Update dependency aws/aws-sdk-php to v3.391.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
aws/aws-sdk-php (source)	3.389.2 → 3.391.1

---

Release Notes

aws/aws-sdk-php (aws/aws-sdk-php)

v3.391.1

Compare Source

• Aws\Retries - Updated the opt-in retry path (AWS_NEW_RETRIES_2026) to emit SEP-compliant retry headers, honor AWS_MAX_ATTEMPTS and shared-config max_attempts, and align long-polling retry behavior with the new retry spec.
• Aws\Connect - Supports updating the task template associated with in-progress task contacts using the new UpdateContactTaskTemplate API. This enables supervisors and developers to dynamically reassign task templates without creating a new task.
• Aws\MediaTailor - Added support for inserting ads via the VAST Ad Buffet standard. You can now configure MediaTailor to insert ads in sequence order using the AdSequencingMode setting in your playback configuration. Standalone ads are used as fallbacks when a sequenced ad is unavailable.
• Aws\EC2 - This release adds support for BGP route protection in Amazon VPC IP Address Manager (IPAM), including route discovery, RPKI route protection findings, and delegated RPKI (Internet Registry Associations, routing policy registrations, and ROA management) for BYOIP prefixes.
• Aws\SageMaker - Amazon SageMaker adds maintenance lifecycle statuses for Notebook Instances
• Aws\MediaPackageV2 - StreamNameOutputMode - a new optional field on MediaPackageV2 OriginEndpoints that lets customers choose whether egress manifests use numeric stream indices (default) or encoder-assigned stream names from the input
• Aws\SecurityAgent - Added enableEmailMfa input field on Actor to enable email-based MFA during penetration tests. When enabled, a server-generated mfaForwardingAddress is returned. Set up a forwarding rule in your email provider to forward MFA emails to this address so the agent can complete email-based MFA login flows
• Aws\HealthLake - Adds provenanceEnabled to StartFHIRImportJob
• Aws\Amplify - Increased the maximum allowed length of the oauthToken parameter in the CreateApp and UpdateApp APIs to support longer OAuth tokens issued by third-party Git providers.

v3.391.0

Compare Source

• Aws\S3 - AWS Backup now lets you create read-only access points for Amazon S3 recovery points, enabling you to access backup data using S3 APIs without initiating a restore.
• Aws\MarketplaceDiscovery - GetOfferTerms now returns netPaymentTerm in offerTerms, specifying payment due period after invoice date. The paymentDuePeriod field uses ISO 8601 duration format (e.g., "P30D" for net 30 days). This is a backward-compatible addition. See API documentation for full structure and examples.
• Aws\EC2 - Adds a new optional IncludeLocalZones parameter to the Spot Placement Score API that defaults to false. When set to true, the Spot Placement Score API will consider the relevant Local Zones with Spot capacity when computing the Spot Placement Score.
• Aws\AutoScaling - EC2 Auto Scaling now supports being managed by other AWS services via the operator field.
• Aws\BedrockAgentCore - Add support for capacity provider sessions in Amazon Bedrock AgentCore. Customers can now delete an active session running on a runtime instance launched through their capacity provider.
• Aws\Kafka - MSK Clusters can now deliver authorizer logs alongside broker logs to the destinations defined by you
• Aws\AgentRegistry - Agent Registry's Public Preview release
• Aws\MarketplaceAgreement - GetAgreementTerms now returns a new term variant in AcceptedTerm, netPaymentTerm, with a paymentDuePeriod field (example "P30D").
• Aws\MediaTailor - AWS Elemental MediaTailor now supports concurrent function execution. The new Concurrent Executor function type runs multiple independent child functions in parallel within a single lifecycle hook, reducing pipeline latency to the duration of the slowest call instead of the sum of all calls.
• Aws\Backup - AWS Backup now lets you create read-only access points for Amazon S3 recovery points, enabling you to access backup data using S3 APIs without initiating a restore.
• Aws\AgentRegistryControl - Agent Registry's Public Preview release
• Aws\SageMaker - Releases new Model Customization SequenceLength parameter for Training and g7 instance types for Training and Processing.
• Aws\DeviceFarm - Adds support for service generated insights across runs, jobs, and tests.
• Aws\BedrockAgentCoreControl - Add support for Gateway rate limits and Runtime instances in Amazon Bedrock AgentCore. Customers can now configure rate limits scoped to control request rates, token consumption rates, and active connection rates. Customers can now create capacity providers to launch runtimes on their EC2 instances.
• Aws\SecurityHub - Security Hub is adding a new public API, ListFreeTrialStatusesV2 to describe the free trial statuses of the Security Hub service and its opt-in features.
• Aws\GameLift - Adds support for C8a, C8i, C9g, M8a, M8i, and M9g EC2 instance type families for managed EC2 and container fleets. Also adds explicit anchors on most string regexes.
• Aws\SocialMessaging - Add support for WhatsApp Conversions APIs.
• Aws\CloudWatchLogs - This release adds index category support to the CloudWatch Logs DescribeFieldIndexes API. Customers can filter and identify DEFAULT, CUSTOM, AUTO, and INACTIVE field indexes.

v3.390.5

Compare Source

• Aws\ECS - New enum values added for Agent Connectivity issues
• Aws\ACMPCA - Private Certificate Authority service now supports RSASSA-PSS signing algorithm.
• Aws\Glue - Added the PutDataCatalogExportConfiguration to export Glue Data Catalog metadata to systems tables stored in S3 Tables.
• Aws\BedrockAgentCoreControl - Adding support for fine-grained access control for AgentCore Memory through managed AgentCore Gateway HTTP Connectors.
• Aws\Deadline - AWS Deadline Cloud now reports persistent volume costs alongside compute and license costs. Customers can view per-fleet storage costs in Usage Explorer by selecting the Usage Type grouping, helping them better understand the costs of their infrastructure.

v3.390.4

Compare Source

• Aws\DynamoDB - Vector indexes are a type of index in Amazon DynamoDB that enable similarity search on vector embedding stored in your table items. Vector indexes use approximate nearest neighbor search to find items whose vectors are most similar to a query vector that you provide.
• Aws\Organizations - Improved accuracy of CloudTrail event documentation for AWS Organizations membership operations.
• Aws\SSOAdmin - AWS IAM Identity Center now lets you create organization-level instances without enabling multi-account permissions. You can enable multi-account permissions during instance creation or later via console or API, which then provisions the necessary service-linked roles.
• Aws\Inspector2 - Adding Azure SBOM export capability.
• Aws\EC2 - Amazon EC2 now supports Application Status Checks, a new status check that monitors your application's health through configurable HTTP(S) paths and ports, so you can detect and automatically respond to application-level impairments.
• Aws\Connect - Amazon Connect Customer now supports up to 50 attachments per email, increased from the previous limit of 10. The individual maximum attachment size limit of 20 MB and the total email size limit of 25 MB still hold true.
• Aws\WorkSpaces - Added ClientExperiencePolicy to ClientProperties object for ModifyClientProperties and DescribeClientProperties APIs.
• Aws\PartnerCentralSelling - Partners can now create leads with only 5 required fields and free-text values for all other fields, reducing import friction. Engagement invitations now include enrichment data (propensity scores, lead readiness) directly in the response.
• Aws\DSQL - UpdateCluster now checks the RemovePeerCluster permission on the specific cluster being removed, not a wildcard and docs now clarify how to set kmsEncryptionKey so the cluster uses the AWS-owned key.
• Aws\IAM - Updating endpoint generation logic

v3.390.3

Compare Source

• Aws\WAFV2 - Updated descriptions for number of PreParseTextTransformations allowed per rule statement
• Aws\TimestreamInfluxDB - This release adds support for customer-managed backup restore, and encryption of new DbInstances and DbClusters using customer-managed KMS keys.
• Aws\ObservabilityAdmin - Launch CMK support for Telemetry Enablement Organization and Account Rules.
• Aws\EKSAuth - Added eksNodeName, instanceId, and zone optional parameters to the AssumeRoleForPodIdentity API.
• Aws\NetworkFirewall - This launch allows customers to use Network Firewall as an explicit Proxy and protect their workloads against threat of data exfiltration.
• Aws\MediaConvert - Updates Kantar server URL validation to accept Fifty5Blue domain. Adds support for output to S3 Glacier Instant Retrieval.
• Aws\DirectConnect - Added route visibility support for AWS Direct Connect, allowing customers to call ListVirtualInterfaceRoutes to view the BGP routes including AS path and BGP communities advertised over their virtual interfaces.

v3.390.2

Compare Source

• Aws\Outposts - Adds the "EKS" value to the AWSServiceName enum and marks the Address field as sensitive.
• Aws\MarketplaceCatalog - This release enhances the ListEntities API to support TargetAgreementId, TargetAgreementIntent, and CreatedBySource filters for the Offer entity type.
• Aws\CloudFormation - Adding enum for sensitive property to DriftIgnoredReason
• Aws\BedrockRuntime - Added support for mid-conversation tool changes in the Amazon Bedrock Converse and ConverseStream APIs
• Aws\DataZone - Adding support for enhanced Git experience in Sagemaker Unified Studio.
• Aws\RDS - Adds StorageOperationStatus and StorageOperationPercentProgress to DescribeDBInstances, letting you monitor RDS storage initialization and optimization progress.
• Aws\ElementalInference - AWS Elemental Inference now supports graphic composition on cropped video outputs, enabling branded graphics and other visual elements to be overlaid as part of the inference workflow.
• Aws\PrometheusService - Amazon Managed Service for Prometheus adds support for an Amazon OpenSearch Service exporter for managed collectors.
• Aws\ConnectCampaignsV2 - Launching feature for abandonment rate pacing control for outbound campaigns.
• Aws\QuickSight - Adding TopicV2 management APIs, adding possibility to use Topics in Analysis
• Aws\Billing - Adds GetEnterpriseSupportChargeSummary, GetEnterpriseSupportContractDetails, and ListEnterpriseSupportLinkedAccountCharges. These APIs provide first-time programmatic access to billing data for Enterprise Support usage previously only available upon request through AWS Concierge or Support.
• Aws\NetworkFirewall - Doc Updates for Container Attributes
• Aws\CloudWatchLogs - Amazon CloudWatch Logs now lets you create and update lookup tables directly from CloudWatch Logs query results by passing a queryId, and configure a lookup table as a scheduled query destination so it refreshes automatically with the latest query results on each run.
• Aws\Resiliencehubv2 - Adding support for new testing capability in AWS Resilience Hub.

v3.390.1

Compare Source

• Aws\BCMRecommendedActions - Removing Smithy RPC v2 CBOR support that was added in previous SDK release.
• Aws\BCMPricingCalculator - Removing Smithy RPC v2 CBOR support that was added in previous SDK release.

v3.390.0

Compare Source

• Aws\Crypto - Fixes issue with client material description decode.
• Aws\BedrockAgentCoreControl - Adds support for configuring models through the OpenResponses API for custom evaluators. CreateEvaluator and UpdateEvaluator now accept an OpenResponses model configuration for LLM-as-a-Judge evaluations.
• Aws\SageMaker - Adds support for g7 family instance types for SageMaker Studio JupyterLab and CodeEditor apps for IAD (us-east-1), PDX (us-west-2), CMH (us-east-2).
• Aws\Lambda - Add Python3.15 (python3.15) and NodeJs 26 (nodejs26.x) support to AWS Lambda
• Aws\Kafka - Amazon MSK Express brokers now support streaming tables for Apache Iceberg, continuously materializing Apache Kafka topics as Iceberg tables in Amazon S3 Tables. Express brokers also now support data delivery to Amazon S3 general purpose buckets.
• Aws\NetworkFirewall - Adds UPDATING field to Container Association Status
• Aws\IAM - Improved IAM Policy Simulator accuracy. Simulator now evaluates SCP conditions and resource scoping, returns explicitDeny for explicit SCP denials, and reports accurate cross-account decisions.
• Aws\SecurityAgent - Adds support for providing a branch override when configured integrated repositories
• Aws\PricingPlanManager - Adds support for Public PricingPlanManager SDK

v3.389.3

Compare Source

• Aws\EC2 - This release adds support for policy-based routing on AWS Transit Gateway, enabling you to route traffic based on 5-tuple matching (source IP, destination IP, source port, destination port, and protocol) using new policy table entry APIs that direct matching traffic to a target route table.
• Aws\GameLiftStreams - Adds ListApplicationShaderCaches API to retrieve shader cache metadata for applications and adds stream URLs, which give end users temporary, unauthenticated access to a stream session in their browser. Includes CreateStreamUrl, GetStreamUrl, ListStreamUrls, and RevokeStreamUrl operations.
• Aws\WAFV2 - AWS WAF now supports pre-parse text transformations, letting you normalize raw query strings before parsing, available on rule statements that use SingleQueryArgument or AllQueryArguments as the FieldToMatch. AWS WAF also added 10 new text transformations, including ModSecurity v3 parity options.
• Aws\Glue - Adding filtering, partitioning, and VPC support to AWS Glue REST API connector
• Aws\IoTSiteWise - We have released a new set of APIs in support of a major new feature within AWS IoT SiteWise called Scenario Discover. Please see user guide about the feature and the API guide in public documentation for new APIs.
• Aws\DatabaseMigrationService - Updated documentation for various DMS Schema Conversion operations

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[deepsource-io]

DeepSource Code Review

We reviewed changes in 1274960...8060d15 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
PHP		Aug 7, 2026 9:54p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.