cloudposse/atmos v1.234.0-nightly.41368226888 on GitHub

📦 Other Changes

test: Improve coverage for mock AWS auth provider credential and identity flows @Copilot (#2511)

Expanded mock AWS auth provider coverage for credential expiration, expiration accessors, validation, non-sensitive BuildWhoamiInfo environment projection, identity metadata, provider resolution, environment preparation, credential-file path sanitization, persisted credential loading, invalid JSON, typed missing-credential errors, and idempotent logout cleanup.

feat: add plugin distribution and verification services @osterman (#3457)

Added plugin distribution and trust services for catalogs, discovery, installation, lockfiles, package management, signing, verification, authentication adapters, and structured output. Packages are verified before installation, archive and alias collisions are rejected, configuration updates remain transactional, compatible variants are preserved for installs and offline restores, and Windows paths and executable suffixes are handled safely.

feat: add plugin bootstrap and authoring services @osterman (#3458)

Added plugin bootstrap and authoring services, including configuration-driven build, scaffold, conformance, OIDC, SDK include installation, protocol generation, signed output, and multi-target builds. Archive installation preserves configured entrypoint names and permissions, rejects collisions, and rolls back failed installs while retaining recovery artifacts when cleanup cannot complete.

feat(cli): add discovery metadata for core commands @osterman (#3466)

Added command-owned documentation URLs and ordered example metadata to the command registry, with independently inherited documentation and examples and metadata-preserving aliases. Core stack, cloud, CI, configuration, and profile commands now register their discovery metadata.

feat(cli): add discovery metadata for supporting commands @osterman (#3467)

Added documentation URLs and ordered examples to the remaining built-in commands, including authentication, AI/MCP, Git, toolchain and version management, secrets, and developer utilities. Nested commands can own their metadata, while commands without dedicated pages inherit their parent documentation.

docs: demonstrate CI failure annotations locally @osterman (#3472)

Updated the CI failure annotations changelog and policy example README with a runnable local preview, expected annotation output, intentional exit code 77, and early-admission behavior.

fix(ci): stabilize quality reporting and CI dependencies @osterman (#3476)

Stabilized quality reporting by selecting the newest CI and Codecov checks, publishing pending and final reports without redundant edits, recovering long-running reports and reruns, and grouping summaries into Readiness, Reviews, and Measures. CI retries, artifact downloads, Ubuntu mirrors, local fixtures, Pact installation, and external dependency handling were also hardened.

Add runnable CDK examples with casts for the CDK tutorial @osterman (#3481)

Added runnable examples/cdk-cloudformation and examples/cdk-terraform applications using the native CloudFormation and Terraform components against the local Floci AWS emulator. The examples include fresh-aware synth hooks, atmos test smoke checks, lifecycle casts, and CDK tutorial links.

Clean up stale overrides in copyable Atmos examples @osterman (#3485)

Cleaned up 57 copyable Atmos examples by removing incidental logging, redundant approval and initialization settings, and global caching auto-approval while retaining required and intentional configuration demonstrations. Quick-start guidance and generated configuration snapshots were updated for current defaults.

Reconcile bundled skills and command documentation @osterman (#3491)

Corrected bundled skill examples and command/configuration documentation across migration, MCP, OCI, scaffold, backend, authentication, toolchain, vendor, Ansible, theme, and component guidance. Unsupported flags and formats were removed, implemented commands and restrictions were documented, and executable examples now receive curated checks.

chore(review): encourage extracting legacy catch-all packages @osterman (#3521)

Added CodeRabbit path instructions encouraging focused extraction of touched behavior and tests into owning packages, with thin adapters where needed.

chore: bump Claude Code plugin version to v1.233.2 @cloudposse-releaser[bot] (#3528)

Bumped the Claude Code plugin version to v1.233.2.

fix(release): recognize landed native stack members @osterman (#3536)

Release history now recognizes merged native-stack PRs when their merge commits are present in the verified release source range, even if GitHub retains the original non-main base branch. Unmerged or unrelated merges still fail validation, and release labels, milestones, and release-plan entries remain enforced.

fix(ci): re-check quality:ready PRs whose head status fails @osterman (#3539)

The scheduled Quality Gate reconciler now re-evaluates quality:ready PRs whose combined head status is failure or error, even when the report is current and the commit is older than 24 hours. quality:not-ready PRs and pending statuses are not selected.

fix(ci): select current workflow results in quality gate @osterman (#3540)

