chore(deps): update backend

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
Authlib	==0.14.3 -> ==1.6.0						major
Flask (changelog)	>=2.2.3, <3 -> >=3.1.1, <4						major
boto3	~=1.34.114 -> ~=1.38.27						minor
cellxgene-ontology-guide (changelog)	~=1.0.0 -> ~=1.6.0						minor
connexion	==2.14.2 -> ==3.2.0						major
connexion	~=2.14.2 -> ~=3.2.0						major
dataclasses-json (changelog)	==0.6.6 -> ==0.6.7						patch
datadog	==0.49.1 -> ==0.51.0						minor
ddtrace (changelog)	>=2.1.4, <3 -> >=3.8.1, <4						major
ddtrace (changelog)	~=2.8.5 -> ~=3.8.1						major
matplotlib	>=3.6.3, <3.7 -> >=3.10.3, <3.11						minor
numba	~=0.59.1 -> ~=0.61.2						minor
psutil	~=5.9.8 -> ~=7.0.0						major
psutil	>=5.9.5, <6 -> >=7, <8						major
pyarrow	==16.0.0 -> ==20.0.0						major
scipy	~=1.13.1 -> ~=1.15.3						minor
swagger-ui (source)	3.23.11 -> 5.22.0						major
swagger-ui (source)	3.0.13 -> 5.22.0						major
ubuntu	22.04 -> 24.04					final	major

---

Release Notes

authlib/authlib (Authlib)

v1.6.0: Version 1.6.0

Compare Source

• Fix issue when RFC9207 is enabled and the authorization endpoint response is not a redirection. pull request #​733
• Fix missing state parameter in authorization error responses. issue #​525
• Support for acr and amr claims in id_token. issue #​734
• Support for the none JWS algorithm.
• Fix response_types strict order during dynamic client registration. issue #​760
• Implement RFC9101 The OAuth 2.0 Authorization Framework: JWT-Secured Authorization Request (JAR). issue #​723
• OIDC UserInfo endpoint support. issue #​459

v1.5.2: Version 1.5.2

Compare Source

Released on Apr 1, 2025

• Forbid fragments in redirect_uris. #​714
• Fix invalid characters in error_description. #​720
• Add claims_cls parameter for client's parse_id_token method. #​725

v1.5.1: Version 1.5.1

Compare Source

Released on Feb 28, 2025

• Fix RFC9207 iss parameter. #​715

v1.5.0: Version 1.5.0

Compare Source

• Fix token introspection auth method for clients. #​662
• Optional typ claim in JWT tokens. #​696
• JWT validation leeway. #​689
• Implement server-side RFC9207. #​700 #​701
• generate_id_token can take a kid parameter. #​702
• More detailed InvalidClientError. #​706
• OpenID Connect Dynamic Client Registration implementation. #​707

v1.4.1: Version 1.4.1

Compare Source

• Improve garbage collection on OAuth clients. #​698
• Fix client parameters for httpx. #​694

v1.4.0: Version 1.4.0

Compare Source

Bugfixes

• Fix id_token decoding when kid is null. #​659
• Support for Python 3.13. #​682
• Force login if the prompt parameter value is login. #​637
• Support for httpx 0.28. #​695

Breaking changes

• Stop support for Python 3.8. #​682

v1.3.2: Version 1.3.2

Compare Source

• Prevent ever-growing session size for OAuth clients.
• Revert quote client id and secret.
• unquote basic auth header for authorization server.

v1.3.1: Version 1.3.1

Compare Source

Prevent OctKey to import ssh and PEM strings.

v1.3.0: Version 1.3.0

Compare Source

Bug fixes

• Restore AuthorizationServer.create_authorization_response behavior, via #​558 by @​TurnrDev
• Include leeway in validate_iat() for JWT, via #​565 by @​dhallam
• Fix encode_client_secret_basic, via #​594 by @​Prilkop
• Use single key in JWK if JWS does not specify kid, via #​596 by @​dklimpel
• Fix error when RFC9068 JWS has no scope field, via #​598 by @​tanguilp
• Get werkzeug version using importlib, via #​591 by @​Sparrow0hawk

