[dependabot]

Bumps the python group with 4 updates: hypothesis, ministack, ruff and pyrefly.

Updates hypothesis from 6.169.0 to 6.170.1

Commits

• 718686d Bump hypothesis version to 6.170.1 and update changelog
• ba6c3e3 Merge pull request #4834 from Zac-HD/claude/hypothesis-4458-prototypes-nqza1f
• 7572cd0 Bump hypothesis version to 6.170.0 and update changelog
• 1ad039f Merge pull request #4871 from Zac-HD/claude/hypothesis-conformance-tests-c6877l
• a03eb1b Merge pull request #4895 from TaiSakuma/add-hypothesis-awkward
• 7219a20 Strengthen provider conformance tests and fix BytestringProvider
• e7c0eb9 Bump hypothesis version to 6.169.4 and update changelog
• c3705d2 Merge pull request #4898 from Arjun-Aravind/fix/unresolved-lazy-annotations
• 6ec54d5 Bump hypothesis version to 6.169.3 and update changelog
• 37c6420 Merge pull request #4903 from MarcoGorelli/random-seed-signature
• Additional commits viewable in compare view

Updates ministack from 1.5.26 to 1.5.28

Release notes

Sourced from ministack's releases.

v1.5.28

What's Changed

New Contributors

• @​OS-kiranmalsetty made their first contribution in ministackorg/ministack#2212

[1.5.28] — 2026-10-16

Added

• RDS — DescribeEvents with reboot events — DescribeEvents returns the availability event DB instance restarted. once a RebootDBInstance has finished, filtered by source, source type, category and time, paged with Marker and kept for 14 days; other RDS lifecycle events are not recorded yet. Contributed by @​jayjanssen.
• S3 Control — Multi-Region Access Points — CreateMultiRegionAccessPoint, DeleteMultiRegionAccessPoint, PutMultiRegionAccessPointPolicy, DescribeMultiRegionAccessPointOperation, GetMultiRegionAccessPoint, GetMultiRegionAccessPointPolicy, ListMultiRegionAccessPoints, GetMultiRegionAccessPointRoutes and SubmitMultiRegionAccessPointRoutes. The async operations apply at once and Describe reports SUCCEEDED, or FAILED with AWS's ErrorDetails for a missing bucket, two buckets in one region or a name already in use. Management is served from us-west-2 and route operations from us-east-1, us-west-2, eu-west-1, ap-northeast-1 and ap-southeast-2, as on AWS; other regions get 301 PermanentRedirect. DeleteBucket on a member returns BucketHasAccessPointsAttached. Under AUTH=true each operation needs its s3: IAM action and x-amz-account-id must name the caller's account. Access points from AWS::S3::MultiRegionAccessPoint appear in the API. Contributed by @​fabio-andre-rodrigues.
• S3 — Multi-Region Access Point failover — a request through the MRAP host goes to the member with a traffic dial of 100 that is homed in MINISTACK_REGION, else the first active member. Setting a dial to 0 moves traffic to the other member, and an update that leaves every dial at 0 is refused. Contributed by @​fabio-andre-rodrigues.
• CloudFormation — DescribeEvents — returns the validation errors of a create that fails pre-deployment validation, which the stack's CREATE_FAILED event tells the caller to look up; every request member is optional. Contributed by @​fabio-andre-rodrigues.
• WAF v2 — regex pattern sets — CreateRegexPatternSet, GetRegexPatternSet, UpdateRegexPatternSet, DeleteRegexPatternSet and ListRegexPatternSets now manage regional and CloudFront-scoped regex pattern sets, with their ARN (regexpatternset), tags and LockToken checks on update and delete (WAFOptimisticLockException for a stale token), as AWS does. Web ACL and rule group rules are stored as sent, so a RegexPatternSetReferenceStatement pointing at a pattern set ARN round-trips; the statement is not evaluated, as MiniStack does not inspect requests. Contributed by @​OS-kiranmalsetty.
• IoT — job rollout rates — jobExecutionsRolloutConfig was stored but every execution was created at once; a job now creates maximumPerMinute executions a minute, or a rate that starts at baseRatePerMinute and grows by incrementFactor for every rateIncreaseCriteria step of notified or succeeded things, notifies each thing when its execution is created, reports isConcurrent until the last batch and stops when the job is canceled or deleted. Contributed by @​iot-rocket.
• Health — auth field — /_ministack/health reports "auth": "enabled" or "disabled", the effective AUTH mode. Contributed by @​jgrumboe.
• Auth — REST API resource policies are evaluated under AUTH=true — an API Gateway resource policy took no part in the decision; for an execute-api:Invoke a statement naming the calling user or role now allows the call without an identity policy, a statement naming only the account still needs one, a Deny wins over an identity Allow, and a call without a SigV4 signature (none, or a bearer token) to a method without authorization passes only when the policy, if any, allows everyone, else it answers ACCESS_DENIED with API Gateway's message. Contributed by @​iot-rocket.
• Auth — KMS key policies are evaluated under AUTH=true — a key policy took no part in the decision; it now has to allow even in the key's own account: a statement naming the calling user or role allows the call without an identity policy, identity policies count only when the key policy has a statement for the account (the default key policy does), and a Deny wins over an identity Allow. Contributed by @​iot-rocket.
• Auth — ECR repository policies count under AUTH=true — a repository policy took no part in the decision; a statement naming the calling user or role now allows the call without an identity policy, a statement naming only the account still needs one, and a Deny wins over an identity Allow. Contributed by @​iot-rocket.
• Auth — Secrets Manager resource policies count under AUTH=true — a secret's resource policy took no part in the decision; a statement naming the calling user or role now allows the call without an identity policy, a statement naming only the account still needs one, and a Deny wins over an identity Allow. Contributed by @​iot-rocket.
• Auth — Lambda function policies count under AUTH=true — an AddPermission statement naming the calling user or role did not let a caller without an identity policy in; it now allows the actions it names (InvokeFunction, GetFunction, ...), while a statement naming only the account still needs an identity Allow, and a call that names the function by ARN is checked against that ARN. Contributed by @​iot-rocket.
• Auth — bucket policies count under AUTH=true in the owner's account — a bucket policy was consulted only for another account's requests; in the owner's account a statement naming the calling user or role now allows the request without an identity policy, a statement naming only the account still needs one, and a Deny wins over an identity Allow, CDK's aws:SecureTransport Deny on the bootstrap bucket included. Contributed by @​iot-rocket.
• Auth — queue and topic policies count under AUTH=true — a queue or topic policy statement naming the calling user or role did not let a caller without an identity policy in; in the owner's account it now allows the call, a statement naming only the account still needs an identity Allow, and across accounts both have to allow. A denial answers AuthorizationError on SNS and reports AccessDenied to SDKs on SQS, its message says "with an explicit deny in a resource-based policy" when the resource's policy denied, and the check reads the queue of the account the QueueUrl names. Contributed by @​iot-rocket.
• IoT — EnableTopicRule and DisableTopicRule — both calls were missing (POST /rules/{ruleName}/enable answered Invalid ruleName), so a rule could only be switched off by replacing it; they now set ruleDisabled, which GetTopicRule and ListTopicRules report and which stops the rule from acting on matching publishes and Basic Ingest until it is enabled again. Contributed by @​iot-rocket.
• IoT — job documents from S3 — CreateJob and CreateJobTemplate read a documentSource (s3:// or an S3 object URL) from MiniStack's S3 once, at creation, where they stored a {"documentSource": "<url>"} placeholder. A missing bucket or object, an object that is not JSON or is over 32 KB and a URL that names no S3 host are refused with AWS's messages, and CreateJob refuses document together with documentSource. Devices get every job document re-serialized as AWS sends it, without spaces and without object members that are null, while GetJobDocument keeps the stored text. Contributed by @​iot-rocket.
• IoT — presigned URLs in job documents — devices got ${aws:iot:s3-presigned-url:<url>} and ${aws:iot:s3-presigned-url-v2:<url>} placeholders as written; the iot-jobs-data API and the MQTT jobs topics now replace each with a SigV4 presigned GET URL of MiniStack's S3, signed with a session of presignedUrlConfig.roleArn and valid for expiresInSec, and CreateJob and CreateJobTemplate refuse a placeholder without a role or an S3 object URL with AWS's messages. Contributed by @​iot-rocket.
• IoT — fleet provisioning by claim — CreateProvisioningClaim issues a five-minute claim certificate that the mTLS listener accepts until it expires, and a device connected with it (or with any registered certificate) gets a certificate from $aws/certificates/create/json and registers itself through $aws/provisioning-templates/<name>/provision/json: the template's parameters, Ref and Fn::Join are resolved, the thing is created or checked against its OverrideSettings, and the certificate is activated and attached to the thing and the template's policies, with AWS's replies and rejections on the requesting connection; with AUTH=true a claim connection is limited to the certificate topics and its own template's, as on AWS. Contributed by @​iot-rocket.
• IoT — pre-provisioning hook — RegisterThing over MQTT now invokes the template's preProvisioningHook Lambda before the template is resolved and applies its answer the way AWS does: parameterOverrides are merged into the device's parameters, allowProvisioning: false is rejected as AccessDenied, and a function that fails, answers in another shape, takes longer than six seconds or may not be invoked gets AWS's InvocationError or InvalidResult. CreateProvisioningTemplate and UpdateProvisioningTemplate check the hook like AWS (a Lambda function ARN, payload version 2020-04-01, no hook on JITP templates, and an invoke permission for iot.amazonaws.com that covers the template) and store the default payload version. Contributed by @​iot-rocket.
• IoT — provisioning template versions — CreateProvisioningTemplateVersion, ListProvisioningTemplateVersions, DescribeProvisioningTemplateVersion and DeleteProvisioningTemplateVersion answered Unsupported IoT path and UpdateProvisioningTemplate refused every defaultVersionId but 1; a template now keeps up to five versions whose ids are never reused, setAsDefault and defaultVersionId choose the version that DescribeProvisioningTemplate returns and RegisterThing applies, the default version cannot be deleted, and an AWS::IoT::ProvisioningTemplate whose TemplateBody changes gets a new default version (deleting the oldest at the limit), all with AWS's errors, including its message for a body that is not JSON. Contributed by @​iot-rocket.
• Cognito — UpdateUserPoolDomain and AWS::Cognito::UserPoolDomain stack updates — UpdateUserPoolDomain was an unknown action; it now changes a domain's ManagedLoginVersion and a custom domain's certificate, CreateUserPoolDomain and DescribeUserPoolDomain return the version, and a second prefix domain on a pool is refused as on AWS. A stack update applies ManagedLoginVersion and CustomDomainConfig through it instead of running the create again, a Domain or UserPoolId change replaces the domain, the create keeps CustomDomainConfig, Ref returns the domain name and Fn::GetAtt returns CloudFrontDistribution. Contributed by @​iot-rocket.
• CloudFormation — SES configuration set updates — AWS::SES::ConfigurationSet and AWS::SES::ConfigurationSetEventDestination stored none of their options, tags or destinations, and a change re-ran the create; both now provision through the SES v2 calls and update in place, a removed option goes back to its default as on AWS, and only a Name or ConfigurationSetName change replaces them. Contributed by @​iot-rocket.
• SES v2 — configuration set options and event destinations — GetConfigurationSet returned only the name and the tags given at creation; it now returns the tracking, delivery, reputation, sending, suppression, VDM and archiving options that CreateConfigurationSet and the seven PutConfigurationSet*Options calls set, and a call clears the members it leaves out, as on AWS. CreateConfigurationSetEventDestination, GetConfigurationSetEventDestinations, UpdateConfigurationSetEventDestination and DeleteConfigurationSetEventDestination are new. CreateConfigurationSet with a name already in use is refused with AlreadyExistsException instead of replacing the set. Contributed by @​iot-rocket.
• IoT — job abort criteria — a job's abortConfig was stored but never acted on; once a device report, a CancelJobExecution, a DeleteJobExecution or a timeout meets one of its criteria, the job is now canceled with reasonCode ABORT_CANCEL and AWS's comment, together with its QUEUED executions. CreateJob and CreateJobTemplate stored any abortConfig; they now refuse what UpdateJob refuses, and all three refuse a missing criterion member, a threshold of 0 or less or with more than two decimals, and a failure type given twice. A CancelJob without force now reports forceCanceled as false. Contributed by @​iot-rocket.

Changed

• RDS — real instance reboot — RebootDBInstance now returns rebooting, stops and starts its backing database container, and waits for SQL readiness before reporting available. Data and endpoint bindings are preserved. An instance that is not available answers InvalidDBInstanceState, and a Docker failure reports failed rather than a successful reboot. Contributed by @​jayjanssen.

Fixed

• CloudFront — function status follows publish and association — DescribeFunction and ListFunctions reported the DEVELOPMENT stage as UNPUBLISHED even after PublishFunction, so Terraform's aws_cloudfront_function.status, which reads that stage, never left UNPUBLISHED; once the current development version is published it now reports UNASSOCIATED, or DEPLOYED while a distribution's cache behavior references the function, and an UpdateFunction makes it UNPUBLISHED again until the next publish. Contributed by @​fabio-andre-rodrigues.
• S3 — bucket home region is enforced — a request signed for a region other than the bucket's now returns 301 PermanentRedirect with x-amz-bucket-region, which SDKs follow; at the bucket's own regional endpoint it returns 400 AuthorizationHeaderMalformed or, presigned, AuthorizationQueryParametersError, with <Region>. HEAD gets the bodiless forms. GetBucketLocation, ListBuckets, CreateBucket, unsigned, SigV2 and SigV4a requests, MRAP requests and internal callers are exempt, and CopyObject from a source in another region still works. Contributed by @​fabio-andre-rodrigues.
• S3 — CreateBucket location constraint (breaking) — a request signed for a region other than us-east-1 must name that region as LocationConstraint, or gets IllegalLocationConstraintException; LocationConstraint=us-east-1 returns InvalidLocationConstraint. Clients that created buckets in another region without a constraint now need one. BucketAlreadyOwnedByYou and BucketAlreadyExists carry AWS's message and <BucketName>. Contributed by @​fabio-andre-rodrigues.
• S3 — ListBuckets bucket-region filter — BucketRegion lists only that region's buckets, with pagination inside the filter; a filter for another region than the endpoint's returns InvalidArgument. Contributed by @​fabio-andre-rodrigues.
• S3 — replication — delete markers replicate for V1 rules (no Filter) and for V2 rules with DeleteMarkerReplication enabled and no tag filter, from DeleteObject and DeleteObjects; version-id deletes don't. Rules with Filter.Tag or Filter.And.Tags replicate only objects carrying those tags. Contributed by @​fabio-andre-rodrigues.
• SigV4a requests no longer land in region s3 — the region was read from a credential scope that SigV4a doesn't have; a single-region X-Amz-Region-Set is used, else the default region. Contributed by @​fabio-andre-rodrigues.
• Lambda — S3 code from another region — CreateFunction, UpdateFunctionCode, PublishLayerVersion and CloudFormation return AWS's InvalidParameterValueException when the code bucket is homed elsewhere. Contributed by @​fabio-andre-rodrigues.
• Resource Groups Tagging — S3 buckets by region — GetResources, GetTagKeys and GetTagValues list only buckets homed in the region they are called in. Contributed by @​fabio-andre-rodrigues.
• CloudFormation — User Initiated on stack events — the stack's CREATE_IN_PROGRESS and UPDATE_IN_PROGRESS events of CreateStack and UpdateStack carried no reason; they now carry User Initiated, as AWS does.
• CloudFormation — AWS::S3::Bucket and existing names — an AWS::S3::Bucket whose BucketName already exists, in this account or another, was adopted (another account's became a second bucket of that name); it now fails pre-deployment validation with NAME_CONFLICT_VALIDATION, or with DisableValidation the resource's create with <name> already exists, as on AWS, and auto-named buckets get a new name for each stack instance. CreateStack, UpdateStack and CreateChangeSet take DisableValidation, and an update now runs the same pre-deployment validation, ending in UPDATE_ROLLBACK_COMPLETE without touching a resource (a bucket the stack already owns is not a conflict). With rollback disabled, a failed validation emits AWS's second CREATE_FAILED event (breaking: a stack no longer adopts a bucket left over from an earlier stack or an S3-only restore). Contributed by @​fabio-andre-rodrigues.
• AppSync — GraphQL requests on the API's own host — a POST /graphql to {apiId}.appsync-api.{region}.{host}, the endpoint uris.GRAPHQL reports, was routed to AppSync Events when unsigned and found its API only by x-api-key when signed, so an AWS_IAM API could not be called there once a second API existed; the host label now selects the API (in the host's region for an unsigned request) and /graphql on an Event API host answers 404 ResourceNotFoundException, as on AWS. Contributed by @​iot-rocket.

... (truncated)

Changelog

Sourced from ministack's changelog.

[1.5.28] — 2026-10-16

Added

• RDS — DescribeEvents with reboot events — DescribeEvents returns the availability event DB instance restarted. once a RebootDBInstance has finished, filtered by source, source type, category and time, paged with Marker and kept for 14 days; other RDS lifecycle events are not recorded yet. Contributed by @​jayjanssen.
• S3 Control — Multi-Region Access Points — CreateMultiRegionAccessPoint, DeleteMultiRegionAccessPoint, PutMultiRegionAccessPointPolicy, DescribeMultiRegionAccessPointOperation, GetMultiRegionAccessPoint, GetMultiRegionAccessPointPolicy, ListMultiRegionAccessPoints, GetMultiRegionAccessPointRoutes and SubmitMultiRegionAccessPointRoutes. The async operations apply at once and Describe reports SUCCEEDED, or FAILED with AWS's ErrorDetails for a missing bucket, two buckets in one region or a name already in use. Management is served from us-west-2 and route operations from us-east-1, us-west-2, eu-west-1, ap-northeast-1 and ap-southeast-2, as on AWS; other regions get 301 PermanentRedirect. DeleteBucket on a member returns BucketHasAccessPointsAttached. Under AUTH=true each operation needs its s3: IAM action and x-amz-account-id must name the caller's account. Access points from AWS::S3::MultiRegionAccessPoint appear in the API. Contributed by @​fabio-andre-rodrigues.
• S3 — Multi-Region Access Point failover — a request through the MRAP host goes to the member with a traffic dial of 100 that is homed in MINISTACK_REGION, else the first active member. Setting a dial to 0 moves traffic to the other member, and an update that leaves every dial at 0 is refused. Contributed by @​fabio-andre-rodrigues.
• CloudFormation — DescribeEvents — returns the validation errors of a create that fails pre-deployment validation, which the stack's CREATE_FAILED event tells the caller to look up; every request member is optional. Contributed by @​fabio-andre-rodrigues.
• WAF v2 — regex pattern sets — CreateRegexPatternSet, GetRegexPatternSet, UpdateRegexPatternSet, DeleteRegexPatternSet and ListRegexPatternSets now manage regional and CloudFront-scoped regex pattern sets, with their ARN (regexpatternset), tags and LockToken checks on update and delete (WAFOptimisticLockException for a stale token), as AWS does. Web ACL and rule group rules are stored as sent, so a RegexPatternSetReferenceStatement pointing at a pattern set ARN round-trips; the statement is not evaluated, as MiniStack does not inspect requests. Contributed by @​OS-kiranmalsetty.
• IoT — job rollout rates — jobExecutionsRolloutConfig was stored but every execution was created at once; a job now creates maximumPerMinute executions a minute, or a rate that starts at baseRatePerMinute and grows by incrementFactor for every rateIncreaseCriteria step of notified or succeeded things, notifies each thing when its execution is created, reports isConcurrent until the last batch and stops when the job is canceled or deleted. Contributed by @​iot-rocket.
• Health — auth field — /_ministack/health reports "auth": "enabled" or "disabled", the effective AUTH mode. Contributed by @​jgrumboe.
• Auth — REST API resource policies are evaluated under AUTH=true — an API Gateway resource policy took no part in the decision; for an execute-api:Invoke a statement naming the calling user or role now allows the call without an identity policy, a statement naming only the account still needs one, a Deny wins over an identity Allow, and a call without a SigV4 signature (none, or a bearer token) to a method without authorization passes only when the policy, if any, allows everyone, else it answers ACCESS_DENIED with API Gateway's message. Contributed by @​iot-rocket.
• Auth — KMS key policies are evaluated under AUTH=true — a key policy took no part in the decision; it now has to allow even in the key's own account: a statement naming the calling user or role allows the call without an identity policy, identity policies count only when the key policy has a statement for the account (the default key policy does), and a Deny wins over an identity Allow. Contributed by @​iot-rocket.
• Auth — ECR repository policies count under AUTH=true — a repository policy took no part in the decision; a statement naming the calling user or role now allows the call without an identity policy, a statement naming only the account still needs one, and a Deny wins over an identity Allow. Contributed by @​iot-rocket.
• Auth — Secrets Manager resource policies count under AUTH=true — a secret's resource policy took no part in the decision; a statement naming the calling user or role now allows the call without an identity policy, a statement naming only the account still needs one, and a Deny wins over an identity Allow. Contributed by @​iot-rocket.
• Auth — Lambda function policies count under AUTH=true — an AddPermission statement naming the calling user or role did not let a caller without an identity policy in; it now allows the actions it names (InvokeFunction, GetFunction, ...), while a statement naming only the account still needs an identity Allow, and a call that names the function by ARN is checked against that ARN. Contributed by @​iot-rocket.
• Auth — bucket policies count under AUTH=true in the owner's account — a bucket policy was consulted only for another account's requests; in the owner's account a statement naming the calling user or role now allows the request without an identity policy, a statement naming only the account still needs one, and a Deny wins over an identity Allow, CDK's aws:SecureTransport Deny on the bootstrap bucket included. Contributed by @​iot-rocket.
• Auth — queue and topic policies count under AUTH=true — a queue or topic policy statement naming the calling user or role did not let a caller without an identity policy in; in the owner's account it now allows the call, a statement naming only the account still needs an identity Allow, and across accounts both have to allow. A denial answers AuthorizationError on SNS and reports AccessDenied to SDKs on SQS, its message says "with an explicit deny in a resource-based policy" when the resource's policy denied, and the check reads the queue of the account the QueueUrl names. Contributed by @​iot-rocket.
