[neilberkman]

Description

Requires ex_aws_auth ~> 1.5 and locks 1.5.0. That release fixes SigV4 canonicalization bugs that can produce SignatureDoesNotMatch:

• Canonical headers were sorted by name:value instead of by name.
• Host could be signed twice (SignedHeaders=host;host).
• Header values collapsed only spaces, not all whitespace.
• The Req plugin truncated multi-valued headers and did not regenerate host on re-sign.

Bedrock IAM credentials, STS and bidirectional streaming all sign through ex_aws_auth, so requiring 1.5 gives those users the fixes.

Three behaviour changes in 1.5 do not affect req_llm:

• AWSAuth.Req.attach/2 now rejects unknown options. req_llm passes only :credentials and :service.
• Region precedence is now explicit option, URL, then credentials.region. req_llm builds the Bedrock URL from the credentials' region, so both agree.
• Returned header names are lowercase. req_llm does not read signed header names back.

The README and the missing-dependency error message now name ~> 1.5.

Type of Change

• Bug fix (non-breaking change fixing an issue)
• New feature (non-breaking change adding functionality)
• Breaking change (fix or feature causing existing functionality to change)
• Documentation update

Breaking Changes

Projects that pin ex_aws_auth below 1.5 need to raise that pin.

Testing

• Tests pass (mix test): 5313 passed. One run had a timing failure in StreamServer.ErrorHandlingTest, which uses a 200 ms wait and passed on 5 isolated reruns.
• Quality checks pass (mix quality)

These tests cover SigV4 signing with mocked HTTP. No live IAM-signed Bedrock request was made.

Checklist

• My code follows the project's style guidelines
• I have updated the documentation accordingly
• I have added tests that prove my fix/feature works
• All new and existing tests pass
• My commits follow conventional commit format
• I have NOT edited CHANGELOG.md (it is auto-generated by git_ops)

Related Issues

None filed.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}