v0.41.0

What's Changed

• feat(msk): Amazon MSK (kafka) restJson1 control plane — full 59-op batch 1 by @vieiralucas in #2184
• feat(msk): real Docker-backed Apache Kafka data plane — batch 2 by @vieiralucas in #2185
• feat(msk): CloudFormation AWS::MSK::* provisioner + tfacc coverage — batch 3 by @vieiralucas in #2186
• feat(msk): cluster attribute fidelity + full tfacc coverage — batch 3b by @vieiralucas in #2187
• feat(kinesisanalyticsv2): Amazon Managed Service for Apache Flink — 33-op control plane (batch 1) by @vieiralucas in #2188
• feat(kinesisanalyticsv2): real Docker-backed Flink-job data plane (batch 2) by @vieiralucas in #2189
• feat(mwaa): Amazon MWAA control plane (full 12-op restJson1 surface) by @vieiralucas in #2192
• feat(fis): Amazon FIS control plane (full 26-op restJson1 surface) by @vieiralucas in #2193
• feat(kinesisanalyticsv2): CloudFormation provisioning + tfacc coverage (batch 3) by @vieiralucas in #2190
• feat(emr): Amazon EMR control plane (full 65-op awsJson1_1 surface) by @vieiralucas in #2191
• feat(xray): AWS X-Ray control + data plane (full 38-op restJson1 surface) by @vieiralucas in #2194
• feat(appsync): AWS AppSync control plane + schema state (greenfield) by @vieiralucas in #2196
• feat(amplify): AWS Amplify control plane (greenfield) by @vieiralucas in #2197
• feat(textract): AWS Textract control plane (greenfield) by @vieiralucas in #2198
• feat(transcribe): Amazon Transcribe control plane (greenfield) by @vieiralucas in #2199
• fix(ci): relocate e2e container data-root to /mnt to stop disk-full flakes by @vieiralucas in #2200
• feat(shield): AWS Shield / Shield Advanced control plane (full 36-op awsJson1_1) by @vieiralucas in #2195
• feat(comprehend): Amazon Comprehend control plane (greenfield) by @vieiralucas in #2201
• feat(translate): Amazon Translate control plane (greenfield) by @vieiralucas in #2202
• feat(mediaconvert): AWS Elemental MediaConvert control plane (greenfield) by @vieiralucas in #2203
• feat(swf): Amazon SWF (Simple Workflow Service) control plane (greenfield) by @vieiralucas in #2204
• ci(e2e): extract nextest archive on /mnt to fix general-* ENOSPC flake by @vieiralucas in #2205
• feat(support): AWS Support API control plane (greenfield) by @vieiralucas in #2206
• feat(serverlessrepo): AWS Serverless Application Repository control plane (greenfield) by @vieiralucas in #2207
• feat(managedblockchain): Amazon Managed Blockchain control plane (greenfield) by @vieiralucas in #2208
• ci(e2e): adapt disk provisioning to runner layout (fix ENOSPC on no-/mnt runners) by @vieiralucas in #2209
• feat(docdb): Amazon DocumentDB control plane (greenfield) by @vieiralucas in #2210
• feat(neptune): Amazon Neptune control plane (greenfield) by @vieiralucas in #2211
• feat(timestream): Amazon Timestream (Write + Query) control plane (greenfield) by @vieiralucas in #2212
• feat(iotdata): AWS IoT Data Plane (device shadows + retained messages) (greenfield) by @vieiralucas in #2213
• feat(pinpoint): Amazon Pinpoint control plane (greenfield) by @vieiralucas in #2215
• style: fix clippy lints surfaced by rust 1.97 by @vieiralucas in #2222
• feat(iot): AWS IoT Core control plane (greenfield, 272 ops) by @vieiralucas in #2220
• feat(iotwireless): AWS IoT Wireless control plane (greenfield, 112 ops) by @vieiralucas in #2223
• feat(sagemaker): Amazon SageMaker control plane (greenfield, 403 ops) by @vieiralucas in #2224
• ci(docker): trivyignore CVE-2026-39822 (Go stdlib in bundled docker CLI) by @vieiralucas in #2225
• ci(docker): apply .trivyignore via trivyignores input by @vieiralucas in #2226
• ci(docker): checkout repo in scan job so Trivy finds .trivyignore by @vieiralucas in #2227
• chore(aws-models): weekly refresh from aws/api-models-aws by @github-actions[bot] in #2176
• feat(cloudfront): serve distributions on the main listener, routed by Host header (#2162) by @vieiralucas in #2221
• fix(iotwireless): persist log-levels/singleton-configs/associations; mint Action output IDs by @vieiralucas in #2229
• fix(pinpoint): 404 on writes to missing app; real RemoveAttributes; journey-metric existence checks by @vieiralucas in #2228
• fix(iot): return GetJobDocument; real policy-version subsystem; mint Action output IDs; invert principal/thing lists by @vieiralucas in #2231
• fix(sagemaker): persist Action-created resources; apply List filters; numeric-coerce timestamps; tighten resolve_key by @vieiralucas in #2230
• feat(sdks): add getDistributions() across all six SDKs by @vieiralucas in #2232
• fix(s3): decode XML entities in delete/tagging; persist encryption/rename/metadata-config; guard delivery slices; list-versions prefixes by @vieiralucas in #2233
• fix(dynamodb): validate query key schema, GSI/LSI attrs, transact bounds; quote-aware PartiQL; numeric stream-seq compare by @vieiralucas in #2234
• fix(sqs): validate VisibilityTimeout range (no receive-time panic); AWS-shaped FIFO SequenceNumber; stale-handle + DLQ fixes by @vieiralucas in #2237
• fix(sns): XML-escape user data in subscription/topic/tag read responses; type-aware filter matching by @vieiralucas in #2236
• fix(iam): validate policy existence on AttachGroupPolicy; DeleteConflict on attached policy; normalize single-object Statement; region-correct ARNs; paginate instance-profile lists by @vieiralucas in #2238
• fix(kms): per-key RSA material, import-length guard, state/MAC validation by @vieiralucas in #2239
• fix(eventbridge): correct event-pattern matching + scheduler target delivery by @vieiralucas in #2241
• fix(stepfunctions): ASL error wildcards, retry/backoff, transition ceiling, nested path validation by @vieiralucas in #2242
• fix(kinesis): record/batch size limits, shard-lineage on reshard, cheap reads by @vieiralucas in #2243
• fix(cognito): enforce MFA at sign-in, real TOTP, token-expiry + auth hardening by @vieiralucas in #2240
• fix(eks,backup,kafka): guard three request-reachable panics by @vieiralucas in #2244
• fix(core): decode form-body percent-escapes as UTF-8 bytes, not Latin-1 by @vieiralucas in #2245
• fix(apigateway): $default routing, integration method/params, execute-api host resolution by @vieiralucas in #2246
• fix(cloudwatch): guard Insights/filter-pattern panics, evaluate metric+composite alarms, list pagination by @vieiralucas in #2247
• fix(rds): apply DB rename + port/endpoint consistency, tighten modify validation by @vieiralucas in #2248
• chore(aws-models): weekly refresh from aws/api-models-aws by @github-actions[bot] in #2235
• fix(secretsmanager): enforce single AWSPREVIOUS/AWSCURRENT, validate inputs, expire deletions by @vieiralucas in #2249
• fix(ec2): stop SG-rule/volume data loss, apply filters+pagination, persist modify/assign ops by @vieiralucas in #2250
• fix(sts): validate RoleSessionName against AWS pattern (reject XML injection) by @vieiralucas in #2252
• fix(ecs): reject phantom clusters, over-limit count, negative desiredCount, phantom task-set service by @vieiralucas in #2253
• fix(elbv2): parse query-string rule conditions + validate ModifyTargetGroup by @vieiralucas in #2254
• fix(ecr): enforce tag immutability + scan/replication + real errors on the OCI push path by @vieiralucas in #2251
• fix(route53): traffic-policy persistence + record materialization + change-batch/health-check validation by @vieiralucas in #2255
• fix(ecs): scope DescribeTasks to cluster, region from ARN, drain CI pending on run failure by @vieiralucas in #2257
• fix(sts): enforce MaxSessionDuration, stop phantom-account creation, stable AssumedRoleId by @vieiralucas in #2256
• fix(ecr): validate blob PATCH Content-Range, real pull-through validation, stable pagination cursors by @vieiralucas in #2258
