Skip to content

fix(deps): update middy-js monorepo to v7 - #40

Open
renovate[bot] wants to merge 1 commit into
devfrom
renovate/major-middy-js-monorepo
Open

fix(deps): update middy-js monorepo to v7#40
renovate[bot] wants to merge 1 commit into
devfrom
renovate/major-middy-js-monorepo

Conversation

@renovate

@renovate renovate Bot commented Feb 12, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@middy/core (source) 3.6.2 → 7.7.2 age confidence
@middy/http-json-body-parser (source) 3.6.2 → 7.7.2 age confidence

Release Notes

middyjs/middy (@​middy/core)

v7.7.2

Compare Source

  • fix release process

Full Changelog: middyjs/middy@7.7.1...7.7.2

v7.7.0

Compare Source

What's Changed

  • Update @aws/durable-execution-sdk-js to v2 - May cause Type breaking change
  • Update core to use new SDK for improved executionMode detection

Security hardening

  • http-response-serializer — caps media-type length at 128 chars and validates against a media-type grammar before reflecting into Content-Type. Stops ReDoS via attacker-supplied media types and prevents echoing untrusted input.

Bug fixes / edge cases

  • Added missing defaults, plus small fixes across http-header-normalizer, http-multipart-body-parser, glue-schema-registry, validator, http-content-negotiation, event-batch-response, http-x402.

Performance

  • core/index.js reworked across standard/durable/streamify execution modes.

Tooling / CI (not user-facing)

  • Biome → 2.5.0 + config migration; fuzz-test fixes (event-normalizer); mutation-coverage improvements; provenance-attestation source fix.

Docs

  • WAF alternative note; typo fixes.
  • Deps: bump github/codeql-action 4.35.5 → 4.36.0 (#​1656)

Full Changelog: middyjs/middy@7.6.8...7.7.0

v7.6.8

Compare Source

What's Changed

  • chore(deps): bump github/codeql-action from 4.35.5 to 4.36.0 in the everything group by @​dependabot[bot] in #​1656

Security hardening

  • http-response-serializer — caps media-type length at 128 chars and validates against a media-type grammar before reflecting into Content-Type. Stops ReDoS via attacker-supplied media types and prevents echoing

Bug fixes / edge cases

  • fix: add in missing defaults, plus small fixes across http-header-normalizer, http-multipart-body-parser, glue-schema-registry, validator, http-content-negotiation, event-batch-response, http-x402.

Performance

  • core/index.js reworked (~73 lines) across the standard/durable/streamify execution modes, plus two perf commits (fix: perf optimization, fix: small perf boost).

Tooling / CI (not user-facing)

  • Biome bumped to 2.5.0 + config migration (the lint fix from earlier in our session — preset: "recommended", SVG/proto/test overrides).
  • Fuzz-test fixes (event-normalizer), mutation-coverage improvements, provenance-attestation source fix.

Docs

  • Added a WAF alternative note; typo fixes.

Full Changelog: middyjs/middy@7.6.7...7.6.8

v7.6.7

Compare Source

What's Changed

Full Changelog: middyjs/middy@7.6.6...7.6.7

v7.6.6

Compare Source

What's Changed

Full Changelog: middyjs/middy@7.6.5...7.6.6

v7.6.5

Compare Source

What's Changed

  • @​middy/input-output-logger — refactored buildContext for durable execution mode; same behavior, cleaner branching (no functional change).
  • Website: svelte rendering fix for router doc pages, minor CSS.

Full Changelog: middyjs/middy@7.6.4...7.6.5

v7.6.4

Compare Source

What's Changed

  • fix: sqs encoding (c60e774) — event-batch-parser: SQS body decoding fixes + test coverage
  • feat: perf improvements (5a4ff11) — broad perf pass across ~30+ middlewares. Added .perf.js benchmarks for many packages. Also touched util/index.d.ts type defs.
  • feat: improve pref (6a6a4ca) — http-router perf rewrite with new bench + 201 lines of new tests.
  • Several ci: fix sec issues/concerns commits
  • test: speed up fuzz times
  • chore(deps): bump cloudflare/wrangler-action 3.15.0 → 4.0.0

Net: one SQS bug fix and a large performance pass touching most middlewares (with new bench files and tests), plus router perf improvements. No breaking API changes evident from the diff stats.

