[dependabot]

Bumps the python-dependencies group with 7 updates:

Package	From	To
aws-lambda-powertools	3.37.0	3.38.0
boto3	1.43.118	1.43.122
botocore	1.43.118	1.43.122
confluent-kafka	2.16.0	2.16.1
pytest	9.1.1	9.2.0
mypy	2.4.0	2.4.1
moto	5.2.4	5.2.5

Updates aws-lambda-powertools from 3.37.0 to 3.38.0

Release notes

Sourced from aws-lambda-powertools's releases.

v3.38.0

Summary

This release adds support for the new Amazon EventBridge Custom Event Bus in Data Classes and Parser, and fixes twenty bugs across Parameters, Event Handler, Idempotency, Logger, Data Classes and Parser.

Almost every fix here came from the community. We opened the bugs we found as good first issue and people picked them up faster than we could review them. Thank you, this is the best part of the job.

Welcome to our thirteen new contributors: @​Thanatos9404, @​SumiRann1, @​proton0210, @​azmi2409, @​mayuriphad, @​MTirnova, @​hiyouwhatsapp, @​MrNK2107, @​sebxt, @​codewithzubair07, @​Oakcube4life, @​Asymtode712 and @​alphasafal. Thanks also to @​LuisFigueroaG for coming back with another fix.

EventBridge Custom Event Bus

Docs

AWS launched a new EventBridge bus, the Custom Event Bus, with subscribers instead of rules, event retention, ordered delivery per event group, replay, and a PutRawEvents API for Avro, Protobuf and raw bytes. The classic bus is still there, now called Custom Event Bus - Classic.

The new bus delivers events to Lambda in a different shape: a JSON array by default, and a Data / Metadata / SystemMetadata envelope when the subscriber uses the WITH_METADATA transformer. The existing EventBridgeEvent data class and EventBridgeModel only understand the classic single envelope, so we added new ones.

EventBridgeV2Event accepts a single object or an array, with or without metadata, and always exposes a list of records:

from aws_lambda_powertools.utilities.data_classes import EventBridgeV2Event, event_source
@​event_source(data_class=EventBridgeV2Event)
def lambda_handler(event: EventBridgeV2Event, context):
for record in event.records:
if record.system_metadata.delivery_type == "REPLAY":
continue
process(record.detail or record.data)

Two things to know before you migrate to EventBridgeV2. The Lambda runtime's bundled boto3 does not have the eventbridgev2 client yet, so publishing to the new bus from inside a function requires packaging boto3 1.43.102 or newer. And we have not added BatchProcessor support for this bus yet: in our tests a partial batch response was not applied by the service, so for now treat each delivery as all-or-nothing and raise if any record should be retried. Thank you @​Asymtode712 for the implementation and @​alphasafal for the octet-stream fix that followed.

Parameters

Nine fixes in Parameters, most of them around get_parameters_by_name and caching:

• The cache key now includes the SDK options, so get("/x") and get("/x", decrypt=True) no longer return each other's value.
• get_parameters_by_name supports version and label selectors ("/param:3", "/param:prod"), no longer mutates the dictionary you pass in, and raises GetParameterError when GetParameters fails in fail-fast mode.
• get_secrets_by_name returns only the names you asked for, instead of every secret sharing the prefix.
• The AppConfig provider recovers when a poll token is rejected, and the module-level get_app_config keeps one provider per environment and application instead of returning the first one for every call.

Event Handler

• The HTTP API resolver strips the stage from the path only when it is actually there, so custom domains work again.
• Catch-all exception handlers no longer turn a 404 into a 500, and exception handlers can return plain values.
• Multipart and JSON body validation reject malformed bodies with 422 instead of crashing.
• Regex strip_prefixes strip only a leading match, Accept-Encoding: gzip;q=0 disables compression, bytes bodies with a JSON content type are base64 encoded, content-type is matched in any casing, and responses echoing a specific origin carry Vary: Origin.

Other fixes

... (truncated)

Changelog

Sourced from aws-lambda-powertools's changelog.