Breaking changes

• RFC9068 implementation, via #​586 by @​azmeuk.

v1.2.1: Version 1.2.1

Compare Source

• Apply headers in ClientSecretJWT.sign method, via #​552
• Allow falsy but non-None grant uri params, via #​544
• Fixed authorize_redirect for Starlette v0.26.0, via #​533
• Removed has_client_secret method and documentation, via #​513
• Removed request_invalid and token_revoked remaining occurences
  and documentation. #​514
• Fixed RFC7591 grant_types and response_types default values, via #​509
• Add support for python 3.12, via #​590

v1.2.0: Version 1.2.0

Compare Source

• Not passing request.body to ResourceProtector, #​485.
• Use flask.g instead of _app_ctx_stack, #​482.
• Add headers parameter back to ClientSecretJWT, #​457.
• Always passing realm parameter in OAuth 1 clients, #​339.
• Implemented RFC7592 Dynamic Client Registration Management Protocol, #​505`
• Add default_timeout for requests OAuth2Session and AssertionSession.
• Deprecate jwk.loads and jwk.dumps

v1.1.0: Version 1.1.0

Compare Source

This release contains breaking changes and security fixes.

• Allow to pass claims_options to Framework OpenID Connect clients, via #​446 by @​Galaxy102
• Fix .stream with context for HTTPX OAuth clients, via #​465 by @​bjoernmeier
• Fix Starlette OAuth client for cache store, via #​478 by @​haggen

Breaking changes:

• Raise InvalidGrantError for invalid code, redirect_uri and no user errors in OAuth 2.0 server.
• The default authlib.jose.jwt would only work with JSON Web Signature algorithms, if you would like to use JWT with JWE algorithms, please pass the algorithms parameter:

jwt = JsonWebToken(['A128KW', 'A128GCM', 'DEF'])

Security fixes for JOSE module

• CVE-2022-39175
• CVE-2022-39174

v1.0.1: Version 1.0.1

Compare Source

• Fix authenticate_none method, via #​438.
• Allow to pass in alternative signing algorithm to RFC7523 authentication methods via #​447.
• Fix missing_token for Flask OAuth client, via #​448.
• Allow openid in any place of the scope, via #​449.
• Security fix for validating essential value on blank value in JWT, via #​445.

v1.0.0: Version 1.0.0

Compare Source

We have dropped support for Python 2 in this release. We have removed
built-in SQLAlchemy integration.

OAuth Client Changes:

The whole framework client integrations have been restructured, if you are
using the client properly, e.g. oauth.register(...), it would work as
before.

OAuth Provider Changes:

In Flask OAuth 2.0 provider, we have removed the deprecated
OAUTH2_JWT_XXX configuration, instead, developers should define
.get_jwt_config on OpenID extensions and grant types.

SQLAlchemy integrations has been removed from Authlib. Developers
should define the database by themselves.

JOSE Changes

• JWS has been renamed to JsonWebSignature
• JWE has been renamed to JsonWebEncryption
• JWK has been renamed to JsonWebKey
• JWT has been renamed to JsonWebToken

The "Key" model has been re-designed, checkout the JSON Web Key for updates.

Added ES256K algorithm for JWS and JWT.

Breaking Changes: find how to solve the deprecate issues via https://git.io/JkY4f

v0.15.6

Compare Source

v0.15.5: Version 0.15.5

Compare Source

• Make Authlib compatible with latest httpx
• Make Authlib compatible with latest werkzeug
• Allow customize RFC7523 alg value

v0.15.4: Version 0.15.4

Compare Source

Security fix when JWT claims is None.