Full Changelog: middyjs/middy@7.6.3...7.6.4

v7.6.3

Compare Source

What's Changed

  • Improve core perf for stream responses

Full Changelog: middyjs/middy@7.6.2...7.6.3

v7.6.2

Compare Source

What's Changed

  • [bug] http-content-encoding ignores encoder options for string/buffer responses #​1641

Full Changelog: middyjs/middy@7.6.1...7.6.2

v7.6.1

Compare Source

What's Changed

  • chore(deps): bump KineticCafe/actions-dco from 2.1.1 to 3.0.0 by @​dependabot[bot] in #​1637
  • update http-jwt to support multiple issuers, cognito support

Breaking changes (but no one is using packages yet)

@​middy/http-jwt

@​middy/http-paseto

  • Renamed cookieName → tokenCookieName.

Features

@​middy/http-jwt

  • New issuers option for multi-issuer JWKS verification: { [iss]: { jwksUri, audience?, algorithm? } }, with built-in caching, cooldown, and prefetch (cacheExpiry, cooldownDuration, disablePrefetch).
  • New token sources: tokenHeaderName, tokenQueryStringName (alongside tokenCookieName). Default is still Authorization: Bearer.
  • algorithm now accepts a string or array of strings; pinned at factory time to prevent alg-substitution attacks.
  • Expanded KMS keySpec compatibility table (now covers RS*/PS* for RSA, ES* for EC, EdDSA for Ed25519). Configured algorithm is validated against the keySpec and verification fails closed on mismatch.
  • New setToContext option to expose the verified payload on request.context (default false, internal-only).

@​middy/http-paseto

  • New tokenHeaderName and tokenQueryStringName sources.
  • New setToContext option (default false).

Full Changelog: middyjs/middy@7.6.0...7.6.1

v7.6.0

Compare Source

What's Changed

  • New Middleware: appconfig-extension by @​willfarrell in #​1270

  • New Middleware: ssm-extension by @​willfarrell in #​1270

  • New Middleware: secrets-manager-extension by @​willfarrell in #​1270

  • New Middleware: event-batch-parser by @​willfarrell in #​1627

  • New Middleware: event-batch-response by @​willfarrell in #​1627

  • New Middleware: event-batch-handler by @​willfarrell in #​1627

  • New Middleware: glue-schema-registry by @​willfarrell in #​1627

  • New Middleware: http-x402 by @​willfarrell in #​1633

  • New Middleware: http-jwt by @​willfarrell

  • New Middleware: http-paseto by @​willfarrell

  • New Middleware: kms by @​willfarrell

  • Update dsql to follow rds pattern, dsql-signer` required.

  • cloudformation-router — Narrowed Route.requestType from string to the union "Create" | "Update" | "Delete", matching the actual CloudFormation event types. Added type tests verifying the three valid values are accepted and invalid strings (including wrong casing like "create") are rejected.

  • cloudwatch-metrics — Added maxProperties: 30 to the dimension set JSON schema validation, enforcing CloudWatch's limit of 30 dimensions per metric.

  • event-normalizer — Added a new maxDecompressedBytes option (default 10 MiB) to guard against decompression bombs when parsing CloudWatch Logs events. The gunzipSync call for aws:cloudwatch events now passes maxOutputLength, and payloads exceeding the cap throw ERR_BUFFER_TOO_LARGE. Includes a test that confirms a 1 MiB gzipped payload fails against a 1 KiB cap.

  • error-logger — Exported the Options type and added type tests verifying that the logger callback receives a middy.Request and that the logger property is optional.

Full Changelog: middyjs/middy@7.5.0...7.6.0

v7.5.0

Compare Source

What's Changed

Full Changelog: middyjs/middy@7.4.0...7.5.0

v7.4.0

Compare Source

What's Changed
  • dsql-signer new middleware!
  • rds-signer to be aligned with dsql-signer, fetchData options can now default to PG* and DB* where they were required before.

