Update floci/floci Docker tag to v2

[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
floci/floci (source)	major	1.6.0 → 2.3.0

---

Release Notes

floci-io/floci (floci/floci)

v2.3.0

Compare Source

Bug Fixes

• accessanalyzer: route GetAnalyzer through GET /analyzer/ (#​5534) (9889910), closes #​5353
• acm: reject empty SAN arrays in certificate requests (#​5688) (e15c081)
• apigateway: match AWS integration responses by status (#​5443) (7b8377f)
• apigateway: refuse EDGE REST APIs outside the commercial partition (#​5397) (a1f9045)
• apigateway: require API keys for imported methods (#​5450) (77113c7)
• apigateway: resolve component parameter references on REST import (#​4855) (0f94d62)
• apigateway: select request models by content type and default (#​5530) (e77710d)
• apigatewayv2: honor payload format 1.0 (#​5338) (04621d8)
• apigatewayv2: include stage variables in Lambda events (#​5416) (22c4c32)
• apigatewayv2: infer the 2.0 response body and answer function errors with a message (#​5153) (ecdecf2)
• apigatewayv2: send cookies and comma-joined duplicates in the 2.0 event (#​5152) (c6369b3)
• apigateway: validate and normalize imported integration types (#​5543) (63e0302)
• appconfig: accept a quoted Ion type parameter in Accept (#​5687) (190ed52), closes #​5673
• appconfig: accept names in management APIs (#​5417) (4ff2632)
• appconfig: serve legacy deployed configuration requests (#​5658) (91c67c6)
• appconfig: support deleting environments (#​5337) (2015d01)
• appsync: front custom domains with the partition's CloudFront zone (#​5237) (9d49e61)
• appsync: name the one service principal in a data-source denial (#​5593) (dbf6c30)
• auth: explain signature date and service mismatches (#​5591) (d5c6a36)
• auth: verify query signatures and retain STS caller identity (#​5584) (a017c94)
• autoscaling: balance scale-out across zones and subnets (#​5525) (6442d75)
• autoscaling: pause suspended capacity adjustments (#​5545) (41517f3)
• autoscaling: preserve launch configuration user data (#​5600) (ddc0e02)
• autoscaling: preserve launch template user data (#​5607) (b488d0c)
• autoscaling: preserve paused refresh ownership (#​5668) (b395560)
• autoscaling: round-trip InstanceMaintenancePolicy, AvailabilityZoneDistribution, CapacityReservationSpecification, ServiceLinkedRoleARN, WeightedCapacity and EnabledMetrics (#​5513) (991bf3a)
• bedrock-runtime: preserve images sent through the proxy (#​4681) (3bdb07d)
• bedrock-runtime: preserve structured output and reasoning effort (#​5512) (d0c7bd1)
• bedrock-runtime: stop abandoned calls and omit error-body logs (#​5526) (ce3d826)
• cloudcontrol: bound the worker queue and reject overflow (#​4479) (517409a)
• cloudformation: accept the stack ID in UpdateStack and CreateChangeSet (#​4846) (efd9512), closes #​4842
• cloudformation: apply an S3 bucket's NotificationConfiguration (#​5493) (6695482)
• cloudformation: apply Tags, DNS attributes and InstanceTenancy on AWS::EC2::VPC (#​5224) (2cade5c)
• cloudformation: apply TimeToLiveSpecification on DynamoDB tables (#​4951) (a5228a0)
• cloudformation: default CreateChangeSet type to UPDATE (#​5287) (f6e76bb)
• cloudformation: expand a SAM function's EventInvokeConfig (#​5524) (aff6f0e)
• cloudformation: honour PermissionsBoundary on AWS::IAM::Role and AWS::IAM::User (#​5266) (7d71df6), closes #​5391 #​5110 #​5391
• cloudformation: honour the DescribeStackResources filters (#​5455) (c5feab6), closes #​5451
• cloudformation: reject resources that depend on each other in a cycle (#​5208) (13738f8)
• cloudformation: replace Cognito user pool groups like CloudFormation (#​4841) (e9f2463), closes #​4836
• cloudformation: report CREATE events for a resource an update adds (#​4932) (8c61aa4)
