AWS Powertools for Lambda Files

Summary

This release introduces two new utilities: Signer, for signing HTTP requests to AWS services with SigV4, and Data Masking, for encrypting, decrypting, or irreversibly erasing sensitive fields in your event data.

We've also fixed three bugs affecting Logger and Tracer under [Lambda Managed Instances](https://docs.aws.amazon.com/lambda/latest/dg/managed-instances.html(LMI) concurrency, where multiplexing several invocations into the same execution environment could cause log lines and X-Ray trace data from one invocation to leak into another.

On top of that, Metrics now supports automatic flushing via the using keyword, Parameters gained an opt-in throwOnMissing option to fail fast on missing values, and Idempotency now warns when a shared persistence layer instance receives a reconfiguration it silently ignores. We've also fixed a Metrics bug where a metric name colliding with a dimension or metadata key could silently corrupt the CloudWatch EMF payload, along with a couple of HTTP Router fixes: a crash affecting bundles that don't install Metrics, and unreachable routes caused by trailing slashes.

⭐ Congratulations to @kimnamu for their first PR merged in the project and thank you to @vishwakt and @Zelys-DFKH for their contributions too. 🎉

Signer

The new @aws-lambda-powertools/signer package signs HTTP requests using AWS Signature Version 4 (SigV4), so you can call IAM-authenticated endpoints — API Gateway, Lambda function URLs, AppSync — from within your Lambda functions.

Signing and sending are kept separate: SigV4Signer signs a web-standard Request and performs no network I/O, while createSignedFetcher gives you a drop-in signed fetch for when you just want to sign and send in one step. By default, the signer reads credentials and region from the Lambda runtime environment, so no extra dependencies or configuration are required.

:::typescript
import { SigV4Signer } from '@aws-lambda-powertools/signer/sigv4';

const signer = new SigV4Signer({ service: 'execute-api' });

export const handler = async () => {
  const signed = await signer.sign(
    'https://example.execute-api.us-east-1.amazonaws.com/items'
  );

  // `signed` is a standard `Request` with the SigV4 headers added
  const response = await fetch(signed);
  await response.json();
};

Data Masking

The new @aws-lambda-powertools/data-masking package lets you encrypt, decrypt, or irreversibly erase sensitive fields within nested event data, using the AWS Encryption SDK and envelope encryption with AWS KMS for encrypt/decrypt operations.

:::typescript
import { DataMasking } from '@aws-lambda-powertools/data-masking';

const masker = new DataMasking();

export const handler = async (event: { body: Record<string, unknown> }) => {
  const data = event.body;

  return masker.erase(data, {
    fields: ['email', 'address.street', 'company_address'],
  });
};

Custom masking rules — partial masking via regex, dynamic-length masks, or a fixed replacement string — are also supported for cases where the default ***** placeholder isn't enough.

Lambda Managed Instances concurrency fixes

Under Lambda Managed Instances, multiple invocations can be multiplexed into the same execution environment. Logger and Tracer previously stored per-invocation state (the Lambda context, the active X-Ray segment, and middleware-scoped subsegments) in shared instance variables rather than scoping it per invocation, so concurrent invocations could stomp on each other's state:

• Logger could emit log lines with the wrong function_request_id, tenant_id, and cold_start — the values from whichever invocation last called addContext().
• Tracer could attach putAnnotation/putMetadata calls, captured responses, and captured errors to the wrong invocation's trace, and the captureLambdaHandler middy middleware could close the wrong subsegment or leave one open.

Both utilities now scope this state per invocation using the Lambda Invoke Store, matching the approach already used by Metrics and Batch, so trace and log data stay correctly attributed to the invocation that produced them.

Automatic metric flushing with using

Metrics now implements Disposable, so on Node.js 24+ you can flush stored metrics automatically when a using binding leaves scope — including when an exception is thrown — without a manual try/finally block or the middleware/decorator.