For example, JWT payload has iss=None:

{
  "iss": None,
  ...
}

But we need to decode it with claims:

claims_options = {
  'iss': {'essential': True, 'values': ['required']}
}
jwt.decode(token, key, claims_options=claims_options)

It didn't raise an error before this fix.

v0.15.3: Version 0.15.3

Compare Source

Fixed .authorize_access_token for OAuth 1.0 services, via https://github.com/lepture/authlib/issues/308

v0.15.2: Version 0.15.2

Compare Source

Fixed httpx authentication bug via #​283

v0.15.1: Version 0.15.1

Compare Source

Backward compitable fix for using JWKs in JWT, via #​280.

v0.15: Version 0.15

Compare Source

This is the last release before v1.0. In this release, we added more RFCs
implementations and did some refactors for JOSE:

• RFC8037: CFRG Elliptic Curve Diffie-Hellman (ECDH) and Signatures in JSON Object Signing and Encryption (JOSE)
• RFC7638: JSON Web Key (JWK) Thumbprint

We also fixed bugs for integrations:

• Fixed support for HTTPX>=0.14.3
• Added OAuth clients of HTTPX back via #​270
• Fixed parallel token refreshes for HTTPX async OAuth 2 client
• Raise OAuthError when callback contains errors via #​275

Breaking Change:

1. The parameter algorithms in JsonWebSignature and JsonWebEncryption
   are changed. Usually you don't have to care about it since you won't use it directly.
2. Whole JSON Web Key is refactored, please check JSON Web Key (JWK)

pallets/flask (Flask)

v3.1.1

Compare Source

Released 2025-05-13

• Fix signing key selection order when key rotation is enabled via
  SECRET_KEY_FALLBACKS. :ghsa:4grg-w6v8-c28g
• Fix type hint for cli_runner.invoke. :issue:5645
• flask --help loads the app and plugins first to make sure all commands
  are shown. :issue:5673
• Mark sans-io base class as being able to handle views that return
  AsyncIterable. This is not accurate for Flask, but makes typing easier
  for Quart. :pr:5659

v3.1.0

Compare Source

Released 2024-11-13

• Drop support for Python 3.8. :pr:5623
• Update minimum dependency versions to latest feature releases.
  Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. :pr:5624,5633
• Provide a configuration option to control automatic option
  responses. :pr:5496
• Flask.open_resource/open_instance_resource and
  Blueprint.open_resource take an encoding parameter to use when
  opening in text mode. It defaults to utf-8. :issue:5504
• Request.max_content_length can be customized per-request instead of only
  through the MAX_CONTENT_LENGTH config. Added
  MAX_FORM_MEMORY_SIZE and MAX_FORM_PARTS config. Added documentation
  about resource limits to the security page. :issue:5625
• Add support for the Partitioned cookie attribute (CHIPS), with the
  SESSION_COOKIE_PARTITIONED config. :issue:5472
• -e path takes precedence over default .env and .flaskenv files.
  load_dotenv loads default files in addition to a path unless
  load_defaults=False is passed. :issue:5628
• Support key rotation with the SECRET_KEY_FALLBACKS config, a list of old
  secret keys that can still be used for unsigning. Extensions will need to
  add support. :issue:5621
• Fix how setting host_matching=True or subdomain_matching=False
  interacts with SERVER_NAME. Setting SERVER_NAME no longer restricts
  requests to only that domain. :issue:5553
• Request.trusted_hosts is checked during routing, and can be set through
  the TRUSTED_HOSTS config. :issue:5636

v3.0.3

Compare Source

Released 2024-04-07

• The default hashlib.sha1 may not be available in FIPS builds. Don't
  access it at import time so the developer has time to change the default.
  :issue:5448
• Don't initialize the cli attribute in the sansio scaffold, but rather in
  the Flask concrete class. :pr:5270

v3.0.2

Compare Source

Released 2024-02-03

• Correct type for jinja_loader property. :issue:5388
• Fix error with --extra-files and --exclude-patterns CLI options.
  :issue:5391

v3.0.1

Compare Source

Released 2024-01-18

• Correct type for path argument to send_file. :issue:5336
• Fix a typo in an error message for the flask run --key option. :pr:5344
• Session data is untagged without relying on the built-in json.loads
object_hook. This allows other JSON providers that don't implement that.
  :issue:5381
• Address more type findings when using mypy strict mode. :pr:5383

v3.0.0

Compare Source

Released 2023-09-30

• Remove previously deprecated code. :pr:5223
• Deprecate the __version__ attribute. Use feature detection, or
  importlib.metadata.version("flask"), instead. :issue:5230
• Restructure the code such that the Flask (app) and Blueprint
  classes have Sans-IO bases. :pr:5127
• Allow self as an argument to url_for. :pr:5264
• Require Werkzeug >= 3.0.0.