• cloudformation: roll back a changed custom resource (#​4941) (e8a300f)
• cloudformation: send the stack's StackId to custom resources (#​4861) (f248eb5), closes #​4973
• cloudformation: wait for a stable ECS service (#​4880) (0ec64ad)
• cloudfront: reject a function runtime that CloudFront does not support (#​5445) (8deac0a), closes #​5425
• cloudfront: release origin connections when viewers disconnect (#​5564) (ee229af)
• cloudfront: serve viewer Range GETs (#​5377) (ff20750)
• cloudfront: stream origin responses and viewer request bodies (#​5278) (1f1d4f9)
• cloudwatch: route Query GET requests through CloudWatch (#​5589) (984e818)
• codeartifact: capture an empty readme for npm versions published without one (#​5683) (4be2b8b)
• codeartifact: escape the namespace/package boundary in storage keys (#​5408) (7fa1a50)
• codeartifact: make npm republish of identical content idempotent (#​5163) (2cf011f)
• codepipeline: link approval notifications to the partition's console host (#​5595) (8bd88bf)
• cognito: include domains in user pool responses (#​5448) (34c11b8)
• cognito: refuse user pool custom domains in GovCloud and EUSC (#​5614) (9df4ffb)
• cognito: reject token validity outside AWS's limits (#​5160) (17c40ce), closes #​5610
• cognito: run missing post-confirmation triggers (#​5207) (5dfb45d)
• cognito: run the PreSignUp trigger on AdminCreateUser (#​5149) (69b4d17)
• cognito: send email from the pool's EmailConfiguration sender (#​5150) (45f45e5)
• cognito: send the AdminCreateUser invitation with a temporary password (#​5155) (641bf98), closes #​5144
• cognito: surface sign-in denials with the exception classes Cognito uses (#​5223) (bcfb9c7)
• core: fail a Docker call after 30 seconds when its connection pool is full (#​5285) (985921c)
• core: give launched containers the port Floci listens on (#​5577) (1883855), closes #​4987
• core: make Docker read timeouts real on a Unix-socket host, except for long-lived streams (#​5294) (ddc47a4)
• core: replay a Docker request after a lost response only when it is safe to repeat (#​5171) (957d492)
• core: reuse pooled Docker connections and validate them after a second idle (#​5333) (3b36a4d), closes #​5294
• core: route a shared Query action name by the Version it declares (#​5549) (8a87e06), closes #​5032
• core: verify SigV4 header signatures for every service under validate-signatures (#​5268) (9f224d9), closes #​5195
• deps: bump botocore to 1.43.111 and regenerate the vendored AWS data (#​5498) (94a801e)
• deps: bump botocore to 1.43.113 and regenerate the vendored AWS data (#​5613) (d84a764)
• dns: forward queries without per-context ordering (#​4643) (89f59de), closes #​4606
• dns: validate forwarded DNS responses against the query and its target (#​4671) (b6eeae9), closes #​4670
• docker: do not retry a call when the Docker socket does not exist (#​5424) (dd6bf4c), closes #​5342
• docker: skip stale connection checks for named pipes (#​5400) (66756f7), closes #​5394
• dynamodb: authorize every requested item return mode (#​5652) (4ea7e3d)
• dynamodb: keep expired items visible until TTL deletion (#​5555) (e919560)
• dynamodb: mark time-to-live deletions on the stream as AWS does (#​4930) (9a7ec1c)
• dynamodb: prefix the Select conflict errors of Query and Scan (#​5562) (9c9e5a1)
• dynamodb: reject a too deep transact value before the transaction runs (#​5483) (6e38c08)
• dynamodb: reject an unknown ReturnConsumedCapacity on Scan (#​5669) (f3e1cb6)
• dynamodb: reject every mix of expression and non-expression parameters in Query and Scan (#​5619) (804335d)
• dynamodb: reject UpdateTable GSI changes AWS refuses (#​4714) (fdb21de), closes #​4572
• dynamodb: treat a null ReturnConsumedCapacity as absent, as AWS does (#​5686) (503899d)
• dynamodb: use the AWS wording when Query or Scan rejects AttributesToGet with a Select (#​5599) (dd0f40f)
• dynamodb: use the current AWS wording for Scan validation errors (#​5504) (c047da8)
• dynamodb: validate legacy Expected operands without rejecting Value (#​5508) (255ad96)
• ec2: add t2.medium through t2.2xlarge to the instance type catalog (#​5528) (24c1fdc)
• ec2: allocate endpoint IPv4 addresses within the subnet prefix (#​5385) (a8374ee), closes #​5384
• ec2: apply EBS encryption by default to new volumes and root volumes (#​5371) (da063a8), closes #​5370
• ec2: avoid Docker waits on the first CreateVpc (#​5179) (dc41417)
• ec2: canonicalize VPC and subnet CIDR blocks on create (#​5214) (4eae79d)
• ec2: derive flow log az-id the way subnets do (#​5238) (7f5a332)
• ec2: enforce VPC IPv4 CIDR block association restrictions (#​5510) (ac5f0bd)
• ec2: expose m6g.large through the shared instance catalog (#​5583) (f4c8237)
• ec2: filter network interfaces by primary address association (#​5531) (04dd78d)
• ec2: give availability-zone ids AWS's shape, shared by EC2, flow logs and EFS (#​5486) (1aabc8b)
• ec2: honor ZoneName, ZoneId and filters in DescribeAvailabilityZones (#​5475) (9cd97f1)
• ec2: list the request partition's regions in DescribeRegions (#​5550) (b4758b0)
• ec2: preserve endpoint IP types across updates and templates (#​5438) (80e8b74)
• ec2: preserve original Spot instance user data (#​5468) (b86268e)
• ec2: preserve original user-data bytes in instance metadata (#​5437) (f4bce30)
• ec2: preserve reserved tags during API and stack updates (#​5611) (90b9d37)
• ec2: preserve VPC endpoint IP address types (#​5427) (47d1e10)
• ec2: reject reserved IPv4 ranges for VPC CIDR blocks (#​5559) (66b2ec0)
• ec2: reject subnet CIDRs outside the VPC address space (#​5461) (20bc835)
• ec2: reject subnet IPv4 prefixes outside /16 to /28 (#​5439) (b1bb016)
• ec2: reject VPC IPv4 prefixes outside /16 to /28 (#​5495) (162ac6d)
• ec2: remove the volume helper container on shutdown (#​5551) (ec5692d)
• ec2: resolve interface endpoint fallback address collisions (#​5347) (84dbed1), closes #​5345
• ec2: return real AWS error for unknown availability zone name (#​5529) (06f0e06), closes eksctl-io/eksctl#8174
• ec2: serve IMDS instance identity credentials (#​5289) (8502565), closes #​5264
• ec2: validate subnet tags before creation (#​5306) (aa94969)
• ecr: advertise the registry at the published address (#​4863) (c1cd5af)
• ecr: retry occupied registry ports (#​4857) (8b1ece9), closes floci-io/floci#4856
• ecs: accept a service ARN in ListTasks (#​4859) (5a8694e)
• ecs: launch service tasks through capacity provider strategies (#​5500) (431748f)
• ecs: look up a task definition without failing on a stored record with no ARN (#​5296) (4927f71)
• ecs: mount and clean up ephemeral task volumes (#​5511) (760c38e)
• ecs: preserve binary output in exec sessions (#​5621) (9f224e5)
• ecs: use caller endpoint for exec stream URLs (#​5666) (6e8a083)
• eks: accept a role ARN from another partition the way STS does (#​5398) (fb202cc)
• eks: mirror the cluster's own region and account in the registry config (#​5399) (8b83892)
• elasticache: restore groups and clusters of every account (#​5244) (05e1beb)
• elasticache: return modeled wire error codes for replication group and user name faults (#​5571) (86b1904)
• elasticache: use the AWS wire codes UserNotFound and UserAlreadyExists (#​5452) (b318794)
• elbv2: honor SubnetMappings in CreateLoadBalancer and SetSubnets (#​5533) (999ccde)
• elbv2: keep a refused ModifyListener from moving the listener (#​5491) (ee274b9)
• elbv2: preserve default listener certificates (#​5692) (a55352b)