[v3.38.0] - 2026-10-28

Maintenance

• version bump
• deps: bump virtualenv from 21.14.9 to 21.14.13 (#8687)

Commits

• bdd41fc chore: version bump
• 26deef8 chore(deps): bump virtualenv from 21.14.9 to 21.14.13 (#8687)
• 6c9db30 chore(deps): bump opentelemetry-api from 1.40.0 to 1.45.1 (#8686)
• 6e62cb0 chore(deps): bump zgosalvez/github-actions-ensure-sha-pinned-actions from 5.0...
• 08f63b1 fix(parser): pass non-JSON octet-stream payloads to the model in EventBridgeV...
• 11cf61c chore(deps): bump ddtrace from 4.8.2 to 4.15.6 (#8688)
• 4d0ea2e chore(deps): bump pydantic, aws-cdk, sentry-sdk, pytest-mock, ruff, zensical ...
• 5785377 feat(data_classes,parser): add EventBridge Custom Event Bus support (#8658)
• 45f7a4d fix(event_handler): fix prefix stripping, gzip negotiation, JSON detection an...
• 05877b2 fix(data-classes,parser): read VPC Lattice v2 x509 identity fields with the c...
• Additional commits viewable in compare view

Updates boto3 from 1.43.118 to 1.43.122

Commits

• f89caef Merge branch 'release-1.43.122'
• 5af8c5f Bumping version to 1.43.122
• 1af5d47 Add changelog entries from botocore
• cc2e975 Merge branch 'release-1.43.121'
• 807ecf8 Merge branch 'release-1.43.121' into develop
• 21a159b Bumping version to 1.43.121
• 426304c Add changelog entries from botocore
• bb4b50f Bump the github-actions group with 5 updates (#4867)
• 912163e Bump https://github.com/astral-sh/ruff-pre-commit (#4866)
• 431a8a1 Merge branch 'release-1.43.120'
• Additional commits viewable in compare view

Updates botocore from 1.43.118 to 1.43.122

Commits

• 76af6f8 Merge branch 'release-1.43.122'
• 88fd8aa Bumping version to 1.43.122
• f16acbc Update to latest models
• 3c9efec fix(s3): prevent generate_presigned_post from mutating Conditions (#3847) (#3...
• 750c41d Update awscrt version to 0.38.0 (#3850)
• bdcc3b1 Merge branch 'release-1.43.121'
• 5baea76 Merge branch 'release-1.43.121' into develop
• af1200b Bumping version to 1.43.121
• bb0f085 Update to latest models
• 5c6356e Merge branch 'release-1.43.120'
• Additional commits viewable in compare view

Updates confluent-kafka from 2.16.0 to 2.16.1

Release notes

Sourced from confluent-kafka's releases.

v2.16.1

Fixes

• Require certifi>=2026.10.19 for the Schema Registry client. When ssl.ca.location is not set (and the SSL_CERT_FILE and SSL_CERT_DIR environment variables are not set), the client verifies Schema Registry certificates against the certifi CA bundle, and earlier certifi releases still trust the eMudhra root whose intermediate CA keys were compromised (details). This update does not change custom trust stores configured through ssl.ca.location, SSL_CERT_FILE or SSL_CERT_DIR.
• Fix MetadataTags.__hash__ raising TypeError on unhashable list values so schemas with metadata.tags can be cached (#2385)
• Fix TopicPartition string formatting showing %I32d instead of the partition number on Windows (#2374)

confluent-kafka-python 2.16.1 is based on librdkafka 2.16.0, see the librdkafka release notes for a complete list of changes, enhancements, fixes and upgrade considerations.

Changelog

Sourced from confluent-kafka's changelog.

v2.16.1

Fixes

• Require certifi>=2026.10.19 for the Schema Registry client. When ssl.ca.location is not set (and the SSL_CERT_FILE and SSL_CERT_DIR environment variables are not set), the client verifies Schema Registry certificates against the certifi CA bundle, and earlier certifi releases still trust the eMudhra root whose intermediate CA keys were compromised (details). This update does not change custom trust stores configured through ssl.ca.location, SSL_CERT_FILE or SSL_CERT_DIR; keep those up to date separately.
• Fix MetadataTags.__hash__ raising TypeError on unhashable list values so schemas with metadata.tags can be cached (#2385)
• Fix TopicPartition string formatting showing %I32d instead of the partition number on Windows (#2374)

confluent-kafka-python 2.16.1 is based on librdkafka 2.16.0, see the librdkafka release notes for a complete list of changes, enhancements, fixes and upgrade considerations.

