Update dependency aws/aws-sdk-php to v3.393.4

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
aws/aws-sdk-php (source)	3.389.2 → 3.393.4

---

Release Notes

aws/aws-sdk-php (aws/aws-sdk-php)

v3.393.4

Compare Source

• Aws\WAFV2 - DataProtectionConfig field Key Documentation Update
• Aws\BedrockAgentCoreControl - Update Dataset schema to THIRDPARTYEVALUATIONV1
• Aws\Kinesis - Generate account endpoint for Kinesis Data Streams requests when the account ID is available
• Aws\BedrockAgentCore - Increase spans count from 1k to 20k
• Aws\DeviceFarm - Added support to CreateRemoveAccessSession for selecting a server version on the mobile WebDriver endpoint.
• Aws\Backup - Updating CLI Docs for Backup Audit Manager List Job Summaries APIs.
• Aws\CloudWatch - Allows customers to specify an initial warm up period to wait for metrics to arrive when creating metric or log alarms

v3.393.3

Compare Source

• Aws\CloudFront - Added SigV4a as a supported signing protocol for Origin Access Control (OAC), enabling CloudFront to sign requests to Amazon S3 Multi-Region Access Point (S3-MRAP) origins.
• Aws\Lambda - Adds support for full JSON resource-based policies, enabling customers to create, retrieve, update, and delete function resource policies as complete JSON documents.
• Aws\SageMaker - Added IAM Identity Center (IdC) support to CreatePartnerApp and UpdatePartnerApp APIs. Added Customer Managed Key (CMK) support to CreateMlflowApp and DescribeMlflowApp.
• Aws\Batch - AWS Batch now supports a new compute environment type that provides fully managed EC2 capacity with broader compute flexibility than Fargate, including GPU instances, bare metal, and specific instance type selection, without infrastructure management overhead.
• Aws\Amplify - Increased the maximum allowed length from 255 to 4,096 characters to support longer access tokens.
• Aws\DirectConnect - This release adds custom route prefix pool allocations for Direct Connect. You can set IPv4 and IPv6 route prefix counts on private and transit virtual interfaces, and view pool size and unallocated counts on connections and LAGs, plus direct connect gateway attachment prefix allocation totals.
• Aws\EC2 - EC2 marks UEFI instance metadata field as sensitive.
• Aws\ARCRegionSwitch - Adds support for Rds switchover read replica for Oracle databases in Region switch plans
• Aws\SESv2 - Amazon SES now supports per-message tracking overrides. You can use the new ConfigurationOverrides parameter in SendEmail and SendBulkEmail to enable or disable open and click tracking for individual messages without changing your account-level or configuration set settings.
• Aws\PricingPlanManager - Documentation update for the CreateSubscription API to correct the default value of the approval mode parameter. The default value for paid subscriptions is MANUAL, not IMMEDIATE as previously documented. The default value remains IMMEDIATE for FREE tier subscriptions.

v3.393.2

Compare Source

• Aws\RedshiftServerless - Amazon Redshift Enhanced System Table Retention that allows customers to store their system table data directly in S3 Tables in customer's account instead of Redshift Managed Storage
• Aws\VPCLattice - Amazon VPC Lattice now supports modification of private DNS options on Service Network VPC Associations
• Aws\AccountAccess - Adds throttling exceptions to operation outputs that were previously inconsistent with other operations.
• Aws\MediaLive - AWS Elemental MediaLive now supports video cropping and output positioning. Use cropRectangle and outputPositionRectangle to position the encoded video within the output frame, with the surrounding area filled with black.
• Aws\BedrockAgentCore - AgentCore Memory now supports Flexible Namespaces and Non-Conversational Payloads in CreateEvent API
• Aws\Redshift - Amazon Redshift enhanced System Table retention that allows customers to store their system table data directly in S3 Tables in customer's account instead of Redshift Managed Storage
• Aws\Batch - AWS Batch now supports managing CloudWatch Container Insights on compute environments via CreateComputeEnvironment and UpdateComputeEnvironment.
• Aws\BedrockAgentCoreControl - AgentCore Memory now supports Flexible Namespaces
• Aws\EKS - Adds support for EKS cluster certificate authorities (CA)

