AWS Powertools for Lambda Files

Summary

In this release, we've expanded the Lambda layer to include all 14 published Powertools packages. Data Masking, Signer, Kafka, and Validation are now available directly from the layer, making it easier to use these utilities without bundling the Powertools packages separately.

Important for Lambda layer users: We've changed how the layers are built and no longer include the AWS SDK for JavaScript v3 clients we previously bundled. We still recommend bundling the SDK packages your function needs so you control their versions. Your bundled SDK takes precedence; if you don't bundle one, Powertools falls back to the SDK provided by the Lambda Node.js runtime. Remove any build exclusions that assumed the Powertools layer supplied the SDK.

We've also made JSON-only Kafka consumers easier to bundle and added Parser support for WITH_METADATA deliveries from the new enhanced Custom Event Bus in Amazon EventBridge.

We've fixed Valkey-backed idempotency when using @valkey/valkey-glide. Previously, the persistence layer passed Redis-client write options that Glide ignored, so records and locks could be written without expiry or conditional-write protection. The persistence layer now passes the correct options, restoring the expected record expiry and protection against duplicate processing. If you use Valkey Glide, we recommend upgrading.

Other Idempotency fixes keep operations tied to the correct record when your handler modifies its input or multiple idempotent functions share a persistence instance, preventing stuck in-progress records and incorrect updates. The HTTP Event Handler also preserves binary response bodies and correctly handles responses with no body, so you can serve files or return 204 No Content without workarounds.

This release also includes several other bug fixes, minor improvements, and documentation updates, with the help of the community.

⭐ Congratulations to @pttydou, @vaibhav8a, @sabaighani, @vahidshaik1901, @Provokke, @victoriademina, @proton0210, and @karthiksenv for their first PRs merged in the project, and thanks to @vishwakt for their many contributions to this release 🎉

More utilities in the Lambda layer

Docs

The Lambda layer now includes all 14 published Powertools packages. Data Masking, Signer, Kafka, and Validation were previously missing, so you can now use those utilities from the layer rather than bundling the Powertools packages separately.

The layer also no longer bundles AWS SDK v3 clients. This avoids mixing layer-provided clients with a different SDK version from the Lambda runtime, which could cause failures when using the DynamoDB DocumentClient.

EventBridge Custom Event Bus support

Docs

Parser now supports WITH_METADATA subscriber deliveries from the new enhanced Custom Event Bus in Amazon EventBridge, which is distinct from Custom Event Bus – Classic. Each delivered record contains the event in Data, optional custom metadata in Metadata, and delivery information in SystemMetadata, such as whether the event is live or replayed.

:::typescript
import { parse } from '@aws-lambda-powertools/parser';
import { EventBridgeWithMetadataEnvelope } from '@aws-lambda-powertools/parser/envelopes';
import { z } from 'zod';

const orderSchema = z.object({
  orderId: z.string(),
  amount: z.number(),
});

export const handler = async (event: unknown) => {
  const orders = parse(event, EventBridgeWithMetadataEnvelope, orderSchema);
  return orders;
};

Use EventBridgeWithMetadataRecordSchema or EventBridgeWithMetadataSchema when you need to retain the event and its metadata. The record schema also supports single-object deliveries.

Simpler Kafka bundles

Docs

If your Kafka consumer only handles JSON, you no longer need to install avro-js and protobufjs just to make your function bundle successfully. These libraries are now optional dependencies loaded only when their corresponding format is configured, so you can leave unused codecs out of your deployment.

If you use Avro or Protocol Buffers, install the corresponding library and include it in your deployment.

