chore(deps): update floci/floci docker tag to v2

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
floci/floci (source)	major	1.5.32-compat → 2.0.1-compat

---

Release Notes

floci-io/floci (floci/floci)

v2.0.1

Compare Source

Bug Fixes

• rds-data: fixing empty array response from statement (#​2880) (46283f3)

v2.0.0

Compare Source

• fix(stepfunctions)!: reject JSONata top-level references at definition time (#​2699) (5534460)

Bug Fixes

• acm: correct wildcard validation record names (#​2575) (88bf0a2)
• apigateway: match measured JWT claim wire format and enforce route authorizationScopes (#​2011) (4980210)
• apigateway: pass RequestContext to ApiGatewayExecuteController in trailing-slash tests (#​2394) (41953d8), closes #​2377
• apigateway: project HTTP API v2 cookies (#​2391) (48880aa)
• apigateway: report RestApi as available (#​2816) (62dbd9d)
• apigateway: route CORS preflight (OPTIONS) to deployed API integ… (#​1955) (0e3391c), closes #​1928
• apigateway: support AWS type Lambda integration and fix duplicate Content-Type header (#​2049) (72dfa63)
• apigateway: support underscores in v2 path parameters (#​2721) (c18af5b)
• apigatewayv2: CloudFormation AuthorizationScopes pass-through and scope-ingestion hardening (follow-up to #​2011) (#​2431) (d0a96d8)
• apigatewayv2: preserve trailing slash in HTTP API event path (#​2367) (6469637), closes #​1863 #​2136
• apigatewayv2: propagate Lambda REQUEST authorizer context to HTTP API backends (#​2715) (908d70d), closes #​1011 #​812 #​581
• apigatewayv2: return stage tags across protocols (#​2413) (5744082)
• apigatewayv2: route requests to API-owning account (#​2377) (ba9ce84)
• apply S3 Vectors metadata filters (#​2417) (bd8d99b), closes #​2160
• appsync: honor configured base URL in API URIs (#​2457) (86e1c01)
• appsync: use ApiKey.id as the API key value (#​2645) (2932500)
• appsync: wait for schema creation in SDK test (#​2456) (43e5e90)
• athena: route database DDL to Glue (#​2757) (2480daa)
• bedrock-agentcore: allow maxResults up to 1000 (#​2487) (9792198)
• bedrock-agentcore: support memory tagging and dropped fields (#​2501) (feb669d), closes #​2316
• build: resolve the JSON schema library from Maven Central (#​2811) (66d910c)
• ci: replace setup-java's broken maven cache with actions/cache (#​2503) (a68bfc4)
• cloudformation: adopt managed policy on stack update (#​2717) (51edcca)
• cloudformation: fail the stack when Lambda S3 code cannot be read (#​2650) (231c097), closes #​2648
• cloudformation: keep a rolled-back stack's diagnostics until the next redeploy (#​2365) (c54f8dd), closes #​2207 Stack#changeSets #​2419
• cloudformation: no-op stack update for unchanged fixed-name resources (#​2385) (5864ff6), closes lex00/floci#16
• cloudformation: reconcile DynamoDB streams declared by StreamSpecification (#​2411) (c4597f2)
• cloudformation: resolve IAM assume role policy intrinsics (#​2630) (6a1d86e)
• cloudformation: tolerate missing stack resources during deletion (#​2039) (12b8ddd)
• cloudfront: include terraform-required distribution fields (#​1940) (8ac23de), closes #​1930
• cloudfront: separate DEVELOPMENT and LIVE function stages (#​2622) (0dfec3c)
• cloudwatch: decompress gzipped cbor bodies. (#​2379) (f952fff)
• cloudwatch: evaluate alarms over CloudWatch's wider evaluation range (#​2771) (cfe8566), closes #​2700
• cognito: AWS-accurate UsernameAttributes pools — UUID username, alias sign-in, and token/revocation parity (#​1849) (1ca19c7)
• cognito: enforce user pool password policies (#​2070) (3aaf745), closes #​2066 #​2066