Commits

• 4d30686 2.16.1 (#2403)
• 83f66df 2.16.1rc1 (#2399)
• fbb7c3b Require certifi>=2026.10.19 for the Schema Registry client (#2398)
• 469f81c Fix TopicPartition string formatting on Windows (#2376)
• 47d1240 Fix MetadataTags hash with list values (#2385) (#2388)
• See full diff in compare view

Updates pytest from 9.1.1 to 9.2.0

Release notes

Sourced from pytest's releases.

9.2.0

pytest 9.2.0 (2026-10-27)

Removals and backward incompatible breaking changes

• #14716: -c now raises a usage error for a path that does not exist, is a directory, or is in a format pytest has no loader for. Such paths were previously either ignored or reported as an unhandled FileNotFoundError.

• #8593: The indirect, ids and scope arguments of Metafunc.parametrize() <pytest.Metafunc.parametrize> -- and therefore of @pytest.mark.parametrize <pytest.mark.parametrize ref> -- are now keyword-only.

  Passing them positionally was a common source of confusing errors, e.g. parametrize("arg1", "arg2", [(1, 2)]) made the argvalues land in indirect and failed with indirect fixture '(1, 2)' doesn't exist; such mistakes now fail with an understandable TypeError. The type annotations have always declared these arguments as keyword-only.

• #993: Plugin import failures at startup are now reported and classified instead of escaping as a raw traceback with the accidental exit code 1:

  • a plugin that cannot be found -- via -p, pytest_plugins or PYTEST_PLUGINS -- exits with pytest.ExitCode USAGE_ERROR (4), like a conftest.py that fails to import;
  • a plugin that is found but raises while importing -- including a broken pytest11 entry point or a missing plugin dependency -- exits with pytest.ExitCode INTERNAL_ERROR (3), with the traceback preserved.

  pytest.main now returns these codes instead of raising ImportError. Also fixed an IndexError from pytest's own internals when the plugin raised an exception with no arguments.

Deprecations (removal in next major release)

• #14742: The private _pytest.python.CallSpec2 name has been renamed to CallSpec. The old CallSpec2 alias remains available for now and will be removed in pytest 10 or 11.

• #14755: Schedule yield_fixture decorator for removal in pytest 10 or 11.

• #14774: Similarly to the deprecation of class-scoped fixtures defined as instance methods in pytest 9.1, all higher-scoped fixtures (module, package, and session) defined as instance methods are now deprecated.

  They suffer from the same issue the original deprecation only fixed for class-scoped fixtures, see 10819 and 14011.

• #14808: Passing a non-string value to a string-typed ini option now emits a pytest.PytestRemovedIn10Warning. This affects [tool.pytest.ini_options] in pyproject.toml. In pytest 10 this will raise a TypeError, matching the behavior of the corresponding TOML config path.

• #7323: Passing bytes to TerminalReporter.write_line() is now deprecated, pass a str instead.

New features

• #14743: Full diff: now contains a legend explaining the + & - symbols in diff output.
• #2781: When strict_markers is enabled, marker names used in -m expressions are now validated against registered markers.
• #6881: Added the parametrize_long_str_id_strategy configuration option to control how long str/bytes parameter values are handled in auto-generated test IDs. Explicit IDs set via ids=[...] or pytest.param(..., id=...) are not affected. Available strategies: short (default, values over 100 chars fall back to argname+index), sha256 (SHA-256 hex digest), legacy (keep full value), and disallow (error requesting explicit IDs).

Improvements in existing functionality

• #10745: A RecursionError whose recursion origin cannot be located now shows only the first and last 10 stack frames, matching what pytest already did when locating the origin failed outright. Previously the full traceback -- often around a thousand near-identical frames -- was rendered, which was both slow and unreadable. Pass --full-trace to see every frame.

... (truncated)

Commits

• ae1d0ff Prepare release version 9.2.0
• 143ce31 pre-commit: exclude codespell on generated release announcements
• 532dc5f tox: add attrs dependency to regen, needed in reportingdemo.rst
• a7b2446 Merge pull request #15245 from pytest-dev/claude/project-thread-9jcf91
• 679d09c [pre-commit.ci] pre-commit autoupdate (#15266)
• 41d12cd docs: clarify typing for yield fixtures
• b9022ba Merge pull request #15182 from 1871698/docs/improve-getting-started-description
• 16f87a7 docs: improve getting-started.rst test execution description
• 082ed70 Merge pull request #15255 from pytest-dev/claude/project-thread-eoi3d6
• ae37a01 Merge pull request #15227 from pytest-dev/claude/project-thread-4etye4
• Additional commits viewable in compare view

Updates mypy from 2.4.0 to 2.4.1

Changelog

Sourced from mypy's changelog.