Full Changelog: middyjs/middy@7.3.4...7.4.0

v7.3.4

Compare Source

What's Changed
  • event-normalizer: add in missing gunzip for CloudWatch events
  • core: export executionMode* to to be consistent with others

Full Changelog: middyjs/middy@7.3.3...7.3.4

v7.3.3

Compare Source

What's Changed

  • ajv security update

Full Changelog: middyjs/middy@7.3.2...7.3.3

v7.3.2

Compare Source

What's Changed

  • Improve duplicate route detection in option validate for http-router

Full Changelog: middyjs/middy@7.3.1...7.3.2

v7.3.1

Compare Source

What's Changed

  • Improve option validation to be more robust

Full Changelog: middyjs/middy@7.3.0...7.3.1

v7.3.0

Compare Source

What's Changed
  • Add in {name}ValideOptions to all packages to allow for easy testing or runtime checks on options
  • Removed package.json export requires that were left over cjs deprecation
  • Security and test improvements
  • chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by @​dependabot[bot] in #​1619
  • chore(deps): bump cloudflare/wrangler-action from 3.14.1 to 3.15.0 by @​dependabot[bot] in #​1618
  • chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @​dependabot[bot] in #​1617
  • chore(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0 by @​dependabot[bot] in #​1616

Full Changelog: middyjs/middy@7.2.3...7.3.0

v7.2.3

Compare Source

What's Changed

Full Changelog: middyjs/middy@7.2.2...7.2.3

v7.2.2

Compare Source

What's Changed

Full Changelog: middyjs/middy@7.2.1...7.2.2

v7.2.1

Compare Source

What changed

Full Changelog: middyjs/middy@7.2.0...7.2.1

v7.2.0

Compare Source

What's Changed

  • event-normalizer: add support for rmq

Full Changelog: middyjs/middy@7.1.8...7.2.0

v7.1.8

Compare Source

What's Changed

  • fix appconfig: crash when Configuration absent in GetLatestConfiguration response (SDK >= 3.929.0) #​1600

Full Changelog: middyjs/middy@7.1.7...7.1.8

v7.1.7

Compare Source

What's Changed
  • @​middy/secrets-manager: Fixed crash when LastRotationDate or LastChangedDate is undefined during rotation-date-based cache expiry calculation. Previously, Math.max(undefined, ...) would produce NaN, breaking the cache logic. Now defaults to 0 when either date is missing.
  • @​middy/cloudformation-response: Auto-populate PhysicalResourceId from context.logStreamName when not explicitly set. This prevents CloudFormation custom resource responses from failing due to a missing required field.
  • @​middy/core (types): Widened the TErr generic in UseFn from Error to any, allowing middleware that uses custom error types to be passed to .use() without type errors.

Full Changelog: middyjs/middy@7.1.6...7.1.7

v7.1.6

Compare Source

What's Changed

Full Changelog: middyjs/middy@7.1.5...7.1.6

v7.1.5

Compare Source

What's Changed
  • httpResponseSerializer generates type error in Middy 7.1.4 #​1590
  • (http-event-normalizer): API Gateway Event v2 is not accepted #​1589
  • chore: update type test setup by @​mrazauskas in #​1588

Full Changelog: middyjs/middy@7.1.4...7.1.5

v7.1.4

Compare Source

What's Changed
  • 7.1.3 introduced type error "Argument not assignable to parameter of type Context" #​1585
  • chore(deps): bump github/codeql-action from 4.32.4 to 4.32.6 by @​dependabot[bot] in #​1582
  • chore(deps): bump actions/setup-node from 6.2.0 to 6.3.0 by @​dependabot[bot] in #​1583
  • chore(deps): bump aquasecurity/trivy-action from 0.34.1 to 0.34.2 by @​dependabot[bot] in #​1584

Full Changelog: middyjs/middy@7.1.3...7.1.4

v7.1.3

Compare Source

What's Changed
  • validator: Fix type definition regression (#​1580)
  • http-multipart-body-parser, http-urlencode-body-parser, http-urlencode-path-parser,
    http-security-headers: Fix HTTP status code handling in type definitions and runtime
  • Performance improvements across core and multiple middleware packages (core, event-normalizer,
    http-content-encoding, http-cors, http-error-handler, http-header-normalizer, http-security-headers,
    input-output-logger, secrets-manager, ssm, util, and others)
  • Add missing type definitions for http-content-negotiation, service-discovery, sts, secrets-manager,
    ws-router
  • Improve type definitions across core, cloudformation-router, http-router, http-event-normalizer,
    s3-object-response, sqs-partial-batch-failure, warmup, error-logger, and others
  • Simplify s3-object-response type definitions
  • Add comprehensive type tests across all packages

Full Changelog: middyjs/middy@7.1.2...7.1.3

v7.1.2

Compare Source

What's Changed
  • Add charset option to http-multipart-body-parser and http-urlencode-body-parser for consistency
    across body parsers
  • Improve type definitions for validator, validator/transpile, secrets-manager, service-discovery,
    sts
  • Add jsonSafeParse and jsonSafeStringify types to util
  • Add more test coverage across packages (100%)