:::typescript
import { Metrics, MetricUnit } from '@aws-lambda-powertools/metrics';

const metrics = new Metrics({
  namespace: 'serverlessAirline',
  serviceName: 'orders',
});

export const handler = async (): Promise<void> => {
  using _ = metrics.addMetric('successfulBooking', MetricUnit.Count, 10);
  // metrics are flushed automatically when the scope exits, including on errors
};

Changes

• chore(testing): use stackEventPollingInterval option, drop CDK patch (#5447) by @svozza
• fix(tracer): isolate active segment per invocation under LMI concurrency (#5446) by @svozza
• fix(idempotency): recompute key prefix from base on each configure call (#5442) by @dreamorosi
• fix(tracer): scope middy middleware segments per invocation (#5444) by @vishwakt
• feat(parser): add errorHandler option for inline parse error handling (#5352) by @Zelys-DFKH
• refactor(logger): remove unsafe context cast in createChild (#5443) by @dreamorosi
• feat(idempotency): warn when persistence layer reconfiguration is ignored (#5422) by @dreamorosi
• chore(skills): make create-issue checkbox handling template-driven (#5439) by @svozza
• fix(logger): scope lambda context per invocation under LMI concurrency (#5430) by @svozza
• docs(event-handler): mention HTTP event handler in package README (#5432) by @svozza
• docs(event-handler): note Bedrock Agents maintenance mode (#5425) by @dreamorosi
• refactor(commons): extract shared isRunningInLambda helper (#5424) by @dreamorosi
• refactor(testing): remove withResolvers polyfill, use native method (#5427) by @dreamorosi
• chore(deps): bump transitive protobufjs from 7.5.8 to 7.6.5 (#5421) by @dreamorosi
• feat(signer): add SigV4 request signing utility (#5344) by @dreamorosi
• docs(idempotency): explain persistence layer reuse across multiple operations (#5419) by @dreamorosi
• docs: document npm package name reservation in maintainers playbook (#5418) by @dreamorosi
• chore(governance): add shared agent skills for creating issues and PRs (#5407) by @svozza
• ci: slow CDK stack-event polling to avoid CFN throttling (#5405) by @svozza
• chore(tests): prevent sentinel key collision in data-masking property test (#5392) by @svozza
• ci(layers): update SSM latest parameter on release (#5369) by @dreamorosi
• chore(maintenance): remove DOM lib, use undici-types for fetch types (#5351) by @svozza
• fix(event-handler): preserve original string for invalid Bedrock Agent number params (#5363) by @kimnamu
• feat(metrics): add Disposable support for automatic flushing via using (#5349) by @svozza
• feat(data-masking): add Data Masking utility (#5143) by @svozza
• feat(parameters): add throwOnMissing option to fail fast on missing values (#5343) by @dreamorosi
• chore(ci): type-check examples/snippets and fix uncovered errors (#5348) by @dreamorosi
• refactor(event-handler): extract shared IP-extraction util for HTTP middleware (#5346) by @dreamorosi
• feat(event-handler): add HTTP request/response data to tracer subsegment (#5338) by @dreamorosi
• build(internal): add test compilation check to package builds (#5336) by @dreamorosi
• feat(event-handler): warn when AppSync Events payload exceeds 240 KB per-event limit (#5339) by @dreamorosi
• chore: approve install scripts for npm v12 allowScripts (#5340) by @svozza
• chore: clear npm audit on aws-cdk-lib transitive dep (#5328) by @dreamorosi
• ci(maintenance): remove PR/branch checkout input from Run e2e Tests workflow (#5326) by @dreamorosi
• test(event-handler): fix stale httpRouter e2e trailing-slash test (#5314) by @svozza
• fix(event-handler): avoid runtime import of metrics package in HTTP metrics middleware (#5310) by @vishwakt
• chore(commons): guard UA string against duplicate PTEnv suffix (#5311) by @svozza
• fix(event-handler): correct InvalidHttpMethodError name (#5254) by @svozza
• chore(idempotency): bump @aws/durable-execution-sdk-js to ^1.1.6 (#5298) by @svozza
• fix(event-handler): normalize trailing slashes in HTTP Router prefix joining (#5255) by @svozza
• fix(commons): clear LRUCache pointers on eviction of last item (#5295) by @vishwakt
• chore(deps): bump aws-cdk and aws-cdk-lib to clear fast-uri advisories (#5292) by @svozza
• fix(metrics): detect key collisions between dimensions, metrics, and metadata (#5240) by @Zelys-DFKH

🔧 Maintenance

• chore(deps): bump soupsieve from 2.7 to 2.8.4 in /docs (#5437) by @dependabot[bot]
• chore(deps-dev): bump fast-check from 4.8.0 to 4.9.0 (#5436) by @dependabot[bot]
• chore(deps-dev): bump @biomejs/biome from 2.5.2 to 2.5.3 (#5414) by @dependabot[bot]
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.3 to 4.37.0 (#5413) by @dependabot[bot]
• chore(deps): bump arktype from 2.2.2 to 2.2.3 (#5415) by @dependabot[bot]
• chore(deps): bump @types/node from 26.1.0 to 26.1.1 (#5416) by @dependabot[bot]
• chore(deps): bump aws-actions/configure-aws-credentials from 6.2.1 to 6.2.2 (#5412) by @dependabot[bot]
• chore(deps-dev): bump @aws/durable-execution-sdk-js from 2.0.0 to 2.1.0 (#5402) by @dependabot[bot]
• chore(deps): bump @aws/lambda-invoke-store from 0.2.4 to 0.3.0 (#5401) by @dependabot[bot]
• chore(deps-dev): bump protobufjs from 8.6.5 to 8.7.0 (#5403) by @dependabot[bot]
• chore(deps-dev): bump undici-types from 8.5.0 to 8.7.0 (#5400) by @dependabot[bot]
• chore(deps): bump the aws-cdk group across 1 directory with 3 updates (#5396) by @dependabot[bot]
• chore(deps-dev): bump the vitest group across 1 directory with 2 updates (#5394) by @dependabot[bot]
• chore(deps-dev): bump the typescript group across 1 directory with 2 updates (#5398) by @dependabot[bot]
• chore(deps): bump arktype from 2.2.1 to 2.2.2 (#5390) by @dependabot[bot]
• chore(deps-dev): bump @redis/client from 6.0.1 to 6.1.0 (#5387) by @dependabot[bot]
• chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.36.3 (#5389) by @dependabot[bot]
• chore(deps-dev): bump markdownlint-cli2 from 0.22.1 to 0.23.0 (#5388) by @dependabot[bot]
• chore(deps): bump the aws-sdk-v3 group across 1 directory with 66 updates (#5395) by @dependabot[bot]
• chore(deps): bump @types/node from 26.0.1 to 26.1.0 (#5386) by @dependabot[bot]
• chore(deps-dev): bump @biomejs/biome from 2.5.1 to 2.5.2 (#5385) by @dependabot[bot]
• chore(deps): bump aws-actions/configure-aws-credentials from 6.2.0 to 6.2.1 (#5384) by @dependabot[bot]
• chore(deps-dev): bump @aws/durable-execution-sdk-js from 1.1.7 to 2.0.0 (#5365) by @dependabot[bot]
• chore(deps): bump release-drafter/release-drafter from 7.4.0 to 7.5.1 (#5378) by @dependabot[bot]
• chore(deps): bump aws-powertools/actions/.github/actions/create-pr from 1.3.0 to 1.5.2 (#5379) by @dependabot[bot]
• chore(deps): bump aws-powertools/actions/.github/actions/version-n-changelog from 1.5.0 to 1.5.2 (#5380) by @dependabot[bot]
• chore(deps): bump zgosalvez/github-actions-ensure-sha-pinned-actions from 5.0.4 to 5.0.5 (#5381) by @dependabot[bot]
• chore(deps-dev): bump @valkey/valkey-glide from 2.4.1 to 2.4.2 (#5383) by @dependabot[bot]
• chore(deps-dev): bump @redis/client from 6.0.0 to 6.0.1 (#5377) by @dependabot[bot]
• chore(deps): bump actions/setup-go from 6.4.0 to 6.5.0 (#5373) by @dependabot[bot]
• chore(deps): bump valibot from 1.4.1 to 1.4.2 (#5382) by @dependabot[bot]
• chore(deps): bump @types/node from 26.0.0 to 26.0.1 (#5376) by @dependabot[bot]
• chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#5372) by @dependabot[bot]
• chore(deps-dev): bump protobufjs from 8.6.4 to 8.6.5 (#5374) by @dependabot[bot]
• chore(deps-dev): bump undici-types from 7.24.6 to 8.5.0 (#5370) by @dependabot[bot]
• chore(deps): bump the aws-sdk-v3 group across 1 directory with 70 updates (#5366) by @dependabot[bot]
• chore(deps-dev): bump @biomejs/biome from 2.5.0 to 2.5.1 (#5371) by @dependabot[bot]
• chore(deps-dev): bump lint-staged from 17.0.7 to 17.0.8 (#5364) by @dependabot[bot]
• chore(deps): bump the aws-cdk group across 1 directory with 3 updates (#5367) by @dependabot[bot]
• chore(deps): bump @types/node from 25.9.3 to 26.0.0 (#5361) by @dependabot[bot]
• chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 (#5360) by @dependabot[bot]
• chore(deps): bump arktype from 2.2.0 to 2.2.1 (#5359) by @dependabot[bot]
• chore(deps-dev): bump protobufjs from 8.6.3 to 8.6.4 (#5358) by @dependabot[bot]
• chore(deps): bump the aws-cdk group across 1 directory with 2 updates (#5356) by @dependabot[bot]
• chore(deps-dev): bump @aws-crypto/client-node from 4.2.2 to 5.0.0 (#5354) by @dependabot[bot]
• chore(deps): bump release-drafter/release-drafter from 7.3.1 to 7.4.0 (#5357) by @dependabot[bot]
• chore(deps-dev): bump the vitest group across 1 directory with 2 updates (#5353) by @dependabot[bot]
• chore(deps): bump the aws-sdk-v3 group across 1 directory with 44 updates (#5355) by @dependabot[bot]
• chore(deps-dev): bump @aws/durable-execution-sdk-js from 1.1.6 to 1.1.7 (#5308) by @dependabot[bot]
• chore(deps-dev): bump @biomejs/biome from 2.4.16 to 2.5.0 (#5342) by @dependabot[bot]
• chore(deps): bump esbuild from 0.28.0 to 0.28.1 (#5341) by @dependabot[bot]
• chore(deps): bump the aws-sdk-v3 group across 1 directory with 62 updates (#5337) by @dependabot[bot]
• chore(deps): bump @aws-sdk/middleware-bucket-endpoint from 3.972.8 to 3.972.24 (#5332) by @dependabot[bot]
• chore(deps): bump the aws-cdk group across 1 directory with 3 updates (#5334) by @dependabot[bot]
• chore(deps): bump @smithy/util-uri-escape from 4.2.2 to 4.3.6 (#5333) by @dependabot[bot]
• chore(deps): bump @smithy/smithy-client from 4.12.9 to 4.13.6 (#5331) by @dependabot[bot]
• chore(deps): bump github/codeql-action from 4.36.1 to 4.36.2 (#5316) by @dependabot[bot]
• chore(deps-dev): bump protobufjs from 8.6.0 to 8.6.3 (#5324) by @dependabot[bot]
• chore(deps): bump @types/aws-lambda from 8.10.161 to 8.10.162 (#5318) by @dependabot[bot]
• chore(deps): bump @types/node from 25.9.1 to 25.9.3 (#5323) by @dependabot[bot]
• chore(deps-dev): bump protobufjs from 8.5.0 to 8.6.0 (#5317) by @dependabot[bot]
• chore(deps-dev): bump lint-staged from 17.0.5 to 17.0.7 (#5315) by @dependabot[bot]
• chore(deps-dev): bump protobufjs from 8.4.2 to 8.5.0 (#5307) by @dependabot[bot]
• chore(deps-dev): bump @biomejs/biome from 2.4.15 to 2.4.16 (#5299) by @dependabot[bot]
• chore(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#5305) by @dependabot[bot]
• chore(deps-dev): bump the vitest group across 1 directory with 2 updates (#5306) by @dependabot[bot]
• chore(deps): bump github/codeql-action from 4.36.0 to 4.36.1 (#5304) by @dependabot[bot]
• chore(deps): bump aws-actions/configure-aws-credentials from 6.1.1 to 6.2.0 (#5303) by @dependabot[bot]
• chore(deps-dev): bump @valkey/valkey-glide from 2.4.0 to 2.4.1 (#5301) by @dependabot[bot]
• chore(deps): bump release-drafter/release-drafter from 7.3.0 to 7.3.1 (#5293) by @dependabot[bot]
• chore(deps-dev): bump @redis/client from 5.12.1 to 6.0.0 (#5302) by @dependabot[bot]
• chore(deps): bump valibot from 1.4.0 to 1.4.1 (#5294) by @dependabot[bot]
• chore(deps): bump github/codeql-action from 4.35.5 to 4.36.0 (#5284) by @dependabot[bot]

This release was made possible by the following contributors:

@Zelys-DFKH, @dependabot[bot], @dreamorosi, @github-actions[bot], @kimnamu, @svozza, @vishwakt, dependabot[bot] and github-actions[bot]