What floci-io/floci shipped
Written by FoxPlug from the repository's own releases; not affiliated with Floci. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/floci-io/floci; Floci did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Cognito now serves the OAuth token revocation endpoint on its own host and on custom domains, so signing a user out revokes the refresh token and every access and ID token. Pull request #4936
- CloudFormation now provisions Application Auto Scaling scalable targets and scaling policies, so stacks that attach a scaling policy to an ECS service no longer fail on those resources. Pull request #5407
- ElastiCache now provides serverless cache management APIs, with CreateServerlessCache, DescribeServerlessCaches, ModifyServerlessCache and DeleteServerlessCache over the AWS Query protocol, each backed by a hidden cluster. Pull request #5366
- CloudFormation now creates real CloudFront public keys, key groups and functions instead of reporting success for stub resources that created nothing. Pull request #5390
- Malformed CopyTags values are rejected before a DB cluster snapshot is copied, instead of being silently treated as false and creating a copy without source tags. Pull request #5472
- CreateSubnet now rejects IPv4 CIDRs that do not fit wholly inside the primary VPC block or an associated secondary block, returning InvalidSubnet.Range without creating a subnet. Pull request #5461
- S3 sends Access-Control-Allow-Credentials true when a request Origin matches a CORS rule through a specific origin, on both preflight and actual responses. Pull request #5375
- A resource that an UpdateStack adds now reports CREATE_IN_PROGRESS, then CREATE_COMPLETE or CREATE_FAILED, and DescribeStackResource shows CREATE_COMPLETE. Pull request #4932
- IAM now evaluates every action against the resource it acts on, so a policy statement that names one IAM resource binds to the action working on it. Pull request #5404
- The Docker call timeout is now configurable through floci.docker.api-timeout-seconds, defaulting to 300 seconds, so a shorter value shortens how long a call waits. Pull request #5431
Why it matters
This week broadens what stacks and clients can rely on: CloudFormation gained provisioners for Application Auto Scaling and real CloudFront public keys, key groups and functions, ElastiCache gained serverless cache APIs, and Cognito answers the OAuth token revocation endpoint. At the same time several validation gaps closed, so subnets outside a VPC block, IAM actions that name a resource, and malformed RDS flags are rejected instead of quietly accepted. For anyone running against Floci, that means fewer surprises from resources that reported CREATE_COMPLETE while nothing was created, and more requests behaving the way AWS does.
Changelog entry
- Feat(cognito): serve the OAuth token revocation endpoint Pull request #4936
- Feat(cloudformation): provision Application Auto Scaling targets and policies Pull request #5407
- Feat(elasticache): add serverless cache APIs Pull request #5366
- Feat(cloudformation): provision CloudFront public keys, key groups and functions Pull request #5390
- Feat(core): make the Docker call timeout configurable Pull request #5431
- Fix(rds): reject malformed cluster snapshot copy flags Pull request #5472
- Fix(ec2): reject subnet CIDRs outside the VPC address space Pull request #5461
- Fix(s3): send Access-Control-Allow-Credentials for matched CORS origins Pull request #5375
- Fix(cloudformation): report CREATE events for a resource an update adds Pull request #4932
- Fix(iam): evaluate every IAM action against the resource it acts on Pull request #5404
- Fix(dynamodb): mark time-to-live deletions on the stream as AWS does Pull request #4930
- Fix(cloudformation): honour PermissionsBoundary on AWS::IAM::Role and AWS::IAM::User Pull request #5266
This week: CloudFormation provisions Application Auto Scaling targets and policies plus real CloudFront public keys, key groups and functions. ElastiCache serverless cache APIs land, and Cognito serves OAuth token revocation.
This week in Floci: CloudFormation now provisions Application Auto Scaling scalable targets and scaling policies, and creates real CloudFront public keys, key groups and functions instead of reporting CREATE_COMPLETE for stubs. ElastiCache gained serverless cache management APIs, and Cognito now serves the OAuth token revocation endpoint on its own host and on custom domains. Validation also tightened: CreateSubnet rejects CIDRs outside the VPC address space, IAM evaluates every action against the resource it acts on, and malformed RDS snapshot copy, parameter reset and proxy boolean flags are rejected before anything is created or changed.
