBufferSize` when the driver mode is blocking');
+    }
   }
 
   /**
@@ -116,6 +131,10 @@ export class AwsLogDriver extends LogDriver {
       retention: this.props.logRetention || Infinity,
     });
 
+    const maxBufferSize = this.props.maxBufferSize
+      ? `${this.props.maxBufferSize.toBytes({ rounding: SizeRoundingBehavior.FLOOR })}b`
+      : undefined;
+
     this.logGroup.grantWrite(containerDefinition.taskDefinition.obtainExecutionRole());
 
     return {
@@ -127,6 +146,7 @@ export class AwsLogDriver extends LogDriver {
         'awslogs-datetime-format': this.props.datetimeFormat,
         'awslogs-multiline-pattern': this.props.multilinePattern,
         'mode': this.props.mode,
+        'max-buffer-size': maxBufferSize,
       }),
     };
   }
diff --git a/packages/aws-cdk-lib/aws-ecs/test/aws-log-driver.test.ts b/packages/aws-cdk-lib/aws-ecs/test/aws-log-driver.test.ts
index dbe8613b854f6..f29e351ba7db4 100644
--- a/packages/aws-cdk-lib/aws-ecs/test/aws-log-driver.test.ts
+++ b/packages/aws-cdk-lib/aws-ecs/test/aws-log-driver.test.ts
@@ -24,6 +24,7 @@ describe('aws log driver', () => {
         multilinePattern: 'pattern',
         streamPrefix: 'hello',
         mode: ecs.AwsLogDriverMode.NON_BLOCKING,
+        maxBufferSize: cdk.Size.mebibytes(25),
       }),
     });
 
@@ -44,6 +45,7 @@ describe('aws log driver', () => {
               'awslogs-datetime-format': 'format',
               'awslogs-multiline-pattern': 'pattern',
               'mode': 'non-blocking',
+              'max-buffer-size': '26214400b',
             },
           },
         }),
@@ -146,6 +148,33 @@ describe('aws log driver', () => {
 
   });
 
+  test('throws error when specifying maxBufferSize and blocking mode', () => {
+    // GIVEN
+    const logGroup = new logs.LogGroup(stack, 'LogGroup');
+
+    // THEN
+    expect(() => new ecs.AwsLogDriver({
+      logGroup,
+      streamPrefix: 'hello',
+      mode: ecs.AwsLogDriverMode.BLOCKING,
+      maxBufferSize: cdk.Size.mebibytes(25),
+    })).toThrow(/.*maxBufferSize.*/);
+
+  });
+
+  test('throws error when specifying maxBufferSize and default settings', () => {
+    // GIVEN
+    const logGroup = new logs.LogGroup(stack, 'LogGroup');
+
+    // THEN
+    expect(() => new ecs.AwsLogDriver({
+      logGroup,
+      streamPrefix: 'hello',
+      maxBufferSize: cdk.Size.mebibytes(25),
+    })).toThrow(/.*maxBufferSize.*/);
+
+  });
+
   test('allows cross-region log group', () => {
     // GIVEN
     const logGroupRegion = 'asghard';
diff --git a/packages/aws-cdk-lib/cloud-assembly-schema/scripts/update-schema.ts b/packages/aws-cdk-lib/cloud-assembly-schema/scripts/update-schema.ts
index 13a410cd4a36f..cb02b1906c4a9 100644
--- a/packages/aws-cdk-lib/cloud-assembly-schema/scripts/update-schema.ts
+++ b/packages/aws-cdk-lib/cloud-assembly-schema/scripts/update-schema.ts
@@ -14,10 +14,32 @@ function log(message: string) {
  */
 const SCHEMA_DIR = path.resolve(__dirname, '../schema');
 
-const SCHEMA_DEFINITIONS: { [schemaName: string]: { rootTypeName: string } } = {
-  'assets': { rootTypeName: 'AssetManifest' },
-  'cloud-assembly': { rootTypeName: 'AssemblyManifest' },
-  'integ': { rootTypeName: 'IntegManifest' },
+const SCHEMA_DEFINITIONS: {
+  [schemaName: string]: {
+    /**
+     * The name of the root type.
+     */
+    rootTypeName: string;
+    /**
+     * Files loaded to generate the schema.
+     * Should be relative to `cloud-assembly-schema/lib`.
+     * Usually this is just the file containing the root type.
+     */
+    files: string[];
+  }
+} = {
+  'assets': {
+    rootTypeName: 'AssetManifest',
+    files: [path.join('assets', 'schema.ts')],
+  },
+  'cloud-assembly': {
+    rootTypeName: 'AssemblyManifest',
+    files: [path.join('cloud-assembly', 'schema.ts')],
+  },
+  'integ': {
+    rootTypeName: 'IntegManifest',
+    files: [path.join('integ-tests', 'schema.ts')],
+  },
 };
 
 export const SCHEMAS = Object.keys(SCHEMA_DEFINITIONS);
@@ -65,7 +87,7 @@ export function generateSchema(schemaName: string, saveToFile: boolean = true) {
     strictNullChecks: true,
   };
 
-  const program = tjs.getProgramFromFiles([path.join(__dirname, '../lib/index.d.ts')], compilerOptions);
+  const program = tjs.getProgramFromFiles(spec.files.map(file =>path.join(__dirname, '..', 'lib', file)), compilerOptions);
   const schema = tjs.generateSchema(program, spec.rootTypeName, settings);
 
   augmentDescription(schema);
@@ -125,5 +147,5 @@ function augmentDescription(schema: any) {
  * compatibility checks.
  */
 function addAnyMetadataEntry(schema: any) {
-  schema.definitions.MetadataEntry?.properties.data.anyOf.push({ description: 'Free form data.' });
+  schema?.definitions?.MetadataEntry?.properties.data.anyOf.push({ description: 'Free form data.' });
 }
diff --git a/tools/@aws-cdk/prlint/lint.ts b/tools/@aws-cdk/prlint/lint.ts
index 43208bcbb1eb6..91501eb95e759 100644
--- a/tools/@aws-cdk/prlint/lint.ts
+++ b/tools/@aws-cdk/prlint/lint.ts
@@ -358,7 +358,7 @@ export class PullRequestLinter {
     );
     const communityRequestedChanges = reviews.data.some(
       review => this.getTrustedCommunityMembers().includes(review.user?.login ?? '')
-        && review.state !== 'APPROVED', // community members cannot request changes
+        && review.state === 'COMMENTED', // community members can only approve or comment
     );
     const communityApproved = reviews.data.some(
       review => this.getTrustedCommunityMembers().includes(review.user?.login ?? '')
diff --git a/tools/@aws-cdk/prlint/test/lint.test.ts b/tools/@aws-cdk/prlint/test/lint.test.ts
index 3fb5a595a1b6b..c693af201bc47 100644
--- a/tools/@aws-cdk/prlint/test/lint.test.ts
+++ b/tools/@aws-cdk/prlint/test/lint.test.ts
@@ -743,7 +743,7 @@ describe('integration tests required on features', () => {
       mockListReviews.mockImplementation(() => {
         return {
           data: [
-            { id: 1111122223, user: { login: 'pahud' }, state: 'COMMENT' },
+            { id: 1111122223, user: { login: 'pahud' }, state: 'COMMENTED' },
           ],
         };
       });
diff --git a/tools/@aws-cdk/spec2cdk/package.json b/tools/@aws-cdk/spec2cdk/package.json
index 1eb0dee630fc8..ce472624c5189 100644
--- a/tools/@aws-cdk/spec2cdk/package.json
+++ b/tools/@aws-cdk/spec2cdk/package.json
@@ -32,8 +32,8 @@
   },
   "license": "Apache-2.0",
   "dependencies": {
-    "@aws-cdk/aws-service-spec": "^0.0.4",
-    "@aws-cdk/service-spec-types": "^0.0.4",
+    "@aws-cdk/aws-service-spec": "^0.0.5",
+    "@aws-cdk/service-spec-types": "^0.0.5",
     "@cdklabs/tskb": "^0.0.1",
     "@cdklabs/typewriter": "^0.0.1",
     "camelcase": "^6",
diff --git a/version.v2.json b/version.v2.json
index 751482038e22f..fcc29723b38c9 100644
--- a/version.v2.json
+++ b/version.v2.json
@@ -1,4 +1,4 @@
 {
-  "version": "2.88.0",
-  "alphaVersion": "2.88.0-alpha.0"
+  "version": "2.89.0",
+  "alphaVersion": "2.89.0-alpha.0"
 }
\ No newline at end of file
diff --git a/yarn.lock b/yarn.lock
index d0a8efabb45e2..92e5e0b403a3c 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -55,12 +55,12 @@
   resolved "https://registry.npmjs.org/@aws-cdk/asset-node-proxy-agent-v5/-/asset-node-proxy-agent-v5-2.0.166.tgz#467507db141cd829ff8aa9d6ea5519310a4276b8"
   integrity sha512-j0xnccpUQHXJKPgCwQcGGNu4lRiC1PptYfdxBIH1L4dRK91iBxtSQHESRQX+yB47oGLaF/WfNN/aF3WXwlhikg==
 
-"@aws-cdk/aws-service-spec@^0.0.4":
-  version "0.0.4"
-  resolved "https://registry.npmjs.org/@aws-cdk/aws-service-spec/-/aws-service-spec-0.0.4.tgz#f5af2fac4dfcd1a9a887b1d52bceafcae1e731d8"
-  integrity sha512-pkAMbkwBfQftlrhocKTTZfnJDbgvyR4lJTHXkI8lDBomdR8/9Dcyo1vX/etBnM7fu3lbNBayBc4YHFgpiyOQYQ==
+"@aws-cdk/aws-service-spec@^0.0.5":
+  version "0.0.5"
+  resolved "https://registry.npmjs.org/@aws-cdk/aws-service-spec/-/aws-service-spec-0.0.5.tgz#db431bf58bcd5792302fd4ef81ef649020bcb08a"
+  integrity sha512-iU1l0QNTZQfjNSKOP9SnemeCxyME2ItFqctRCyPWaJe0m+6YPNuU0PS1Dwelf9SgA6fe2wK4fJlP5pA2I8PDgg==
   dependencies:
-    "@aws-cdk/service-spec-types" "^0.0.4"
+    "@aws-cdk/service-spec-types" "^0.0.5"
     "@cdklabs/tskb" "^0.0.1"
 
 "@aws-cdk/lambda-layer-kubectl-v24@^2.0.242":
@@ -68,10 +68,10 @@
   resolved "https://registry.npmjs.org/@aws-cdk/lambda-layer-kubectl-v24/-/lambda-layer-kubectl-v24-2.0.242.tgz#4273a5ad7714f933a7eba155eb9280823086db71"
   integrity sha512-7/wIOo685tmrEe4hh6zqDELhBZh5OQGf3Hd2FU2Vnwy2ZubW8qTmEw5gqJCsCrGKeYDoa1BcVhDRZ/nzjkaqyA==
 
-"@aws-cdk/service-spec-types@^0.0.4":
-  version "0.0.4"
-  resolved "https://registry.npmjs.org/@aws-cdk/service-spec-types/-/service-spec-types-0.0.4.tgz#a1c9c256144a5645002c4e0461cdaac724ea2fd0"
-  integrity sha512-1lP0BntXheMmKumAQhHmXqAR/U90BJJ5/L9azFmxqU9zqG7uAwVyZz2vRMQlWGpdMIsnkFTd9pfgghjnaYYrtg==
+"@aws-cdk/service-spec-types@^0.0.5":
+  version "0.0.5"
+  resolved "https://registry.npmjs.org/@aws-cdk/service-spec-types/-/service-spec-types-0.0.5.tgz#dc94f7dcdf733d8dde7ec64fbe8aad2c0eb5c49d"
+  integrity sha512-qOktXW7SWzAymWnDsV97l/HHBl6WaYxxjlyfIvMr5o1sDFzusyoRQVrgKrlsZ75iGYV7PlGTLLcI3Zkhz42bhQ==
   dependencies:
     "@cdklabs/tskb" "^0.0.1"