diff --git a/.changes/1.28.10.json b/.changes/1.28.10.json
new file mode 100644
index 0000000000..51a64c29c6
--- /dev/null
+++ b/.changes/1.28.10.json
@@ -0,0 +1,37 @@
+[
+  {
+    "category": "``apigatewayv2``",
+    "description": "[``botocore``] Documentation updates for Amazon API Gateway.",
+    "type": "api-change"
+  },
+  {
+    "category": "``ce``",
+    "description": "[``botocore``] This release introduces the new API 'GetSavingsPlanPurchaseRecommendationDetails', which retrieves the details for a Savings Plan recommendation. It also updates the existing API 'GetSavingsPlansPurchaseRecommendation' to include the recommendation detail ID.",
+    "type": "api-change"
+  },
+  {
+    "category": "``chime-sdk-media-pipelines``",
+    "description": "[``botocore``] AWS Media Pipeline compositing enhancement and Media Insights Pipeline auto language identification.",
+    "type": "api-change"
+  },
+  {
+    "category": "``cloudformation``",
+    "description": "[``botocore``] This release supports filtering by DRIFT_STATUS for existing API ListStackInstances and adds support for a new API ListStackInstanceResourceDrifts. Customers can now view resource drift information from their StackSet management accounts.",
+    "type": "api-change"
+  },
+  {
+    "category": "``ec2``",
+    "description": "[``botocore``] Add \"disabled\" enum value to SpotInstanceState.",
+    "type": "api-change"
+  },
+  {
+    "category": "``glue``",
+    "description": "[``botocore``] Added support for Data Preparation Recipe node in Glue Studio jobs",
+    "type": "api-change"
+  },
+  {
+    "category": "``quicksight``",
+    "description": "[``botocore``] This release launches new Snapshot APIs for CSV and PDF exports, adds support for info icon for filters and parameters in Exploration APIs, adds modeled exception to the DeleteAccountCustomization API, and introduces AttributeAggregationFunction's ability to add UNIQUE_VALUE aggregation in tooltips.",
+    "type": "api-change"
+  }
+]
\ No newline at end of file
diff --git a/.github/codeql.yml b/.github/codeql.yml
new file mode 100644
index 0000000000..04e6bd81ba
--- /dev/null
+++ b/.github/codeql.yml
@@ -0,0 +1,2 @@
+paths:
+- "boto3/"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000000..ff97bc29b7
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,35 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: ["develop"]
+  pull_request:
+    branches: ["develop"]
+  schedule:
+    - cron: "0 0 * * 5"
+
+permissions: "read-all"
+
+jobs:
+  analyze:
+    name: "Analyze"
+    runs-on: "ubuntu-latest"
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+    - name: "Checkout repository"
+      uses: "actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3"
+
+    - name: "Run CodeQL init"
+      uses: "github/codeql-action/init@cdcdbb579706841c47f7063dda365e292e5cad7a"
+      with:
+        config-file: "./.github/codeql.yml"
+        languages: "python"
+
+    - name: "Run CodeQL autobuild"
+      uses: "github/codeql-action/autobuild@cdcdbb579706841c47f7063dda365e292e5cad7a"
+
+    - name: "Run CodeQL analyze"
+      uses: "github/codeql-action/analyze@cdcdbb579706841c47f7063dda365e292e5cad7a"
diff --git a/.github/workflows/fail-master-prs.yml b/.github/workflows/fail-master-prs.yml
index 671b81edb0..e6ca087aab 100644
--- a/.github/workflows/fail-master-prs.yml
+++ b/.github/workflows/fail-master-prs.yml
@@ -4,6 +4,9 @@ on:
   pull_request:
     branches: [ master ]
 
+permissions:
+  contents: read
+
 jobs:
   fail:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 4779c4db2e..39bb3e9eea 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -5,6 +5,9 @@ on:
   pull_request:
     branches-ignore: [ master ]
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-20.04
diff --git a/.github/workflows/run-tests.yml b/.github/workflows/run-tests.yml
index ffb340d6ad..bdb63ca04b 100644
--- a/.github/workflows/run-tests.yml
+++ b/.github/workflows/run-tests.yml
@@ -5,6 +5,9 @@ on:
   pull_request:
     branches-ignore: [ master ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
diff --git a/.github/workflows/stale_issue.yml b/.github/workflows/stale_issue.yml
index bc2be6eb26..c2d5bbdfb6 100644
--- a/.github/workflows/stale_issue.yml
+++ b/.github/workflows/stale_issue.yml
@@ -3,7 +3,10 @@ name: "Close stale issues"
 # Controls when the action will run.
 on:
   schedule:
-  - cron: "0 * * * *"
+  - cron: "0 0 * * *"
+
+permissions:
+  contents: read
 
 jobs:
   issue-cleanup:
@@ -36,6 +39,7 @@ jobs:
         # Issue timing
         days-before-stale: 5
         days-before-close: 2
+
         # If you don't want to mark a issue as being ancient based on a
         # threshold of "upvotes", you can set this here. An "upvote" is
         # the total number of +1, heart, hooray, and rocket reactions
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index df1b8c9b4b..8a90b2830b 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -2,6 +2,18 @@
 CHANGELOG
 =========
 
+1.28.10
+=======
+
+* api-change:``apigatewayv2``: [``botocore``] Documentation updates for Amazon API Gateway.
+* api-change:``ce``: [``botocore``] This release introduces the new API 'GetSavingsPlanPurchaseRecommendationDetails', which retrieves the details for a Savings Plan recommendation. It also updates the existing API 'GetSavingsPlansPurchaseRecommendation' to include the recommendation detail ID.
+* api-change:``chime-sdk-media-pipelines``: [``botocore``] AWS Media Pipeline compositing enhancement and Media Insights Pipeline auto language identification.
+* api-change:``cloudformation``: [``botocore``] This release supports filtering by DRIFT_STATUS for existing API ListStackInstances and adds support for a new API ListStackInstanceResourceDrifts. Customers can now view resource drift information from their StackSet management accounts.
+* api-change:``ec2``: [``botocore``] Add "disabled" enum value to SpotInstanceState.
+* api-change:``glue``: [``botocore``] Added support for Data Preparation Recipe node in Glue Studio jobs
+* api-change:``quicksight``: [``botocore``] This release launches new Snapshot APIs for CSV and PDF exports, adds support for info icon for filters and parameters in Exploration APIs, adds modeled exception to the DeleteAccountCustomization API, and introduces AttributeAggregationFunction's ability to add UNIQUE_VALUE aggregation in tooltips.
+
+
 1.28.9
 ======
 
diff --git a/boto3/__init__.py b/boto3/__init__.py
index c991ffac8e..e41198c685 100644
--- a/boto3/__init__.py
+++ b/boto3/__init__.py
@@ -17,7 +17,7 @@
 from boto3.session import Session
 
 __author__ = 'Amazon Web Services'
-__version__ = '1.28.9'
+__version__ = '1.28.10'
 
 
 # The default Boto3 session; autoloaded when needed.
diff --git a/setup.cfg b/setup.cfg
index 44b5c643d6..d66d366fb8 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -3,7 +3,7 @@ universal = 0
 
 [metadata]
 requires_dist =
-    botocore>=1.31.9,<1.32.0
+    botocore>=1.31.10,<1.32.0
     jmespath>=0.7.1,<2.0.0
     s3transfer>=0.6.0,<0.7.0
 
diff --git a/setup.py b/setup.py
index aa0c9ccff8..85a8800f44 100644
--- a/setup.py
+++ b/setup.py
@@ -13,7 +13,7 @@
 
 
 requires = [
-    'botocore>=1.31.9,<1.32.0',
+    'botocore>=1.31.10,<1.32.0',
     'jmespath>=0.7.1,<2.0.0',
     's3transfer>=0.6.0,<0.7.0',
 ]