Changes

• chore(deps): apply available npm audit fixes (#5790) by @svozza
• test(batch): add Lambda Managed Instances isolation coverage (#5768) by @karthiksenv
• fix(parser): accept real Cognito trigger events from common flows (#5777) by @vishwakt
• docs(parser): fix schema names in built-in schemas table (#5784) by @vishwakt
• feat(parser): support EventBridge WITH_METADATA deliveries (#5776) by @proton0210
• refactor(idempotency): make DynamoDB error check minification-resistant (#5775) by @dreamorosi
• fix(parser): accept multi-value headers in VPC Lattice v2 events (#5773) by @vishwakt
• fix(parser): accept documented SES receipt event variants (#5772) by @vishwakt
• fix(parser): keep PhysicalResourceId in CloudFormation events (#5767) by @proton0210
• refactor(tracer): track fetch subsegments per request (#5746) by @victoriademina
• fix(idempotency): pass cache SET options in the Valkey Glide shape (#5737) by @Provokke
• fix(tests): deterministic LMI e2e overlap and capacity provider headroom (#5736) by @svozza
• fix(parser): keep transform errors as the ParseError cause (#5745) by @svozza
• fix(parser): keep Lambda authorizer context in the REST API event schema (#5749) by @vishwakt
• fix(idempotency): bind operations to their own key prefix on a shared store (#5708) by @svozza
• fix(batch): throw when a synchronous processor gets a promise-returning handler (#5650) by @vahidshaik1901
• fix(event-handler): honor Accept-Encoding q-values in compression (#5725) by @arnabrahman
• fix(idempotency): complete and delete the record acquired at operation start (#5717) by @vishwakt
• fix(idempotency): keep payload validation hash on cache record completion (#5706) by @svozza
• fix(event-handler): handle empty proxy response bodies (#5701) by @svozza
• fix(event-handler): preserve binary Web Response bodies (#5700) by @svozza
• chore(tests): split custom Vitest matchers out of setupEnv (#5704) by @svozza
• fix(event-handler): stop recursive HTTP error handler dispatch (#5703) by @svozza
• chore(tests): centralise TypeScript test configuration (#5695) by @svozza
• refactor(event-handler): simplify HTTP event parsing (#5686) by @svozza
• chore(tests): replace aws-sdk-client-mock-vitest with local matcher (#5693) by @svozza
• fix(ci): skip unrelated release workflows without approval (#5688) by @svozza
• fix(event-handler): ignore body on GET/HEAD requests when converting to Web Request (#5683) by @sabaighani
• fix(idempotency): retain cache locks without execution deadlines (#5680) by @svozza
• chore(tests): add Metrics e2e suite for Lambda Managed Instances (#5663) by @svozza
• fix(idempotency): delete only acquired records in the Middy onError hook (#5676) by @svozza
• fix(event-handler): honour isBase64Encoded and binary bodies on proxy results (#5668) by @svozza
• chore(ci): align cached-node-modules pins and drop a stale header comment (#5665) by @svozza
• chore(ci): remove the unused Publish Package workflow (#5664) by @svozza
• fix(parser): stop malformed base64 from escaping safeParse (#5666) by @vishwakt
• docs(maintenance): explain how to test invocation-scoped state (#5661) by @svozza
• fix(ci): harden the release manifest patch and e2e sweep incident lookup (#5662) by @svozza
• chore(maintenance): pin Python 3.14 across the docs toolchain (#5648) by @svozza
• chore(maintenance): align CI matrices and repository templates (#5635) by @dreamorosi
• chore(ci): derive workflow matrices from the root workspaces list (#5638) by @svozza
• fix(maintenance): normalize package test scripts (#5653) by @dreamorosi
• chore(ci): convert the scripts in .github/scripts to ESM (#5640) by @svozza
• chore(maintenance): retire sample application (#5634) by @dreamorosi
• docs(maintenance): retire stale process docs (#5618) by @dreamorosi
• chore(maintenance): make the root tsconfig an options base with no program (#5646) by @svozza
• fix(event-handler): fail invocation on UnauthorizedException in onPublish (#5621) by @svozza
• fix(data-masking): honor throwOnMissingField consistently and resolve paths before masking (#5630) by @svozza
• fix(batch): populate response() before full batch throw and normalize non-Error throws (#5625) by @svozza
• fix(parameters): include request options in cache key (#5623) by @svozza
• refactor(commons): extract InvokeStore fallback into InvocationScoped (#5615) by @dreamorosi
• chore(deps): bump click to 8.3.3 in docs requirements (#5616) by @dreamorosi
• chore(ci): auto-merge non-major Dependabot GitHub Actions updates (#5608) by @svozza
• docs: add CODING_STANDARDS.md agent-facing coding reference (#5598) by @dreamorosi
• chore(tests): add scheduled sweeper for leaked e2e infrastructure (#5599) by @dreamorosi
• chore(layers): replace shell filesystem commands (#5596) by @dreamorosi
• chore(tests): add LMI e2e suite and run-scoped shared capacity provider (#5465) by @svozza
• chore(maintenance): move dev tooling to devDependencies in private workspaces (#5595) by @svozza
• ci(maintenance): auto-merge Dependabot dev dependency updates (#5568) by @svozza
• fix(layers): bundle all publishable utilities in the Lambda layer (#5577) by @svozza
• fix(kafka): lazily import Avro and Protobuf codecs so JSON-only consumers bundle (#5578) by @svozza
• chore(deps): bump transitive deps to resolve high-severity advisories (#5588) by @svozza
• chore(deps): pin vitest and @vitest/coverage-v8 to exact versions (#5585) by @svozza
• docs: fix misspelled 'descrition' front-matter key and a typo (#5582) by @vaibhav8a
• chore: deprecate custom config service types (#5575) by @pttydou
• fix(ci): gate release on npm registry propagation (#5572) by @svozza
• ci(maintenance): add aggregate unit-test check for branch protection (#5567) by @svozza
• fix(event-handler): handle +json content types and bodyless responses (#5570) by @arnabrahman
• fix(layers): do not ship AWS SDK clients in the Lambda layer (#5512) by @svozza