Full Changelog: middyjs/middy@7.1.1...7.1.2

v7.1.1

Compare Source

What's Changed
  • http-cors add in punycode support
  • export options in ts defs

Full Changelog: middyjs/middy@7.1.0...7.1.1

v7.1.0

Compare Source

What's Changed
  • Add ReadableStream support to http-content-encoding by @​willfarrell in #​1333
  • http-cors: allow Access-Control-Request-Method to be used @​mdesousa #​1315
  • security improvements (edge cases)
  • improve test coverage (>99%)

Full Changelog: middyjs/middy@7.0.3...7.1.0

v7.0.3

Compare Source

What's Changed
New Contributors

Full Changelog: middyjs/middy@7.0.2...7.0.3

v7.0.2

Compare Source

  • Add in workaround for bundlers that don't honour sideEffects:false. #​1548

Full Changelog: middyjs/middy@7.0.1...7.0.2

v7.0.1

Compare Source

What's Changed

Full Changelog: middyjs/middy@7.0.0...7.0.1

v7.0.0

Compare Source

For full details and upgrade guide see https://middy.js.org/docs/upgrade/6-7

Notable changes
  • Deprecate Node.js v20.x.
  • Add support for Node.js v24.x.
  • Add support for Durable Functions, caused breaking changes to streamifyResponse.
  • LLRT can now be used when using executionModeStandard (default) & executionModeDurableContext
  • Works with new Tenant isolation mode
  • Works with new multi-concurrency on Lambda Managed Instances
What's Changed

Full Changelog: middyjs/middy@6.4.5...7.0.0

v6.4.5

Compare Source

What's Changed
New Contributors

Full Changelog: middyjs/middy@6.4.4...6.4.5

v6.4.4

Compare Source

What's Changed

Full Changelog: middyjs/middy@6.4.3...6.4.4

v6.4.3

Compare Source

What's changed

Full Changelog: middyjs/middy@6.4.2...6.4.3

v6.4.2

Compare Source

What's Changed
New Contributors

Full Changelog: middyjs/middy@6.4.1...6.4.2

v6.4.1

Compare Source

What's Changed

Full Changelog: middyjs/middy@6.4.0...6.4.1

v6.4.0

Compare Source

What's Changed

Full Changelog: middyjs/middy@6.3.2...6.4.0

v6.3.2

Compare Source

What's Changed
New Contributors

Full Changelog: middyjs/middy@6.3.1...6.3.2

v6.3.1

Compare Source

What's Changed

Full Changelog: middyjs/middy@6.3.0...6.3.1

v6.3.0

Compare Source

What's Changed
New Contributors

Full Changelog: middyjs/middy@6.2.4...6.3.0

v6.2.4

Compare Source

What's Changed
  • httpMultipartBodyParser - disableContentTypeError behavior possibly changed unintentionally in v6.1.0 #​1328

Full Changelog: middyjs/middy@6.2.3...6.2.4

v6.2.3

Compare Source

What's Changed

Full Changelog: middyjs/middy@6.2.2...6.2.3

v6.2.2

Compare Source

What's Changed
New Contributors

Full Changelog: middyjs/middy@6.2.1...6.2.2

v6.2.1

Compare Source

What's Changed

Full Changelog: middyjs/middy@6.2.0...6.2.1

v6.2.0

Compare Source

What's Changed
New Contributors

Full Changelog: middyjs/middy@6.1.6...6.2.0

v6.1.6

Compare Source

What's Changed
New Contributors

Full Changelog: middyjs/middy@6.1.5...6.1.6

v6.1.5

Compare Source

What's Changed
  • fix(http-json-body-parser): allow "undefined" body if disableContentTypeError:true by @​apalchys in #​1285

Full Changelog: middyjs/middy@6.1.4...6.1.5

v6.1.4

Compare Source

What's Changed
New Contributors

Full Changelog: middyjs/middy@6.1.3...6.1.4

v6.1.3

Compare Source

What's Changed
  • fix: add TypeScript type definition for request.earlyResponse by @​iiroj in #​1277
New Contributors

Full Changelog: middyjs/middy@6.1.2...6.1.3

v6.1.2

Compare Source

What's Changed
  • fix NPM is missing 6.1.x versions #​1276

Full Changelog: middyjs/middy@6.1.1...6.1.2

v6.1.1

Compare Source

What's Changed

Full Changelog: middyjs/middy@6.1.0...6.1.1

v6.0.0

Compare Source

For full details and upgrade guide see https://middy.js.org/docs/upgrade/5-6

Notable changes
  • Deprecate Node.js v18.x.
  • Add support for Node.js v22.x.
  • Add support for --experimental-require-module
What's Changed

Thanks to @​ehmicky for contributing to this release.

