AWS Powertools for Lambda Files

Summary

This release is mainly composed of bug fixes across the HTTP event handler, Metrics, Logger, and Parser utilities, along with the removal of Node.js 20 support now that the runtime has reached end-of-life on AWS Lambda.

In the HTTP event handler, we have fixed response header corruption where multi-attribute headers like Set-Cookie (with Expires dates) and other comma-containing values were being incorrectly split into multiple headers. The HTTP event handler also now correctly preserves PATCH request bodies on ALB events and returns the proper 204 response for CORS preflight requests that omit the Access-Control-Request-Headers header.

In Metrics, dimension limits are now enforced per-array rather than across the merged set, preventing CloudWatch EMF rejections when default and request-scoped dimensions overlap. Logger now flushes the log buffer when critical() is called with flushOnErrorLog enabled, matching the behaviour of error().

[!IMPORTANT] Node.js 20 is no longer supported. Node.js 20 reached end-of-life on AWS Lambda, so this release drops support for it. If you are still on Node.js 20, we recommend upgrading to Node.js 22 before updating Powertools.

⭐ Congratulations to @vishwakt and @nanookclaw for their first PRs merged in the project 🎉

Changes

• chore(deps): fix npm audit vulnerabilities (#5269) by @svozza
• fix(event-handler): allow cors preflight without request headers (#5267) by @vishwakt
• fix(event-handler): preserve ALB PATCH bodies (#5259) by @nanookclaw
• fix(event-handler): restrict v1/alb comma header splitting to an allowlist (#5257) by @vishwakt
• fix(parser): cognito validationData may be null (#5250) by @bdellegrazie
• fix(metrics): enforce dimension limits per-array (#5229) by @vishwakt
• improv(docs): fixed the docs to mention middy support for v7.x (#5238) by @sdangol
• fix(metrics): account for all dimensions in setDefaultDimensions() li… (#5228) by @vishwakt
• fix(logger): flush log buffer on critical() when flushOnErrorLog is e… (#5227) by @vishwakt
• fix(metrics): clear state in publishStoredMetrics even when throwOnEmptyMetrics throws (#5213) by @svozza
• chore: drop Node.js 20 support (#5218) by @svozza
• fix(commons): prevent deepMerge from mutating source objects (#5202) by @svozza
• fix(commons): correctly handle shared references in deepMerge (#5195) by @svozza
• ci(maintenance): Remove release comment automation (#5193) by @dreamorosi
• fix(logger): correctly serialize shared object references in JSON replacer (#5186) by @svozza

🔧 Maintenance

• chore(deps-dev): bump protobufjs from 8.4.0 to 8.4.2 (#5285) by @dependabot[bot]
• chore(deps): bump actions/stale from 10.2.0 to 10.3.0 (#5279) by @dependabot[bot]
• chore(deps): bump idna from 3.10 to 3.15 in /docs (#5274) by @dependabot[bot]
• chore(deps-dev): bump protobufjs from 8.3.0 to 8.4.0 (#5270) by @dependabot[bot]
• chore(deps): bump pymdown-extensions from 10.21.2 to 10.21.3 in /docs (#5275) by @dependabot[bot]
• chore(deps-dev): bump the vitest group across 1 directory with 2 updates (#5277) by @dependabot[bot]
• chore(deps-dev): bump @valkey/valkey-glide from 2.3.1 to 2.4.0 (#5271) by @dependabot[bot]
• chore(deps-dev): bump lint-staged from 17.0.4 to 17.0.5 (#5272) by @dependabot[bot]
• chore(deps): bump @types/node from 25.8.0 to 25.9.1 (#5276) by @dependabot[bot]
• chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#5264) by @dependabot[bot]
• chore(deps-dev): bump @aws/durable-execution-sdk-js from 1.1.2 to 1.1.3 (#5265) by @dependabot[bot]
• chore(deps): bump @types/node from 25.7.0 to 25.8.0 (#5266) by @dependabot[bot]
• chore(deps-dev): bump protobufjs from 8.2.0 to 8.3.0 (#5253) by @dependabot[bot]
• chore(deps): bump gitpython from 3.1.48 to 3.1.50 in /docs (#5234) by @dependabot[bot]
• chore(deps): bump urllib3 from 2.6.3 to 2.7.0 in /docs (#5239) by @dependabot[bot]
• chore(deps): bump @types/node from 25.6.0 to 25.7.0 (#5244) by @dependabot[bot]
• chore(deps-dev): bump fast-check from 4.7.0 to 4.8.0 (#5247) by @dependabot[bot]
• chore(deps): bump actions/dependency-review-action from 4.9.0 to 5.0.0 (#5241) by @dependabot[bot]
• chore(deps-dev): bump the vitest group across 1 directory with 2 updates (#5242) by @dependabot[bot]
• chore(deps-dev): bump lint-staged from 17.0.2 to 17.0.4 (#5243) by @dependabot[bot]
• chore(deps-dev): bump @biomejs/biome from 2.4.14 to 2.4.15 (#5245) by @dependabot[bot]
• chore(deps-dev): bump protobufjs from 8.0.3 to 8.2.0 (#5246) by @dependabot[bot]
• chore(deps): bump release-drafter/release-drafter from 7.2.1 to 7.3.0 (#5231) by @dependabot[bot]
• chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#5230) by @dependabot[bot]
• chore(deps): bump gitpython from 3.1.47 to 3.1.48 in /docs (#5226) by @dependabot[bot]
• chore(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 (#5223) by @dependabot[bot]
• chore(deps): bump valibot from 1.3.1 to 1.4.0 (#5224) by @dependabot[bot]
• chore(deps-dev): bump lint-staged from 16.4.0 to 17.0.2 (#5225) by @dependabot[bot]
• chore(deps-dev): bump zod from 4.4.1 to 4.4.3 (#5221) by @dependabot[bot]
• chore(deps-dev): bump @biomejs/biome from 2.4.13 to 2.4.14 (#5222) by @dependabot[bot]
• chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#5219) by @dependabot[bot]
• chore(deps-dev): bump @aws/durable-execution-sdk-js from 1.1.1 to 1.1.2 (#5220) by @dependabot[bot]
• chore(deps): bump release-drafter/release-drafter from 7.2.0 to 7.2.1 (#5216) by @dependabot[bot]
• chore(deps-dev): bump zod from 4.3.6 to 4.4.1 (#5217) by @dependabot[bot]
• chore(deps): bump ajv from 8.18.0 to 8.20.0 (#5214) by @dependabot[bot]
• chore(deps-dev): bump protobufjs from 8.0.1 to 8.0.3 (#5215) by @dependabot[bot]
• chore(deps): bump gitpython from 3.1.43 to 3.1.47 in /docs (#5211) by @dependabot[bot]
• chore(deps-dev): bump @biomejs/biome from 2.4.12 to 2.4.13 (#5203) by @dependabot[bot]
• chore(deps-dev): bump markdownlint-cli2 from 0.22.0 to 0.22.1 (#5201) by @dependabot[bot]
• chore(deps-dev): bump the vitest group across 1 directory with 2 updates (#5199) by @dependabot[bot]
• chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 (#5198) by @dependabot[bot]
• chore(deps): bump typescript from 6.0.2 to 6.0.3 in the typescript group across 1 directory (#5197) by @dependabot[bot]
• chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (#5188) by @dependabot[bot]
• chore(deps-dev): bump @aws/durable-execution-sdk-js from 1.1.0 to 1.1.1 (#5194) by @dependabot[bot]
• chore(deps-dev): bump @biomejs/biome from 2.4.11 to 2.4.12 (#5189) by @dependabot[bot]
• chore(deps-dev): bump @redis/client from 5.12.0 to 5.12.1 (#5190) by @dependabot[bot]
• chore(deps-dev): bump @redis/client from 5.11.0 to 5.12.0 (#5185) by @dependabot[bot]

This release was made possible by the following contributors:

@bdellegrazie, @dependabot[bot], @dreamorosi, @github-actions[bot], @nanookclaw, @sdangol, @svozza, @vishwakt, dependabot[bot] and github-actions[bot]