🔧 Maintenance

• chore(deps-dev): bump @types/node from 26.6.3 to 26.6.4 (#5785) by @dependabot[bot]
• chore(deps-dev): bump @redis/client from 6.2.1 to 6.3.0 (#5786) by @dependabot[bot]
• chore(deps-dev): bump @biomejs/biome from 2.5.14 to 2.5.15 (#5782) by @dependabot[bot]
• chore(deps-dev): bump @aws/durable-execution-sdk-js from 2.4.0 to 2.6.0 (#5781) by @dependabot[bot]
• chore(deps-dev): bump the vitest group across 1 directory with 2 updates (#5779) by @dependabot[bot]
• chore(deps): bump arktype from 2.2.5 to 2.2.7 (#5783) by @dependabot[bot]
• chore(deps): bump release-drafter/release-drafter from 7.7.0 to 7.9.0 (#5780) by @dependabot[bot]
• chore(deps-dev): bump @types/aws-lambda from 8.10.163 to 8.10.164 (#5766) by @dependabot[bot]
• chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /docs (#5763) by @dependabot[bot]
• chore(deps): bump gitpython from 3.1.59 to 3.1.62 in /docs (#5762) by @dependabot[bot]
• chore(deps): bump aws-cdk-lib from 2.270.0 to 2.271.0 in the aws-cdk group across 1 directory (#5760) by @dependabot[bot]
• chore(deps): bump the aws-sdk-v3 group across 1 directory with 54 updates (#5759) by @dependabot[bot]
• chore(deps-dev): bump lint-staged from 17.5.1 to 17.6.0 (#5756) by @dependabot[bot]
• chore(deps-dev): bump @types/node from 26.6.2 to 26.6.3 (#5755) by @dependabot[bot]
• chore(deps): bump arktype from 2.2.3 to 2.2.5 (#5754) by @dependabot[bot]
• chore(deps-dev): bump @valkey/valkey-glide from 2.5.2 to 2.5.3 (#5753) by @dependabot[bot]
• chore(deps-dev): bump the vitest group across 1 directory with 2 updates (#5751) by @dependabot[bot]
• chore(deps-dev): bump undici-types from 8.11.0 to 8.11.2 (#5752) by @dependabot[bot]
• chore(deps): bump the aws-cdk group across 1 directory with 3 updates (#5723) by @dependabot[bot]
• chore(deps): bump the codeql-action group across 1 directory with 3 updates (#5750) by @dependabot[bot]
• chore(deps): bump python from 016508b to 9e9fde4 in /docs (#5747) by @dependabot[bot]
• chore(deps-dev): bump undici-types from 8.10.2 to 8.11.0 (#5748) by @dependabot[bot]
• chore(deps): bump zgosalvez/github-actions-ensure-sha-pinned-actions from 5.0.8 to 5.0.9 (#5740) by @dependabot[bot]
• chore(deps): bump the aws-sdk-v3 group across 1 directory with 29 updates (#5741) by @dependabot[bot]
• chore(deps-dev): bump markdownlint-cli2 from 0.23.2 to 0.23.3 (#5739) by @dependabot[bot]
• chore(deps-dev): bump fast-check from 4.10.1 to 4.10.2 (#5738) by @dependabot[bot]
• chore(deps): bump soupsieve from 2.8.4 to 2.9 in /docs (#5726) by @dependabot[bot]
• chore(deps): bump python from c6ead21 to 016508b in /docs (#5729) by @dependabot[bot]
• chore(deps-dev): bump @types/node from 26.6.1 to 26.6.2 (#5734) by @dependabot[bot]