Full Changelog: middyjs/middy@5.5.1...6.0.0

v5.5.1

Compare Source

What's Changed

Full Changelog: middyjs/middy@5.5.0...5.5.1

v5.5.0

Compare Source

What's Changed
  • Add in notFoundResponse override to ws-router and http-router to allow returning a custom response. @​willfarrell

Full Changelog: middyjs/middy@5.4.7...5.5.0

v5.4.7

Compare Source

What's Changed
New Contributors

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team February 12, 2024 21:22
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch from c3b43c2 to 57ffe72 Compare February 21, 2024 16:30
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch from 57ffe72 to b813311 Compare March 2, 2024 03:33
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch 3 times, most recently from 33893c3 to b05e568 Compare March 16, 2024 22:17
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch 2 times, most recently from ae613b8 to 259a7a7 Compare May 11, 2024 01:38
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch from 259a7a7 to 83c5b0d Compare May 16, 2024 19:32
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch from 83c5b0d to 439c84f Compare June 3, 2024 23:34
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch 2 times, most recently from fe7d4b8 to 8414673 Compare June 24, 2024 13:06
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch from 8414673 to a32cfac Compare July 2, 2024 22:19
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch 2 times, most recently from 30ae274 to 71de0db Compare July 13, 2024 21:09
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch from 71de0db to 443316f Compare August 11, 2024 15:06
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch from 443316f to 1706875 Compare September 1, 2024 15:55
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch from 1706875 to c26ac14 Compare September 17, 2024 02:14
@namanaman
namanaman removed the request for review from a team September 17, 2024 14:15
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch from c26ac14 to 153d0ac Compare October 16, 2024 18:42
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch from 153d0ac to 8982ddf Compare November 24, 2024 03:33
@renovate renovate Bot changed the title fix(deps): update middy-js monorepo to v5 (major) fix(deps): update middy-js monorepo to v6 (major) Nov 24, 2024
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch 5 times, most recently from e13114e to 830017b Compare March 4, 2025 02:09
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch from 830017b to 431a084 Compare March 20, 2025 03:31
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch 2 times, most recently from 206b85e to 2089d19 Compare May 2, 2025 01:53
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch 2 times, most recently from 928b0ec to ff98946 Compare August 20, 2025 13:59
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch 4 times, most recently from 3615d09 to be45bf5 Compare August 31, 2025 12:33
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch from be45bf5 to 0701d96 Compare September 9, 2025 01:30
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch from 0701d96 to b4be6c5 Compare September 25, 2025 14:11
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch from b4be6c5 to 42c5cd6 Compare October 21, 2025 21:39
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch from 42c5cd6 to 4e9efb8 Compare November 10, 2025 19:03
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch from 4e9efb8 to 08272b7 Compare November 18, 2025 18:33
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch from 08272b7 to 1db6c3b Compare November 27, 2025 18:53
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch from 1db6c3b to 107b93d Compare January 8, 2026 05:39
@renovate renovate Bot changed the title fix(deps): update middy-js monorepo to v6 (major) fix(deps): update middy-js monorepo to v7 (major) Jan 8, 2026
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch 2 times, most recently from 0729de7 to fc1a3d7 Compare January 9, 2026 05:25
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch 4 times, most recently from 55dce67 to 5469331 Compare February 27, 2026 18:32
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch from 5469331 to 71292da Compare March 6, 2026 21:34
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch 4 times, most recently from a62d260 to 4550e4f Compare March 18, 2026 21:17
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch 2 times, most recently from 7aa8866 to d313fe5 Compare March 22, 2026 01:12
@renovate
renovate Bot force-pushed the renovate/major-middy-js-monorepo branch 2 times, most recently from 93a6869 to d622fad Compare April 15, 2026 04:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants