github aws-powertools/powertools-lambda-python v3.35.0
on GitHub

4 hours ago

Summary

This release includes an important security improvement for Data Masking and a significant cold start optimization for Parser.

We are happy to welcome six new contributors in this release: @Adityaj0, @manshahH, @ErezMizrahi, @wuodar, @MohammedAlkindi, and @TanbirRamim. Thank you for taking the time to report problems, work through reviews, and improve the prokject.

Data Masking now fails closed

Previously, an error while applying a masking rule could emit a warning and return the original value unchanged. Since callers received a normal return value, they could continue logging or storing data believing that masking had succeeded.

Data Masking now raises DataMaskingError when a masking provider fails, a masking path is invalid, or a regular expression cannot be compiled. Existing Data Masking exceptions now inherit from this common base exception. 

from aws_lambda_powertools.utilities.data_masking import DataMasking
from aws_lambda_powertools.utilities.data_masking.exceptions import DataMaskingError

data_masker = DataMasking()

try:
    masked = data_masker.erase(
        {"customer": {"email": "customer@example.com"}},
        masking_rules={"customer.email": {"regex_pattern": "[", "mask_format": "*"}},
    )
except DataMaskingError:
    # Stop processing the payload when masking cannot be completed.
    raise

Missing fields continue to follow the existing raise_on_missing_field setting. With its default value, a missing field raises DataMaskingFieldNotFoundError; when explicitly disabled, Data Masking emits a warning and continues.

See #8446 for the complete change.

Faster Parser imports

Importing parse or event_parser previously loaded all 16 Parser envelope modules, even when the application did not use an envelope.

Envelopes and BaseEnvelope are now loaded only when first accessed. Existing public imports continue to work, so no application changes are required.

In the Lambda benchmark contributed in #8405, this reduced INIT_DURATION by approximately 900ms on arm64 with Python 3.13 and 1024MB of memory. The exact improvement depends on the function and packaging configuration.

Thank you @ErezMizrahi for finding this and working through the compatibility details with us.

Changes

  • fix(metrics): stop spurious overwrite warnings from set_default_dimensions (#8403) by @vishwakt
  • chore(feature_flags): warn on empty schema and empty rules (#8430) by @dreamorosi
  • fix(event_handler): match generic alias response models in OpenAPI schema (#8453) by @TanbirRamim
  • fix(feature_flags): handle same-hour midnight rollover and reject malformed HH:MM (#8428) by @dreamorosi
  • test(shared): compare abs_lambda_path against a normalised path (#8457) by @MohammedAlkindi
  • fix(parameters): honor auto transform in batched get_parameters_by_name (#8436) by @MohammedAlkindi
  • fix(streaming): _S3SeekableIO.next/iter don't advance self._position, corrupting subsequent seek()/read() (#8389) by @Adityaj0
  • fix(event_handler): isolate local ASGI request state (#8452) by @wuodar
  • perf(parser): lazy-load envelopes to reduce Lambda cold start latency by ~900ms (#8405) by @ErezMizrahi
  • fix(data-classes): normalize authorizer ALL verb (#8445) by @leandrodamascena
  • fix(data-masking): fail closed on masking errors (#8446) by @leandrodamascena
  • chore(ci): retire Python 3.9 layer automation (#8439) by @dreamorosi
  • chore(ci): mirror commercial layer visibility (#8422) by @dreamorosi
  • chore(ci): add partition layer balancer (#8419) by @dreamorosi
  • chore(ci): omit null layer metadata fields (#8416) by @dreamorosi
  • fix(idempotency): Redis persistence layer reclaims live in-progress records as orphans, allowing concurrent double-execution (#8387) by @Adityaj0
  • refactor(typing): use PEP 604 syntax for Optional annotations (UP045) (#8399) by @manshahH
  • fix(idempotency): is_missing_idempotency_key iterates dict keys instead of values (#8391) by @Adityaj0

📜 Documentation updates

🔧 Maintenance

This release was made possible by the following contributors:

@Adityaj0, @amin-farjadi, @dreamorosi, @ErezMizrahi, @leandrodamascena, @manshahH, @MohammedAlkindi, @TanbirRamim, @vishwakt, @wuodar, @dependabot[bot], Amin Farjadi, @claude, emizrahi and @ericbn

Check out latest releases or
releases around aws-powertools/powertools-lambda-python v3.35.0

Don't miss a new powertools-lambda-python release

NewReleases is sending notifications on new releases.

Get notifications