aws-powertools/powertools-lambda-python v3.40.0

on GitHub

Summary

Sixteen bug fixes across Data Masking, Batch, Idempotency, Kafka, Parser, Event Handler, Feature Flags and Data Classes, Amazon Connect Outbound Campaigns as a new event source, and an Agent Skill so coding assistants build Lambda functions with Powertools the way the docs describe.

One week after 3.39.0 and the community is still carrying the release: fifteen community PRs from eight people. Welcome to our four new contributors: @anishmehta24, @soujasK, @thebadalov and @Goldloli. Thanks to @ASHMEET555, @alphasafal, @azmi2409 and @ShussMiao for coming back, and to @LemonCondor, @Manishram-ai, @AtulJoshi1206 and @ibrhmyi for the reports.

Reminder: we stop supporting Python 3.10 on February 1, 2027. Details in #8735.

Data Masking: fail closed

After a report that a payload referencing the same object twice came back with the second copy unmasked, we went through erase() end to end. Every case where it returned something the docs say it masks is fixed: repeated objects and __slots__, Pydantic SecretStr/SecretBytes and UUID/datetime/Decimal fields, masking_rules on a JSON string or pointing at a dict or list, fields and masking_rules passed together (now DataMaskingError), Enum values, and every AWS Encryption SDK error on decrypt surfacing as DataMaskingDecryptValueError.

Behaviour change, on purpose. A regex_pattern + mask_format rule whose pattern does not match now masks the whole value. Before, the value came back untouched. A field under a rule is sensitive; returning it in clear because it had an unexpected shape is a leak, not a contract. If you relied on non-matching text passing through, check the match before calling erase. Thank you @LemonCondor.

New

• Amazon Connect Outbound Campaigns: ConnectOutboundCampaignsEvent in Data Classes and ConnectOutboundCampaignsEventModel in Parser. Declare CustomerData as Json[YourModel] to have it decoded and validated. Thank you @ASHMEET555.
• Agent Skill: the docs ship as a skill in .agents/skills/, a SKILL.md plus one reference per utility generated from the docs, so an assistant writes the same code the docs show. Install instructions in the README.

Fixes

• Batch: a record whose model conversion raises something Pydantic does not wrap in ValidationError is reported, not the whole batch; SqsFifoPartialProcessor does the same for short-circuited records. Thank you @soujasK.
• Idempotency: falsy responses (0, False, "", [], {}) are replayed instead of None; the Redis layer keeps the payload hash on completion. Thank you @thebadalov.
• Kafka: Confluent Protobuf message indexes decode as zigzag varints (@alphasafal); an empty string key stays "" (@ASHMEET555).
• Parser: CloudWatchLogsEnvelope accepts plain text lines with model=str (@azmi2409). VpcLatticeV2Model types headers and query strings as dict[str, list[str]], the shape the service sends; hand-written events with plain strings no longer validate. VPCLatticeV2Resolver with validation handles the list-valued Content-Type. Reported by @Manishram-ai and @AtulJoshi1206.
• Event Handler: SameSite.DEFAULT_MODE leaves the attribute out; compressed routes send Vary: Accept-Encoding.
• Feature Flags: SCHEDULE_BETWEEN_DAYS_OF_WEEK matches by weekday index, so it works with any LC_TIME.
• Data Classes: SQSMessageAttribute returns None for the value the type does not carry; TransferFamilyAuthorizer.password is None without a password; AppSyncResolverEvent.identity returns AppSyncIdentityLambda for AWS_LAMBDA authorization (@Goldloli, @ShussMiao, @ibrhmyi).

Five of those were reported and fixed by @anishmehta24 in two days. Thank you.

Changes

• fix(batch): report short-circuited FIFO records that don't match the model (#8663) by @soujasK
• fix(batch): report records that fail model conversion with non-validation errors (#8662) by @soujasK
• fix(data_classes): return None from TransferFamilyAuthorizer.password when the event has none (#8715) by @anishmehta24
• fix(data_classes): return None for the SQS attribute value an attribute does not carry (#8713) by @anishmehta24
• fix(event_handler): add Vary: Accept-Encoding to responses of compressed routes (#8711) by @anishmehta24
• fix(event_handler): leave SameSite out of cookies in DEFAULT_MODE (#8709) by @anishmehta24
• fix(feature_flags): match days of week regardless of locale (#8707) by @anishmehta24
• fix(idempotency): return stored falsy responses on replay (#8701) by @thebadalov
• fix(parser): fall back to Python validation for non-JSON string payloads (#8699) by @azmi2409
• fix(kafka): deserialize empty string record key instead of returning None (#8698) by @ASHMEET555
• fix(kafka): decode Confluent Protobuf message indexes as zigzag varints (#8670) by @alphasafal
• fix(idempotency): keep the payload hash when completing records in the Redis layer (#8656) by @thebadalov

🌟New features and non-breaking changes

• feat(event_sources): add support for Amazon Connect Outbound Campaigns (#8702) by @ASHMEET555

📜 Documentation updates

• fix(data_masking): mask what the docs promise in the edge cases of erase (#8781) by @leandrodamascena
• chore(docs): regenerate the agent skill references (#8775) by @leandrodamascena
• feat(docs): ship an Agent Skill for building Lambda functions with Powertools (#8745) by @leandrodamascena
• docs: explain how Logger, Metrics and Tracer telemetry shows up in CloudWatch Omni (#8693) by @leandrodamascena
• docs: exclude tooling files from the published docs site (#8770) by @dreamorosi
• feat(event_sources): add support for Amazon Connect Outbound Campaigns (#8702) by @ASHMEET555
• fix(data_classes): add AppSyncIdentityLambda for AWS_LAMBDA authorization (#8720) by @Goldloli
• docs(data_classes): correct AppSync identity docstring for OPENID_CONNECT and pin the dispatch (#8705) by @ShussMiao

🐛 Bug and hot fixes

• fix(parser,event_handler): accept the list values VPC Lattice V2 sends in headers and query strings (#8793) by @leandrodamascena

🔧 Maintenance

• chore(deps): bump pydantic, valkey-glide, fastjsonschema, pip, ruff, zensical, aws-cdk and upload-sarif (#8792) by @leandrodamascena
• chore(docs): regenerate the agent skill references (#8775) by @leandrodamascena
• feat(docs): ship an Agent Skill for building Lambda functions with Powertools (#8745) by @leandrodamascena

This release was made possible by the following contributors:

@alphasafal, @anishmehta24, @ASHMEET555, @azmi2409, @dreamorosi, @Goldloli, @leandrodamascena, @ShussMiao, @soujasK, @thebadalov and @dependabot[bot]