boto/boto3 (boto3)

v1.38.27

Compare Source

=======

• api-change:emr-serverless: [botocore] This release adds the capability for users to specify an optional Execution IAM policy in the StartJobRun action. The resulting permissions assumed by the job run is the intersection of the permissions in the Execution Role and the specified Execution IAM Policy.
• api-change:sagemaker: [botocore] Release new parameter CapacityReservationConfig in ProductionVariant

v1.38.26

Compare Source

=======

• api-change:amplify: [botocore] Add support for customizable build instance sizes. CreateApp and UpdateApp operations now accept a new JobConfig parameter composed of BuildComputeType.
• api-change:autoscaling: [botocore] Add support for "apple" CpuManufacturer in ABIS
• api-change:bcm-pricing-calculator: [botocore] Add AFTER_DISCOUNTS_AND_COMMITMENTS to Workload Estimate Rate Type. Set ListWorkLoadEstimateUsage maxResults range to minimum of 0 and maximum of 300.
• api-change:cloudtrail: [botocore] CloudTrail Feature Release: Support for Enriched Events with Configurable Context for Event Data Store
• api-change:connect: [botocore] Amazon Connect Service Feature: Email Recipient Limit Increase
• api-change:dataexchange: [botocore] This release adds Tag support for Event Action resource, through which customers can create event actions with Tags and retrieve event actions with Tags.
• api-change:datasync: [botocore] AgentArns field is made optional for Object Storage and Azure Blob location create requests. Location credentials are now managed via Secrets Manager, and may be encrypted with service managed or customer managed keys. Authentication is now optional for Azure Blob locations.
• api-change:fsx: [botocore] FSx API changes to support the public launch of new Intelligent Tiering storage class on Amazon FSx for Lustre
• api-change:ivs-realtime: [botocore] IVS Real-Time now offers customers the participant replication that allow customers to copy a participant from one stage to another.
• api-change:mwaa: [botocore] Amazon MWAA now lets you choose a worker replacement strategy when updating an environment. This release adds two worker replacement strategies: FORCED (default), which stops workers immediately, and GRACEFUL, which allows workers to finish current tasks before shutting down.
• api-change:s3: [botocore] Adding checksum support for S3 PutBucketOwnershipControls API.
• api-change:sagemaker: [botocore] Add maintenance status field to DescribeMlflowTrackingServer API response

v1.38.25

Compare Source

=======

• api-change:cost-optimization-hub: [botocore] This release allows customers to modify their preferred commitment term and payment options.
• api-change:ec2: [botocore] Enable the option to automatically delete underlying Amazon EBS snapshots when deregistering Amazon Machine Images (AMIs)
• api-change:events: [botocore] Allow for more than 2 characters for location codes in EventBridge ARNs
• api-change:network-firewall: [botocore] You can now use VPC endpoint associations to create multiple firewall endpoints for a single firewall.
• api-change:synthetics: [botocore] Add support to change ephemeral storage. Add a new field "TestResult" under CanaryRunStatus.

v1.38.24

Compare Source

=======

• api-change:ce: [botocore] This release introduces Cost Comparison feature (GetCostAndUsageComparisons, GetCostComparisonDrivers) allowing you find cost variations across multiple dimensions and identify key drivers of spending changes.
• api-change:deadline: [botocore] AWS Deadline Cloud service-managed fleets now support storage profiles. With storage profiles, you can map file paths between a workstation and the worker hosts running the job.
• api-change:ec2: [botocore] This release adds three features - option to store AWS Site-to-Site VPN pre-shared keys in AWS Secrets Manager, GetActiveVpnTunnelStatus API to check the in-use VPN algorithms, and SampleType option in GetVpnConnectionDeviceSampleConfiguration API to get recommended sample configs for VPN devices.

v1.38.23

Compare Source

=======

• api-change:ec2: [botocore] This release adds support for the C7i-flex, M7i-flex, I7i, I7ie, I8g, P6-b200, Trn2, C8gd, M8gd and R8gd instances
• api-change:security-ir: [botocore] Update PrincipalId pattern documentation to reflect what user should receive back from the API call

v1.38.22

Compare Source

=======

• api-change:amp: [botocore] Add QueryLoggingConfiguration APIs for Amazon Managed Prometheus
• api-change:auditmanager: [botocore] With this release, the AssessmentControl description field has been deprecated, as of May 19, 2025. Additionally, the UpdateAssessment API can now return a ServiceQuotaExceededException when applicable service quotas are exceeded.
• api-change:dsql: [botocore] Features: support for customer managed encryption keys
• api-change:glue: [botocore] This release supports additional ConversionSpec parameter as part of IntegrationPartition Structure in CreateIntegrationTableProperty API. This parameter is referred to apply appropriate column transformation for columns that are used for timestamp based partitioning

v1.38.21

Compare Source

=======

• api-change:application-autoscaling: [botocore] Doc only update that addresses a customer reported issue.
• api-change:bedrock-agent-runtime: [botocore] Amazon Bedrock introduces asynchronous flows (in preview), which let you run flows for longer durations and yield control so that your application can perform other tasks and you don't have to actively monitor the flow's progress.
• api-change:cloudwatch: [botocore] Adds support for setting up Contributor Insight rules on logs transformed via Logs Transformation feature.
• api-change:ec2: [botocore] Release of Dualstack and Ipv6-only EC2 Public DNS hostnames
• api-change:partnercentral-selling: [botocore] Modified validation to allow expectedCustomerSpend array with zero elements in Partner Opportunity operations.

v1.38.20

Compare Source

=======

• api-change:datasync: [botocore] Remove Discovery APIs from the DataSync service
• api-change:ec2: [botocore] This release expands the ModifyInstanceMaintenanceOptions API to enable or disable instance migration during customer-initiated reboots for EC2 Scheduled Reboot Events.
• api-change:glue: [botocore] Enhanced AWS Glue ListConnectionTypes API Model with additional metadata fields.
• api-change:inspector2: [botocore] This release adds GetClustersForImage API and filter updates as part of the mapping of container images to running containers feature.
• api-change:oam: [botocore] Add IncludeTags field to GetLink, GetSink and UpdateLink API
• api-change:privatenetworks: [botocore] The privatenetworks client has been removed following the deprecation of the service.
• api-change:rds: [botocore] This release introduces the new DescribeDBMajorEngineVersions API for describing the properties of specific major versions of database engines.

v1.38.19

Compare Source

=======

• api-change:dsql: [botocore] CreateMultiRegionCluster and DeleteMultiRegionCluster APIs removed
• api-change:ec2: [botocore] This release includes new APIs for System Integrity Protection (SIP) configuration and automated root volume ownership delegation for EC2 Mac instances.
• api-change:mediapackagev2: [botocore] This release adds support for DVB-DASH, EBU-TT-D subtitle format, and non-compacted manifests for DASH in MediaPackage v2 Origin Endpoints.

v1.38.18

Compare Source

=======

• api-change:bedrock-data-automation: [botocore] Add support for VIDEO modality to BlueprintType enum.
• api-change:bedrock-data-automation-runtime: [botocore] Add AssetProcessingConfiguration for video segment to InputConfiguration
• api-change:codepipeline: [botocore] CodePipeline now supports new API ListDeployActionExecutionTargets that lists the deployment target details for deploy action executions.
• api-change:ecs: [botocore] This is an Amazon ECs documentation only release to support the change of the container exit "reason" field from 255 characters to 1024 characters.
• api-change:emr: [botocore] Added APIs for managing Application UIs: Access Persistent (serverless) UIs via CreatePersistentAppUI DescribePersistentAppUI & GetPersistentAppUIPresignedURL, and Cluster-based UIs through GetOnClusterAppUIPresignedURL. Supports Yarn, Spark History, and TEZ interfaces.
• api-change:glue: [botocore] Changes include (1) Excel as S3 Source type and XML and Tableau's Hyper as S3 Sink types, (2) targeted number of partitions parameter in S3 sinks and (3) new compression types in CSV/JSON and Parquet S3 sinks.
• api-change:neptune: [botocore] This release adds Global Cluster Switchover capability which enables you to change your global cluster's primary AWS Region, the region that serves writes, while preserving the replication between all regions in the global cluster.
• api-change:service-quotas: [botocore] This release introduces CreateSupportCase operation to SDK.

v1.38.17

Compare Source

=======

• api-change:bedrock-agent: [botocore] Amazon Bedrock Flows introduces DoWhile loops nodes, parallel node executions, and enhancements to knowledge base nodes.
• api-change:codebuild: [botocore] AWS CodeBuild now supports Docker Server capability
• api-change:controltower: [botocore] Updated the descriptions for the AWS Control Tower Baseline APIs to make them more intuitive.
• api-change:dms: [botocore] Introduces Data Resync feature to describe-table-statistics and IAM database authentication for MariaDB, MySQL, and PostgreSQL.
• api-change:pcs: [botocore] This release adds support for Slurm accounting. For more information, see the Slurm accounting topic in the AWS PCS User Guide. Slurm accounting is supported for Slurm 24.11 and later. This release also adds 24.11 as a valid value for the version parameter of the Scheduler data type.
• api-change:workspaces: [botocore] Added the new AlwaysOn running mode for WorkSpaces Pools. Customers can now choose between AlwaysOn (for instant access, with hourly usage billing regardless of connection status), or AutoStop (to optimize cost, with a brief startup delay) for their pools.

v1.38.16

Compare Source

=======

• api-change:cognito-idp: [botocore] Add exceptions to WebAuthn operations.
• api-change:firehose: [botocore] This release adds catalogARN support for s3 tables multi-catalog catalogARNs.
• api-change:logs: [botocore] This release adds a new API "ListLogGroups" and an improvement in API "DescribeLogGroups"
• api-change:mediaconvert: [botocore] This update enables cropping for video overlays and adds a new STL to Teletext upconversion toggle to preserve styling.

v1.38.15

Compare Source

=======

• api-change:bedrock: [botocore] Enable cross-Region inference for Amazon Bedrock Guardrails by using the crossRegionConfig parameter when calling the CreateGuardrail or UpdateGuardrail operation.
• api-change:bedrock-agent-runtime: [botocore] Changes for enhanced metadata in trace
• api-change:controltower: [botocore] AWS Control Tower now reports the inheritance drift status for EnabledBaselines through the GetEnabledBaseline and ListEnabledBaselines APIs. You can now filter EnabledBaselines by their enablement and drift status using the ListEnabledBaselines API to view accounts and OUs that require attention.
• api-change:dsql: [botocore] CreateMultiRegionClusters and DeleteMultiRegionClusters APIs marked as deprecated. Introduced new multi-Region clusters creation experience through multiRegionProperties parameter in CreateCluster API.
• api-change:ecs: [botocore] This release extends functionality for Amazon EBS volumes attached to Amazon ECS tasks by adding support for the new EBS volumeInitializationRate parameter in ECS RunTask/StartTask/CreateService/UpdateService APIs.
• api-change:license-manager: [botocore] Add Tagging feature to resources in the Managed Entitlements service. License and Grant resources can now be tagged.

v1.38.14

Compare Source

=======

• api-change:deadline: [botocore] AWS Deadline Cloud service-managed fleets now support configuration scripts. Configuration scripts make it easy to install additional software, like plugins and packages, onto a worker.
• api-change:ec2: [botocore] EC2 - Adding support for AvailabilityZoneId
• api-change:iam: [botocore] Updating the endpoint list for the Identity and access management (IAM) service
• api-change:medialive: [botocore] Add support to the AV1 rate control mode
• api-change:mediatailor: [botocore] Documenting that EnabledLoggingStrategies is always present in responses of PlaybackConfiguration read operations.
• api-change:s3control: [botocore] Updates to support S3 Express zonal endpoints for directory buckets in AWS CLI
• api-change:sagemaker: [botocore] No API changes from previous release. This release migrated the model to Smithy keeping all features unchanged.
• api-change:supplychain: [botocore] Launch new AWS Supply Chain public APIs for DataIntegrationEvent, DataIntegrationFlowExecution and DatasetNamespace. Also add more capabilities to existing public APIs to support direct dataset event publish, data deduplication in DataIntegrationFlow, partition specification of custom datasets.

v1.38.13

Compare Source

=======

• api-change:athena: [botocore] Minor API documentation updates
• api-change:logs: [botocore] We are pleased to announce limit increases to our grok processor logs transformation feature. Now you can define 20 Grok patterns in their configurations, with an expanded total pattern matching limit of 512 characters.
• api-change:synthetics: [botocore] Add support to retry a canary automatically after schedule run failures. Users can enable this feature by configuring the RetryConfig field when calling the CreateCanary or UpdateCanary API. Also includes changes in GetCanary and GetCanaryRuns to support retrieving retry configurations.
• api-change:workspaces: [botocore] Remove parameter EnableWorkDocs from WorkSpacesServiceModel due to end of support of Amazon WorkDocs service.

v1.38.12

Compare Source

=======

• api-change:cloudfront: [botocore] Doc-only update for CloudFront. These changes include customer-reported issues.
• api-change:codepipeline: [botocore] Add support for Secrets Manager and Plaintext environment variable types in Commands action
• api-change:ec2: [botocore] Launching the feature to support ENA queues offering flexibility to support multiple queues per Enhanced Network Interface (ENI)
• api-change:glue: [botocore] This new release supports customizable RefreshInterval for all Saas ZETL integrations from 15 minutes to 6 days.
• api-change:guardduty: [botocore] Updated description of a data structure.
• api-change:sso-admin: [botocore] Update PutPermissionBoundaryToPermissionSet API's managedPolicyArn pattern to allow valid ARN only. Update ApplicationName to allow white spaces.

v1.38.11

Compare Source

=======

• api-change:ec2: [botocore] This release adds API support for Path Component Exclusion (Filter Out ARN) for Reachability Analyzer
• api-change:imagebuilder: [botocore] Updated the CreateImageRecipeRequest ParentImage description to include all valid values as updated with the SSM Parameters project.
• api-change:medialive: [botocore] Enables Updating Anywhere Settings on a MediaLive Anywhere Channel.
• api-change:sagemaker: [botocore] SageMaker AI Studio users can now migrate to SageMaker Unified Studio, which offers a unified web-based development experience that integrates AWS data, analytics, artificial intelligence (AI), and machine learning (ML) services, as well as additional tools and resource
• api-change:synthetics: [botocore] Add support to test a canary update by invoking a dry run of a canary. This behavior can be used via the new StartCanaryDryRun API along with new fields in UpdateCanary to apply dry run changes. Also includes changes in GetCanary and GetCanaryRuns to support retrieving dry run configurations.

v1.38.10

Compare Source

=======

• api-change:ec2: [botocore] This release adds support for Amazon EBS Provisioned Rate for Volume Initialization, which lets you specify a volume initialization rate to ensure that your EBS volumes are initialized in a predictable amount of time.
• api-change:servicecatalog: [botocore] ServiceCatalog's APIs (DeleteServiceAction, DisassociateServiceActionFromProvisioningArtifact, AssociateServiceActionWithProvisioningArtifact) now throw InvalidParametersException when IdempotencyToken is invalid.
• api-change:timestream-query: [botocore] Add dualstack endpoints support and correct us-gov-west-1 FIPS endpoint.
• api-change:timestream-write: [botocore] Add dualstack endpoints support.

v1.38.9

Compare Source

======

• api-change:datazone: [botocore] This release adds a new authorization policy to control the usage of custom AssetType when creating an Asset. Customer can now add new grant(s) of policyType USE_ASSET_TYPE for custom AssetTypes to apply authorization policy to projects members and domain unit owners.
• api-change:devicefarm: [botocore] Add an optional parameter to the GetDevicePoolCompatibility API to pass in project information to check device pool compatibility.
• api-change:ec2: [botocore] This update introduces API operations to manage and create local gateway VIF and VIF groups. It also includes API operations to describe Outpost LAGs and service link VIFs.
• api-change:ecs: [botocore] Add support to roll back an In_Progress ECS Service Deployment
• api-change:mediaconvert: [botocore] This release adds an optional sidecar per-frame video quality metrics report and an ALL_PCM option for audio selectors. It also changes the data type for Probe API response fields related to video and audio bitrate from integer to double.