Quality Gate now selects the newest run of a workflow by creation time and run ID and excludes GitHub Actions checks only when their check-suite ID identifies a superseded run. Current failures and pending runs, unknown or shared suite IDs, external checks, and synthetic merge-commit checks remain enforced.

fix: plugin release inputs and changelog release badge @osterman (#3554)

Removed the repository root go.mod from auth-secrets plugin release inputs and bumped the plugin to 1.0.1. Changelog posts now show manual, detected, or Unreleased release badges, and the CDK hooks post includes the cast and castTitle metadata required for its timeline card.

docs: add plugin pages and fix CI network checks @osterman (#3575)

Added /plugins and /plugins/official documentation pages with quick-start guidance, official package details, existing guide links, and Capabilities navigation. CI network diagnostics now allow StepSecurity up to 60 seconds to initialize and recognize exact eBPF DNS rejection events.

fix(release): group release preview issues by release-notes category @osterman (#3577)

Release preview issues now group milestone PRs under the same categories and order as published release notes, including Breaking Changes, Features, Bug Fixes, and Other Changes, with PRs sorted within each group. Preview entries retain each PR's state and summary.

fix(ci): stop the Quality Gate from blocking on unapproved signal runs @osterman (#3583)

Quality Gate no longer treats Quality Gate Signal runs as CI evidence at their trigger events, and legacy blocked reports are re-evaluated once using the v2 exclusion marker. action_required results now direct users to approve waiting workflows while continuing to block readiness.

✨ Features

feat(cast): interpret VHS tapes and add atmos cast record @osterman (#2889)

type: cast steps can now interpret VHS tapes supplied inline with tape: or from .tape files with tape_file:, in steps or PTY-backed session mode without requiring the VHS binary. Added atmos cast record options, configurable shell initialization, screenshots, literal VHS typing, setup parsing, wait semantics, and support for VHS directives and keypresses.

Add stack planning, selectors, CI, and directory scaffolding @osterman (#3429)

Added dependency-aware stack planning and testing with atmos stack plan and stack test, stack and component selectors, --dry-run, custom capabilities, CI reporting, and introspection through stack list, stack describe, and stack instances. stack create --target now renders one or more decomposed stack layouts with scaffold inputs, validation, exclusive writes, rollback, and independent records.

feat(cast): Starlark cast recorder, script source, and CI cast checks @osterman (#3431)

Added cast.recorder(...) for Starlark scripts, combining command execution and recording with PTY blocks, assertions, policies, replacements, and fingerprint validation. Script steps can load local sources, session waits avoid terminal echo, and casts validate all now covers every cast validator.

Add stack lifecycle orchestration and scaffold creation @osterman (#3442)

Added dependency-aware atmos stack deploy and stack destroy, plus scaffold-backed single-file stack create and shared lifecycle adapters. Hook declarations are validated against registered lifecycle events for current editions, while scaffold planning, generation failures, stale records, and recovery guidance are handled explicitly.

Add safe Doctor migrations and fix nested error rendering @osterman (#3454)

Added safe Doctor migrations for legacy naming patterns and tokens, guarded by production before/after identity checks, with guidance for local schema copies. Nested errors now render without raw Markdown, terminal color is preserved through wrappers, metadata explanations are separated from actionable hints, and hook dispatch logs use Debug level.

feat: enable native Go plugins and OIDC authentication @osterman (#3459)

Enabled the experimental native plugin command family, startup integration, built-in OCI identity, policy checks, OIDC authentication, and plugin build --platform/--all-platforms. Policy reports preserve JSON field names and embedded objects across YAML output, with CLI documentation, SDK automation, demos, and release guidance.

feat(policy): add validation engines and shared runtime context @osterman (#3461)

Added native OPA and JSON Schema policy engines with boolean and diagnostic Rego results, YAML/JSON file checks, and shared environment, runtime, version, FIPS, calendar, and CI evidence. Deployment and authentication guardrails, shared version/date checks, migration guidance, and reference documentation were added.

fix(yaml): require explicit function tags with edition compatibility @osterman (#3463)

Unpinned configurations and editions from 2026-10-20 now require explicit YAML function tags, preserving tag identity through loading, merging, templates, deferred evaluation, and serialization. Legacy behavior remains available with edition: "2026-10-19", including condition shorthand and explicit evaluation APIs.

feat(cli): add --docs and --example command discovery @osterman (#3468)

Command help and usage errors now show copyable documentation URLs, with global --docs, --docs=md/--docs=markdown, and --example discovery and initialization. Markdown retrieval supports rendering, progress, cancellation, bounded downloads, and resolved links; example selection handles confirmations, occupied destinations, --force, aliases, --chdir, and custom flag ownership.

Add Fogg migration and CDK guides with CloudFormation improvements @osterman (#3471)

Added Fogg migration and AWS CDK/CDK Terrain tutorials, changelog and roadmap content, and Learn navigation. CloudFormation synthesis hooks now run before generated files are read, with inherited region and duration-based timeout settings plus Doctor migrations for legacy minute values.

feat: conditional stack imports and tagging tutorials; fix deferred rendering @osterman (#3473)

Added conditional stack imports through when, allowing labels and tags to select optional mixins and component instances for CLI selectors such as --tags and --labels. Native tags preserve replacement, append, merge, and unknown-list semantics; deferred map rendering, tagging tutorials, scaffolded Terraform sharing, and related examples were updated.

Validate merged stack auth and preserve secret discovery safety @osterman (#3487)

Added auth validate --stack with optional --component validation of each selected component's merged authentication configuration while retaining strict global validation. Secret discovery remains lazy, the default GCP ADC specification is supported, and the first SOPS write after key generation is repaired.

Generalize component executable overrides and execution flags @osterman (#3488)

Added consistent --command executable overrides to Terraform, Helmfile, Packer, and Ansible while preserving compatibility flags and precedence. Helmfile dry-run behavior, global options, stderr forwarding, and matching command/configuration documentation were corrected.

Fix source handling and add backend and alias inspection @osterman (#3490)

Added atmos toolchain aliases for sorted table or JSON/YAML inspection of effective aliases without registry lookup or installation, with configured aliases overriding built-ins. Added static atmos terraform backend list and describe inspection of merged local configuration, including imports and inheritance without authentication or expression execution.

Run repository checks through Atmos Git hooks and Starlark @osterman (#3494)

Repository checks, formatting, Git hooks, CI, and autofix now use a shared YAML/Starlark suite with native Git sandboxes, atomic writes, YAML bindings, and terminal-aware progress. Staged and unstaged edits are preserved, fixes are copied back safely, and forced hook replacement backs up existing launchers.

feat(starlark): add modules, records, and typed configuration @osterman (#3505)

Added module.load(path) and struct(**fields) to automation scripts with cached, frozen, parallel imports, cycle detection, and cancellation. Added typed YAML/JSON configuration loading and validation with schemas, defaults, bounds, optional fields, lists, enums, immutable records, source diagnostics, and config1.merge(config2).

feat(plugins): add public releases, catalog, and auth-secrets @osterman (#3510)

Added public OCI plugin releases and catalog discovery, with cloudposse/auth-secrets as the first independently versioned package. New secrets/store, secrets/env, plugin release, release plan, verify-public, and catalog sync --inventory commands support scoped credentials, masked environment projection, package signing and verification, cross-platform builds, and catalog reconciliation.

feat(starlark): add stdin, file writes, and script-local OS controls @osterman (#3526)

Added stdin= to exec.run, component.exec, and atmos.* wrappers, sending exact bytes without shell arguments and replaying input on retries. Added invocation-scoped os.getenv, os.environ, os.getcwd, os.platform, os.arch, os.setenv, and os.chdir, plus fs.write_file with exclusive creation by default and permission-preserving overwrite.

feat(yaml): support bounded parallel exec evaluation @osterman (#3527)

Added settings.functions.exec.max_concurrency to bound concurrent evaluation of ordinary !exec expressions, with a default of 1. Results retain their document positions, failures cancel outstanding commands, policy checks run before execution, and --skip=exec behavior is preserved.

Add conditional retries for component error events @osterman (#3542)

Added action: retry policies for component lifecycle and SDK error events across Terraform/OpenTofu, Helmfile, Packer, Ansible, native Helm, Kubernetes, CloudFormation, containers, and emulators, with predicates, budgets, aliases, schemas, and diagnostics. AWS configuration and credential updates are serialized on Windows, and screengrab staging uses the destination filesystem for atomic publication.

feat: native Vault identities and explicit credential templates @noeljackson (#3557)

Vault and OpenBao stores can now consume VAULT_TOKEN from a configured native Atmos identity, while auth-secrets providers read named credentials through store, path, and optional exact top-level field references. secrets/env renders explicit spec.env templates after authentication, masks source and rendered values, rejects unsafe or oversized templates, and locks complete store operations to prevent identity crossover.