• IoT — EnableTopicRule and DisableTopicRule — both calls were missing (POST /rules/{ruleName}/enable answered Invalid ruleName), so a rule could only be switched off by replacing it; they now set ruleDisabled, which GetTopicRule and ListTopicRules report and which stops the rule from acting on matching publishes and Basic Ingest until it is enabled again. Contributed by @​iot-rocket.
• IoT — job documents from S3 — CreateJob and CreateJobTemplate read a documentSource (s3:// or an S3 object URL) from MiniStack's S3 once, at creation, where they stored a {"documentSource": "<url>"} placeholder. A missing bucket or object, an object that is not JSON or is over 32 KB and a URL that names no S3 host are refused with AWS's messages, and CreateJob refuses document together with documentSource. Devices get every job document re-serialized as AWS sends it, without spaces and without object members that are null, while GetJobDocument keeps the stored text. Contributed by @​iot-rocket.
• IoT — presigned URLs in job documents — devices got ${aws:iot:s3-presigned-url:<url>} and ${aws:iot:s3-presigned-url-v2:<url>} placeholders as written; the iot-jobs-data API and the MQTT jobs topics now replace each with a SigV4 presigned GET URL of MiniStack's S3, signed with a session of presignedUrlConfig.roleArn and valid for expiresInSec, and CreateJob and CreateJobTemplate refuse a placeholder without a role or an S3 object URL with AWS's messages. Contributed by @​iot-rocket.
• IoT — fleet provisioning by claim — CreateProvisioningClaim issues a five-minute claim certificate that the mTLS listener accepts until it expires, and a device connected with it (or with any registered certificate) gets a certificate from $aws/certificates/create/json and registers itself through $aws/provisioning-templates/<name>/provision/json: the template's parameters, Ref and Fn::Join are resolved, the thing is created or checked against its OverrideSettings, and the certificate is activated and attached to the thing and the template's policies, with AWS's replies and rejections on the requesting connection; with AUTH=true a claim connection is limited to the certificate topics and its own template's, as on AWS. Contributed by @​iot-rocket.
• IoT — pre-provisioning hook — RegisterThing over MQTT now invokes the template's preProvisioningHook Lambda before the template is resolved and applies its answer the way AWS does: parameterOverrides are merged into the device's parameters, allowProvisioning: false is rejected as AccessDenied, and a function that fails, answers in another shape, takes longer than six seconds or may not be invoked gets AWS's InvocationError or InvalidResult. CreateProvisioningTemplate and UpdateProvisioningTemplate check the hook like AWS (a Lambda function ARN, payload version 2020-04-01, no hook on JITP templates, and an invoke permission for iot.amazonaws.com that covers the template) and store the default payload version. Contributed by @​iot-rocket.
• IoT — provisioning template versions — CreateProvisioningTemplateVersion, ListProvisioningTemplateVersions, DescribeProvisioningTemplateVersion and DeleteProvisioningTemplateVersion answered Unsupported IoT path and UpdateProvisioningTemplate refused every defaultVersionId but 1; a template now keeps up to five versions whose ids are never reused, setAsDefault and defaultVersionId choose the version that DescribeProvisioningTemplate returns and RegisterThing applies, the default version cannot be deleted, and an AWS::IoT::ProvisioningTemplate whose TemplateBody changes gets a new default version (deleting the oldest at the limit), all with AWS's errors, including its message for a body that is not JSON. Contributed by @​iot-rocket.
• Cognito — UpdateUserPoolDomain and AWS::Cognito::UserPoolDomain stack updates — UpdateUserPoolDomain was an unknown action; it now changes a domain's ManagedLoginVersion and a custom domain's certificate, CreateUserPoolDomain and DescribeUserPoolDomain return the version, and a second prefix domain on a pool is refused as on AWS. A stack update applies ManagedLoginVersion and CustomDomainConfig through it instead of running the create again, a Domain or UserPoolId change replaces the domain, the create keeps CustomDomainConfig, Ref returns the domain name and Fn::GetAtt returns CloudFrontDistribution. Contributed by @​iot-rocket.
• CloudFormation — SES configuration set updates — AWS::SES::ConfigurationSet and AWS::SES::ConfigurationSetEventDestination stored none of their options, tags or destinations, and a change re-ran the create; both now provision through the SES v2 calls and update in place, a removed option goes back to its default as on AWS, and only a Name or ConfigurationSetName change replaces them. Contributed by @​iot-rocket.
• SES v2 — configuration set options and event destinations — GetConfigurationSet returned only the name and the tags given at creation; it now returns the tracking, delivery, reputation, sending, suppression, VDM and archiving options that CreateConfigurationSet and the seven PutConfigurationSet*Options calls set, and a call clears the members it leaves out, as on AWS. CreateConfigurationSetEventDestination, GetConfigurationSetEventDestinations, UpdateConfigurationSetEventDestination and DeleteConfigurationSetEventDestination are new. CreateConfigurationSet with a name already in use is refused with AlreadyExistsException instead of replacing the set. Contributed by @​iot-rocket.
• IoT — job abort criteria — a job's abortConfig was stored but never acted on; once a device report, a CancelJobExecution, a DeleteJobExecution or a timeout meets one of its criteria, the job is now canceled with reasonCode ABORT_CANCEL and AWS's comment, together with its QUEUED executions. CreateJob and CreateJobTemplate stored any abortConfig; they now refuse what UpdateJob refuses, and all three refuse a missing criterion member, a threshold of 0 or less or with more than two decimals, and a failure type given twice. A CancelJob without force now reports forceCanceled as false. Contributed by @​iot-rocket.

Changed

• RDS — real instance reboot — RebootDBInstance now returns rebooting, stops and starts its backing database container, and waits for SQL readiness before reporting available. Data and endpoint bindings are preserved. An instance that is not available answers InvalidDBInstanceState, and a Docker failure reports failed rather than a successful reboot. Contributed by @​jayjanssen.

Fixed

• CloudFront — function status follows publish and association — DescribeFunction and ListFunctions reported the DEVELOPMENT stage as UNPUBLISHED even after PublishFunction, so Terraform's aws_cloudfront_function.status, which reads that stage, never left UNPUBLISHED; once the current development version is published it now reports UNASSOCIATED, or DEPLOYED while a distribution's cache behavior references the function, and an UpdateFunction makes it UNPUBLISHED again until the next publish. Contributed by @​fabio-andre-rodrigues.
• S3 — bucket home region is enforced — a request signed for a region other than the bucket's now returns 301 PermanentRedirect with x-amz-bucket-region, which SDKs follow; at the bucket's own regional endpoint it returns 400 AuthorizationHeaderMalformed or, presigned, AuthorizationQueryParametersError, with <Region>. HEAD gets the bodiless forms. GetBucketLocation, ListBuckets, CreateBucket, unsigned, SigV2 and SigV4a requests, MRAP requests and internal callers are exempt, and CopyObject from a source in another region still works. Contributed by @​fabio-andre-rodrigues.
• S3 — CreateBucket location constraint (breaking) — a request signed for a region other than us-east-1 must name that region as LocationConstraint, or gets IllegalLocationConstraintException; LocationConstraint=us-east-1 returns InvalidLocationConstraint. Clients that created buckets in another region without a constraint now need one. BucketAlreadyOwnedByYou and BucketAlreadyExists carry AWS's message and <BucketName>. Contributed by @​fabio-andre-rodrigues.
• S3 — ListBuckets bucket-region filter — BucketRegion lists only that region's buckets, with pagination inside the filter; a filter for another region than the endpoint's returns InvalidArgument. Contributed by @​fabio-andre-rodrigues.
• S3 — replication — delete markers replicate for V1 rules (no Filter) and for V2 rules with DeleteMarkerReplication enabled and no tag filter, from DeleteObject and DeleteObjects; version-id deletes don't. Rules with Filter.Tag or Filter.And.Tags replicate only objects carrying those tags. Contributed by @​fabio-andre-rodrigues.
• SigV4a requests no longer land in region s3 — the region was read from a credential scope that SigV4a doesn't have; a single-region X-Amz-Region-Set is used, else the default region. Contributed by @​fabio-andre-rodrigues.
• Lambda — S3 code from another region — CreateFunction, UpdateFunctionCode, PublishLayerVersion and CloudFormation return AWS's InvalidParameterValueException when the code bucket is homed elsewhere. Contributed by @​fabio-andre-rodrigues.
• Resource Groups Tagging — S3 buckets by region — GetResources, GetTagKeys and GetTagValues list only buckets homed in the region they are called in. Contributed by @​fabio-andre-rodrigues.
• CloudFormation — User Initiated on stack events — the stack's CREATE_IN_PROGRESS and UPDATE_IN_PROGRESS events of CreateStack and UpdateStack carried no reason; they now carry User Initiated, as AWS does.
• CloudFormation — AWS::S3::Bucket and existing names — an AWS::S3::Bucket whose BucketName already exists, in this account or another, was adopted (another account's became a second bucket of that name); it now fails pre-deployment validation with NAME_CONFLICT_VALIDATION, or with DisableValidation the resource's create with <name> already exists, as on AWS, and auto-named buckets get a new name for each stack instance. CreateStack, UpdateStack and CreateChangeSet take DisableValidation, and an update now runs the same pre-deployment validation, ending in UPDATE_ROLLBACK_COMPLETE without touching a resource (a bucket the stack already owns is not a conflict). With rollback disabled, a failed validation emits AWS's second CREATE_FAILED event (breaking: a stack no longer adopts a bucket left over from an earlier stack or an S3-only restore). Contributed by @​fabio-andre-rodrigues.
• AppSync — GraphQL requests on the API's own host — a POST /graphql to {apiId}.appsync-api.{region}.{host}, the endpoint uris.GRAPHQL reports, was routed to AppSync Events when unsigned and found its API only by x-api-key when signed, so an AWS_IAM API could not be called there once a second API existed; the host label now selects the API (in the host's region for an unsigned request) and /graphql on an Event API host answers 404 ResourceNotFoundException, as on AWS. Contributed by @​iot-rocket.
• Cognito — no ID token without openid — the /oauth2/token authorization code and refresh token grants returned an id_token whatever was granted; they now return one only when the grant carries openid, as AWS does, and a refresh token from InitiateAuth or AdminInitiateAuth still gets one. Contributed by @​iot-rocket.
• Cognito — token endpoint access tokens carry the granted scopes — /oauth2/token wrote aws.cognito.signin.user.admin into every access token whatever was granted; the authorization code, client credentials and refresh token grants now write the requested scopes the app client allows (all of them when none are requested, only resource server scopes for client credentials) in the order AWS lists them, refreshed tokens keep the original scopes, and the pre token generation event's request.scopes lists them, so API Gateway scope checks decide as on AWS. Contributed by @​iot-rocket.
• S3 — object ACL grants answer another account's read — a bucket owned by another account refused every read that only the object ACL granted: the ACL was looked up under the wrong version, and a grant to the caller's canonical ID was never read. With ACLs enabled, a READ grant to the account or a group now opens GetObject and HeadObject of the version it was set on, ?versionId= included, and READ_ACP opens GetObjectAcl; a grant to one account is not public, so Block Public Access leaves it in force. Contributed by @​iot-rocket.
• CloudWatch — DescribeAlarms and DescribeAlarmHistory paging — both returned at most MaxRecords items (default 100) and never a NextToken, so a paginator stopped after the first page; they now return a NextToken while more items match, default to 50 items and refuse a MaxRecords outside 1 to 100 with ValidationError. DescribeAlarms now lists metric and composite alarms in one name-ordered sequence that MaxRecords counts together, and DescribeAlarmHistory lists the newest items first unless ScanBy is TimestampAscending. DescribeAlarms without AlarmTypes now returns metric alarms only, as on AWS; composite alarms need AlarmTypes=["CompositeAlarm"]. Contributed by @​iot-rocket.
• CloudWatch Logs — a log group's resource policy by resourceArn alone — PutResourcePolicy and DeleteResourcePolicy refused a resourceArn without policyName; they now take it, store the group's policy without a name and with a counting revisionId, and answer a request with neither field or a revision conflict with AWS's errors. AWS::Logs::LogGroup now creates, rewrites and removes the group's own policy from ResourcePolicyDocument. Contributed by @​iot-rocket.
• CloudTrail — trail read-backs and recording switched on at runtime — GetTrail and DescribeTrails returned the stored IsLogging, _StartedAt and _StoppedAt keys and empty S3KeyPrefix and SnsTopicName members, and GetTrailStatus left out the six deprecated string members and moved StopLoggingTime when a stopped trail was stopped again; they now answer in AWS's shapes, with the start and stop times in milliseconds, and keep the last stop time. Recording switched on through /_ministack/config began only after the first CloudTrail API call and now starts with the next request. Contributed by @​iot-rocket.
• ACM / Signer — certificate key and in-use refusals — ImportCertificate accepted a call without a PrivateKey and now answers AWS's ValidationException; DeleteCertificate removed a certificate an Active Signer signing profile uses and now answers ResourceInUseException, with those profiles listed in DescribeCertificate's InUseBy; CancelSigningProfile answered 200 with {} and now answers 204 with an empty body, as on AWS. Contributed by @​iot-rocket.

... (truncated)

Commits

• 0696dbf Release/v1.5.28 (#2226)
• c6eedf2 release v1.5.28 (#2225)
• 2c2eacd restore 1.5.27 changelog (#2224)
• 696bf7f prerelease v1.5.28 (#2222)
• b257efe ci: exercise HTTP authorization contracts in both auth modes (#2221)
• e774987 fix(apigateway): include Lambda authorizers in the REST API export (#2220)
• 198fb49 feat(rds): expose retained reboot events through DescribeEvents (#2218)
• f68314c fix(rds): restart database compute on instance reboot (#2217)
• d996646 fix(cognito): pass the bare NameID or sub as InboundFederation userName (#2216)
• 70d3189 fix(s3): treat requests without credentials as anonymous under AUTH=true (#2215)
• Additional commits viewable in compare view

Updates ruff from 0.17.0 to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

Install ruff 0.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.ps1 | iex"

Download ruff 0.17.1

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.1

Released on 2026-10-15.

Preview features

• [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

• Fix dedent with multiple leading comments (#29382)
• [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
• [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
• [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

• Treat more collections and weakref containers as mutable (#29213)

Documentation

• [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

• @​fixfon
• @​mmaxjr
• @​joshuavetos
• @​nekomario28
• @​ntBre
• @​shan3520

Commits

• 4683270 Bump version to 0.17.1 (#29420)
• 3514027 [ty] Update typing conformance suite pin (#29417)
• 8294556 Update referenced PR security-review workflow (#29237)
• d1e1b1f [ty] Preserve recursive aliases when rebuilding intersections (#29057)
• 9352615 [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (...
• 83a3afc Fix dedent with multiple leading comments (#29382)
• b42a873 [ty] Clarify object attribute write-contract rationale (#29384)
• d01678e [ty] Clarify object attribute write-contract rationale (