Mypy 2.4.1

• Process overloads as a whole in two-phase type checking (Ivan Levkivskyi, PR 22231)
• Skip recursive setup for frame-private nested functions in mypyc (Piotr Sawicki, PR 22187)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

• A5rocks
• Adam Dangoor
• Alex Waygood
• Ali Hamdan
• Brian Helba
• Chad Dombrova
• David Foster
• dnwpark
• Edgar Ramírez Mondragón
• Giorgos Michas
• Ivan Levkivskyi
• Jelle Zijlstra
• Jukka Lehtosalo
• Marc Mueller
• Michael R. Crusoe
• NIYONSHUTI Emmanuel
• Piotr Sawicki
• Shantanu
• themylogin
• Vaggelis Danias
• Willy Bruns

I'd also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

... (truncated)

Commits

• ad02a35 Skip test for 2.4.1
• cad7794 Finalize version to 2.4.1
• d9cbcbc Add changelog for Mypy 2.4.1 (#22310)
• 2860baa Process overloads as a whole in two-phase type-checking (#22231)
• 9b3e307 [mypyc] Skip recursive setup for frame-private nested functions (#22187)
• 10ad5f6 Bump ast-serialize to 0.12.1 (#22093)
• 350052f Bump ast-serialize to 0.12.0 (#22087)
• f7d08cf Bump version to 2.4.1+dev
• See full diff in compare view

Updates moto from 5.2.4 to 5.2.5

Changelog

Sourced from moto's changelog.

5.2.5

Docker Digest for 5.2.5: sha256:59a1965d845249b04def37a0e2565f9cc6c44543cb89b68e90f28f344b3b0d1a

New Methods:
    * S3Vectors:
        * list_tags_for_resource()
        * tag_resource()
        * untag_resource()
Miscellaneous:

* AutoScaling: delete_autoscaling_group() now correctly succeeds when an attached ELBv2 target group has been deleted

* CloudFormation: get_template_summary() no longer crashes when the optional AWSTemplateFormatVersion-key is not supplied

* CloudFormation: list_stack_resources() now returns the correct LastUpdatedTimestamp-attribute

* CognitoIDP now serves the OpenID Connect discovery document

* Connect: Resources can now be discovered by the ResourceGroupsTagging API

* ECS: list_container_instances() now supports the status-parameter

* Logs: describe_queries() now returns a correctly formatted createTime, enabling support for the Go SDK

* S3: now supports underscores in object metadata keys

* S3: get_object_attributes() now returns the LastModified-attribute in the correct format

* S3: upload_part() now no longer hangs when using ThreadedMotoServer in conjunction with @mock_aws (regression from 5.2.4)

* S3Vectors: create_index() and create_vector_bucket() now support the tag-parameter

* StepFunctions: create_state_machine() now supports the type-parameter

* SQS: send_message_batch() now returns a correctly-formatted 'Failed'-attribute (if appropriate)

* SWF: describe_workflow_execution() and get_workflow_execution_history() now have basic parameter validation

Commits

• 57b3772 Pre-Release: Up Version Number
• ae5c31d Prep release 5.2.5 (#10430)
• db82cbc Make strict adherence to AWS SQS purge queue behaviour optional (#10409)
• d42f047 CloudFormation: allow GetTemplateSummary without AWSTemplateFormatVersion (#1...
• f0a2584 CloudFormation: return LastUpdatedTimestamp in ListStackResources (#10424)
• 96a7b09 StepFunctions: store and return the state machine type (#10405)
• 95cecea aws - connect - add resource groups tagging api support via TaggableResources...
• a42ca27 Wait for the Windows proxy before running its test suite (#10423)
• b26ffd3 Cognito IDP: serve the OpenID Connect discovery document (#10377)
• ec8074c Core: add a dedicated service-model router (#10421)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7e023fde-6973-4740-b6c1-8582199012f7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn