chore(deps): update floci/floci docker tag to v1.5.34

[renovate]

This PR contains the following updates:

Package	Update	Change
floci/floci (source)	patch	1.5.32-compat → 1.5.34-compat

---

Release Notes

floci-io/floci (floci/floci)

v1.5.34

Compare Source

Added

• cloudtrail: new in-process service. Supports CreateTrail, DescribeTrails, DeleteTrail, UpdateTrail, PutEventSelectors, GetEventSelectors, StartLogging, StopLogging, GetTrailStatus, LookupEvents. S3 data events on hooked ops (PutObject, GetObject, HeadObject, DeleteObject, ListObjects, GetObjectAcl) are buffered per-trail and flushed as gzipped JSON log files into the destination bucket at AWS-shaped key paths (AWSLogs/${account}/CloudTrail/${region}/yyyy/MM/dd/${file}.json.gz) at a configurable cadence. IAM-enforcement denials emit matching AccessDenied records (#​1460)
• iam: seeded AWSCloudTrail_FullAccess and AWSCloudTrail_ReadOnlyAccess AWS managed policies.
• iam: distinguish s3:GetObjectAcl / s3:PutObjectAcl / s3:Get|Put|DeleteObjectTagging from base S3 ops via ?acl / ?tagging query parameters when resolving an action for IAM enforcement.
• ses: implement identity (sending authorization) policies for v1 and v2 (#​1750)
• stepfunctions: support the HTTP invoke step (#​1503)
• stepfunctions: implement the States.JsonMerge intrinsic (#​1662)
• eks: add eks.disable-cni to start k3s without its bundled CNI, so a real CNI can be installed in its place (#​1793)

Fixed

• storage: dedupe storage backends by resolved file path. Two components opening the same file each got an independent in-memory store, and on graceful shutdown the stale duplicate flushed last and overwrote persisted state (#​1931)
• elbv2: move persisted-listener restore out of @PostConstruct. Restoring listeners during bean creation re-entered the CDI proxy and recursed until the process died, so after a restart with persisted listeners every ELBv2 operation failed (#​2015)
• core: reject REST requests signed for a service Floci does not implement with UnknownOperationException, instead of letting them fall through to S3's path-style routes and return a misleading NoSuchBucket (#​1967)
• cloudformation: model AWS::IAM::Policy as an inline policy so two stacks can reuse the same generated policy name; report failed rollback cleanup as ROLLBACK_FAILED, detach removed IAM inline-policy targets on stack updates, and migrate the legacy managed-policy representation during update or deletion (#​1800)
• core: return 4xx client errors instead of 500 for malformed JSON-protocol input (#​1926)
• s3: return 400 MalformedXML for an unparseable PutObjectRetention RetainUntilDate (#​1631)
• s3: preserve literal question marks in copy source keys (#​1924)
• cognito: build OIDC URLs from effectiveBaseUrl so FLOCI_HOSTNAME is honored (#​1929)
• cognito: prefer phone delivery for signup verification (#​1839)
• dynamodb: tokenize UpdateExpression whitespace-insensitively (#​1862)
• dynamodb: throw ValidationException when a list_append operand is not a list type (#​1702)
• firehose: return ResourceInUseException on a duplicate CreateDeliveryStream (#​1738)
• ec2: apply the cidr-block filter in DescribeSubnets (#​1864)
• neptune: throw the modeled InsufficientStorageClusterCapacity fault when the proxy-port range is exhausted, so SDK clients can map it to a typed exception (#​1879)

Changed

• ci: attach provenance and SBOM attestations to the published images (#​2032)

v1.5.33

Compare Source

Added

• eks: support managed node groups and Fargate profiles (create/describe/list/delete) (#​1523)
• stepfunctions: support JSONata workflow variables (Assign) (#​1824)
• cognito: implement GlobalSignOut (#​1701)
• cognito: emit jti/origin_jti claims and support RevokeToken (#​1705)
• cloudformation: parse secrets in ECS ContainerDefinitions (#​1874)

Fixed

• s3: fail fast on unwritable data root instead of opaque 500s (#​1868)
• s3: handle DeleteBucketReplication instead of deleting the whole bucket (#​1837)
• s3: return default SSE-S3 from GetBucketEncryption instead of 404 (#​1838)
• s3: honor ACL headers and explicit grants (#​1768)
• lifecycle: tear down process-bound containers on shutdown (#​1869)
• ec2: reject duplicate key pair names in ImportKeyPair (#​1848)
• iam: pass S3 list condition context to IAM enforcement (#​1748)
• scheduler: forward MessageAttributes in universal sns:publish target (#​1706)
• elbv2: expose target health reason parity (#​1743)
• rds: return DBSubnetGroupNotFoundFault for missing DescribeDBSubnetGroups name (#​1870)
• cloudformation: carry PackageType through SAM Function expansion (#​1772)
• eks: register FargateProfileStatus for native-image reflection (#​1876)

---

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

• Branch creation
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.88%. Comparing base (1ae5028) to head (92f5d83).

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #466   +/-   ##
=======================================
  Coverage   81.88%   81.88%           
=======================================
  Files           5        5           
  Lines         414      414           
=======================================
  Hits          339      339           
  Misses         45       45           
  Partials       30       30           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.