v1.38.8

Compare Source

======

• api-change:bedrock-data-automation: [botocore] Added support for Custom output and blueprints for AUDIO data types.
• api-change:ds: [botocore] Doc only update - fixed typos.
• api-change:kinesis: [botocore] Marking ResourceARN as required for Amazon Kinesis Data Streams APIs TagResource, UntagResource, and ListTagsForResource.

v1.38.7

Compare Source

======

• api-change:appconfig: [botocore] Adding waiter support for deployments and environments; documentation updates
• api-change:connect: [botocore] This release adds the following fields to DescribeContact: DisconnectReason, AgentInitiatedHoldDuration, AfterContactWorkStartTimestamp, AfterContactWorkEndTimestamp, AfterContactWorkDuration, StateTransitions, Recordings, ContactDetails, ContactEvaluations, Attributes
• api-change:sagemaker: [botocore] Feature - Adding support for Scheduled and Rolling Update Software in Sagemaker Hyperpod.
• api-change:verifiedpermissions: [botocore] Amazon Verified Permissions / Features : Adds support for tagging policy stores.

v1.38.6

Compare Source

======

• api-change:bedrock: [botocore] You can now specify a cross region inference profile as a teacher model for the CreateModelCustomizationJob API. Additionally, the GetModelCustomizationJob API has been enhanced to return the sub-task statuses of a customization job within the StatusDetails response field.
• api-change:bedrock-agent: [botocore] Features: Add inline code node to prompt flow
• api-change:bedrock-agent-runtime: [botocore] Support for Custom Orchestration within InlineAgents
• api-change:cleanrooms: [botocore] This release adds support for ProtectedQuery results to be delivered to more than one collaboration member via the new distribute output configuration in StartProtectedQuery.
• api-change:deadline: [botocore] Adds support for tag management on workers and tag inheritance from fleets to their associated workers.
• api-change:ec2: [botocore] Launch of cost distribution feature for IPAM owners to distribute costs to internal teams.
• api-change:ecr: [botocore] Adds dualstack support for Amazon Elastic Container Registry (Amazon ECR).
• api-change:ecr-public: [botocore] Adds dualstack support for Amazon Elastic Container Registry Public (Amazon ECR Public).
• api-change:logs: [botocore] CloudWatch Logs supports "DELIVERY" log class. This log class is used only for delivering AWS Lambda logs to Amazon S3 or Amazon Data Firehose.
• api-change:mailmanager: [botocore] Introducing new RuleSet rule PublishToSns action, which allows customers to publish email notifications to an Amazon SNS topic. New PublishToSns action enables customers to easily integrate their email workflows via Amazon SNS, allowing them to notify other systems about important email events.

v1.38.5

Compare Source

======

• api-change:connectcases: [botocore] Introduces CustomEntity as part of the UserUnion data type. This field is used to indicate the entity who is performing the API action.
• api-change:kinesis: [botocore] Amazon KDS now supports tagging and attribute-based access control (ABAC) for enhanced fan-out consumers.
• api-change:pinpoint-sms-voice-v2: [botocore] AWS End User Messaging has added MONITOR and FILTER functionality to SMS Protect.
• api-change:qbusiness: [botocore] Add support for anonymous user access for Q Business applications
• api-change:sagemaker: [botocore] Introduced support for P5en instance types on SageMaker Studio fo

---

Configuration

📅 Schedule: Branch creation - "every weekend" in timezone UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Deployment Summary

• backend_url: https://pr-7096-backend.rdev.single-cell.czi.technology
• frontend_url: https://pr-7096-frontend.rdev.single-cell.czi.technology
• delete_db_task_definition_arn: arn:aws:ecs:us-west-2:***:task-definition/dp-rdev-pr-7096-deletion:1
• migrate_db_task_definition_arn: arn:aws:ecs:us-west-2:***:task-definition/dp-rdev-pr-7096-migration:1