🐛 Bug Fixes

fix(ai): use provider default models in --ai config hints @pcbeingused333 (#3413)

AI setup hints now obtain each provider's model from its DefaultModel, including the Anthropic, Bedrock, Gemini, Ollama, and Grok providers, instead of maintaining a separate hardcoded list. The hints therefore use model IDs accepted by the providers.

fix(include): resolve base_path before the working directory @djal (#3426)

!include and !include.raw now resolve bare relative paths against base_path before the working directory, while ./ and ../ paths remain relative to the including manifest and absolute paths are used as-is. The working directory remains a last resort for bare paths, and missing manifest-relative paths no longer fall through to base_path.

test: cover a stack-wide terraform_workspace_template, list it in metadata docs @bercedev (#3453)

Documented terraform_workspace_template as supported global metadata and added coverage showing that a stack-wide template reaches Terraform component metadata.

refactor: establish shared API and native plugin SDK @osterman (#3455)

Established the shared pkg/api contracts, standalone Go plugin SDK, protocol bindings, native transport, manifest and configuration primitives, and Starlark cast integration while preserving pkg/automation imports through deprecated aliases. Native plugin CPU variants now match immutable Atmos build metadata deterministically without OS or architecture fallback.

fix: unify credential handling and OCI registry access @osterman (#3456)

Added shared extension descriptors, OCI registry access, and unified built-in authentication and credential handling for the plugin distribution layers. Credential publication and logout cleanup are serialized, nested registry-auth deadlocks are prevented, GHCR token priority is preserved, and registry and identity operations retain their safety checks.

fix(terraform): run lifecycle hooks in prepared workdirs @osterman (#3462)

Terraform bulk init and test operations now run destroy, before, after, and per-component lifecycle hooks in prepared work directories while preserving resolved paths and credentials. Tool-version discovery is scoped to each project, and test fixtures start before emulator authentication.

fix: preserve Helm repository auth and AWS ambient context @osterman (#3470)

Native Helm render, install, and upgrade chart lookup now preserve repository credentials, TLS options, and credential-forwarding policy. AWS ambient authentication context is populated while retaining SDK discovery, AWS_PROFILE, and explicit managed credential overrides.

Preserve literal values and diagnose YAML function scope @osterman (#3486)

Preserved literal YAML values through loading, merging, templates, and output while enabling stack random and cwd evaluation and diagnosing functions in unsupported locations. Raw YAML shielding no longer affects decoded command arguments or import paths; screengrab staging and plugin archive path validation were also tightened.

Fix runtime evaluation and command execution boundaries @osterman (#3489)

Preserved saved plans during inspection and restored single-component destroy CI output while correcting custom-command boundaries, devcontainer settings, MCP exports, schema-directory flags, Ansible and workflow paths, retry defaults, SBOM discovery, and native Helm handling. CI-mode configuration reads now share the same lock as theme environment binding.

fix(helmfile): colorize diff output by default on a TTY @STiFLeR7 (#3498)

atmos helmfile diff now enables HELM_DIFF_COLOR=true automatically when Atmos detects color output and the user has not explicitly set the variable. Explicit component, stack, or shell values continue to override Atmos's default.

fix: upgrade Node.js to 24.22.1 and Go to 1.26.10 for CVEs @osterman (#3502)

Updated the AWS SAML Playwright Node.js runtime to 24.22.1, moved the website to Node 24.22.1 LTS, and upgraded the website's dompurify, launch-editor, and follow-redirects overrides. Go was updated to 1.26.10 to address the crypto/x509 certificate-verification advisory.

fix(stacks): resolve inherited metadata.component directories @osterman (#3508)

Inherited metadata.component is now resolved before backend generation while preserving explicit overrides, legacy selection, and disabled metadata inheritance. This keeps execution directories and affected-component detection aligned with the inherited module path.

build: streamline releases and pin GitHub Actions runners @osterman (#3509)

Release builds now publish six binaries and six Linux packages, with Linux 386, 32-bit ARM, and FreeBSD prebuilt downloads retired. atmos release cut --resume can recover unfinished production releases, Quality Gate uses current policy and status evidence, Git sandboxes preserve comparison metadata, and shared hooks select the current checkout's build/atmos executable.

fix(terraform): propagate skipped functions to nested lookups @osterman (#3513)

Terraform nested output and state lookups now preserve evaluation options such as --skip=secret and partition caches by skip list, preventing dependency lookups from contacting skipped secret providers.

fix(terraform): run tests without generating a backend @osterman (#3514)

Terraform tests no longer generate a backend file when auto_generate_backend_file is enabled, so provider-free test modules do not require backend_type; existing backend files are preserved.

fix(secret): honor scoped providers during key generation @osterman (#3515)

secret keygen -s <stack> now resolves stack, component, and type-scoped providers without evaluating secret values, including provider-only stacks with imported and templated configuration. Ambiguous overrides and missing explicit selections are rejected, while registered component types participate in filtering and description.

fix(sops): resolve nested recipient files and relative rules @osterman (#3516)

SOPS discovery now finds nested .sops.yaml recipient files from encrypted files and generates repository-relative matching rules for relative and absolute paths on Unix and Windows. When spec.file is omitted, a wildcard rule is derived from the configured secrets directory.

fix(secret): allow stack secrets without a component @osterman (#3517)

secret set NAME=value -s <stack> and secret validate -s <stack> now support stack and global declarations without requiring an unrelated component. Instance-scoped operations continue to require a component, and shared declarations are validated across inherited contexts.

fix(commands): honor stack on custom Atmos steps @osterman (#3518)

Custom Atmos steps with stack: <name> now pass the rendered stack to child commands when no explicit stack flag is present, placing it before passthrough -- and preserving explicit forms such as -sprod.

fix(emulator): validate the Kubernetes API port before startup @osterman (#3519)

Emulator specification validation now rejects Kubernetes configurations that replace container.ports without retaining the API port 6443/tcp. Existing port-list replacement semantics remain unchanged.

fix(ui): render email autolinks once and clarify test behavior @osterman (#3520)

Email autolinks in ui.info and related terminal messages now render once. Documentation also clarifies --help=all, stack-variable injection, and retained Terraform test files.

fix(sops): restore missing recipients from existing age keys @osterman (#3522)

SOPS key generation can recover a missing public recipient from an existing age private key without changing private key material, while preserving recipient rules and explicit recipients and rejecting ambiguous identities.

fix(ui): don't mangle list markers and emails in ui.* messages @osterman (#3524)

Starlark ui.info, ui.success, and ui.warning now preserve Markdown list markers, nested indentation, and wrapped list layout while rendering email autolinks once. The no-color renderer, toast status placement, emphasis, links, colors, masking, and task routing remain supported.

feat(duration): human-readable minutes/hours in resource-usage summary @osterman (#3529)

Resource-usage summaries now use duration.Format, displaying minute- and hour-scale values such as 34m 47s and 1h 2m 3s while retaining millisecond and second formatting for shorter durations. Values near a minute round to 1m instead of showing 60.0s.

fix(security): reduce scanner noise and patch dependencies @osterman (#3541)

Reduced security scanner noise by suppressing same-repository action false positives and reporting remaining backlogs by scanner. Go was updated to 1.26.10, patched JavaScript dependencies were applied, and Terraform hook test state is restored between shuffled runs.

fix(auth): isolate store identity auth from the component manager @osterman (#3546)

Added AuthenticateIsolated to authenticate an identity on a separate manager that shares effective configuration, credentials, validation, and realm without changing the caller's chain or stack context. Store authentication for AWS, Azure, and GCP now uses the isolated context, preventing store identity resolution from changing subsequent component state or secret lookups.

fix(ai): default Gemini to gemini-3.8-flash @pcbeingused333 (#3553)

Gemini's default model is now gemini-3.8-flash, and the TUI's function-calling hint and provider documentation use that model instead of retired or restricted Gemini versions.

fix(imports): support oci:// in stack and atmos.yaml imports @osterman (#3556)

Stack and atmos.yaml imports now support oci://host/repo:tag//path for files, directories, and globs, including nested_imports: remote, with one cached pull per invocation and imports.ttl support. Missing paths return ErrOCIImportMissingPath; remote cache copies retain extensions and are refreshed after a source is re-pulled.

fix(ai): report cached prompt tokens for OpenAI-compatible providers @pcbeingused333 (#3565)

OpenAI-compatible response parsing now reports usage.prompt_tokens_details.cached_tokens as Usage.CacheReadTokens, so atmos ai chat and usage output expose cached prompt tokens for OpenAI, Azure OpenAI, Grok, Ollama, and other compatible providers.

