[dependabot]

Bumps aws/aws-sdk-php from 3.400.1 to 3.401.3.

Release notes

Sourced from aws/aws-sdk-php's releases.

Version 3.401.3

• Aws\EndpointV2 - EndpointDefinitionProvider now rejects service names and api versions that are not a single safe path segment, preventing path traversal through the version or service client options.
• Aws\IoTWireless - Documentation update release for AWS service
• Aws\WorkspacesInstances - ModifyVolume is a new public API for WorkSpaces Core Managed Instances. Customers can change the size, type, IOPS, or throughput of an existing managed volume online, with no stop required. Customers track progress by calling EC2 DescribeVolumesModifications directly.
• Aws\OpenSearchService - Amazon OpenSearch Service adds a new TLS security policy to support FIPS policy and post-quantum cryptography
• Aws\ECS - Adds support for configurable envoy application log levels. Customers can now debug network connectivity issues with their task's sidecar envoys.
• Aws\CodeStarNotifications - Documentation update release for AWS service
• Aws\CodeDeploy - Adds support for suspending Amazon EC2 Auto Scaling processes during CodeDeploy EC2 in-place deployments. Use ec2DeploymentOptions to choose which processes are suspended and resumed.
• Aws\TimestreamInfluxDB - Adds four new parameters to the InfluxDBv3Enterprise parameter group for Amazon Timestream for InfluxDB. The new parameters are upgradePachaTree, walBufferSize, snapshotSize, and snapshotDuration.
• Aws\SocialMessaging - Adding support for WhatsApp Direct Send.
• Aws\ManagedGrafana - Documentation update release for AWS service
• Aws\CloudWatchLogs - Amazon CloudWatch Logs now supports filtering DescribeDeliverySources by resourceArns, DescribeDeliveryDestinations by names, and DescribeDeliveries by deliverySourceNames.
• Aws\Connect - Amazon Connect GetAttachedFile API now supports an optional UrlContentDisposition parameter. Set it to INLINE to get a pre-signed URL that displays the file in the browser, so agents can preview email attachments without downloading them. ATTACHMENT (download) remains the default.
• Aws\WorkSpaces - Adds optional imageValidationMode enum to ImportCustomWorkspaceImageRequest. This allows customers to opt-in to having prevalidation run in the service account instead of customer account.
• Aws\ControlTower - Documentation update release for AWS service
• Aws\CodeCommit - Documentation update release for AWS service
• Aws\BedrockAgentCore - Adds the Builtin.FailureAnalysis evaluator for batch evaluations. GetBatchEvaluation now returns insightResults that group session failures into insights with root causes and suggested fixes.
• Aws\Amplify - Documentation update release for AWS service
• Aws\drs - Documentation update release for AWS service
• Aws\DataZone - Adds SDK and CLI support for the Iceberg REST catalog connection types already available in Amazon SageMaker Unified Studio - ICEBERGRESTCATALOG, SNOWFLAKEICEBERGRESTCATALOG, and DATABRICKSICEBERGRESTCATALOG.
• Aws\DynamoDB - Enable account endpoint generation for existing CN and GovCloud regions
• Aws\BedrockAgentRuntime - Adds support for applying a Retrieval Instruction, optionally by version, to AgenticRetrieveStream requests for Amazon Bedrock Knowledge Bases, and reports the applied instruction and version on the trace.
• Aws\EMRContainers - Documentation update release for AWS service
• Aws\BedrockAgent - Adds Retrieval Instructions for Amazon Bedrock Knowledge Bases. Create, get, update, delete, list, and version customer-authored instructions that guide how a knowledge base retrieves and answers, with content review before use.
• Aws\GlueDataBrew - Documentation update release for AWS service
• Aws\XRay - Adds support for encrypting the Transaction Search spans log group with a customer managed AWS KMS key. Pass the key ARN in the new CloudWatchLogsConfiguration.SpansLogGroupKmsKeyId field of UpdateTraceSegmentDestination. X-Ray applies the key when it creates the log group.
• Aws\ObservabilityAdmin - Adding support for EKS Container Insights Telemetry Rules
• Aws\CodeConnections - Documentation update release for AWS service
• Aws\CloudWatch - This release adds ActionConfiguration to PutMetricAlarm, PutCompositeAlarm and PutLogAlarm. It allows customers to include an alarm's tags in its notifications and alarm state change events
• Aws\GuardDuty - Adding a new Expected Bucket Owner optional field for GuardDuty publishing destination APIs
• Aws\DevOpsAgent - Documentation update release for AWS service
• Aws\CodePipeline - Documentation update release for AWS service

Version 3.401.2

• Aws\GuardDuty - Releasing support for Custom Detection Rule Runtime Monitoring
• Aws\Lambda - AWS Lambda now supports an optional X-Ray trace header for chained invocations in durable executions, enabling child invocations to be linked to the initiating span.
• Aws\MarketplaceMetering - Documentation update - added a Get started pointer to the AWS Marketplace AI Metering Agent Skill in the BatchMeterUsage API reference. No API or behavior change.
• Aws\BedrockAgentCoreControl - This release supports scoping Amazon Bedrock AgentCore Gateway rate limits by request header or request body field.
• Aws\Organizations - With dual-stack enabled, all requests now resolve to the endpoint in the partition's primary Region (for example, organizations.us-east-1.api.aws) and are signed for that Region. Previously, requests from other Regions resolved to a nonexistent endpoint. No API changes.
• Aws\ARCRegionSwitch - Features - Adds support for an optional payload to invoke the Lambda function with as part of the Custom action Lambda execution block
• Aws\EC2 - Adds T8i instance sizes to the InstanceType enum. T8i instances are low-cost burstable instances powered by custom sixth generation Intel Xeon 6 processors, available exclusively on AWS, and built on the latest sixth generation AWS Nitro cards
• Aws\DynamoDBStreams - Add support for a new iterator type (AT TIMESTAMP) for DynamoDB Streams GetShardIterator API that allows reading from a specific point in time from the stream.
• Aws\Transfer - AWS Transfer Family now lets you store SFTP server host keys in AWS Secrets Manager in your own AWS account. This gives you greater control over your server identity and helps simplify server migrations and failover.
• Aws\CloudFront - This release adds a new "IpAddressType" field to "VPCOriginEndpointConfig", allowing customers to specify whether their VPC origin accepts IPv4-only or dualstack connections.
• Aws\imagebuilder - This release adds parentInstance to infrastructure configurations, so builds can use an already-running instance from an Amazon EC2 Auto Scaling group. It also adds terminateInstanceOnCompletion, which keeps build and test instances running after image creation ends.

Version 3.401.1

• Aws\Retries - retry_mode and max_attempts are now resolved independently, so a value set in the environment no longer hides the other value in the shared config file. The shared config file lookup now also honors [profile name] sections, and an invalid retry_mode or max_attempts in the shared config file now raises a ConfigurationException, as it already did for environment variables. On the opt-in retry path (AWS_NEW_RETRIES_2026), DynamoDB and DynamoDB Streams use the DynamoDB attempt defaults (4 in standard/adaptive mode, 11 in legacy mode) when max_attempts is not set, and DynamoDbStreamsClient applies the same defaults as DynamoDbClient.
• Aws\ARCRegionSwitch - Adds support for SSM Execution Block in Region switch plans
• Aws\DataSync - AWS DataSync Enhanced mode now supports FSx for OpenZFS, NFS 4.2, and object metadata controls

... (truncated)

Commits

• 7b8541e 3.401.3 release
• 3e8b70d Update models for release
• 441a958 Bump shivammathur/setup-php from 2.37.2 to 2.40.0 (#3379)
• dbe74fc Validate service and version in EndpointDefinitionProvider (#3378)
• b1af919 3.401.2 release
• a90459c Update models for release
• 4cdda6c 3.401.1 release
• 1d50dd2 Update models for release
• 9cb49b9 bugfix: DynamoDB retry defaults on the opt-in path (#3368)
• 4a1b961 3.401.0 release
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[dependabot]

Superseded by #494.