diff --git a/.github/actions/spelling/README.md b/.github/actions/spelling/README.md
index 1f699f3de3..da6f2e9d9b 100644
--- a/.github/actions/spelling/README.md
+++ b/.github/actions/spelling/README.md
@@ -12,6 +12,7 @@ File | Purpose | Format | Info
 [line_forbidden.patterns](line_forbidden.patterns) | Patterns to flag in checked lines | perl regular expression (order matters, first match wins) | [patterns](https://github.com/check-spelling/check-spelling/wiki/Configuration-Examples%3A-patterns)
 [expect.txt](expect.txt) | Expected words that aren't in the dictionary | one word per line (sorted, alphabetically) | [expect](https://github.com/check-spelling/check-spelling/wiki/Configuration#expect)
 [advice.md](advice.md) | Supplement for GitHub comment when unrecognized words are found | GitHub Markdown | [advice](https://github.com/check-spelling/check-spelling/wiki/Configuration-Examples%3A-advice)
+[block-delimiters.list](block-delimiters.list) | Define block begin/end markers to ignore lines of text | line with _literal string_ for **start** followed by line with _literal string_ for **end** | [block ignore](https://github.com/check-spelling/check-spelling/wiki/Feature%3A-Block-Ignore#status)
 
 Note: you can replace any of these files with a directory by the same name (minus the suffix)
 and then include multiple files inside that directory (with that suffix) to merge multiple files together.
diff --git a/.github/actions/spelling/block-delimiters.list b/.github/actions/spelling/block-delimiters.list
new file mode 100644
index 0000000000..a7817de612
--- /dev/null
+++ b/.github/actions/spelling/block-delimiters.list
@@ -0,0 +1,15 @@
+# Public Keys
+-----BEGIN PUBLIC KEY-----
+-----END PUBLIC KEY-----
+
+# RSA Private Key
+-----BEGIN RSA PRIVATE KEY-----
+-----END RSA PRIVATE KEY-----
+
+# GPG Public Key
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+-----END PGP PUBLIC KEY BLOCK-----
+
+# Certificates
+-----BEGIN CERTIFICATE-----
+-
diff --git a/.github/actions/spelling/candidate.patterns b/.github/actions/spelling/candidate.patterns
index 3d8178ce79..8c9607bb76 100644
--- a/.github/actions/spelling/candidate.patterns
+++ b/.github/actions/spelling/candidate.patterns
@@ -8,7 +8,7 @@
 ^.*\b[Cc][Ss][Pp][Ee][Ll]{2}:\s*[Dd][Ii][Ss][Aa][Bb][Ll][Ee]-[Ll][Ii][Nn][Ee]\b
 
 # patch hunk comments
-^\@\@ -\d+(?:,\d+|) \+\d+(?:,\d+|) \@\@ .*
+^@@ -\d+(?:,\d+|) \+\d+(?:,\d+|) @@ .*
 # git index header
 index (?:[0-9a-z]{7,40},|)[0-9a-z]{7,40}\.\.[0-9a-z]{7,40}
 
@@ -26,7 +26,7 @@ index (?:[0-9a-z]{7,40},|)[0-9a-z]{7,40}\.\.[0-9a-z]{7,40}
 # data url in quotes
 ([`'"])data:(?:[^ `'"].*?|)(?:[A-Z]{3,}|[A-Z][a-z]{2,}|[a-z]{3,}).*\g{-1}
 # data url
-data:[-a-zA-Z=;:/0-9+]*,\S*
+\bdata:[-a-zA-Z=;:/0-9+]*,\S*
 
 # https/http/file urls
 (?:\b(?:https?|ftp|file)://)[-A-Za-z0-9+&@#/%?=~_|!:,.;]+[-A-Za-z0-9+&@#/%=~_|]
@@ -74,7 +74,7 @@ magnet:[?=:\w]+
 # AWS SNS
 \bsns\.[-0-9a-z]+.amazonaws\.com/[-\w/&#%_?:=]*
 # AWS VPC
-#vpc-\w+
+vpc-\w+
 
 # While you could try to match `http://` and `https://` by using `s?` in `https?://`, sometimes there
 # YouTube url
@@ -152,6 +152,9 @@ themes\.googleusercontent\.com/static/fonts/[^/\s"]+/v\d+/[^.]+.
 # GHSA
 GHSA(?:-[0-9a-z]{4}){3}
 
+# GitHub actions
+\buses:\s+[-\w.]+/[-\w./]+@[-\w.]+
+
 # GitLab commit
 \bgitlab\.[^/\s"]*/\S+/\S+/commit/[0-9a-f]{7,16}#[0-9a-f]{40}\b
 # GitLab merge requests
@@ -210,7 +213,7 @@ accounts\.binance\.com/[a-z/]*oauth/authorize\?[-0-9a-zA-Z&%]*
 # medium link
 \blink\.medium\.com/[a-zA-Z0-9]+
 # medium
-\bmedium\.com/\@?[^/\s"]+/[-\w]+
+\bmedium\.com/@?[^/\s"]+/[-\w]+
 
 # microsoft
 \b(?:https?://|)(?:(?:download\.visualstudio|docs|msdn2?|research)\.microsoft|blogs\.msdn)\.com/[-_a-zA-Z0-9()=./%]*
@@ -275,7 +278,7 @@ slack://[a-zA-Z0-9?&=]+
 [0-9a-f]{32}\@o\d+\.ingest\.sentry\.io\b
 
 # Twitter markdown
-\[\@[^[/\]:]*?\]\(https://twitter.com/[^/\s"')]*(?:/status/\d+(?:\?[-_0-9a-zA-Z&=]*|)|)\)
+\[@[^[/\]:]*?\]\(https://twitter.com/[^/\s"')]*(?:/status/\d+(?:\?[-_0-9a-zA-Z&=]*|)|)\)
 # Twitter hashtag
 \btwitter\.com/hashtag/[\w?_=&]*
 # Twitter status
@@ -330,7 +333,7 @@ ipfs://[0-9a-zA-Z]{3,}
 [^"\s]+/gitweb/\S+;h=[0-9a-f]+
 
 # HyperKitty lists
-/archives/list/[^@/]+\@[^/\s"]*/message/[^/\s"]*/
+/archives/list/[^@/]+@[^/\s"]*/message/[^/\s"]*/
 
 # lists
 /thread\.html/[^"\s]+
@@ -348,7 +351,7 @@ ipfs://[0-9a-zA-Z]{3,}
 \bopen\.spotify\.com/embed/playlist/\w+
 
 # Mastodon
-\bmastodon\.[-a-z.]*/(?:media/|\@)[?&=0-9a-zA-Z_]*
+\bmastodon\.[-a-z.]*/(?:media/|@)[?&=0-9a-zA-Z_]*
 
 # scastie
 \bscastie\.scala-lang\.org/[^/]+/\w+
@@ -390,13 +393,13 @@ ipfs://[0-9a-zA-Z]{3,}
 (?:\\(?:u00|x)1[Bb]|\x1b|\\u\{1[Bb]\})\[\d+(?:;\d+|)m
 