fix(ai): send max_completion_tokens for OpenAI o-series and gpt-6 models @pcbeingused333 (#3566)

OpenAI-compatible clients now send max_completion_tokens for all o-series models and gpt-6* models, while other names beginning with o continue to use max_tokens. This applies across OpenAI, Azure OpenAI, GitHub, Grok, DeepSeek, OpenRouter, and Z.ai clients.

fix: stabilize CI and clarify script failures @osterman (#3569)

CI workflows now preserve environments, recognize StepSecurity eBPF enforcement, warm native CI caches with Floci, and refresh AWS credentials before website deployment. Milestone queue handling, worker cleanup, CI-mode configuration synchronization, and Starlark failure guidance were also corrected.

Restore bulk Terraform plan summaries and enforce size limits @osterman (#3580)

Bulk Terraform plans now restore template-based summaries for every executed component, including no-change runs, with shared duration formatting. Aggregate reports and masked summary-file writes are size-bounded, writers are serialized, and oversized output produces a deduplicated warning recommending --tags or --labels.

fix: upgrade regressions in YAML functions, store hooks, custom flags @osterman (#3584)

YAML function values inside templates now resolve correctly, such as name: "app-{{ .vars.region }}", and unsupported map, list, or rewritten-function cases report clear errors. Store hooks can skip missing Terraform outputs during destroy with a warning, and custom commands may declare --example and --docs flags of any type.

fix(terraform): inject Atmos Auth credentials into terraform shell @osterman (#3604)

atmos terraform shell now runs the Atmos Auth Terraform pre-hook before terraform init, workspace selection, and the interactive shell, injecting identity credentials such as AWS_PROFILE, credential-file paths, and region settings. Authentication-hook failures now stop shell setup instead of continuing without credentials.

🤖 Automatic Updates

chore(deps): bump github.com/posthog/posthog-go from 1.12.6 to 1.17.4 @dependabot[bot] (#2764)

Bumped github.com/posthog/posthog-go from 1.12.6 to 1.17.4, including fixes for duplicated distinct_id flag properties and transient feature-flag request retries.

chore(deps): update dependency @types/node to v22.20.5 @renovate[bot] (#3422)

Updated the @types/node development dependency from 22.20.4 to 22.20.5.

chore(deps): update dependency tsx to v4.23.15 @renovate[bot] (#3423)

Updated the tsx dependency from 4.23.13 to 4.23.15, including fixes for bare built-in namespace inheritance, CommonJS require.cache and require.extensions, and portable namespaced register() declarations.

build(deps): bump al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1 @dependabot[bot] (#3425)

Bumped al.essio.dev/pkg/shellescape from 1.6.0 to 1.6.1.

chore(deps): update dependency prettier to v3.9.10 @renovate[bot] (#3507)

Updated Prettier from 3.9.9 to 3.9.10, including the Markdown GFM table parser update.

chore(deps): bump golang.org/x/tools from 0.51.0 to 0.52.0 in /tools/lintroller @dependabot[bot] (#3534)

Updated golang.org/x/tools from 0.51.0 to 0.52.0 in tools/lintroller, including the corresponding Go tooling and gopls fixes.

chore(deps): bump golang from 1.27.1 to 1.27.2 in /.devcontainer @dependabot[bot] (#3558)

Updated the / .devcontainer Go image from 1.27.1 to 1.27.2.

chore(deps): bump github.com/aws/aws-sdk-go-v2 from 1.47.1 to 1.47.3 @dependabot[bot] (#3559)

Updated github.com/aws/aws-sdk-go-v2 from 1.47.1 to 1.47.3, including updated Smithy dependencies and generated AWS clients.

chore(deps): bump github.com/PuerkitoBio/goquery from 1.12.0 to 1.13.0 @dependabot[bot] (#3560)

Updated github.com/PuerkitoBio/goquery from 1.12.0 to 1.13.0, which adds the top-level goquery.Text helper and performance improvements.

fix(deps): update github.com/cyberphone/json-canonicalization digest to 32a4819 @renovate[bot] (#3572)

Updated the github.com/cyberphone/json-canonicalization dependency digest from 19d51d7 to 32a4819.

chore(deps): update actions/upload-artifact action to v7.0.2 @renovate[bot] (#3574)

Updated actions/upload-artifact from v7.0.1 to v7.0.2, improving retries for HTTP 429 responses and honoring valid Retry-After headers.