v0.45.0

What's Changed

• fix(docker): clear Trivy gate on two go1.26.5 stdlib HIGHs in bundled docker CLI by @vieiralucas in #2470
• chore(aws-models): weekly refresh from aws/api-models-aws by @github-actions[bot] in #2471
• fix(cloudformation): honor DeletionPolicy and UpdateReplacePolicy by @vieiralucas in #2472
• fix(ec2,iam): XML-escape user data in per-attribute describe responses by @vieiralucas in #2473
• fix: harden request-path panic/overflow DoS vectors by @vieiralucas in #2474
• fix(cloudformation): clamp GenerateSecretString PasswordLength by @vieiralucas in #2475
• fix: scope returned ARNs/endpoints to the request region, not frozen config by @vieiralucas in #2476
• fix(secretsmanager): ResourceNotFoundException returns HTTP 400, not 404 by @vieiralucas in #2477
• fix(elasticache): CopySnapshot finalizes to available instead of stuck creating by @vieiralucas in #2478
• fix(memorydb,xray): seeded default ARNs follow the request region by @vieiralucas in #2482
• fix(s3): accept every modeled StorageClass and SSEAlgorithm value by @vieiralucas in #2483
• fix(ssoadmin,logs,ec2): honor modeled members that were silently dropped by @vieiralucas in #2484
• chore(aws-models): weekly refresh from aws/api-models-aws by @github-actions[bot] in #2479
• fix(conformance): recognize S3's published shared error responses by @vieiralucas in #2486
• fix(conformance): recognize five more EC2 .NotFound error codes by @vieiralucas in #2487
• fix(kms): generate key material before taking the state lock by @vieiralucas in #2485
• fix(cognito,opensearch): return responses in the shapes the models define by @vieiralucas in #2488
• feat(acm): implement the ARN-keyed resource tagging operations by @vieiralucas in #2489
• fix(ssm): bound CreateCloudConnector inputs; recognize SSM's shared errors by @vieiralucas in #2490
• fix(rds): honor Filters on the Describe operations (#2481) by @vieiralucas in #2492
• fix(rds): return recorded backtracks and honor Filters on three more Describes by @vieiralucas in #2497
• feat(rds): record and report IAM role associations by @vieiralucas in #2498
• feat(s3): implement object annotations by @vieiralucas in #2491
• feat(backup): implement backup access points by @vieiralucas in #2495
• fix(conformance): recognize the Query-protocol services' shared errors by @vieiralucas in #2494
• feat(cloudwatch): implement log alarms by @vieiralucas in #2499
• fix(cloudformation): support YAML short-form intrinsic tags by @vieiralucas in #2496
• chore(aws-models): weekly refresh from aws/api-models-aws by @github-actions[bot] in #2493
• feat(dynamodb): implement vector indexes and SearchVectors by @vieiralucas in #2500
• fix(rds): stop putting undeclared error shapes on the wire by @vieiralucas in #2501
• feat(wafv2): implement the monetization reporting operations by @vieiralucas in #2503
• feat(cloudformation): implement ValidateTemplate and GetTemplateSummary by @vieiralucas in #2508
• feat(acm): implement the ACME certificate-issuance surface by @vieiralucas in #2506
• fix(dynamodb): make the item write path O(1) instead of O(table size) by @kubukoz in #2505
• feat(glue): complete the business catalog and reach full Glue conformance by @vieiralucas in #2509
• feat(ec2): implement application status checks by @vieiralucas in #2507
• feat(docdb,neptune): honor Filters on the Describes that document them by @vieiralucas in #2510
• feat(config): implement third-party cloud connectors by @vieiralucas in #2512
• fix(lambda): 404 function-scoped operations when the function is absent by @vieiralucas in #2513
• feat(ec2): implement IPAM internet-registry associations and routing policy registrations by @vieiralucas in #2511
• fix(ecs,lambda): a transient image pull failure no longer fails the launch by @vieiralucas in #2516
• fix(dynamodb): make DeleteItem O(log n) instead of O(table size) by @vieiralucas in #2517
• chore(aws-models): weekly refresh from aws/api-models-aws by @github-actions[bot] in #2514
• fix(dynamodb): resume Scan and PartiQL pages after deleted rows by @vieiralucas in #2518
• fix(ec2,codebuild): retry a throttled first image pull instead of failing the launch by @vieiralucas in #2519
• ci(nextest): print the output of a failed attempt that a retry then passes by @vieiralucas in #2520
• fix(dynamodb): reject updates that write a primary-key attribute by @vieiralucas in #2521
• test(core): wait out ETXTBSY before running the fake container CLI by @vieiralucas in #2522
• fix(dynamodb): resolve table ARNs in every table lookup by @vieiralucas in #2524
• fix(ec2): enforce security-group egress and ingress as independent gates by @vieiralucas in #2525
• fix(codebuild): sweep only build containers whose owning process is gone by @vieiralucas in #2526
• fix(cloudfront): hold a function to a CPU-time budget, not wall-clock time by @vieiralucas in #2523
• fix(logs): append event segments and reclaim expired logs by @Vincent-Wu-Haha in #2527
• fix(ci): retry tfacc Go module downloads; bump rustls for RUSTSEC-2026-0285 by @vieiralucas in #2531
• feat(iam): policy variables and ForAllValues over keys with no values by @vieiralucas in #2528
• feat(dynamodb): IAM enforcement, resource-based policies and fine-grained access control by @vieiralucas in #2529
• feat(dynamodb): cross-account table and stream access through ARNs by @vieiralucas in #2532
• chore(aws-models): weekly refresh from aws/api-models-aws by @github-actions[bot] in #2530
• fix(ec2): close the gaps in the IPAM internet-registry operations by @vieiralucas in #2533
• feat(cloudformation): provision stack set instances as real stacks by @vieiralucas in #2534
• fix(docker): bump bundled docker CLI to 29.8.0 to clear Go stdlib HIGHs by @vieiralucas in #2535
• fix(cloudformation): generate AWS-style names for unnamed resources by @vieiralucas in #2536
• chore(release): bump workspace to v0.45.0 by @vieiralucas in #2537

New Contributors

• @kubukoz made their first contribution in #2505
• @Vincent-Wu-Haha made their first contribution in #2527

Full Changelog: v0.44.10...v0.45.0