Week of September 28, 2026
What shipped
- Redshift Serverless now supports workgroups that actually run, letting Terraform, CloudFormation and SDK clients create a namespace and workgroup, connect with psql or JDBC, and run SQL through the Data API. Pull request #5012
- EKS now applies nodegroup labels, taints and capacity type to Kubernetes nodes, so pods with nodeSelector requirements schedule correctly and workloads tolerating nodegroup taints land on the right nodes. Pull request #5063
- CloudFormation now provisions AWS::Cognito::UserPoolUserToGroupAttachment instead of stubbing it, so users actually join groups instead of remaining unattached. Pull request #4806
- IoT now serves the custom authorizer management API with CreateAuthorizer, DescribeAuthorizer, UpdateAuthorizer, DeleteAuthorizer, ListAuthorizers, SetDefaultAuthorizer, DescribeDefaultAuthorizer and ClearDefaultAuthorizer. Pull request #4826
- EventBridge now supports API destination targets with CreateApiDestination, DescribeApiDestination, UpdateApiDestination and related operations. Pull request #5009
- CloudFormation now provisions AWS::Transfer::User, completing the Transfer service with User and Server support. Pull request #5076
- EMR can now resize running clusters with ModifyInstanceGroups and ModifyInstanceFleet, and list bootstrap actions with ListBootstrapActions. Pull request #4900
- EKS clusters no longer ship with a default local-path StorageClass, so PersistentVolumeClaims wait for a real CSI driver instead of silently provisioning local volumes. Pull request #5061
- IAM now models SSH public keys with UploadSSHPublicKey, GetSSHPublicKey, ListSSHPublicKeys, UpdateSSHPublicKey and DeleteSSHPublicKey. Pull request #5051
- REST Lambda authorizers now validate authorization policies, respect TTL caching, and reject invalid output instead of accepting the first Allow statement blindly. Pull request #5002
Why it matters
This week brings significant completeness improvements across managed services: Redshift Serverless gains actual compute workgroups, EKS nodes receive their metadata correctly, and several services like Cognito user groups and IoT custom authorizers move from stubs to fully functional implementations. These changes reduce silent failures where operations would succeed but do nothing.
Changelog entry
- Feat(redshift-serverless): add running workgroups and Data API WorkgroupName support Pull request #5012
- Feat(eks): apply nodegroup labels, taints and capacity type to the node Pull request #5063
- Feat(cognito): provision user group attachments Pull request #4806
- Feat(iot): manage custom authorizers Pull request #4826
- Feat(eventbridge): add ApiDestination target support Pull request #5009
- Feat(cloudformation): provision AWS::Transfer::User Pull request #5076
- Feat(emr): resize instance groups and fleets, list bootstrap actions Pull request #4900
- Feat(eks): stop shipping a default storage class in clusters Pull request #5061
- Feat(iam): model SSH public keys Pull request #5051
- Fix(apigateway): validate and cache REST Lambda authorizers Pull request #5002
- Fix(iam): resolve server certificate references in ELB and CloudFront Pull request #5075
- Fix(stepfunctions): resolve a Lambda task's function ARN in its own account and region Pull request #5079
This week: Redshift Serverless workgroups run, EKS labels and taints reach nodes, Cognito user groups attach, IoT custom authorizers work, EventBridge API destinations land, Transfer adds User, EMR resizes clusters, EKS drops the default storage class, IAM models SSH keys, REST a
Floci shipped significant progress across managed services this week. Redshift Serverless now supports workgroups that actually run, EKS applies nodegroup labels and taints to Kubernetes nodes, Cognito user groups attach instead of remaining stubbed, and IoT serves the custom authorizer management API. EMR can resize running clusters, EventBridge supports API destination targets, Transfer adds User support, and IAM models SSH public keys. REST Lambda authorizers now validate policies and respect caching instead of accepting invalid output blindly.
Week of September 21, 2026
What shipped
- ECS task containers now receive their IAM role credentials, enabling tasks to authenticate as their configured role. Pull request #4486
- Route 53 now resolves private hosted zone records from cluster containers, bridging the management plane and DNS serving. Pull request #4353
- S3 CreateBucket applies AWS's region rules consistently across all partitions. Pull request #4494
- SES list operations now support pagination with a shared mechanism covering ListTemplates and ListExportJobs. Pull request #4465
- KMS imported key material now supports elliptic curve key types: ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, and ECC_SECG_P256K1. Pull request #4428
- EC2 route tables now support InstanceId and NetworkInterfaceId route targets with automatic InstanceOwnerId population. Pull request #4416
- API Gateway import now honors the failonwarnings parameter and preserves parser warnings in responses. Pull request #4531
- Cloud Map DNS A record answers now include the configured TTL and distinguish NXDOMAIN from no-data responses. Pull request #4448
- IoT MQTT WebSocket bridge stabilizes concurrent client sessions and handles broker-initiated closes. Pull request #3816
- ElastiCache now accepts HELLO AUTH handshakes for protected endpoints. Pull request #4476
Why it matters
This week brings critical AWS feature coverage: ECS tasks can now authenticate as their roles, Route 53 serves private DNS to containers, and multi-partition support extends S3 and hostname handling across AWS regions. The additions span authentication, DNS resolution, and regional compatibility.
Changelog entry
- Feat(ecs): ECS task containers receive IAM role credentials from task-role sessions Pull request #4486
- Feat(route53): Route 53 resolves private hosted zone records from cluster containers Pull request #4353
- Fix(s3): S3 CreateBucket applies AWS region rules in every partition Pull request #4494
- Feat(ses): SES list operations support pagination for ListTemplates and ListExportJobs Pull request #4465
- Feat(kms): KMS imported key material supports ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, ECC_SECG_P256K1 Pull request #4428
- Feat(ec2): EC2 route tables support InstanceId and NetworkInterfaceId route targets Pull request #4416
- Fix(apigateway): API Gateway import honors failonwarnings and preserves parser warnings Pull request #4531
- Feat(cloudmap): Cloud Map DNS A answers include configured TTL Pull request #4448
- Fix(iot): IoT MQTT WebSocket bridge stabilizes concurrent sessions Pull request #3816
- Fix(elasticache): ElastiCache accepts HELLO AUTH handshakes Pull request #4476
- Fix(cognito): Cognito PasswordPolicy validates MinimumLength and removes default of 8 Pull request #4359
- Fix(sqs): SQS FIFO deduplication retained for full five-minute window after deletion Pull request #4460
- Fix(sns): SNS retries failed SQS subscription deliveries up to three times with DLQ support Pull request #4468
- Fix(core): AWS hostnames built and recognized in every partition Pull request #4451
- Fix(cloudformation): CloudFormation DeleteStack deletes UPDATE_FAILED resources Pull request #4470
- Fix(rds): RDS RestoreDBClusterFromSnapshot honors Port parameter Pull request #4326
- Fix(cognito): Cognito auth challenge sessions expire Pull request #4417
- Fix(cognito): Cognito USER_AUTH flow hides unknown users with PreventUserExistenceErrors Pull request #4478
- Feat(iam): IAM adds last-accessed reporting actions Pull request #4488
- Fix(elbv2): ELBv2 health checks use target group's HealthCheckPort Pull request #4432
Floci ships ECS task role credentials, Route 53 private DNS from containers, and multi-partition S3 region rules. EC2 route targets, KMS ECC keys, and ElastiCache HELLO AUTH also land.
This week's Floci update strengthens container authentication and DNS: ECS tasks now receive IAM role credentials, Route 53 resolves private zones from cluster containers, and S3 applies region rules across partitions. Additional improvements include EC2 route target support, KMS elliptic curve imported keys, ElastiCache HELLO AUTH, and SES pagination.
Week of September 14, 2026
What shipped
- SageMaker training jobs now respect GPU instance types like ml.g5.xlarge instead of running on CPU. Pull request #4015
- EKS Pod Identity association management lets you map Kubernetes namespaces and service accounts to IAM roles. Pull request #4012
- Glue catalog resource policy and Data Catalog encryption settings are now supported. Pull request #4027
- Glue Data Catalog connections API is implemented with create, get, update, delete and test operations. Pull request #3939
- EventBridge can now route events to Step Functions state machines as direct targets. Pull request #4006
- Cognito USER_AUTH flow lets users choose between password, password SRP, email OTP or SMS OTP authentication. Pull request #3930
- Redshift supports S3 COPY with JSON format and manifest files, plus DynamoDB zero-ETL backfill. Pull request #3889
- AWS Batch CancelJob and TerminateJob operations stop containers and manage job lifecycle state correctly. Pull request #3922
- IAM and STS now use cryptographic random generation for access key secrets, session secrets, tokens and KMS grant tokens. Pull request #3960
Why it matters
This week brought significant AWS service coverage expansions—Glue catalogs and classifiers, EKS Pod Identity, SageMaker GPU support, EventBridge-to-Step-Functions integration, and Redshift JSON copying—alongside critical security fixes for credential generation and important lifecycle fixes for Cognito, Batch and other services. The work spans multiple AWS services with both new capabilities and correctness improvements.
Changelog entry
- Feat(sagemaker): support GPU-backed training jobs Pull request #4015
- Feat(eks): implement pod identity association management Pull request #4012
- Feat(glue): catalog resource policy and Data Catalog encryption settings Pull request #4027
- Fix(cognito): accept USER_SRP_AUTH in AdminInitiateAuth Pull request #3973
- Fix(cognito): omit AvailableChallenges from RespondToAuthChallenge responses Pull request #4025
- Fix(iam): use SecureRandom for secret credentials and tokens Pull request #3960
- Fix(eks): store and return encryptionConfig and logging on clusters Pull request #4007
- Feat(glue): Data Catalog connections Pull request #3939
- Feat(eventbridge): start Step Functions targets Pull request #4006
- Feat(cognito): support the USER_AUTH choice-based auth flow Pull request #3930
- Fix(dynamodb): enforce the 400KB item limit on every update surface Pull request #3991
- Feat(glue): add crawler classifier APIs Pull request #3985
- Feat(redshift): support S3 COPY JSON and manifest, and DynamoDB zero-ETL backfill Pull request #3889
- Feat(batch): support canceling and terminating jobs Pull request #3922
- Fix(kms): match the AWS error codes, messages and check order Pull request #3968
This week: SageMaker GPU support, EKS Pod Identity, Glue catalog/classifiers, EventBridge→StepFunctions, Redshift JSON COPY, Cognito USER_AUTH, Batch job control, plus cryptographic credential generation and dozens of correctness fixes.
This week's Floci updates span AWS service expansion and critical fixes. New: SageMaker GPU-backed training, EKS Pod Identity associations, Glue catalog policies and classifiers, EventBridge-to-StepFunctions routing, Redshift JSON/manifest COPY, Cognito USER_AUTH flow, Batch job cancellation. Security: switched credential generation to cryptographic randomness. Correctness: fixed Cognito auth flows, DynamoDB item limits, KMS error codes, CloudFormation lifecycle, ECS request handling, and dozens more.