• elbv2: preserve repeated target response headers (#​5628) (15f50cb)
• elbv2: reject a listener certificate the account does not have (#​5474) (2332533)
• emr: use the cluster's regional private DNS domain for instances and the master (#​5169) (4115bec)
• eventbridge: reject malformed Detail JSON for PutEvents (#​5465) (e3c2096)
• eventbridge: require EventPattern or ScheduleExpression in PutRule (#​5172) (be668ac)
• eventbridge: stop a scheduled rule's timer when its rule is gone (#​5462) (d6f93ab)
• eventbridge: stop schedule-only rules from matching put events (#​5168) (bb24ee0)
• iam: answer AWS's own errors for a malformed service-credential id, and for DeleteUser (#​5239) (3a8f974), closes #​5084
• iam: authorize a Smithy RPC v2 call as the operation its route runs (#​5620) (29ead62)
• iam: authorize an operation as the action AWS checks for it (#​5604) (eba0582)
• iam: check DynamoDB transaction item permissions (#​5576) (69bbd22)
• iam: enforce inline role policy quota (#​5327) (d22b4f1)
• iam: enforce user and group inline policy quotas (#​5590) (1d8f65d)
• iam: evaluate every IAM action against the resource it acts on (#​5404) (d884d55), closes #​4979
• iam: honor managed policy attachment conditions (#​5578) (367ae0b)
• iam: make the server certificate reference check atomic with the write (#​5368) (477e3ef), closes #​5087
• iam: match absent context keys with ForAllValues (#​5482) (ea8da22)
• iam: open every ValidationError with the count AWS puts on it (#​5280) (88d429a), closes #​5240 #​5239 #​5240
• iam: page ListRoles and ListPolicies through MaxItems and Marker (#​5515) (72a4cc5)
• iam: preserve later policy writes during rollback (#​5596) (9ab820d)
• iam: refuse inactive keys and unreadable credentials in enforcement (#​5346) (46f9c23)
• iam: return UserName from GetAccessKeyLastUsed (#​5579) (372d3d1)
• iam: route every dispatched IAM action, and require the parameters the model requires (#​5227) (4495ade), closes #​5032
• iam: separate a constraint failure from an invalid value in PutAccountProperties (#​5240) (5fc8b04), closes #​5177
• iam: take service-linked role names and suffix support from AWS evidence (#​5293) (df4fa58), closes #​5084
• iam: validate RoleName in CreateRole (#​5374) (cb67380)
• iam: validate RoleName in every role action (#​5391) (b2b083e)
• kms: return an empty body for operations without output (#​5318) (63ef2d3)
• lambda: add cookies array to function URL events (#​5288) (673c809), closes #​5255
• lambda: check the RevisionId precondition in UpdateFunctionCode (#​4641) (b9625bf), closes #​4639
• lambda: default event source mapping BatchSize by source type (#​5362) (29319fb), closes #​4740
• lambda: end the invocation when a checkpoint closes a durable execution (#​5299) (ebd364e)
• lambda: enforce function policies on cross-account calls (#​5476) (6d7d85f)
• lambda: expose the executing version on cold launches (#​5523) (8565ad8)
• lambda: keep every AddPermission condition and store account principals as root ARNs (#​5123) (e28c58c), closes #​4627
• lambda: keep watching for a runtime exit after the wait stream fails (#​5284) (a3027c0), closes #​3314
• lambda: list $LATEST first, then versions in numeric order (#​5376) (47dae88), closes #​5121
• lambda: list changed durable operations in creation order (#​5328) (9c2db35)
• lambda: quote the model's FunctionName pattern in the validation error (#​5487) (32cb4b7)
• lambda: refuse function URLs in GovCloud and China (#​5615) (2551626)
• lambda: validate members the model bounds (ESM Topics, S3 code, alias, LicenseInfo) (#​4989) (c3133f1), closes #​4607 #​4607
• logs: enforce stream resource permissions (#​5694) (dbe7fdb)
• mq: return CreateBroker members from DescribeBroker (#​5211) (73133b4), closes #​1951
• mq: route DescribeSharedResources (#​5356) (d1fe27c)
• partition: accept EFS access points in ISO-E and ISO-F and list the execution's regions in Step Functions (#​5485) (7837792)
• partition: hold escaped host regexes to the DNS suffix gate (#​5232) (1b61945)
• partition: read strict-mode service availability from endpoint rulesets too (#​5231) (8a1d1dd)
• partition: serve a pseudo signing region as its partition's global region (#​5233) (e1cd6fe)
• partitions: source the China CloudFront suffix and GovCloud API Gateway zones (#​5618) (3afb5b4)
• rds-data: accept parameter names that start with a digit (#​5119) (bdb37f0)
• rds-data: reject an ExecuteStatement response over 1 MiB (#​5120) (a7e2447)
• rds-data: reject concurrent transaction requests (#​5575) (2a04cd7)
• rds-data: reject result rows larger than 64 KB (#​5290) (93cc2ff), closes #​5113
• rds-data: reject SQL containing multiple statements (#​5556) (f833ca9)
• rds-data: return typed array result fields (#​5665) (bb06acd)
• rds,elasticache: decode IAM auth token parameters once (#​5039) (3041d6b)
• rds: apply Aurora IAM changes to existing members (#​5608) (966da1d)
• rds: apply PostgreSQL startup parameters to IAM sessions as the token's role (#​5304) (91c15be)
• rds: bind IAM tokens to the published port (#​5305) (3171b8a)
• rds: delete managed instance secrets (#​5330) (c70e1b0)
• rds: forward PostgreSQL startup parameters through the proxy (#​5151) (1199f3a)
• rds: honor restore IAM flags and reject malformed booleans (#​5473) (03a0dfe)
• rds: inherit Aurora member master credentials (#​5667) (92b2cf7)
• rds: inherit cluster IAM settings for new members (#​5653) (12c8f96)
• rds: keep Aurora member passwords owned by their cluster (#​5685) (430af5f)
• rds: list Aurora engines in DescribeOrderableDBInstanceOptions (#​5585) (025af9d)
• rds: load the token role's ALTER ROLE defaults into IAM sessions (#​5344) (e61b66f)
• rds: preserve credentials when managed-secret opt-out is refused (#​5553) (2927a45)
• rds: preserve snapshot partitions in custom regions (#​5428) (ad1fbbc)
• rds: reject malformed cluster snapshot copy flags (#​5472) (1e92b7e)
• rds: reject malformed event subscription flags (#​5481) (eb3c14d)
• rds: reject malformed instance boolean flags (#​5332) (b28eac9)
• rds: reject malformed parameter reset flags (#​5454) (4fd8df2)
• rds: reject malformed proxy boolean flags (#​5453) (af3672e)
• rds: reject malformed upgrade flags (#​5329) (c8f16d2)
• rds: reject tag ARNs from another partition (#​5419) (6083795)
• rds: report the default managed secret key (#​5420) (23e6fce)
• rds: restrict custom endpoint mutations to Aurora (#​5206) (d8b170a)
• rds: use cluster IAM policies for Aurora members (#​5605) (2aca536)
• redshift-serverless: return HTTP 400 for ResourceNotFoundException and ConflictException (#​5409) (972ff03)
• rekognition: refuse the images Rekognition refuses (#​5540) (c65b6e9)
• route53resolver: require at least two IP addresses for CreateResolverEndpoint (#​5539) (4da5143), closes #​4774
• route53: return the health check on a CreateHealthCheck retry (#​5298) (0d4b8cd)
• s3: answer an expired session with ExpiredToken when verifying signatures (#​5435) (013a921)
• s3: answer GetObject Range requests as S3 does (#​5436) (09a2d5c)
• s3: compare conditional GET dates at second precision (#​5598) (ca1d74c)
• s3: evaluate identity policies per key in DeleteObjects (#​5471) (23c6666)
• s3: limit CORS credentials header to S3-routed requests (#​5375) (9698c21)
• s3: refuse DeleteBucket while versions or delete markers remain (#​5548) (e023ae9)
• s3: reject a PutObject or UploadPart over 5 GiB ([#​5469](ht

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.