• chore(deps): bump the codeql-action group across 1 directory with 3 updates (#5733) by @dependabot[bot]
• chore(deps): bump aws-actions/configure-aws-credentials from 6.2.4 to 6.3.0 (#5728) by @dependabot[bot]
• chore(deps-dev): bump fast-check from 4.10.0 to 4.10.1 (#5732) by @dependabot[bot]
• chore(deps-dev): bump @biomejs/biome from 2.5.13 to 2.5.14 (#5731) by @dependabot[bot]
• chore(deps-dev): bump @types/node from 26.5.1 to 26.6.1 (#5730) by @dependabot[bot]
• chore(deps-dev): bump the vitest group across 1 directory with 2 updates (#5727) by @dependabot[bot]
• chore(deps-dev): bump zod from 4.6.4 to 4.6.5 (#5724) by @dependabot[bot]
• chore(deps): bump the aws-sdk-v3 group across 1 directory with 46 updates (#5722) by @dependabot[bot]
• chore(deps-dev): bump zod from 4.6.2 to 4.6.4 (#5721) by @dependabot[bot]
• chore(deps): bump valibot from 1.4.2 to 1.5.0 (#5718) by @dependabot[bot]
• chore(deps-dev): bump lint-staged from 17.5.0 to 17.5.1 (#5719) by @dependabot[bot]
• chore(deps-dev): bump @aws/durable-execution-sdk-js from 2.3.1 to 2.4.0 (#5720) by @dependabot[bot]
• chore(deps): bump the codeql-action group across 1 directory with 3 updates (#5713) by @dependabot[bot]
• chore(deps-dev): bump @types/node from 26.5.0 to 26.5.1 (#5712) by @dependabot[bot]
• chore(deps-dev): bump @biomejs/biome from 2.5.12 to 2.5.13 (#5711) by @dependabot[bot]
• chore(deps-dev): bump zod from 4.5.4 to 4.6.2 (#5710) by @dependabot[bot]
• chore(deps-dev): bump fast-check from 4.9.0 to 4.10.0 (#5709) by @dependabot[bot]
• chore(deps-dev): bump @types/node from 26.4.1 to 26.5.0 (#5696) by @dependabot[bot]
• chore(deps-dev): bump the vitest group across 1 directory with 2 updates (#5655) by @dependabot[bot]
• chore(deps): bump the aws-cdk group across 1 directory with 2 updates (#5682) by @dependabot[bot]
• chore(deps): bump aws-powertools/actions/.github/actions/version-n-changelog from 1.5.2 to 1.6.0 (#5689) by @dependabot[bot]
• chore(deps): bump aws-powertools/actions/.github/actions/create-pr from 1.5.2 to 1.6.0 (#5690) by @dependabot[bot]
• chore(deps): bump the aws-sdk-v3 group across 1 directory with 29 updates (#5681) by @dependabot[bot]
• chore(deps): bump gitpython from 3.1.58 to 3.1.59 in /docs (#5677) by @dependabot[bot]
• chore(deps-dev): bump @types/node from 26.4.0 to 26.4.1 (#5679) by @dependabot[bot]
• chore(deps): bump zgosalvez/github-actions-ensure-sha-pinned-actions from 5.0.7 to 5.0.8 (#5672) by @dependabot[bot]
• chore(deps-dev): bump undici-types from 8.10.1 to 8.10.2 (#5670) by @dependabot[bot]
• chore(deps-dev): bump lint-staged from 17.4.1 to 17.5.0 (#5671) by @dependabot[bot]
• chore(deps-dev): bump @aws/durable-execution-sdk-js from 2.3.0 to 2.3.1 (#5669) by @dependabot[bot]
• chore(deps): bump aws-cdk-lib from 2.267.0 to 2.268.0 in the aws-cdk group across 1 directory (#5660) by @dependabot[bot]
• chore(deps): bump the aws-sdk-v3 group across 1 directory with 33 updates (#5659) by @dependabot[bot]
• chore(deps-dev): bump @biomejs/biome from 2.5.11 to 2.5.12 (#5658) by @dependabot[bot]
• chore(deps-dev): bump @types/aws-lambda from 8.10.162 to 8.10.163 (#5657) by @dependabot[bot]
• chore(deps-dev): bump @valkey/valkey-glide from 2.5.1 to 2.5.2 (#5656) by @dependabot[bot]
• chore(deps): bump click from 8.3.3 to 8.5.0 in /docs (#5628) by @dependabot[bot]
• chore(deps-dev): bump undici-types from 8.10.0 to 8.10.1 (#5629) by @dependabot[bot]
• chore(deps): bump aws-actions/configure-aws-credentials from 6.2.3 to 6.2.4 (#5613) by @dependabot[bot]
• chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#5607) by @dependabot[bot]
• chore(deps): bump aws-actions/configure-aws-credentials from 6.2.2 to 6.2.3 (#5604) by @dependabot[bot]
• chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#5605) by @dependabot[bot]
• chore(deps): bump the aws-cdk group across 1 directory with 3 updates (#5611) by @dependabot[bot]
• chore(deps): bump the aws-sdk-v3 group across 1 directory with 29 updates (#5610) by @dependabot[bot]
• chore(deps-dev): bump zod from 4.5.2 to 4.5.4 (#5609) by @dependabot[bot]
• chore(deps-dev): bump lint-staged from 17.3.0 to 17.4.1 (#5606) by @dependabot[bot]
• chore(deps-dev): bump zod from 4.4.3 to 4.5.2 (#5603) by @dependabot[bot]
• chore(deps-dev): bump protobufjs from 8.7.2 to 8.8.0 (#5601) by @dependabot[bot]
• chore(deps-dev): bump @biomejs/biome from 2.5.10 to 2.5.11 (#5602) by @dependabot[bot]
• chore(deps-dev): bump @types/node from 26.3.0 to 26.4.0 (#5600) by @dependabot[bot]
• chore(deps): bump the codeql-action group across 1 directory with 3 updates (#5581) by @dependabot[bot]
• chore(deps-dev): bump @biomejs/biome from 2.5.8 to 2.5.10 (#5586) by @dependabot[bot]
• chore(deps-dev): bump the vitest group across 1 directory with 2 updates (#5580) by @dependabot[bot]
• chore(deps): bump @types/node from 26.2.0 to 26.3.0 (#5591) by @dependabot[bot]
• chore(deps): bump the aws-cdk group across 1 directory with 3 updates (#5590) by @dependabot[bot]
• chore(deps): bump the aws-sdk-v3 group across 1 directory with 54 updates (#5589) by @dependabot[bot]
• chore(deps-dev): bump @aws/durable-execution-sdk-js from 2.2.0 to 2.3.0 (#5561) by @dependabot[bot]
• chore(deps): bump the aws-sdk-v3 group across 1 directory with 55 updates (#5571) by @dependabot[bot]

This release was made possible by the following contributors:

@arnabrahman, @dreamorosi, @karthiksenv, @proton0210, @Provokke, @pttydou, @sabaighani, @svozza, @vahidshaik1901, @vaibhav8a, @victoriademina, @vishwakt, @dependabot[bot] and @claude