What's Changed

• Fix E3697: measure Lambda environment size as compact JSON bytes by @Varshith-Kali in #4860
• docs(kiro): make blast radius a first-class review question by @kddejong in #4954
• Fix E3051: stop firing on Content behind an intrinsic function by @kddejong in #4956
• Fix E0002: report errors from rule collections that do not register RuleError by @hoganbr-amzn in #4908
• fix: let api.lint() run a Rules collection passed by the caller by @hoganbr-amzn in #4909
• fix: raise SchemaPatchError instead of exiting from schema patching by @hoganbr-amzn in #4911
• Fix E3045: flag AccessControl with BucketOwnerEnforced OwnershipControls by @Varshith-Kali in #4792
• Allow array form for AWS::CloudFormation::Init commands by @Varshith-Kali in #4809
• Fix E1011: skip FindInMap key errors when map name comes from a parameter Default by @Varshith-Kali in #4810
• Fix E3051: validate SSM Document Content given as a JSON string by @Varshith-Kali in #4902
• fix: stop Runner.__init__ exiting on an unresolvable template glob by @kddejong in #4966
• Fix E2011/E7002: report I2011 and I7002 for names near the limit by @hoganbr-amzn in #4965
• Fix E1700: stop rejecting rule names CloudFormation accepts by @pcbeingused333 in #4924
• Fix E3530: accept sts root and federated-user principals by @pcbeingused333 in #4927
• Fix E3530: flag NotPrincipal, group ARNs, and string "*" in role trust policies by @Varshith-Kali in #4862
• Fix E1011: emit compact JSON from the Fn::ToJsonString resolver by @kddejong in #4972
• Fix E1011: report bad Fn::FindInMap keys in unconstrained positions by @Varshith-Kali in #4919
• Fix E2529: count subscription filters per condition scenario by @Varshith-Kali in #4917
• Fix E3510: accept an empty Sid, repeated or not by @pcbeingused333 in #4937
• Remove the dead E6004 outputs name rule by @kddejong in #4983
• Fix E3026: skip NumCacheClusters check for cluster mode groups sized by NodeGroupConfiguration or ReplicasPerNodeGroup by @Varshith-Kali in #4920
• Fix E3601: accept Task resource ARNs from every partition by @hoganbr-amzn in #4978
• fix(iam): accept IAM principal ARNs from every partition by @hoganbr-amzn in #4976
• fix(context): resolve AWS::Partition and AWS::URLSuffix in every region by @hoganbr-amzn in #4980
• chore: let the triage agent ask before pr create/comment by @kddejong in #4988
• Fix E3046: allow the awslogs flush-interval and buffered-events options by @pcbeingused333 in #4925
• fix(conditions): pair each Fn::Equals once when building condition CNF by @kddejong in #4987
• Fix E3006: decide Fn::Equals on AWS::Partition from the region by @hoganbr-amzn in #4982
• perf: deduplicate matches with a set by @hoganbr-amzn in #4910
• Fix E3601: support state-level JSONata and JSONata numeric fields by @hoganbr-amzn in #4947
• fix: exclude the test directory from bandit by @kddejong in #4989
• perf(conditions): solve each set of condition pins once by @hoganbr-amzn in #4992
• Update PyPI workflow and snapshot results script by @satyakigh in #4990
• Fix E3009: require command in cfn-init commands entries by @moneytool in #4914
• ci: publish to pypi before uploading the release asset by @kddejong in #4996
• Fix E3692: allow Multi-AZ read replicas and omitted StorageType by @hoganbr-amzn in #4963
• Update CloudFormation schemas to 2026-11-05 by @github-actions[bot] in #4955

New Contributors

• @pcbeingused333 made their first contribution in #4924

Full Changelog: v1.59.0...v1.60.0

What's Changed

• test(conditions): cover add_equivalence branches by @moneytool in #4790
• Fix E3002/E6101: don't crash when a resource or output condition can never be true by @Varshith-Kali in #4786
• Fix crash when a resource's Metadata is not an object by @Neg23 in #4784
• Fix E3601: stringify path segments so array indices do not crash message formatting by @Varshith-Kali in #4782
• Fix E1017: allow Fn::If and nested Fn::Select as the Fn::Select index by @Varshith-Kali in #4793
• Add E1001: require at least one resource in the Resources section by @Varshith-Kali in #4781
• fix: Check the length of a template Description that mentions a dynamic reference by @sayaksatpathi in #4765
• Fix E8001: stop rejecting condition names CloudFormation accepts by @Varshith-Kali in #4787
• Fix crash when the template Metadata is not an object by @Neg23 in #4807
• Fix E3004: evaluate SAM resource dependency cycles before reporting by @proton0210 in #4755
• Fix E1029: skip where CloudFormation doesn't evaluate Fn::Sub by @Thanatos9404 in #4759
• Fix E8001: report non-string condition names instead of crashing by @Varshith-Kali in #4814
• fix: Validate --registry-schemas types against their schema again by @sayaksatpathi in #4763
• Fix E3620: Add db.serverless to the DocumentDB instance classes by @Thanatos9404 in #4761
• Fix E3670: Use full xlarge names for Amazon MQ instance types by @Thanatos9404 in #4760
• feat: add Python 3.15 support by @botantony in #4764
• Fix E3690/E3691: accept neptune and sqlserver-dev engines by @Varshith-Kali in #4830
• Fix E3049: don't report when HealthCheckPort is omitted by @Neg23 in #4829
• Fix E1152: accept resolve:ssm: ImageId on AWS::EC2::Instance by @Varshith-Kali in #4828
• feat(kiro): add issue-triage, issue-worker, and pr-reviewer agents by @kddejong in #4831
• fix(formats): match an anyOf of formats on the source schema by @kddejong in #4832
• Update tests for schema changes by @kddejong in #4864
• fix(conditions): extend Fn::Equals mutual-exclusion beyond AllowedValues parameters by @Varshith-Kali in #4805
• Fix E3688: false positives on IpProtocol "-1", icmpv6 and "ICMP" rules by @Varshith-Kali in #4806
• chore(deps): bump setuptools from 84.0.0 to 84.2.1 in /requirements by @dependabot[bot] in #4861
• Update tests for schema changes by @kddejong in #4872
• feat(kiro): widen triage issue access, machine-generate permissions by @kddejong in #4868
• Fix E1019: resolve SAM generated Version/Alias references in Fn::Sub by @moneytool in #4798
• Fix E3720: do not require StorageEncrypted on RDS read replicas by @Varshith-Kali in #4842
• docs: rank deployment above probes in agent evidence hierarchy by @kddejong in #4867
• Fix E3690/E3691: allow major-only EngineVersion for mysql and mariadb by @moneytool in #4796
• Fix E2015: compare Default as CloudFormation strings by @moneytool in #4797
• docs: check quota adjustability before encoding a limit by @kddejong in #4895
• Fix E3005: skip DependsOn check when target condition is always true by @Varshith-Kali in #4843
• Fix E3001: allow a string resource-level Description by @blacksoxx in #4922
• Fix E3671: Set gp3 Iops limits per resource type by @Thanatos9404 in #4866
• Test W3001: pin that a resource-level Description does not warn by @kddejong in #4923
• Fix E3671: allow gp3 Iops from 100 and warn when it is raised by @kddejong in #4930
• Fix E3051: skip Automation schema for AppConfig SSM document types by @Varshith-Kali in #4844
• docs(kiro): narrow the validate-template prohibition to provider-owned constraints by @kddejong in #4932
• Add E1165: AWS::IAM::Role.Name format keyword by @kddejong in #4936
• Remove rule E3511 in favour of the E1156 role ARN format by @kddejong in #4942
• Fix E3615: Allow a CloudWatch alarm Period of 20 by @Thanatos9404 in #4905
• Update schemas (AdditionalSpecs/LmbdRuntimeLifecycle.json): Lambda runtime lifecycle dates from AWS docs by @hoganbr-amzn in #4943
• Fix E2531/W2531/E2533: handle unscheduled Lambda runtime block dates by @kddejong in #4945
• Fix E3695: Allow redis EngineVersion 6.x on CacheCluster by @Thanatos9404 in #4906
• Fix E3062: scope DBInstanceClass enum per engine by @Varshith-Kali in #4870
• fix(scripts): only collect orderable options for available RDS versions by @kddejong in #4946
• Update CloudFormation schemas to 2026-10-28 by @github-actions[bot] in #4808
• fix(config): only accept append_rules and output_file from the CLI, `--c...

What's Changed

• test(getatts): add NumberOfAssociations to NetworkFirewall::Firewall by @kddejong in #4788
• fix: handle SAM RestApi stage references by @0xTaoZ in #4730
• fix(lambda): update SnapStart supported regions by @0xTaoZ in #4740
• fix: Allow object form of CodeUri in SAM Globals.Function by @moneytool in #4741
• fix(conditions): avoid exponential CNF when registering conditions by @moneytool in #4742
• fix(formats): register log group name validation correctly by @0xTaoZ in #4745
• fix: validate every required deployment parameter by @proton0210 in #4753
• fix: defer unresolved gathered property comparisons by @proton0210 in #4754
• Update CloudFormation schemas to 2026-10-20 by @github-actions[bot] in #4727

New Contributors

• @moneytool made their first contribution in #4741
• @proton0210 made their first contribution in #4753

Full Changelog: v1.57.2...v1.58.0

What's Changed

• Support changes required for Python 3.15 by @s-t-e-v-e-n-k in #4717
• chore(deps-dev): update coverage requirement from >=7.16.1 to >=7.16.2 in /requirements by @dependabot[bot] in #4732

New Contributors

• @s-t-e-v-e-n-k made their first contribution in #4717

Full Changelog: v1.57.1...v1.57.2

What's Changed

• chore(deps-dev): update coverage requirement from >=7.2.1 to >=7.16.1 in /requirements by @dependabot[bot] in #4720
• Update CloudFormation schemas to 2026-09-28 by @github-actions[bot] in #4716
• update W1101: Report every YAML alias, including scalars by @esetnik in #4724

New Contributors

• @esetnik made their first contribution in #4724

Full Changelog: v1.57.0...v1.57.1

What's Changed

• fix: Require ProvisionedThroughput when DynamoDB BillingMode is omitted by @kddejong in #4702
• fix E3700: Skip first-stage check for conditional stage entries by @kddejong in #4701
• fix: Escape hyphen in SSM dynamic reference pattern by @kddejong in #4700
• add E3725: FSx FileSystemType-specific StorageCapacity by @kddejong in #4708
• docs: Refresh stale .kiro steering and prompts by @kddejong in #4710
• fix: reject Fn::Select lifecycle policies without transform by @0xTaoZ in #4704
• chore(deps): bump pyinstaller from 6.22.2 to 6.22.3 in /requirements by @dependabot[bot] in #4713
• refactor: simplify Fn::Select lifecycle policy error metadata by @kddejong in #4711
• fix: resolve every index Fn::Select can take by @ashvinctrl in #4705
• Update CloudFormation schemas to 2026-09-17 by @github-actions[bot] in #4703
• feat: Add metadata context validation rules (I4010, I4011, I4012) by @chrisqm-dev in #4655
• add I4010: Template or architecture-relevant resource has no Context block by @chrisqm-dev in #4708
• add W4011: Context block has no 'why' by @chrisqm-dev in #4708
• add W4012: Context field does not match the schema by @chrisqm-dev in #4708

New Contributors

• @ashvinctrl made their first contribution in #4705

Full Changelog: v1.56.3...v1.57.0

What's Changed

• fix W1028: scope to enclosing Fn::If pins by @kddejong in #4690
• fix E1017: report out-of-bounds Fn::Select on a literal list by @kddejong in #4695
• fix E1010: report clean error for Fn::GetAtt string form without an attribute by @kddejong in #4696
• Update CloudFormation schemas to 2026-09-10 by @github-actions[bot] in #4691
• fix W1101: resolved Fn::FindInMap should not share identity (W1101 false positive) by @kddejong in #4698

Full Changelog: v1.56.2...v1.56.3

What's Changed

• fix: Allow intrinsics in SAM Globals properties by @kddejong in #4683
• add E3717: Lambda Timeout limit based on CapacityProviderConfig by @kddejong in #4685
• fix E2529: Raise CloudWatch Logs subscription filter limit to 5 by @kddejong in #4688
• Avoid maxProperties warnings for single-property schemas by @0xTaoZ in #4686
• Allow Fn::GetAZs in Fn::Join values by @0xTaoZ in #4677

Full Changelog: v1.56.1...v1.56.2

What's Changed

• fix(ecs): Support 32 vCPU Fargate task definitions by @kddejong in #4668
• Guard against YAML alias amplification (billion laughs) by @kddejong in #4670
• fix: Type-check resource Refs in UpdatePolicy/CreationPolicy by @kddejong in #4676
• Update CloudFormation schemas to 2026-09-08 by @github-actions[bot] in #4667

Full Changelog: v1.56.0...v1.56.1

What's Changed

• test(functions): assert FindInMap rejects non-DefaultValue 4th item without transform by @kddejong in #4639
• fix: Prevent path traversal in nested stack TemplateURL resolution by @kddejong in #4640
• fix: Require object for CreationPolicy and UpdatePolicy by @kddejong in #4641
• Fix E1010 resolve GetAtt to SAM generated resources by @kddejong in #4646
• chore(deps): bump pyinstaller from 6.21.0 to 6.22.1 in /requirements by @dependabot[bot] in #4647
• docs: add inspect.software health badge by @Nayjest in #4648
• Add AutoScalingInstanceRefresh to the UpdatePolicy schema by @ktrysmt in #4656
• chore(deps): bump pyinstaller from 6.22.1 to 6.22.2 in /requirements by @dependabot[bot] in #4650
• Update CloudFormation schemas to 2026-08-28 by @github-actions[bot] in #4637
• Fix E3016: Reject AutoScalingInstanceRefresh with AutoScalingRollingUpdate by @kddejong in #4661
• fix: Defer schema metadata updates until install succeeds by @Fail-Safe in #4662
• chore: Remove unused caching path from get_url_retrieve by @kddejong in #4663
• Allow GetAtt outputs on SAM applications by @0xTaoZ in #4665
• Update CloudFormation schemas to 2026-08-31 by @github-actions[bot] in #4664

New Contributors

• @Nayjest made their first contribution in #4648
• @ktrysmt made their first contribution in #4656
• @Fail-Safe made their first contribution in #4662

Full Changelog: v1.55.1...v1.56.0