v1.4.11

What's Changed

Full Changelog: v1.4.10...v1.4.11

[1.4.11] — 2026-08-04

Added

• Lambda — Function URL data plane — CreateFunctionUrlConfig returned a {urlId}.lambda-url.{region}.on.aws URL that nothing served: a request addressed to it matched no route, fell through to S3 virtual-host addressing, and came back as NoSuchBucket. Function URLs are now invocable. A request reaching the gateway on a {urlId}.lambda-url.{region}.* host — or on the path-based /_aws/lambda-url/{urlId}/... form, for clients that can't set Host and browsers that won't resolve *.localhost — resolves the URL id to its function and invokes it with a payload-format-2.0 event carrying $default for routeKey and stage, rawPath/rawQueryString percent-encoded as AWS sends them, and body/queryStringParameters omitted rather than null. AuthType is enforced (AWS_IAM returns 403 Forbidden to an unsigned request, header-signed and presigned both pass; NONE is open), the Cors config drives preflight and response headers with a non-allowed origin getting none, and InvokeMode: RESPONSE_STREAM responses are unwrapped from the HttpResponseStream framing so the prelude supplies the status and headers instead of leaking into the body. Cookies returned via the format-2.0 cookies array become Set-Cookie headers. Contributed by @liammizrahi.
• API Gateway v1 — state is now account- and region-scoped — REST APIs, resources, methods, integrations, deployments, stages, models, API keys, and usage plans were stored globally and leaked across account and region boundaries. They now scope by account and region; execute-api dispatch resolves a REST API's owning region by id (the mock execute-api host carries no region segment) and runs the invocation in that scope, and a caller-supplied ms-custom-id stays unique across the account's regions. Persisted state carries the on-disk format v3 an older binary refuses rather than misreads; legacy snapshots restore into each API's region and v1 tags remain account-scoped. Contributed by @Areson.
• CloudWatch Logs — Insights queries are now account- and region-scoped — Logs Insights query ids were account-scoped, so a StartQuery in one region could be read or stopped from another, contrary to the regional Logs Insights API. They now scope by account and region; persisted state carries the on-disk format v3 an older binary refuses, and legacy queries restore into their referenced log group's region. Contributed by @Areson.

Fixed

• Step Functions — aws-sdk:ec2 tasks now return the SDK output shape — the EC2 Query-XML adapter passed a near-wire structure through without reshaping or typing, so describeVolumes returned VolumeSet.Item.Status where AWS returns Volumes[0].State, scalars were strings, empty collections were "" instead of [], and a requestId the SDK never returns was included — an ASL Choice written against AWS silently took the wrong branch locally. The normalizer now follows the SDK output shape: PascalCase member names, *Set wrappers pluralized and unwrapped, and list/int/bool leaves coerced, with overrides for names that cannot be inferred (e.g. keySet -> KeyPairs). Contributed by @bandle.
• CloudWatch — DescribeAlarms and metric reads over CBOR still broke the Terraform AWS provider ≥ 6.50 — after 1.4.10 fixed the alarm timestamp encoding, absent optional fields (ExtendedStatistic, Unit) were still serialized as CBOR Nil, which the provider's typed smithy-rpc-v2-cbor decoder rejected with unexpected value type *cbor.Nil; separately, GetMetricStatistics and GetMetricData returned their Timestamp / Timestamps members as strings rather than CBOR tag 1. Absent optional fields are now omitted from every CloudWatch CBOR response (real AWS never sends null), and metric-data timestamps are tag-1 encoded. Reported by @sdreger.