 # URL escaped characters
-\%[0-9A-F][A-F](?=[A-Za-z])
+%[0-9A-F][A-F](?=[A-Za-z])
 # lower URL escaped characters
-\%[0-9a-f][a-f](?=[a-z]{2,})
+%[0-9a-f][a-f](?=[a-z]{2,})
 # IPv6
 \b(?:[0-9a-fA-F]{0,4}:){3,7}[0-9a-fA-F]{0,4}\b
 # c99 hex digits (not the full format, just one I've seen)
-#0x[0-9a-fA-F](?:\.[0-9a-fA-F]*|)[pP]
+0x[0-9a-fA-F](?:\.[0-9a-fA-F]*|)[pP]
 # Punycode
 \bxn--[-0-9a-z]+
 # sha
@@ -423,7 +426,7 @@ sha\d+:[0-9]*[a-f]{3,}[0-9a-f]*
 # uuid:
 \b[0-9a-fA-F]{8}-(?:[0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}\b
 # hex digits including css/html color classes:
-(?:[\\0][xX]|\\u|[uU]\+|#x?|\%23)[0-9_a-fA-FgGrR]*?[a-fA-FgGrR]{2,}[0-9_a-fA-FgGrR]*(?:[uUlL]{0,3}|[iu]\d+)\b
+(?:[\\0][xX]|\\u|[uU]\+|#x?|%23)[0-9_a-fA-FgGrR]*?[a-fA-FgGrR]{2,}[0-9_a-fA-FgGrR]*(?:[uUlL]{0,3}|[iu]\d+)\b
 # integrity
 integrity=(['"])(?:\s*sha\d+-[-a-zA-Z=;:/0-9+]{40,})+\g{-1}
 
@@ -441,7 +444,7 @@ integrity=(['"])(?:\s*sha\d+-[-a-zA-Z=;:/0-9+]{40,})+\g{-1}
 Name\[[^\]]+\]=.*
 
 # IServiceProvider / isAThing
-#\b(?:I|isA)(?=(?:[A-Z][a-z]{2,})+\b)
+\b(?:I|isA)(?=(?:[A-Z][a-z]{2,})+(?:[A-Z]|\b))
 
 # crypt
 (['"])\$2[ayb]\$.{56}\g{-1}
@@ -455,6 +458,9 @@ Name\[[^\]]+\]=.*
 # scala modules
 ("[^"]+"\s*%%?\s*){2,3}"[^"]+"
 
+# Intel intrinsics
+_mm_\w+
+
 # Input to GitHub JSON
 content: (['"])[-a-zA-Z=;:/0-9+]*=\g{-1}
 
@@ -462,11 +468,15 @@ content: (['"])[-a-zA-Z=;:/0-9+]*=\g{-1}
 # you'll want to remove the `(?=.*?")` suffix.
 # The `(?=.*?")` suffix should limit the false positives rate
 # printf
-%(?:(?:(?:hh?|ll?|[jzt])?[diuoxn]|l?[cs]|L?[fega]|p)(?=[a-z]{2,})|(?:X|L?[FEGA]|p)(?=[a-zA-Z]{2,}))(?=[_a-zA-Z]+\b)(?!%)(?=.*?['"])
+%(?:(?:(?:hh?|ll?|[jzt])?[diuoxn]|l?[cs]|L?[fega]|p)(?=[a-z]{2,})|(?:X|L?[FEGA]|p)(?=[a-zA-Z]{2,}))(?!%)(?=[_a-zA-Z]+(?!%)\b)(?=.*?['"])
+
+# Alternative printf
+# %s
+%(?:s(?=[a-z]{2,}))(?!%)(?=[_a-zA-Z]+(?!%)\b)(?=.*?['"])
 
 # Python string prefix / binary prefix
 # Note that there's a high false positive rate, remove the `?=` and search for the regex to see if the matches seem like reasonable strings
-(?<!')\b(?:B|BR|Br|F|FR|Fr|R|RB|RF|Rb|Rf|U|UR|Ur|b|bR|br|f|fR|fr|r|rB|rF|rb|rf|u|uR|ur)'(?=[A-Z]{3,}|[A-Z][a-z]{2,}|[a-z]{3,})
+(?<!['"])\b(?:B|BR|Br|F|FR|Fr|R|RB|RF|Rb|Rf|U|UR|Ur|b|bR|br|f|fR|fr|r|rB|rF|rb|rf|u|uR|ur)['"](?=[A-Z]{3,}|[A-Z][a-z]{2,}|[a-z]{3,})
 
 # Regular expressions for (P|p)assword
 \([A-Z]\|[a-z]\)[a-z]+
@@ -483,7 +493,7 @@ content: (['"])[-a-zA-Z=;:/0-9+]*=\g{-1}
 # javascript replace regex
 \.replace\(/[^/\s"]{3,}/[gim]*\s*,
 # assign regex
-= /[^*]*?(?:[a-z]{3,}|[A-Z]{3,}|[A-Z][a-z]{2,}).*/
+= /[^*].*?(?:[a-z]{3,}|[A-Z]{3,}|[A-Z][a-z]{2,}).*/[gi]?(?=\W|$)
 # perl regex test
 [!=]~ (?:/.*/|m\{.*?\}|m<.*?>|m([|!/@#,;']).*?\g{-1})
 
@@ -493,6 +503,9 @@ content: (['"])[-a-zA-Z=;:/0-9+]*=\g{-1}
 # perl run
 perl(?:\s+-[a-zA-Z]\w*)+
 
+# C network byte conversions
+(?:\d|\bh)to(?!ken)(?=[a-z])|to(?=[adhiklpun]\()
+
 # Go regular expressions
 regexp?\.MustCompile\(`[^`]*`\)
 
@@ -506,7 +519,7 @@ regexp?\.MustCompile\(`[^`]*`\)
 sed 's/(?:[^/]*?[a-zA-Z]{3,}[^/]*?/){2}
 
 # node packages
-(["'])\@[^/'" ]+/[^/'" ]+\g{-1}
+(["'])@[^/'" ]+/[^/'" ]+\g{-1}
 
 # go install
 go install(?:\s+[a-z]+\.[-@\w/.]+)+
@@ -542,17 +555,20 @@ customObjectInstantitationMethod
 \.fa-[-a-z0-9]+
 
 # bearer auth
-(['"])Bear[e][r] .*?\g{-1}
+(['"])[Bb]ear[e][r] .*?\g{-1}
+
+# bearer auth
+\b[Bb]ear[e][r]:? [-a-zA-Z=;:/0-9+.]+
 
 # basic auth
-(['"])Basic [-a-zA-Z=;:/0-9+]{3,}\g{-1}
+(['"])[Bb]asic [-a-zA-Z=;:/0-9+]{3,}\g{-1}
 
 # base64 encoded content
-([`'"])[-a-zA-Z=;:/0-9+]+=\g{-1}
+#([`'"])[-a-zA-Z=;:/0-9+]{3,}=\g{-1}
 # base64 encoded content in xml/sgml
->[-a-zA-Z=;:/0-9+]+=</
+#>[-a-zA-Z=;:/0-9+]{3,}=</
 # base64 encoded content, possibly wrapped in mime
-(?:^|[\s=;:?])[-a-zA-Z=;:/0-9+]{50,}(?:[\s=;:?]|$)
+#(?:^|[\s=;:?])[-a-zA-Z=;:/0-9+]{50,}(?:[\s=;:?]|$)
 
 # encoded-word
 =\?[-a-zA-Z0-9"*%]+\?[BQ]\?[^?]{0,75}\?=
@@ -566,14 +582,14 @@ customObjectInstantitationMethod
 # systemd mode
 systemd.*?running in system mode \([-+].*\)$
 
+# Lorem
 # Update Lorem based on your content (requires `ge` and `w` from https://github.com/jsoref/spelling; and `review` from https://github.com/check-spelling/check-spelling/wiki/Looking-for-items-locally )
 # grep '^[^#].*lorem' .github/actions/spelling/patterns.txt|perl -pne 's/.*i..\?://;s/\).*//' |tr '|' "\n"|sort -f |xargs -n1 ge|perl -pne 's/^[^:]*://'|sort -u|w|sed -e 's/ .*//'|w|review -
 # Warning, while `(?i)` is very neat and fancy, if you have some binary files that aren't proper unicode, you might run into:
-## Operation "substitution (s///)" returns its argument for non-Unicode code point 0x1C19AE (the code point will vary).
-## You could manually change `(?i)X...` to use `[Xx]...`
-## or you could add the files to your `excludes` file (a version after 0.0.19 should identify the file path)
-# Lorem
-(?:\w|\s|[,.])*\b(?i)(?:amet|consectetur|cursus|dolor|eros|ipsum|lacus|libero|ligula|lorem|magna|neque|nulla|suscipit|tempus)\b(?:\w|\s|[,.])*
+# ... Operation "substitution (s///)" returns its argument for non-Unicode code point 0x1C19AE (the code point will vary).
+# ... You could manually change `(?i)X...` to use `[Xx]...`
+# ... or you could add the files to your `excludes` file (a version after 0.0.19 should identify the file path)
+(?:(?:\w|\s|[,.])*\b(?i)(?:amet|consectetur|cursus|dolor|eros|ipsum|lacus|libero|ligula|lorem|magna|neque|nulla|suscipit|tempus)\b(?:\w|\s|[,.])*)
 
 # Non-English
 [a-zA-Z]*[ÀÁÂÃÄÅÆČÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæčçèéêëìíîïðñòóôõöøùúûüýÿĀāŁłŃńŅņŒœŚśŠšŜŝŸŽžź][a-zA-Z]{3}[a-zA-ZÀÁÂÃÄÅÆČÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæčçèéêëìíîïðñòóôõöøùúûüýÿĀāŁłŃńŅņŒœŚśŠšŜŝŸŽžź]*|[a-zA-Z]{3,}[ÀÁÂÃÄÅÆČÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæčçèéêëìíîïðñòóôõöøùúûüýÿĀāŁłŃńŅņŒœŚśŠšŜŝŸŽžź]|[ÀÁÂÃÄÅÆČÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæčçèéêëìíîïðñòóôõöøùúûüýÿĀāŁłŃńŅņŒœŚśŠšŜŝŸŽžź][a-zA-Z]{3,}
@@ -591,16 +607,25 @@ systemd.*?running in system mode \([-+].*\)$
 # latex (check-spelling >= 0.0.22)
 #\\\w{2,}\{
 
+# American Mathematical Society (AMS) / Doxygen
+TeX/AMS
+
+# File extensions
+\*\.[+\w]+,
+
 # eslint
 "varsIgnorePattern": ".+"
 
 # Windows short paths
 [/\\][^/\\]{5,6}~\d{1,2}[/\\]
 
+# cygwin paths
+/cygdrive/[a-zA-Z]/(?:Program Files(?: \(.*?\)| ?)(?:/[-+.~\\/()\w ]+)*|[-+.~\\/()\w])+
+
 # in check-spelling@v0.0.22+, printf markers aren't automatically consumed
 # printf markers
 #(?<!\\)\\[nrt](?=[a-z]{2,})
-# alternate markers if you run into latex and friends
+# alternate printf markers if you run into latex and friends
 #(?<!\\)\\[nrt](?=[a-z]{2,})(?=.*['"`])
 
 # apache
@@ -630,13 +655,24 @@ W/"[^"]+"
 # Compiler flags (linker)
 ,-B
 
+# libraries
+\blib(?!rar(?:ies|y))(?=[a-z])
+
+# WWNN/WWPN (NAA identifiers)
+\b(?:0x)?10[0-9a-f]{14}\b|\b(?:0x|3)?[25][0-9a-f]{15}\b|\b(?:0x|3)?6[0-9a-f]{31}\b
+
+# iSCSI iqn (approximate regex)
+\biqn\.[0-9]{4}-[0-9]{2}(?:[\.-][a-z][a-z0-9]*)*\b
+
 # curl arguments
-\b(?:\\n|)curl(?:\s+-[a-zA-Z]{1,2}\b)*(?:\s+-[a-zA-Z]{3,})(?:\s+-[a-zA-Z]+)*
+\b(?:\\n|)curl(?:\.exe|)(?:\s+-[a-zA-Z]{1,2}\b)*(?:\s+-[a-zA-Z]{3,})(?:\s+-[a-zA-Z]+)*
 # set arguments
-\bset(?:\s+-[abefimouxE]{1,2})*\s+-[abefimouxE]{3,}(?:\s+-[abefimouxE]+)*
+\b(?:bash|sh|set)(?:\s+-[abefimouxE]{1,2})*\s+-[abefimouxE]{3,}(?:\s+-[abefimouxE]+)*
 # tar arguments
 \b(?:\\n|)g?tar(?:\.exe|)(?:(?:\s+--[-a-zA-Z]+|\s+-[a-zA-Z]+|\s[ABGJMOPRSUWZacdfh-pr-xz]+\b)(?:=[^ ]*|))+
 # tput arguments -- https://man7.org/linux/man-pages/man5/terminfo.5.html -- technically they can be more than 5 chars long...
 \btput\s+(?:(?:-[SV]|-T\s*\w+)\s+)*\w{3,5}\b
 # macOS temp folders
 /var/folders/\w\w/[+\w]+/(?:T|-Caches-)/
+# github runner temp folders
+/home/runner/work/_temp/[-_/a-z0-9]+
diff --git a/.github/actions/spelling/excludes.txt b/.github/actions/spelling/excludes.txt
index c74e8f1fc3..dece41b18b 100644
--- a/.github/actions/spelling/excludes.txt
+++ b/.github/actions/spelling/excludes.txt
@@ -6,11 +6,10 @@
 (?:^|/)go\.sum$
 (?:^|/)package(?:-lock|)\.json$
 (?:^|/)Pipfile$
-(?:^|/)projectcalico\.mdx$
 (?:^|/)pyproject.toml
 (?:^|/)requirements(?:-dev|-doc|-test|)\.txt$
 (?:^|/)vendor/
-(?:|$^ 91.67% - excluded 11/12)(?:^|/)felixconfig\.mdx$
+/config/vocabularies/CalicoDocs/[^/]+$
 \.a$
 \.ai$
 \.all-contributorsrc$
@@ -65,7 +64,6 @@
 \.qm$
 \.s$
 \.sig$
-\.snap$
 \.so$
 \.svgz?$
 \.sys$
@@ -84,6 +82,16 @@
 \.zip$
 ^\.github/actions/spelling/
 ^\Q.github/workflows/spelling.yml\E$
+^\Qcalico-cloud/reference/resources/felixconfig.mdx\E$
+^\Qcalico-cloud_versioned_docs/version-19-1/reference/resources/felixconfig.mdx\E$
+^\Qcalico-enterprise/reference/resources/felixconfig.mdx\E$
+^\Qcalico-enterprise_versioned_docs/version-3.16/reference/resources/felixconfig.mdx\E$
+^\Qcalico-enterprise_versioned_docs/version-3.17/reference/resources/felixconfig.mdx\E$
+^\Qcalico-enterprise_versioned_docs/version-3.18-2/reference/resources/felixconfig.mdx\E$
+^\Qcalico-enterprise_versioned_docs/version-3.18/reference/resources/felixconfig.mdx\E$
+^\Qcalico-enterprise_versioned_docs/version-3.19-1/reference/resources/felixconfig.mdx\E$
+^\Qcalico_versioned_docs/version-3.25/reference/resources/felixconfig.mdx\E$
+^\Qcalico_versioned_docs/version-3.26/reference/resources/felixconfig.mdx\E$
 ^\Qstatic/.nojekyll\E$
 ^\Qstatic/css/swagger-ui.css\E$
 ^\Qstatic/json/calico-api-swagger.json\E$
diff --git a/.github/actions/spelling/expect.txt b/.github/actions/spelling/expect.txt
index 7c354ed63b..709db0d0d3 100644
--- a/.github/actions/spelling/expect.txt
+++ b/.github/actions/spelling/expect.txt
@@ -1,4 +1,3 @@
-abcd
 aca
 acn
 acr
@@ -8,9 +7,8 @@ addrtype
 addsuffix
 adom
 aead
-agaffney
 aggregationkind
-airgapped
+ajo
 aks
 alecthomas
 alertexception
@@ -25,6 +23,7 @@ anonymization
 anotherpassword
 anotheruser
 anymatch
+aoda
 apidocs
 apikey
 apiservers
@@ -35,9 +34,10 @@ apparentlymart
 applicationlayer
 aquasecurity
 araddon
+argjson
 arp
 ASNs
-Atlassian
+atlassian
 atomicwrites
 auditlog
 authenticationreviews
@@ -64,7 +64,6 @@ azureudr
 azureudrcreate
 azureuser
 azurewebsites
-backjo
 backported
 badstuff
 baremetal
@@ -93,11 +92,12 @@ bmizerany
 bmj
 bmnfd
 boolbase
-Bootstrapper
+bootstrapper
 botnet
 Bottlerocket
 boxshadow
 bpf
+BPFCONNECTTIMELOADBALANCING
 BPFCONNECTTIMELOADBALANCINGENABLED
 BPFDATAIFACEPATTERN
 BPFDISABLEUNPRIVILEGED
@@ -107,6 +107,7 @@ BPFENABLED
 BPFENFORCERPF
 BPFEXTERNALSERVICEMODE
 BPFEXTTOSERVICECONNMARK
+BPFHOSTNETWORKEDNATWITHOUTCTLB
 BPFKUBEPROXYENDPOINTSLICESENABLED
 BPFKUBEPROXYIPTABLESCLEANUPENABLED
 BPFKUBEPROXYMINSYNCPERIOD
@@ -114,6 +115,7 @@ BPFL
 BPFLOGLEVEL
 BPFPOLICYDEBUGENABLED
 bpftool
+bpg
 bquq
 brd
 breadcrumb
@@ -143,6 +145,7 @@ calicoq
 calicousers
 calicovpp
 calieb
+calient
 calim
 calinode
 calivppctl
@@ -157,6 +160,7 @@ CAPTUREMAXROTATIONSECONDS
 CAPTUREMAXSIZEBYTES
 cartservice
 caseydavenport
+cbf
 ccb
 ccdf
 cdc
@@ -201,7 +205,6 @@ cloudtrace
 cloudversion
 clsact
 clsx
-CLTB
 clust
 Clusterconfiguration
 clusterinfo
@@ -213,7 +216,6 @@ clusterrolebinding
 clusterwide
 clym
 cmds
-cmv
 cnapp
 cnat
 cncf
@@ -236,17 +238,20 @@ containernetworking
 containerregistry
 containersecurity
 copsvx
+coraza
 coredns
 coredump
 corefile
 corejs
+coreruleset
 coutinhop
-crashloop
 crawlee
 crd
 cri
 crio
 crt
+csbdl
+csh
 CSRs
 csum
 csztr
@@ -266,6 +271,7 @@ cytoscape
 cytoscapejs
 daemonset
 dagre
+danudey
 datacenter
 datamodel
 datapath
@@ -277,10 +283,10 @@ DATASTORETYPE
 datcon
 dateutil
 davecgh
+davidgiga
 dbb
 dbc
 dbll
-DCF
 ddf
 dds
 debian
@@ -290,7 +296,6 @@ deepdiff
 deepmerge
 deeppacketinspection
 DEFAULTENDPOINTTOHOSTACTION
-dekker
 deploymentconfig
 detailyang
 devicegroup
@@ -344,7 +349,6 @@ downloadsurl
 downsides
 DPath
 dpdk
-dpi
 dpo
 dport
 DQVRFLS
@@ -357,39 +361,48 @@ DSL
 dsn
 dsv
 DVersion
+dxm
+Dynatrace
 eastcoast
 easyjson
 ebpf
 ecmp
 ecn
 ecp
+eezxd
 egressgateway
+egressgatewaypolicy
 EGRESSIPROUTINGRULEPRIORITY
 EGRESSIPSUPPORT
 EGRESSIPVXLANPORT
 EGRESSIPVXLANVNI
 egw
+egwpolicy
 ejr
 eksctl
 Elasticssearch
 emojis
 encap
+endef
 endfront
 endpointport
 ENDPOINTREPORTINGDELAYSECS
 ENDPOINTREPORTINGENABLED
 endpointslices
 endpointsselection
+ENDPOINTSTATUSPATHPREFIX
 endtime
 eni
 enp
 ent
 entityrule
+entra
 envconfig
 envify
 envoyproxy
 epel
 Equifax
+esac
 esn
 ETCDADDR
 ETCDCAFILE
@@ -402,9 +415,8 @@ ethertype
 EUI
 EUS
 evals
-Ewh
+evn
 exfiltrating
-EXMBUGA
 Expando
 externalnetwork
 EXTERNALNODESCIDRLIST
@@ -417,6 +429,7 @@ FAKEROOT
 fasaxc
 fbcb
 fbjs
+fcf
 fcose
 fcuello
 FDB
@@ -433,15 +446,16 @@ feodo
 fetcd
 ffd
 fff
-Ffs
+ffilippopoulos
 fgf
-findstr
+fgw
 finwise
 firefox
 Firewalld
 firewalled
 firewallpolicy
 firewalls
+fkk
 flannelcni
 flexvol
 flexvolume
@@ -479,8 +493,7 @@ fortimgr
 fortinet
 FOUC
 FQDNs
-freecaykes
-frezbo
+fqu
 frf
 frozenprocess
 fsa
@@ -534,7 +547,7 @@ gostrongswanvici
 gpgcheck
 gpgkey
 grafana
-GRC
+grqsg
 gso
 gsuite
 GSUNBVEUt
@@ -567,6 +580,7 @@ hipstershop
 hjiawei
 HJMS
 hkwnc
+hma
 hns
 honeypods
 honeypots
@@ -587,7 +601,6 @@ httpmock
 httppathmatch
 httppull
 hugepages
-hugetlb
 huiyizzz
 huoqifeng
 hvvg
@@ -604,11 +617,12 @@ idf
 idr
 idsevents
 IFACEPATTERN
+Ifaces
 ifd
-ifeq
 ifindex
 ifm
 IFNAME
+ifneq
 ifprefix
 ifstate
 IGPs
@@ -623,7 +637,7 @@ imagepath
 imageset
 imagesize
 imbalanced
-IMDS
+imds
 inforeader
 ingressgateway
 iniflags
@@ -638,15 +652,12 @@ interoperate
 intranode
 intrusiondetection
 INXIX
-iommu
-iova
 ipaddr
 ipam
 ipamblocks
 ipamconfig
 ipamconfigurations
 ipamhandles
-IPin
 IPINIPENABLED
 IPINIPMTU
 ipip
@@ -664,7 +675,6 @@ IPSECMODE
 IPSECPSKFILE
 ipsets
 IPSETSREFRESHINTERVAL
-iptable
 IPTABLESBACKEND
 IPTABLESFILTERALLOWACTION
 IPTABLESLOCKFILEPATH
@@ -679,6 +689,7 @@ iputils
 ipvs
 IPVXLAN
 IPVXLANVNI
+irrp
 isarray
 isequal
 Iserver
@@ -692,6 +703,7 @@ itype
 jarcoal
 jdoss
 jiang
+jigo
 jinzhu
 jira
 jlk
@@ -709,9 +721,9 @@ jsonpickle
 jsrsasign
 Jstarfish
 JTi
-juanfresia
 Jumpmap
 jumpstart
+Juo
 jwjq
 jxuumt
 kardianos
@@ -722,7 +734,6 @@ kelseyhightower
 kernelconfig
 keyout
 keyspace
-KHTML
 Kiali
 kibana
 kindnetd
@@ -737,9 +748,11 @@ kpt
 krishgobinath
 krisiasty
 ksa
+kta
 ktx
 kubeadm
 kubeconfigs
+kubecontrollers
 kubecontrollersconfig
 kubecontrollersconfiguration
 kubeletwin
@@ -755,8 +768,9 @@ KVj
 KVM
 kvs
 Lamborghini
-laurenceman
+lastword
 LBaa
+lbogdan
 lcore
 ldaps
 leaderelection
@@ -766,16 +780,9 @@ leschenko
 lestrrat
 lexluthor
 lft
+lha
 lht
 Libbpf
-libcalico
-libcni
-libexec
-libinjection
-libp
-libphonenumber
-libpthread
-libresolv
 licensekey
 lifecycles
 linkdown
@@ -783,6 +790,7 @@ linkedin
 linuxnet
 lithammer
 liudalibj
+lkfz
 LLGR
 lma
 lmm
@@ -819,12 +827,12 @@ logstorage
 logtime
 logtostderr
 lookback
-lou
 lpx
 lre
 ltsc
 lvl
 lwr
+lyh
 Lzc
 mailru
 mallocs
@@ -837,10 +845,12 @@ manualhelm
 manylinux
 masap
 MASQ
+matthewdupre
 maxdata
 MAXIPSETSIZE
 MAXLOGS
 mazdakn
+mbv
 mcache
 mcm
 mcr
@@ -855,7 +865,6 @@ METADATAADDR
 METADATAPORT
 metallb
 metastring
-MEUH
 mgleung
 mhmxs
 mic
@@ -864,7 +873,6 @@ Microdata
 microevent
 microk
 microsegmentation
-MII
 mipearson
 Mirai
 Mirantis
@@ -946,6 +954,7 @@ nftables
 nic
 nifb
 nik
+nimimeht
 nlb
 nman
 nmap
@@ -956,6 +965,7 @@ nodeagent
 nodecontainer
 nodecontroller
 nodegroup
+nodeinstance
 nodeip
 nodelocaldns
 nodename
@@ -964,7 +974,6 @@ nodepool
 nodeport
 noderunning
 nohuge
-noiommu
 noqueue
 noreferreer
 notrack
@@ -976,13 +985,13 @@ nssm
 nsswitch
 numa
 nxadm
+obw
 ocp
 oidc
 ojsonpath
 olekukonko
 olivere
 olljanat
-oneshot
 Onforward
 onlink
 onprem
@@ -1005,37 +1014,38 @@ osext
 osl
 osrg
 oss
-overlayfs
 overlimits
 OVN
 OVS
-OWASP
+owasp
 owide
+oxr
 oyaml
-OZXRz
+ozdanborne
 packagename
 packetcapture
 paloaltonetworks
 pango
 parameterised
-pasanw
 pascalcase
 patrickmn
 pcap
 pcns
+pcqm
 peerings
 pegjs
 pendo
 pfifo
 pfm
+pfrz
 pgrep
+phonenumber
 phy
 pimterry
 pingtest
 pki
 pkts
 platf
-Plite
 plotly
 PNAT
 pnm
@@ -1050,7 +1060,6 @@ policyrecommendationscope
 policysync
 POLICYSYNCPATHPREFIX
 POLLFREQ
-popd
 popperjs
 Poppins
 Popsvx
@@ -1064,6 +1073,7 @@ preinstalled
 Prepull
 Preschedule
 prfsha
+PRJ
 proactively
 processpath
 prodname
@@ -1091,17 +1101,18 @@ promhttp
 proptype
 prot
 protobuf
+protoport
 Prouter
 provisioners
 psa
 PSH
 psp
-pushd
-pwsh
+pthread
+pudfjs
+pxggq
 Pxxxxxx
 pyasn
 pyparsing
-pytest
 qclass
 qdisc
 qfgj
@@ -1116,6 +1127,7 @@ querybuilder
 queryserver
 quitquitquit
 QYoo
+qzpkt
 radixo
 raf
 rafaelvanoni
@@ -1130,9 +1142,9 @@ realgaurav
 realip
 rearchitected
 redhat
-redref
 refcnt
 regexes
+relabelings
 relateurl
 remotecluster
 remoteclusterconfig
@@ -1140,7 +1152,6 @@ remoteclusterconfiguration
 remotedev
 REMOVEEXTERNALROUTES
 renderkid
-rene
 replicaset
 REPORTINGINTERVALSECS
 REPORTINGTTLSECS
@@ -1150,7 +1161,9 @@ resolv
 resynced
 resyncing
 resyncs
+retagging
 reuseport
+reviewdog
 rfw
 rhsm
 rke
@@ -1158,6 +1171,7 @@ rkhnf
 roadmap
 robbrockbank
 robfig
+rodrigorfk
 rolebinding
 rolepolicy
 rotatelogs
@@ -1167,7 +1181,6 @@ ROUTEREFRESHINTERVAL
 ROUTESOURCE
 routestatus
 ROUTESYNCDISABLED
-routetable
 routetablerange
 RPF
 rpfilter
@@ -1183,6 +1196,7 @@ rtt
 rtype
 rulemetadata
 ruleset
+runc
 runcmd
 runlevel
 runsv
@@ -1193,8 +1207,11 @@ sankey
 SAs
 scaleloader
 schd
-Scheerer
 screenshots
+sealedsecrets
+securityeventwebhook
+securityeventwebhookconfigvar
+securityeventwebhookconfigvarsource
 selectdocs
 SEO
 SERVERCERTFILE
@@ -1244,7 +1261,6 @@ snat
 snetworkplumbingwg
 snp
 SOCKMAP
-socksvr
 SOI
 somefile
 someip
@@ -1254,6 +1270,7 @@ someuser
 sonarjs
 songjiang
 soupsieve
+spammy
 spi
 SPIFFE
 spikecurtis
@@ -1295,7 +1312,6 @@ SYSTEMDRIVE
 SZez
 tablewriter
 tagline
-Tahoma
 tamcore
 Tanzu
 tapable
@@ -1308,11 +1324,13 @@ termcolor
 termie
 terraform
 testid
+testiface
 testvm
 tga
 tgz
 threatdef
 threatfeed
+Ths
 Thu
 tiername
 tigera
@@ -1362,7 +1380,6 @@ TYPHAWRITETIMEOUT
 uablrek
 uber
 UCP
-UECx
 uio
 umd
 uncordon
@@ -1387,15 +1404,14 @@ uttaro
 validatingwebhookconfigurations
 vcpu
 vdom
-Verdana
 veth
 vfio
 vfzgh
 vhhvw
-Vicz
 viewports
 vif
 virbr
+virt
 virtio
 vishvananda
 visit'ing
@@ -1406,7 +1422,9 @@ vmlinux
 vms
 vmxnet
 VNC
+vnd
 vnet
+vnext
 VNI
 vnic
 voltron
@@ -1436,6 +1454,7 @@ VXLANVNI
 VZBVEUg
 VZLS
 WAFs
+watchercache
 wbhv
 wcwidth
 wdoekes
@@ -1456,17 +1475,22 @@ wireframes
 wireserver
 Wireshark
 wistia
+wkr
 wlan
 wlp
 wmcb
 WMCO
 wni
+wokz
+wordpress
 workiva
 workloadendpoint
 workloadendpointcontroller
 WORKLOADSOURCESPOOFING
 wpdipagkg
+wrappedcallbacks
 wrt
+wsuzl
 WXGM
 wzdgp
 XAddress
@@ -1479,6 +1503,7 @@ xlarge
 Xpress
 XREFS
 xtables
+xukzj
 xvf
 xxs
 yalp
@@ -1492,8 +1517,7 @@ yggh
 yglrpt
 YHR
 youtube
-yussufsh
 zipp
+zipzvv
 znw
-ZTENMAs
 ZYz
diff --git a/.github/actions/spelling/line_forbidden.patterns b/.github/actions/spelling/line_forbidden.patterns
index 4b0bb2db6d..180a29237a 100644
--- a/.github/actions/spelling/line_forbidden.patterns
+++ b/.github/actions/spelling/line_forbidden.patterns
@@ -1,134 +1,169 @@
 # reject `m_data` as VxWorks defined it and that breaks things if it's used elsewhere
 # see [fprime](https://github.com/nasa/fprime/commit/d589f0a25c59ea9a800d851ea84c2f5df02fb529)
 # and [Qt](https://github.com/qtproject/qt-solutions/blame/fb7bc42bfcc578ff3fa3b9ca21a41e96eb37c1c7/qtscriptclassic/src/qscriptbuffer_p.h#L46)
-# \bm_data\b
+#\bm_data\b
 
+# Were you debugging using a framework with `fit()`?
 # If you have a framework that uses `it()` for testing and `fit()` for debugging a specific test,
-# you might not want to check in code where you were debugging w/ `fit()`, in which case, you might want
-# to use this:
+# you might not want to check in code where you skip all the other tests.
 #\bfit\(
 
-# s.b. anymore
+# Should be `anymore`
 \bany more[,.]
 
-# s.b. cannot
+# Should be `cannot` (or `can't`)
+# See https://www.grammarly.com/blog/cannot-or-can-not/
+# > Don't use `can not` when you mean `cannot`. The only time you're likely to see `can not` written as separate words is when the word `can` happens to precede some other phrase that happens to start with `not`.
+# > `Can't` is a contraction of `cannot`, and it's best suited for informal writing.
+# > In formal writing and where contractions are frowned upon, use `cannot`.
+# > It is possible to write `can not`, but you generally find it only as part of some other construction, such as `not only . . . but also.`
+# - if you encounter such a case, add a pattern for that case to patterns.txt.
 \b[Cc]an not\b
 
-# s.b. GitHub
+# Should be `GitHub`
 (?<![&*.]|// |\btype )\bGithub\b(?![{)])
 
-# s.b. GitLab
+# Should be `GitLab`
 (?<![&*.]|// |\btype )\bGitlab\b(?![{)])
 
-# s.b. JavaScript
+# Should be `JavaScript`
 \bJavascript\b
 
-# s.b. macOS or Mac OS X or ...
+# Should be `macOS` or `Mac OS X` or ...
 \bMacOS\b
 
-# s.b. Microsoft
+# Should be `Microsoft`
 \bMicroSoft\b
 
-# s.b. OAuth
+# Should be `OAuth`
 (?:^|[^-/*$])[ '"]oAuth(?: [a-z]|\d+ |[^ a-zA-Z0-9:;_.()])
 
-# s.b. TypeScript
+# Should be `RabbitMQ`
+\bRabbitmq\b
+
+# Should be `TypeScript`
 \bTypescript\b
 
-# s.b. another
+# Should be `another`
 \ban[- ]other\b
 
-# s.b. case-(in)sensitive
+# Should be `case-(in)sensitive`
 \bcase (?:in|)sensitive\b
 
-# s.b. deprecation warning
+# Should be `coinciding`
+\bco-inciding\b
+
+# Should be `deprecation warning(s)`
 \b[Dd]epreciation [Ww]arnings?\b
 
-# s.b. greater than
+# Should be `greater than`
 \bgreater then\b
 
-# s.b. in front of
+# Should be `ID`
+#\bId\b
+
+# Should be `in front of`
 \bin from of\b
 
-# s.b. into
+# Should be `into`
 # when not phrasal and when `in order to` would be wrong:
 # https://thewritepractice.com/into-vs-in-to/
 #\sin to\s(?!if\b)
 
-# s.b. is obsolete
+# Should be `use`
+\sin used by\b
+
+# Should be `is obsolete`
 \bis obsolescent\b
 
-# s.b. it's or its
+# Should be `it's` or `its`
 \bits['’]
 
-# s.b. opt-in
+# Should be `its`
+\bit's(?= own\b)
+
+# Should be `perform its`
+\bperform it's\b
+
+# Should be `opt-in`
 #(?<!\sfor)\sopt in\s
 
-# s.b. less than
+# Should be `less than`
 \bless then\b
 
-# s.b. one of
+# Should be `load balancer`
+\b[Ll]oud balancer
+
+# Should be `one of`
 \bon of\b
 
-# s.b. otherwise
+# Should be `otherwise`
 \bother[- ]wise\b
 
-# s.b. or (more|less)
+# Should be `or (more|less)`
 \bore (?:more|less)\b
 
-# s.b. rather than
+# Should be `rather than`
 \brather then\b
 
-# s.b. `regardless, ...` or `regardless of (whether)`
+# Should be `regardless, ...` or `regardless of (whether)`
 \b[Rr]egardless if you\b
 
-# s.b. nonexistent
+# Should be `no longer needed`
+\bno more needed\b(?! than\b)
+
+# Should be `did not exist`
+\bwere not existent\b
+
+# Should be `nonexistent`
 \bnon existing\b
+
+# Should be `nonexistent`
 \b[Nn]o[nt][- ]existent\b
 
-# s.b. brief / details/ param / return / retval
+# Should be `@brief` / `@details` / `@param` / `@return` / `@retval`
 (?:^\s*|(?:\*|//|/*)\s+`)[\\@](?:breif|(?:detail|detials)|(?:params(?!\.)|prama?)|ret(?:uns?)|retvl)\b
 
-# s.b. preexisting
-#[Pp]re[- ]existing
+# Should be `preexisting`
+[Pp]re[- ]existing
 
-# s.b. preempt
+# Should be `preempt`
 [Pp]re[- ]empt\b
 
-# s.b. preemptively
+# Should be `preemptively`
 [Pp]re[- ]emptively
 
-# s.b. recently changed or recent changes
+# Should be `recently changed` or `recent changes`
 [Rr]ecent changed
 
-# s.b. reentrancy
+# Should be `reentrancy`
 [Rr]e[- ]entrancy
 
-# s.b. reentrant
+# Should be `reentrant`
 [Rr]e[- ]entrant
 
-# s.b. understand
+# Should be `understand`
 \bunder stand\b
 
-# s.b. workarounds
+# Should be `workarounds`
 \bwork[- ]arounds\b
 
-# s.b. workaround
+# Should be `workaround`
 (?:(?:[Aa]|[Tt]he|ugly)\swork[- ]around\b|\swork[- ]around\s+for)
 
-# s.b. (coarse|fine)-grained
+# Should be `(coarse|fine)-grained`
 \b(?:coarse|fine) grained\b
 
-# s.b. neither/nor -- or reword
+# Should be `neither/nor` -- or reword
 #\bnot\b[^.?!"/(]+\bnor\b
 
-# probably a double negative
-# s.b. neither/nor (plus rewording the beginning)
+# Should be `neither/nor` (plus rewording the beginning)
+# This is probably a double negative...
 #\bnot\b[^.?!"/]*\bneither\b[^.?!"/(]*\bnor\b
 
-# In English, it is generally wrong to have the same word twice in a row without punctuation.
-# Duplicated words are generally mistakes.
-# There are a few exceptions where it is acceptable (e.g. "that that").
-# If the highlighted doubled word pair is in a code snippet, you can write a pattern to mask it.
-# If the highlighted doubled word pair is in prose, have someone read the English before you dismiss this error.
+# In English, duplicated words are generally mistakes
+# There are a few exceptions (e.g. "that that").
+# If the highlighted doubled word pair is in:
+# * code, write a pattern to mask it.
+# * prose, have someone read the English before you dismiss this error.
 \s([A-Z]{3,}|[A-Z][a-z]{2,}|[a-z]{3,})\s\g{-1}\s
diff --git a/.github/actions/spelling/patterns.txt b/.github/actions/spelling/patterns.txt
index bca07bda5c..05d22a29c6 100644
--- a/.github/actions/spelling/patterns.txt
+++ b/.github/actions/spelling/patterns.txt
@@ -1,82 +1,94 @@
 # See https://github.com/check-spelling/check-spelling/wiki/Configuration-Examples:-patterns
 
 # Automatically suggested patterns
-# hit-count: 12020 file-count: 1763
+# hit-count: 12126 file-count: 1814
 # https/http/file urls
 (?:\b(?:https?|ftp|file)://)[-A-Za-z0-9+&@#/%?=~_|!:,.;]+[-A-Za-z0-9+&@#/%=~_|]
 
-# hit-count: 7255 file-count: 994
+# hit-count: 7306 file-count: 993
 # version suffix <word>v#
 (?:(?<=[A-Z]{2})V|(?<=[a-z]{2}|[A-Z]{2})v)\d+(?:\b|(?=[a-zA-Z_]))
 
-# hit-count: 905 file-count: 878
+# hit-count: 962 file-count: 935
 # node packages
-(["'])\@[^/'" ]+/[^/'" ]+\g{-1}
+(["'])@[^/'" ]+/[^/'" ]+\g{-1}
 
-# hit-count: 581 file-count: 126
+# hit-count: 539 file-count: 113
+# hex runs
+\b[0-9a-fA-F]{16,}\b
+
+# hit-count: 537 file-count: 123
 # kubernetes pod status lists
 # https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-phase
 \w+(?:-\w+)+\s+\d+/\d+\s+(?:Running|Pending|Succeeded|Failed|Unknown)\s+
 
-# hit-count: 515 file-count: 105
-# hex runs
-\b[0-9a-fA-F]{16,}\b
-
-# hit-count: 307 file-count: 120
+# hit-count: 321 file-count: 125
 # IPv6
 \b(?:[0-9a-fA-F]{0,4}:){3,7}[0-9a-fA-F]{0,4}\b
 
-# hit-count: 284 file-count: 93
+# hit-count: 288 file-count: 96
 # kubernetes object suffix
 -[0-9a-f]{10}-\w{5}\s
 
-# hit-count: 280 file-count: 102
+# hit-count: 272 file-count: 96
 # uuid:
 \b[0-9a-fA-F]{8}-(?:[0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}\b
 
-# hit-count: 257 file-count: 92
+# hit-count: 269 file-count: 97
 # hex digits including css/html color classes:
-(?:[\\0][xX]|\\u|[uU]\+|#x?|\%23)[0-9_a-fA-FgGrR]*?[a-fA-FgGrR]{2,}[0-9_a-fA-FgGrR]*(?:[uUlL]{0,3}|[iu]\d+)\b
+(?:[\\0][xX]|\\u|[uU]\+|#x?|%23)[0-9_a-fA-FgGrR]*?[a-fA-FgGrR]{2,}[0-9_a-fA-FgGrR]*(?:[uUlL]{0,3}|[iu]\d+)\b
 
-# hit-count: 240 file-count: 98
-# base64 encoded content, possibly wrapped in mime
-(?:^|[\s=;:?])[-a-zA-Z=;:/0-9+]{50,}(?:[\s=;:?]|$)
+# hit-count: 234 file-count: 89
+# libraries
+\blib(?!rar(?:ies|y))(?=[a-z])
 
-# hit-count: 179 file-count: 35
+# hit-count: 200 file-count: 49
 # IServiceProvider / isAThing
-\b(?:I(?!Ps)|isA)(?=(?:[A-Z][a-z]{2,})+\b)
+\b(?:IP(?=[a-z])|(?:I|isA)(?=(?:[A-Z][a-z]{2,})+(?:[A-Z]|\b)))
 
-# hit-count: 56 file-count: 13
+# hit-count: 174 file-count: 70
+# AWS VPC
+vpc-\w+
+
+# hit-count: 60 file-count: 17
 # URL escaped characters
-\%[0-9A-F][A-F](?=[A-Za-z])
+%[0-9A-F][A-F](?=[A-Za-z])
 
-# hit-count: 45 file-count: 33
+# hit-count: 48 file-count: 36
 # tar arguments
 \b(?:\\n|)g?tar(?:\.exe|)(?:(?:\s+--[-a-zA-Z]+|\s+-[a-zA-Z]+|\s[ABGJMOPRSUWZacdfh-pr-xz]+\b)(?:=[^ ]*|))+
 
 # hit-count: 20 file-count: 16
 # curl arguments
-\b(?:\\n|)curl(?:\s+-[a-zA-Z]{1,2}\b)*(?:\s+-[a-zA-Z]{3,})(?:\s+-[a-zA-Z]+)*
+\b(?:\\n|)curl(?:\.exe|)(?:\s+-[a-zA-Z]{1,2}\b)*(?:\s+-[a-zA-Z]{3,})(?:\s+-[a-zA-Z]+)*
 
 # hit-count: 13 file-count: 2
 # css url wrappings
 \burl\([^)]+\)
 
+# hit-count: 9 file-count: 5
+# C network byte conversions
+(?:\d|\bh)to(?!ken)(?=[a-z])|to(?=[adhiklpun]\()
+
 # hit-count: 7 file-count: 7
 # sed regular expressions
 sed 's/(?:[^/]*?[a-zA-Z]{3,}[^/]*?/){2}
 
-# hit-count: 4 file-count: 2
+# hit-count: 6 file-count: 3
 # Contributor
 \[[^\]]+\]\(https://github\.com/[^/\s"]+/?\)
 
-# hit-count: 3 file-count: 2
+# hit-count: 2 file-count: 1
+# data url in quotes
+([`'"])data:(?:[^ `'"].*?|)(?:[A-Z]{3,}|[A-Z][a-z]{2,}|[a-z]{3,}).*\g{-1}
+
+# hit-count: 2 file-count: 1
 # assign regex
-= /[^*]*?(?:[a-z]{3,}|[A-Z]{3,}|[A-Z][a-z]{2,}).*/
+= /[^*].*?(?:[a-z]{3,}|[A-Z]{3,}|[A-Z][a-z]{2,}).*/[gi]?(?=\W|$)
 
 # hit-count: 1 file-count: 1
-# GitHub SHA refs
-\[([0-9a-f]+)\]\(https://(?:www\.|)github.com/[-\w]+/[-\w]+/commit/\g{-1}[0-9a-f]*
+# GitHub actions
+\buses:\s+[-\w.]+/[-\w./]+@[-\w.]+
 
 # hit-count: 1 file-count: 1
 # javascript match regex
@@ -89,8 +101,11 @@ sed 's/(?:[^/]*?[a-zA-Z]{3,}[^/]*?/){2}
 token:\s+[-.\w]+
 
 \bget pods -n(?=\w)
+/\\s(?=[a-z])
 
-/\\s.*/
+certificate-authority-data: .*$
+
+\bcss-\w{6,7}\b(?=[ "](?!"))
 
 # Questionably acceptable forms of `in to`
 # Personally, I prefer `log into`, but people object
@@ -112,7 +127,10 @@ token:\s+[-.\w]+
 # go templates
 \s(\w+)\s+\g{-1}\s+\`(?:graphql|inject|json|yaml):
 # doxygen / javadoc / .net
-(?:[\\@](?:brief|groupname|t?param|return|retval)|(?:public|private|\[Parameter(?:\(.+\)|)\])(?:\s+static|\s+override|\s+readonly)*)(?:\s+\{\w+\}|)\s+(\w+)\s+\g{-1}\s
+(?:[\\@](?:brief|groupname|link|t?param|return|retval)|(?:public|private|\[Parameter(?:\(.+\)|)\])(?:\s+(?:static|override|readonly|required|virtual))*)(?:\s+\{\w+\}|)\s+(\w+)\s+\g{-1}\s
+
+# Python package registry has incorrect spelling for macOS / Mac OS X
+"Operating System :: MacOS :: MacOS X"
 
 # Commit message -- Signed-off-by and friends
 ^\s*(?:(?:Based-on-patch|Co-authored|Helped|Mentored|Reported|Reviewed|Signed-off)-by|Thanks-to): (?:[^<]*<[^>]*>|[^<]*)\s*$
diff --git a/.github/workflows/spelling.yml b/.github/workflows/spelling.yml
index 007160756d..7e01c2dcee 100644
--- a/.github/workflows/spelling.yml
+++ b/.github/workflows/spelling.yml
@@ -59,19 +59,19 @@ name: Check Spelling
 on:
   push:
     branches:
-    - "**"
+      - "**"
     tags-ignore:
-    - "**"
+      - "**"
   pull_request_target:
     branches:
-    - "**"
+      - "**"
     types:
-    - 'opened'
-    - 'reopened'
-    - 'synchronize'
+      - 'opened'
+      - 'reopened'
+      - 'synchronize'
   issue_comment:
     types:
-    - 'created'
+      - 'created'
 
 jobs:
   spelling:
@@ -90,39 +90,43 @@ jobs:
       # note: If you use only_check_changed_files, you do not want cancel-in-progress
       cancel-in-progress: true
     steps:
-    - name: check-spelling
-      id: spelling
-      uses: check-spelling/check-spelling@prerelease
-      with:
-        suppress_push_for_open_pull_request: ${{ github.actor != 'dependabot[bot]' && 1 }}
-        checkout: true
-        check_file_names: 1
-        spell_check_this: check-spelling/spell-check-this@prerelease
-        post_comment: 0
-        use_magic_file: 1
-        report-timing: 1
-        warnings: bad-regex,binary-file,deprecated-feature,ignored-expect-variant,large-file,limited-references,no-newline-at-eof,noisy-file,non-alpha-in-dictionary,token-is-substring,unexpected-line-ending,whitespace-in-dictionary,minified-file,unsupported-configuration,no-files-to-check
-        experimental_apply_changes_via_bot: 1
-        use_sarif: ${{ (!github.event.pull_request || (github.event.pull_request.head.repo.full_name == github.repository)) && 1 }}
-        extra_dictionary_limit: 20
-        extra_dictionaries:
-          cspell:software-terms/dict/softwareTerms.txt
-          cspell:aws/aws.txt
-          cspell:npm/dict/npm.txt
-          cspell:k8s/dict/k8s.txt
-          cspell:node/dict/node.txt
-          cspell:php/dict/php.txt
-          cspell:python/src/python/python-lib.txt
-          cspell:python/src/common/extra.txt
-          cspell:html/dict/html.txt
-          cspell:django/dict/django.txt
-          cspell:typescript/dict/typescript.txt
-          cspell:golang/dict/go.txt
-          cspell:fullstack/dict/fullstack.txt
-          cspell:dotnet/dict/dotnet.txt
-          cspell:filetypes/filetypes.txt
-          cspell:java/src/java.txt
-        check_extra_dictionaries: ''
+      - name: check-spelling
+        id: spelling
+        uses: check-spelling/check-spelling@prerelease
+        with:
+          suppress_push_for_open_pull_request: ${{ github.actor != 'dependabot[bot]' && 1 }}
+          checkout: true
+          check_file_names: 1
+          spell_check_this: check-spelling/spell-check-this@prerelease
+          post_comment: 0
+          use_magic_file: 1
+          report-timing: 1
+          warnings: bad-regex,binary-file,deprecated-feature,ignored-expect-variant,large-file,limited-references,no-newline-at-eof,noisy-file,non-alpha-in-dictionary,token-is-substring,unexpected-line-ending,whitespace-in-dictionary,minified-file,unsupported-configuration,no-files-to-check,unclosed-block-ignore-begin,unclosed-block-ignore-end
+          experimental_apply_changes_via_bot: 1
+          use_sarif: ${{ (!github.event.pull_request || (github.event.pull_request.head.repo.full_name == github.repository)) && 1 }}
+          check_extra_dictionaries: ''
+          extra_dictionaries: |
+            cspell:software-terms/dict/softwareTerms.txt
+            cspell:aws/aws.txt
+            cspell:npm/dict/npm.txt
+            cspell:k8s/dict/k8s.txt
+            cspell:html/dict/html.txt
+            cspell:node/dict/node.txt
+            cspell:php/dict/php.txt
+            cspell:python/src/python/python-lib.txt
+            cspell:python/src/common/extra.txt
+            cspell:django/dict/django.txt
+            cspell:typescript/dict/typescript.txt
+            cspell:golang/dict/go.txt
+            cspell:fullstack/dict/fullstack.txt
+            cspell:dotnet/dict/dotnet.txt
+            cspell:filetypes/filetypes.txt
+            cspell:java/src/java.txt
+            cspell:python/src/python/python.txt
+            cspell:java/src/java-terms.txt
+            cspell:css/dict/css.txt
+            cspell:r/src/r.txt
+            cspell:powershell/dict/powershell.txt
 
   update:
     name: Update PR
@@ -140,9 +144,9 @@ jobs:
       group: spelling-update-${{ github.event.issue.number }}
       cancel-in-progress: false
     steps:
-    - name: apply spelling updates
-      uses: check-spelling/check-spelling@prerelease
-      with:
-        experimental_apply_changes_via_bot: 1
-        checkout: true
-        ssh_key: "${{ secrets.CHECK_SPELLING }}"
+      - name: apply spelling updates
+        uses: check-spelling/check-spelling@prerelease
+        with:
+          experimental_apply_changes_via_bot: 1
+          checkout: true
+          ssh_key: "${{ secrets.CHECK_SPELLING }}"