• test(emr): conformance coverage for all 65 EMR operations by @vieiralucas in #2260
• test(neptune): conformance coverage for all 70 Neptune operations by @vieiralucas in #2261
• test(docdb): conformance coverage for all 55 DocDB operations by @vieiralucas in #2262
• refactor(api-surface): demote leaked service/state modules to pub(crate) by @vieiralucas in #2263
• fix(apigatewayv2,codedeploy): deterministic connection map + ARN-parse guard by @vieiralucas in #2264
• fix(ecs): real DescribeServiceRevisions + opaque List pagination cursors by @vieiralucas in #2259
• refactor(api-surface): demote 5 CFN-consumed state modules to pub(crate) by @vieiralucas in #2265
• test(cloudfront): bounded-poll status transition instead of fixed sleep by @vieiralucas in #2266
• refactor(core): add core::ids and dedupe the short-id idiom by @vieiralucas in #2267
• refactor(core): finish short-id migration + drop dead code by @vieiralucas in #2268
• refactor(redshift): use core::query::optional_query_param by @vieiralucas in #2269
• refactor(eks): split 6963-line service.rs into helpers/tests modules by @vieiralucas in #2270
• refactor(codecommit): extract helper layer out of 5277-line service.rs by @vieiralucas in #2271
• fix(core): bound + memoize container-CLI probe so local conformance probes don't hang by @vieiralucas in #2272
• refactor(ec2): split 5014-line rest.rs into per-resource submodules by @vieiralucas in #2273
• refactor(cloudformation): extract 6 resource families from 9003-line provisioner mod.rs by @vieiralucas in #2274
• fix(sqs,iam): stop two data-destruction paths (bug-hunt) by @vieiralucas in #2275
• fix(iot): persist TopicRuleDestination + UpdateThingGroupsForThing by @vieiralucas in #2278
• fix(dynamodb): honor list pagination tokens + numeric-aware batch dup-key by @vieiralucas in #2277
• fix(route53): consume pagination markers instead of looping on page 1 by @vieiralucas in #2276
• fix(s3,lambda): checksum integrity, bucket-name + config validation (bug-hunt) by @vieiralucas in #2279
• fix(iot): persist security-profile attachments + DeprecateThingType (bug-hunt) by @vieiralucas in #2281
• fix(kms): key usage/state/spec validation + real ECDH DeriveSharedSecret (bug-hunt) by @vieiralucas in #2280
• fix(ssm): JIT access requests, automation signals, resource-data-sync type (bug-hunt) by @vieiralucas in #2282
• fix(apigw,apigwv2,cognito,wafv2,ecs): persist dropped params + validate managed rule groups (bug-hunt) by @vieiralucas in #2284
• fix(iotwireless): persist thing/certificate/partner-account associations (bug-hunt) by @vieiralucas in #2283
• fix(glue,sagemaker,pipes,sns,scheduler): persist versions/status + honor DLQ + FIFO/EB params (bug-hunt) by @vieiralucas in #2285
• fix(secretsmanager,dynamodb,s3,sns,iam): AWS-correct error codes/status (bug-hunt LOW) by @vieiralucas in #2291
• fix(core,cloudformation): unknown X-Amz-Target -> UnknownOperationException; UpdateStack GetAtt merge (bug-hunt) by @vieiralucas in #2287
• fix(iam,organizations,core): gate cross-account AssumeRoot on org membership (bug-hunt 5.2) by @vieiralucas in #2292
• fix(ecr,sqs,elasticache): data-durability + portability gaps (bug-hunt 4.2/4.3/4.4) by @vieiralucas in #2290
• fix(kinesis,ec2,sns,iam,ecs,secretsmanager,bedrock): validation + pagination correctness (bug-hunt) by @vieiralucas in #2286
• feat(core): recover repeated @httpquery params via query_param_all (bug-hunt 1.45) by @vieiralucas in #2293
• fix(iam): tighten service-principal trust + SAML audience binding (bug-hunt 5.6/5.7) by @vieiralucas in #2289
• fix(core,aws,s3): auth enforcement gaps (bug-hunt 5.1/5.3/5.4) by @vieiralucas in #2288
• fix(s3): validate x-amz-content-sha256 against received body (bug-hunt 5.4) by @vieiralucas in #2294
• chore(release): bump workspace to v0.41.0 by @vieiralucas in #2295

Full Changelog: v0.40.1...v0.41.0