v3.393.1

Compare Source

• Aws\MediaLive - AWS Elemental MediaLive now supports SCTE-35 marker passthrough without IDR frame insertion for CMAF Ingest, MediaPackage V2, and transport stream outputs.
• Aws\MarketplaceCatalog - Introducing two new APIs, DescribeAssessment and ListAssessments. These APIs expose validation issues on Marketplace resources. The validation issues are exposed via a newly created resource called Assessment.
• Aws\Batch - Update AWS Batch documentation with newer Fargate Supported configurations, notes, and fix broken Docker link re-directs.
• Aws\WorkSpaces - Amazon WorkSpaces now supports nested virtualization, allowing you to run hypervisors and virtualization-based workloads within your WorkSpaces. You can enable or disable nested virtualization when creating a WorkSpace or by modifying an existing WorkSpace's properties.
• Aws\Outposts - AWS Outposts now supports VPC Endpoint configuration in CreatePrivateConnectivityConfig, enabling scoped private connectivity with provisioning role creation for secure outpost installations
• Aws\EC2 - Doc release for CreateImage support for instances with local snapshots in Outpost
• Aws\EntityResolution - Added ResourceNotFoundException to DeleteSchemaMapping, DeleteMatchingWorkflow, DeleteIdMappingWorkflow, and DeleteIdNamespace. These operations now return a 404 ResourceNotFoundException (previously a 200 Success) when the target resource does not exist.

v3.393.0

Compare Source

• Aws\Handler - Adds support for Guzzle transport sharing (persistent connections) via the new transport_sharing client option.
• Aws\GeoMaps - Amazon Location Service now supports POI density and category filtering on dynamic maps. The GetStyleDescriptor API adds two optional parameters. PoiDensity (Off to VeryDense) controls POI volume, and PoiCategories filters by up to nine categories. Available on HERE and Grab map styles.
• Aws\Connect - This release adds new APIs to create, describe, update, delete, and list extraction definitions, enabling customers to manage lifecycle of extraction definition resources. Additionally, this release adds new event sources for Rules related to ACW and new action to Extract Information.
• Aws\BedrockAgentCoreControl - Adds implementations of third-party evaluators, both managed-as-a-service and as templates within custom evaluators.
• Aws\drs - AWS Elastic Disaster Recovery (AWS DRS) now offers Recovery Plans to recover multi-server applications in the right order in one action. Define the launch sequence once, with ordered steps and wait times, and DRS runs it automatically. Validate with non-disruptive drills and monitor in real time.
• Aws\ECR - Documentation update for the ECR PutReplicationConfiguration API to increase the replication rule limit from 10 to 25
• Aws\BedrockAgentRuntime - AgenticRetrieveStream API now supports Amazon Bedrock AgentCore Memory. Use the new memoryConfiguration parameter to continue a session from short-term memory and retrieve from long-term memory.
• Aws\Organizations - Add new Transfer Responsibility error codes and document related CloudTrail events for accepting and terminating a Transfer Responsibility.

v3.392.3

Compare Source

• Aws\RedshiftServerless - Amazon Redshift now unlocks a locked admin user account and resets the failed-login counter when you update the admin password using the UpdateNamespace API. This option is available only when account lockout security is enabled.
• Aws\Glue - Added support for associating glossary terms with iterable form items, such as table columns.
• Aws\BedrockAgentCore - Add support for the Machine Payments Protocol (MPP) and x402 upto scheme payments protocol in Amazon Bedrock AgentCore Payments. Customers can now pay for MPP-gated resources and also pay services which requires upto scheme in x402
• Aws\ObservabilityAdmin - CloudWatch Logs centralization rules now support tag propagation. You can configure a TagPropagationConfiguration on your centralization rule to automatically sync resource tags from source to destination log groups, with configurable conflict resolution strategies.
• Aws\Redshift - Amazon Redshift now unlocks a locked admin user account and resets the failed-login counter when you update the admin password using the ModifyCluster API. This option is available only when account lockout security is enabled.
• Aws\BedrockAgentRuntime - Adds CheckIngestedDocumentAcl and GetIngestedDocumentAcl APIs to Amazon Bedrock Knowledge Bases. Customers can verify user access to documents based on ingested ACLs and retrieve full ACL details including allow and deny entries, enabling validation of ACL ingestion without test retrievals.
• Aws\MWAAServerless - Adds support for Consuming code for MWAA Serverless
• Aws\SageMaker - Release support for g7.2xlarge, g7.4xlarge, g7.8xlarge, g7.12xlarge, g7.24xlarge, and g7.48xlarge instance types for SageMaker HyperPod
• Aws\BedrockAgentCoreControl - Adds AgentCore Payments support for CMK, Marketplace Subscriptions and QuickCreate

v3.392.2

Compare Source

• Aws\ACM - This change allows customers to update their existing email-validated certificates to use the DNS validation method.
• Aws\Connect - Adds the StartAssistantContact API to start chat contacts handled by an AI agent. Adds SegmentAttributes to StartWebRTCContact, and corrects its error response to now receive AccessDeniedException (previously returned as an internal server error due to a missing error declaration).
• Aws\SecurityAgent - Add support for setting a maximum task-hour budget cap on penetration tests and code reviews, and for revalidating previously reported findings via a new REVALIDATION job type.
• Aws\CodeCommit - Added the GetBlobDifferences API operation, which returns line-level diffs between two blob versions without requiring a local clone. Returns structured hunks with context, additions, and deletions. Supports pagination for large diffs.
• Aws\CleanRooms - This release adds support for minimum aggregation thresholds and comparison controls to the Custom analysis rule type.
• Aws\AutoScaling - Amazon EC2 Auto Scaling now supports terminating multiple instances in a single TerminateInstanceInAutoScalingGroup call via the new InstanceIds parameter, returning an Activities list. LaunchInstances now returns IdempotentCallInProgressFault for duplicate client tokens.

v3.392.1

Compare Source

• Aws\WellArchitected - This change releases the Well-Architected Agent, a generative AI service that analyzes a customer's AWS environment and delivers personalized, prioritized recommendations across cost, security, performance, and resilience.
• Aws\Glue - Documentation updates for materialized views APIs.
• Aws\IAM - Introduced role manager, an IAM capability that automatically sets up the IAM roles your AWS services need. When you set up a supported service in the console, role manager creates a role for you or reuses an existing one from an AWS-managed template.
• Aws\DSQL - Improved validation of Kinesis stream ARN format to ensure only valid ARN characters are accepted
• Aws\MediaConnect - AWS MediaConnect now supports tuning the internal recovery latency between Router Inputs and Outputs to prioritize stream quality versus end-to-end latency.
• Aws\Odb - Adds support for Oracle Exadata on Exascale Infrastructure (ExaDB-XS) resources including storage vaults and VM clusters.
• Aws\QuickSight - Added APIs for DLP with Microsoft Purview (manage configs with label enforcement across Spaces, Chat, Knowledge Bases), Approval Workflows (CRUD for policies on asset sharing for Agents, Knowledge Bases, Spaces), and Limits Management (limit profiles for index storage and agent hours per user).

v3.392.0

Compare Source

• Aws\DataZone - GetSubscriptionGrant now returns materialized asset scope name for mapping Lake Formation data cell filters or Redshift views to subscription grants.
• Aws\CloudDirectory - Added an end-of-support notice to Amazon Cloud Directory public CLI reference documentation.
• Aws\Organizations - Documentation update for AWS Organizations that clarifies valid input values for the HandshakePartyType parameter in the InviteAccountToOrganization. API ORGANIZATION is valid in responses only. valid input values are ACCOUNT and EMAIL
• Aws\Textract - Amazon A2I entered maintenance mode in July 2026 and now rejects StartHumanLoop requests from accounts that it does not recognize as existing customers. This update adds a corresponding note to the HumanLoopConfig parameter documentation so that the API Reference and SDK docs explain this behavior.
• Aws\EKS - This feature would give customers the ability to selectively tune certain configurations of Kubernetes control plane components in an Amazon EKS cluster.
• Aws\BedrockAgentCore - Adding online eval arn as input for recommendation API
• Aws\Connect - Seven new APIs for managing custom metrics, including create, describe, update, and delete. Using Custom Metrics, customers of Amazon Connect Customer can tailor analytics dashboards to their needs by applying custom thresholds, filters, and calculations to one or more out of the box measurements.
• Aws\AccountAccess - Adds SDK support for AWS IAM account access manager, a feature that enables mapping of IAM roles to the users and groups in AWS IAM Identity Center.
• Aws\CleanRooms - Adds support for exporting redacted query execution logs in AWS Clean Rooms

v3.391.2

Compare Source

• Aws\SageMakerRuntime - Added the PrefixAwareId header to InvokeEndpoint and InvokeEndpointWithResponseStream. This optional parameter serves as a routing hint for endpoints configured with prefix-aware routing, differentiating routing decisions for requests that share the same prompt prefix.
• Aws\ElementalInference - Added support for the SearchFixtures API and DataSourceConfiguration, enabling customers to map fixture event data onto clipping outputs for improved feature accuracy.
• Aws\MediaLive - Added VirtualSourceAddress to multicast output destinations for MediaLive Anywhere channels. Specifies the source IP address for outbound multicast packets when downstream networks enforce source-IP filtering.
• Aws\SageMaker - Added PREFIX AWARE routing strategy and PrefixAwareRoutingConfig to CreateEndpointConfig. Configure PrefixLength and ConcurrencyThreshold to route requests that share the same prompt prefix to the same instance.
• Aws\Connect - Added Malay language option to use AI to automatically fill evaluation forms in Malay

v3.391.1

Compare Source

• Aws\Retries - Updated the opt-in retry path (AWS_NEW_RETRIES_2026) to emit SEP-compliant retry headers, honor AWS_MAX_ATTEMPTS and shared-config max_attempts, and align long-polling retry behavior with the new retry spec.
• Aws\Connect - Supports updating the task template associated with in-progress task contacts using the new UpdateContactTaskTemplate API. This enables supervisors and developers to dynamically reassign task templates without creating a new task.
• Aws\MediaTailor - Added support for inserting ads via the VAST Ad Buffet standard. You can now configure MediaTailor to insert ads in sequence order using the AdSequencingMode setting in your playback configuration. Standalone ads are used as fallbacks when a sequenced ad is unavailable.
• Aws\EC2 - This release adds support for BGP route protection in Amazon VPC IP Address Manager (IPAM), including route discovery, RPKI route protection findings, and delegated RPKI (Internet Registry Associations, routing policy registrations, and ROA management) for BYOIP prefixes.
• Aws\SageMaker - Amazon SageMaker adds maintenance lifecycle statuses for Notebook Instances
• Aws\MediaPackageV2 - StreamNameOutputMode - a new optional field on MediaPackageV2 OriginEndpoints that lets customers choose whether egress manifests use numeric stream indices (default) or encoder-assigned stream names from the input
• Aws\SecurityAgent - Added enableEmailMfa input field on Actor to enable email-based MFA during penetration tests. When enabled, a server-generated mfaForwardingAddress is returned. Set up a forwarding rule in your email provider to forward MFA emails to this address so the agent can complete email-based MFA login flows
• Aws\HealthLake - Adds provenanceEnabled to StartFHIRImportJob
• Aws\Amplify - Increased the maximum allowed length of the oauthToken parameter in the CreateApp and UpdateApp APIs to support longer OAuth tokens issued by third-party Git providers.

v3.391.0

Compare Source

• Aws\S3 - AWS Backup now lets you create read-only access points for Amazon S3 recovery points, enabling you to access backup data using S3 APIs without initiating a restore.
• Aws\MarketplaceDiscovery - GetOfferTerms now returns netPaymentTerm in offerTerms, specifying payment due period after invoice date. The paymentDuePeriod field uses ISO 8601 duration format (e.g., "P30D" for net 30 days). This is a backward-compatible addition. See API documentation for full structure and examples.
• Aws\EC2 - Adds a new optional IncludeLocalZones parameter to the Spot Placement Score API that defaults to false. When set to true, the Spot Placement Score API will consider the relevant Local Zones with Spot capacity when computing the Spot Placement Score.
• Aws\AutoScaling - EC2 Auto Scaling now supports being managed by other AWS services via the operator field.
• Aws\BedrockAgentCore - Add support for capacity provider sessions in Amazon Bedrock AgentCore. Customers can now delete an active session running on a runtime instance launched through their capacity provider.
• Aws\Kafka - MSK Clusters can now deliver authorizer logs alongside broker logs to the destinations defined by you
• Aws\AgentRegistry - Agent Registry's Public Preview release
• Aws\MarketplaceAgreement - GetAgreementTerms now returns a new term variant in AcceptedTerm, netPaymentTerm, with a paymentDuePeriod field (example "P30D").
• Aws\MediaTailor - AWS Elemental MediaTailor now supports concurrent function execution. The new Concurrent Executor function type runs multiple independent child functions in parallel within a single lifecycle hook, reducing pipeline latency to the duration of the slowest call instead of the sum of all calls.
• Aws\Backup - AWS Backup now lets you create read-only access points for Amazon S3 recovery points, enabling you to access backup data using S3 APIs without initiating a restore.
• Aws\AgentRegistryControl - Agent Registry's Public Preview release
• Aws\SageMaker - Releases new Model Customization SequenceLength parameter for Training and g7 instance types for Training and Processing.
• Aws\DeviceFarm - Adds support for service generated insights across runs, jobs, and tests.
• Aws\BedrockAgentCoreControl - Add support for Gateway rate limits and Runtime instances in Amazon Bedrock AgentCore. Customers can now configure rate limits scoped to control request rates, token consumption rates, and active connection rates. Customers can now create capacity providers to launch runtimes on their EC2 instances.
• Aws\SecurityHub - Security Hub is adding a new public API, ListFreeTrialStatusesV2 to describe the free trial statuses of the Security Hub service and its opt-in features.
• Aws\GameLift - Adds support for C8a, C8i, C9g, M8a, M8i, and M9g EC2 instance type families for managed EC2 and container fleets. Also adds explicit anchors on most string regexes.
• Aws\SocialMessaging - Add support for WhatsApp Conversions APIs.
• Aws\CloudWatchLogs - This release adds index category support to the CloudWatch Logs DescribeFieldIndexes API. Customers can filter and identify DEFAULT, CUSTOM, AUTO, and INACTIVE field indexes.

v3.390.5

Compare Source

• Aws\ECS - New enum values added for Agent Connectivity issues
• Aws\ACMPCA - Private Certificate Authority service now supports RSASSA-PSS signing algorithm.
• Aws\Glue - Added the PutDataCatalogExportConfiguration to export Glue Data Catalog metadata to systems tables stored in S3 Tables.
• Aws\BedrockAgentCoreControl - Adding support for fine-grained access control for AgentCore Memory through managed AgentCore Gateway HTTP Connectors.
• Aws\Deadline - AWS Deadline Cloud now reports persistent volume costs alongside compute and license costs. Customers can view per-fleet storage costs in Usage Explorer by selecting the Usage Type grouping, helping them better understand the costs of their infrastructure.