• cognito: reject self-managed verification status (#​2532) (f8597bd)
• docdb: give a record without an ARN the one it should have had (#​2425) (7602002)
• docdb: refuse an engine version a live account does not list (#​2682) (46d2f4e), closes #​2681
• docdb: scope cluster and instance identifiers per region (#​2440) (3887a6c), closes #​2408
• docdb: store and return cluster and instance settings (#​2651) (f019573), closes #​2614
• dynamodb: cap GSI multi-attribute key parts at 4 attributes (#​2475) (13f6867), closes #​2460
• dynamodb: enforce composite query order (#​2471) (e4356de), closes #​2462
• dynamodb: hybrid persistence (#​2677) (e531683)
• dynamodb: recognize every HASH attribute of a composite GSI partition key (#​2474) (768e96a), closes #​2461
• dynamodb: reject key attribute values whose type does not match the key schema (#​2625) (bf6c7b0), closes #​2624
• dynamodb: reject LSI KeySchema with other than one sort key (#​2476) (0397826), closes #​2459
• dynamodb: return LastEvaluatedKey when Limit stops exactly at the last item (#​2389) (41ff13e), closes #​2383
• dynamodb: stop getSortKeyNames() from corrupting persisted tables (#​2463) (726c9c7), closes #​2415
• dynamodb: tolerate whitespace before a function's own parenthesis (#​2510) (e4b101d), closes #​2509
• dynamodb: validate cursor key types (#​2470) (e3df59a), closes #​2468
• dynamodb: validate index access paths (#​2278) (30f965d)
• dynamodb: validate query key types (#​2469) (a57c6c8), closes #​2467
• ec2: apply availability-zone filter in DescribeInstances (#​2543) (3bdcd5b), closes #​2542
• ec2: canonicalize IPv4 route destinations at the API boundary (#​2620) (8f76e13), closes Ec2ServicePersistenceTest#legacyNonCanonicalRouteDestinationCanonicalizesOnRestart
• ec2: create /run/sshd before starting sshd (#​1855) (3daab4a)
• ec2: derive default vpc/subnet/sg ids per region (#​2384) (337dead), closes Ec2ServiceTest#defaultVpcSubnetAndSecurityGroupIdsAreRegionScoped lex00/floci#21 pre-#​21 pre-#​21 #​21 #​21 floci-io/floci#21
• ec2: honour documented Describe* filters and stop ENIs inheriting instance tags (#​2747) (26ae4ef)
• ec2: install packages with yum on Amazon Linux 2 guests (#​2448) (c9f456e), closes #​2449
• ec2: install the SSH client package in guests, not just the server (#​2449) (f3029ee)
• ec2: reject a duplicate route destination with RouteAlreadyExists (#​2546) (1be97c9)
• ec2: report a reachable EIP address, and run gzipped user-data (#​2621) (41b5148)
• ec2: retry Docker port collisions (#​2029) (b27b32f)
• ec2: round-trip launch template data instead of discarding it (#​2595) (f1ad306), closes Ec2ServicePersistenceTest#legacyIamProfileAndInstanceTagsSurviveRestart
• ec2: store and report a route's IPv6 destination, and stop DeleteRoute NPEing (#​2492) (e18a262)
• ecs: apply cluster settings given on CreateCluster (#​2845) (19013b8), closes #​2806
• ecs: report schedulingStrategy, deploymentController and availabilityZoneRebalancing on services (#​2482) (13664e7)
• ecs: roll service tasks onto a changed task definition (#​2483) (f3b22e7)
• ecs: round-trip command and entryPoint on container definitions (#​2446) (5c45c14), closes #​2445
• ecs: round-trip runtimePlatform and logConfiguration on task definitions (#​2443) (a2389e7)
• ecs: scope service tasks by owning service, not by caller-supplied group (#​2731) (c6b9e4c), closes #​2716
• eks: implement cluster restoration after restart to maintain state (#​2780) (eaecb36)
• elasticache: keep a replication group's encryption, snapshot settings, tags and ARN (#​2632) (75f8f42), closes #​2615
• elasticache: report transit encryption, not the auth-token flag (#​2844) (90d1a19)
• elasticache: return the modeled capacity fault on proxy-port exhaustion (#​2423) (f40d2e3)
• elb: route Classic (v1) requests to a dedicated handler instead of ELBv2 (#​2619) (afe26c6)
• eventbridge: AWS-conformant InputTransformer from CloudFormation and PutTargets (#​1885) (9b3aee6)
• eventbridge: return 400 for missing resources (#​2553) (4083d06)
• firehose: use request region in delivery stream ARN (#​2719) (47e0647)
• iam: correct GetAccountSummary provider and access-key counts (#​2426) (17e77ba)
• iam: implement UpdateAccountPasswordPolicy, Get and Delete (#​2616) (f411a31)
• inject AWS SDK environment into Flink sidecars (#​2486) (127e51e), closes #​2404
• kinesis-cbor: timestamps mis-scaled 1000x on the CBOR path (#​2432) (39ed771), closes #​2368
• kinesis: apply CreateStream's Tags instead of dropping them (#​2494) (564dbf2)
• kinesis: reject non-blob Data instead of coercing it with asText (#​2551) (df5581e), closes #​2516
• kms: grant fidelity (#​2639) (5400204)
• lambda: delete only the named version when DeleteFunction has a Qualifier (#​2824) (ca4c84c), closes #​2819
• lambda: honour ListLayers and ListLayerVersions query parameters (#​2817) (4462963), closes #​2808
• lambda: honour Publish on CreateFunction and UpdateFunctionCode (#​2825) (a7b2b79), closes #​2820
• lambda: implement GetLayerVersionByArn (#​2812) (5b363ff)
• lambda: make the code-volume populate concurrency configurable (#​2830) (968ff78), closes #​2050
• lambda: read deployment packages via the zip central directory (#​2649) (cd3f367), closes #​2593 #​1215
• lambda: replace the extracted package instead of merging into it (#​2672) (e4c6903), closes #​2647
• lambda: resolve ARN and function URL invocations in owning account (#​2414) (c22652d)
• lambda: resolve launched-container placeholder creds to the owning account (#​2657) (be89286)
• lambda: return VpcConfig, SnapStart and LoggingConfig from every read path (#​2527) (94795dd), closes -_/#A-Za-z0-9
• lambda: round-trip StartingPosition on event source mappings (#​2370) (151e3fc)
• lambda: serialize resource policy mutations (#​2430) (2314c85)
• lifecycle: run start/ready hooks when FLOCI_PORT is non-default (#​2439) (ba97c08), closes #​2437
• memorydb,neptune,docdb: degrade gracefully with no Docker daemon (#​2386) (65b22ff), closes lex00/floci#44
• msk: accept an empty serverProperties on Create/UpdateConfiguration (#​2491) (fcd662f)
• msk: persist CreateCluster broker node groups, encryption, client auth, logging, configuration and tags (#​2366) (0205e4e), closes #​2571
• msk: reject numberOfBrokerNodes values that only look whole after double rounding (#​2571) (bd436ee), closes MskService#validateCreateRequest
• msk: return BadRequestException when a configuration ARN does not exist (#​2572) (247bd59), closes MskService#describeConfiguration
• opensearch: address spawned domain containers by IP, not name (#​2746) (fcc6067)
• preserve Firehose compression format in CloudFormation (#​2406) (ebd4a07)
• preserve Route 53 private hosted-zone VPC associations (#​2342) (967ea84), closes #​2294
• rds,docdb: list DocumentDB clusters and instances in the RDS-family list form (#​2623) (3b0e31b), closes #​2613 #​1829
• rds,firehose,cognito: match AWS's real defaults so a second terraform plan reports no changes (#​2420) (5ed3a8c), closes FirehoseService#mergeDestination
• rds: clear CLIENT_SSL before forwarding the TLS-terminated handshake response to the backend (#​2698) (0090739)
• rds: grant the MySQL/MariaDB master user RDS-master-equivalent privileges (#​2679) (6c96f47)
• rds: keep the tags given to CreateDBSubnetGroup (#​2627) (20ecb89), closes #​2612
• rds: propagate ModifyDBCluster master-password rotations to the backend and every proxy (#​2727) (895b59f), closes #​2709
• rds: propagate ModifyDBInstance master-password rotations to the backend and proxy (#​2709) (09a05c2)
• rds: reject a duplicate create while provisioning is in flight (#​2525) (7ef698c), closes #​2051
• rds: store and return the encryption and backup settings given on create (#​2617) (5033ace), closes #​2611
• repair main CI (AslExecutor test compilation, Redshift compat test endpoint) (#​2726) (477e8ae), closes #​2703 #​2688
• s3: accept the log-delivery-write canned ACL (#​2653) (2a014d2)
• s3: emit post events for browser uploads (#​2577) (d8ef1c8)
• s3: prevent compliance retention downgrade (#​2755) (2e5935d)
• s3: resolve virtual-hosted buckets whose names contain dots (#​2493) (ea2b62f)
• s3: return x-amz-version-id from presigned POST (#​2608) (066e6c9), closes #​2607
• s3: route the replication subresource instead of falling through (#​2519) (ce4f6d1), closes #​2296
• secretsmanager,rds: rotate secrets that an AWS service manages (#​2378) (23015a7)
• secretsmanager: raise InvalidRequestException, not ResourceNotFoundException, for pending-deletion secrets (#​2514) (fd78ae4), closes #​2513
• secretsmanager: stop CreateSecret overwriting a secret inside its recovery window (#​2555) (1e443ac), closes #​2549
• security: reject unregistered SigV4 access keys and unbound usernames (#​2680) (f9d28c9), closes #​2657
• serialize Kinesis stream creation timestamps as plain decimals (#​2173) (c335086), closes #​2099
• ses: enforce full AWS tag validation across all SES resources (#​2504) (29f6e7a)
• ses: reject non-string tag members with SerializationException (#​2512) (60dd795)
• ses: report the sending account in send-event payloads (#​2499) (bd36b02)
• ses: return DeliveryOptions from v1 DescribeConfigurationSet (#​2841) (7473c57)
• signin: preserve AWS token error modes (#​2554) (399bf20)
• ssm: stop re-reading shared mutable state in the command status rollup (#​2477) (6f1ce9b), closes #​2264 #​2264
• ssm: validate SettingValue and require an account list on ModifyDocumentPermission (#​2635) (149ac63)
• stepfunctions: bound $range allocation at the AWS memory limit (#​2790) (f7f16cd), closes #​2738 #​2737
• stepfunctions: bound a running execution the four ways AWS does (#​2782) (9288769), closes #​2733
• stepfunctions: bound JSONata evaluation by time and depth (#​2697) (3954018), closes Frame#setRuntimeBounds #​2667
• stepfunctions: end the execution when a state throws an Error (#​2693) (acf8879), closes #​2666
• stepfunctions: fail the state when a JSONata expression returns nothing (#​2689) (ea11e67), closes #​2665
• stepfunctions: keep a JSONata expression's explicit null in the output (#​2684) (48e0ecd), closes #​2664 #​2665
• stepfunctions: let a mocked response with no attempts start the execution (#​2823) (63a2a60), closes #​2523
• stepfunctions: refuse the definitions AWS refuses, at both validation entry points (#​2786) (ead70ea)
• stepfunctions: resolve the substitutions in a JSONata error cause (#​2687) (09d813d), closes #​2668
• stepfunctions: write a large whole number in full in $string (#​2683) (2a7ee7a), closes #​2669
• ui: reconnect the UI sidecar without restarting Floci (#​2718) (02f9754), closes HI#severity
• update .gitignore to include .mission/ for shared tooling visibility (#​2750) (2bc3736)

Features

• acm: certificate validation records and revocation (#​2655) (3bd9bcc)
• apigateway: API key import/usage-plan fidelity and update-operation fixes (#​2631) (9b9e7f5)
• apigatewayv2: OpenAPI import and Terraform-visible API/stage attributes (#​2714) (881695e)
• apigatewayv2: support custom domain names and API mappings (#​2390) (74da157)
• applicationautoscaling: evaluate target-tracking and step-scaling policies against ECS (#​2692) (2a7c94b), closes #​2565
• appsync: Phase 7 — GraphQL execute authentication (#​2380) (3f12428)
• aps: add Amazon Managed Service for Prometheus workspaces (#​2604) (277809f)
• autoscaling: P0 operations and lifecycle-hook delete-by-name (#​2673) (e9a379b)
• batch: add update and delete job queue endpoints with corresponding service logic (#​2807) (6f123e8)
• cloudformation: apply security-group rules — inline properties and standalone resources (#​1993) (1461a10), closes #​1992
• cloudformation: CDK Provider-framework custom resources and changeset/SSM param fidelity (#​2688) (08e532a), closes #​2455 #​2455 #​2666
• cloudformation: CodeBuild/CodePipeline CFN provisioning (#​2685) (ac94232)
• cloudformation: expand SAM AWS::Serverless::HttpApi to ApiGatew… (#​1956) (6fa53ab)
• cloudformation: provision WAFv2 web ACLs and AWS Config rules (#​2701) (8a705d0), closes CloudFormationTemplateEngine#resolveNode
• cloudfront: apply response-headers policies when serving (#​1833) (520c0f4), closes #​1820 #​1823
• cloudfront: forward origin custom headers (#​1832) (f2ad05c), closes #​1820 #​1823
• cloudwatch-logs: add resource policy actions (#​2574) (859db2f)
• cloudwatch: Adds support for orderBy, pagination, limit in DescribeLogStreams response (#​2362) (846e78d)
• codegurureviewer: repository association lifecycle with tagging (#​2741) (0b46d80)
• codepipeline: validate ListPipelineExecutions filters and PutApprovalResult inputs (#​2696) (a155e66)
• cognito: user pool domain operations (Create/Describe/DeleteUserPoolDomain) (#​2742) (ed16713)
• comprehend: add Amazon Comprehend sync text-analysis actions (#​2674) (5c1b69c), closes #​2660
• config: compliance evaluation loop, retention, pagination (#​2642) (1b3417a)
• connect: instance management (CreateInstance family, attributes, storage configs, tags) (#​2740) (7b6266e)
• controltower: add AWS Control Tower with landing-zone and baseline lifecycle (#​2578) (4524099)
• core: add configurable mock responses for stub AI services (#​2765) (e2e69f6), closes #​2764
• core: label emulated resource containers with io.floci.* identity (#​2497) (8247014), closes #​1818 #​1818
• docs: guard the service matrix against undocumented services (#​2465) (700acc6), closes #​2436
• ec2: IPAM with real CIDR allocation, EBS encryption defaults, and transit gateway route export (#​2596) (9563b7e), closes #​2526 floci-io/floci#2605
• ec2: support ModifyVpcEndpoint and persist the endpoint policy (#​2526) (2e8cbc1), closes #​2317
• ec2: support transit gateway route tables, associations and routes (#​2348) (bc0f88c), closes #​2308 #​2329
• ec2: support transit gateway VPC attachments (#​2347) (74e43a4), closes #​2308
• ecs: rewrite ECR image URIs on RunTask like Lambda already does (#​2641) (c405093), closes #​2568
• efs: add Elastic File System (file systems, mount targets, access points) (#​2371) (943b4c1)
• elasticache: support cache parameter groups (#​2392) (6b62817)
• elasticache: support cache subnet groups (#​2401) (06d58aa)
• elasticache: support cluster-mode replication groups (#​2633) (97ff0bc)
• emrserverless: support EMR Serverless applications (#​2403) (8a673fc)
• eventbridge: add Connection API actions (#​1897) (36a55f5)
• firehose: add StartDeliveryStreamEncryption and StopDeliveryStreamEncryption (#​2583) (4affa05)
• firehose: deliver records from a Kinesis stream source (#​2528) (009ac0b)
• firehose: honor CompressionFormat and FileExtension on S3 delivery (#​2410) (bba5ffb), closes #​2328
• fis: add AWS FIS support ([#​2435

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.88%. Comparing base (1ae5028) to head (ab8034b).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #469   +/-   ##
=======================================
  Coverage   81.88%   81.88%           
=======================================
  Files           5        5           
  Lines         414      414           
=======================================
  Hits          339      339           
  Misses         45       45           
  Partials       30       30           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.