v3.390.4

Compare Source

• Aws\DynamoDB - Vector indexes are a type of index in Amazon DynamoDB that enable similarity search on vector embedding stored in your table items. Vector indexes use approximate nearest neighbor search to find items whose vectors are most similar to a query vector that you provide.
• Aws\Organizations - Improved accuracy of CloudTrail event documentation for AWS Organizations membership operations.
• Aws\SSOAdmin - AWS IAM Identity Center now lets you create organization-level instances without enabling multi-account permissions. You can enable multi-account permissions during instance creation or later via console or API, which then provisions the necessary service-linked roles.
• Aws\Inspector2 - Adding Azure SBOM export capability.
• Aws\EC2 - Amazon EC2 now supports Application Status Checks, a new status check that monitors your application's health through configurable HTTP(S) paths and ports, so you can detect and automatically respond to application-level impairments.
• Aws\Connect - Amazon Connect Customer now supports up to 50 attachments per email, increased from the previous limit of 10. The individual maximum attachment size limit of 20 MB and the total email size limit of 25 MB still hold true.
• Aws\WorkSpaces - Added ClientExperiencePolicy to ClientProperties object for ModifyClientProperties and DescribeClientProperties APIs.
• Aws\PartnerCentralSelling - Partners can now create leads with only 5 required fields and free-text values for all other fields, reducing import friction. Engagement invitations now include enrichment data (propensity scores, lead readiness) directly in the response.
• Aws\DSQL - UpdateCluster now checks the RemovePeerCluster permission on the specific cluster being removed, not a wildcard and docs now clarify how to set kmsEncryptionKey so the cluster uses the AWS-owned key.
• Aws\IAM - Updating endpoint generation logic

v3.390.3

Compare Source

• Aws\WAFV2 - Updated descriptions for number of PreParseTextTransformations allowed per rule statement
• Aws\TimestreamInfluxDB - This release adds support for customer-managed backup restore, and encryption of new DbInstances and DbClusters using customer-managed KMS keys.
• Aws\ObservabilityAdmin - Launch CMK support for Telemetry Enablement Organization and Account Rules.
• Aws\EKSAuth - Added eksNodeName, instanceId, and zone optional parameters to the AssumeRoleForPodIdentity API.
• Aws\NetworkFirewall - This launch allows customers to use Network Firewall as an explicit Proxy and protect their workloads against threat of data exfiltration.
• Aws\MediaConvert - Updates Kantar server URL validation to accept Fifty5Blue domain. Adds support for output to S3 Glacier Instant Retrieval.
• Aws\DirectConnect - Added route visibility support for AWS Direct Connect, allowing customers to call ListVirtualInterfaceRoutes to view the BGP routes including AS path and BGP communities advertised over their virtual interfaces.

v3.390.2

Compare Source

• Aws\Outposts - Adds the "EKS" value to the AWSServiceName enum and marks the Address field as sensitive.
• Aws\MarketplaceCatalog - This release enhances the ListEntities API to support TargetAgreementId, TargetAgreementIntent, and CreatedBySource filters for the Offer entity type.
• Aws\CloudFormation - Adding enum for sensitive property to DriftIgnoredReason
• Aws\BedrockRuntime - Added support for mid-conversation tool changes in the Amazon Bedrock Converse and ConverseStream APIs
• Aws\DataZone - Adding support for enhanced Git experience in Sagemaker Unified Studio.
• Aws\RDS - Adds StorageOperationStatus and StorageOperationPercentProgress to DescribeDBInstances, letting you monitor RDS storage initialization and optimization progress.
• Aws\ElementalInference - AWS Elemental Inference now supports graphic composition on cropped video outputs, enabling branded graphics and other visual elements to be overlaid as part of the inference workflow.
• Aws\PrometheusService - Amazon Managed Service for Prometheus adds support for an Amazon OpenSearch Service exporter for managed collectors.
• Aws\ConnectCampaignsV2 - Launching feature for abandonment rate pacing control for outbound campaigns.
• Aws\QuickSight - Adding TopicV2 management APIs, adding possibility to use Topics in Analysis
• Aws\Billing - Adds GetEnterpriseSupportChargeSummary, GetEnterpriseSupportContractDetails, and ListEnterpriseSupportLinkedAccountCharges. These APIs provide first-time programmatic access to billing data for Enterprise Support usage previously only available upon request through AWS Concierge or Support.
• Aws\NetworkFirewall - Doc Updates for Container Attributes
• Aws\CloudWatchLogs - Amazon CloudWatch Logs now lets you create and update lookup tables directly from CloudWatch Logs query results by passing a queryId, and configure a lookup table as a scheduled query destination so it refreshes automatically with the latest query results on each run.
• Aws\Resiliencehubv2 - Adding support for new testing capability in AWS Resilience Hub.

v3.390.1

Compare Source

• Aws\BCMRecommendedActions - Removing Smithy RPC v2 CBOR support that was added in previous SDK release.
• Aws\BCMPricingCalculator - Removing Smithy RPC v2 CBOR support that was added in previous SDK release.

v3.390.0

Compare Source

• Aws\Crypto - Fixes issue with client material description decode.
• Aws\BedrockAgentCoreControl - Adds support for configuring models through the OpenResponses API for custom evaluators. CreateEvaluator and UpdateEvaluator now accept an OpenResponses model configuration for LLM-as-a-Judge evaluations.
• Aws\SageMaker - Adds support for g7 family instance types for SageMaker Studio JupyterLab and CodeEditor apps for IAD (us-east-1), PDX (us-west-2), CMH (us-east-2).
• Aws\Lambda - Add Python3.15 (python3.15) and NodeJs 26 (nodejs26.x) support to AWS Lambda
• Aws\Kafka - Amazon MSK Express brokers now support streaming tables for Apache Iceberg, continuously materializing Apache Kafka topics as Iceberg tables in Amazon S3 Tables. Express brokers also now support data delivery to Amazon S3 general purpose buckets.
• Aws\NetworkFirewall - Adds UPDATING field to Container Association Status
• Aws\IAM - Improved IAM Policy Simulator accuracy. Simulator now evaluates SCP conditions and resource scoping, returns explicitDeny for explicit SCP denials, and reports accurate cross-account decisions.
• Aws\SecurityAgent - Adds support for providing a branch override when configured integrated repositories
• Aws\PricingPlanManager - Adds support for Public PricingPlanManager SDK

v3.389.3

Compare Source

• Aws\EC2 - This release adds support for policy-based routing on AWS Transit Gateway, enabling you to route traffic based on 5-tuple matching (source IP, destination IP, source port, destination port, and protocol) using new policy table entry APIs that direct matching traffic to a target route table.
• Aws\GameLiftStreams - Adds ListApplicationShaderCaches API to retrieve shader cache metadata for applications and adds stream URLs, which give end users temporary, unauthenticated access to a stream session in their browser. Includes CreateStreamUrl, GetStreamUrl, ListStreamUrls, and RevokeStreamUrl operations.
• Aws\WAFV2 - AWS WAF now supports pre-parse text transformations, letting you normalize raw query strings before parsing, available on rule statements that use SingleQueryArgument or AllQueryArguments as the FieldToMatch. AWS WAF also added 10 new text transformations, including ModSecurity v3 parity options.
• Aws\Glue - Adding filtering, partitioning, and VPC support to AWS Glue REST API connector
• Aws\IoTSiteWise - We have released a new set of APIs in support of a major new feature within AWS IoT SiteWise called Scenario Discover. Please see user guide about the feature and the API guide in public documentation for new APIs.
• Aws\DatabaseMigrationService - Updated documentation for various DMS Schema Conversion operations

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[deepsource-io]

DeepSource Code Review

We reviewed changes in 1274960...22fd122 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
PHP		Aug 21, 2026 7:07p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.