Bump the npm group across 3 directories with 24 updates

[dependabot]

Bumps the npm group with 24 updates in the / directory:

Package	From	To
@aws-lambda-powertools/logger	2.35.0	2.36.0
@modelcontextprotocol/core	2.3.0	2.3.1
@modelcontextprotocol/server	2.3.0	2.3.1
oxfmt	0.71.0	0.72.0
@aws-lambda-powertools/commons	2.35.0	2.36.0
@oxfmt/binding-android-arm-eabi	0.71.0	0.72.0
@oxfmt/binding-android-arm64	0.71.0	0.72.0
@oxfmt/binding-darwin-arm64	0.71.0	0.72.0
@oxfmt/binding-darwin-x64	0.71.0	0.72.0
@oxfmt/binding-freebsd-x64	0.71.0	0.72.0
@oxfmt/binding-linux-arm-gnueabihf	0.71.0	0.72.0
@oxfmt/binding-linux-arm-musleabihf	0.71.0	0.72.0
@oxfmt/binding-linux-arm64-gnu	0.71.0	0.72.0
@oxfmt/binding-linux-arm64-musl	0.71.0	0.72.0
@oxfmt/binding-linux-ppc64-gnu	0.71.0	0.72.0
@oxfmt/binding-linux-riscv64-gnu	0.71.0	0.72.0
@oxfmt/binding-linux-riscv64-musl	0.71.0	0.72.0
@oxfmt/binding-linux-s390x-gnu	0.71.0	0.72.0
@oxfmt/binding-linux-x64-gnu	0.71.0	0.72.0
@oxfmt/binding-linux-x64-musl	0.71.0	0.72.0
@oxfmt/binding-openharmony-arm64	0.71.0	0.72.0
@oxfmt/binding-win32-arm64-msvc	0.71.0	0.72.0
@oxfmt/binding-win32-ia32-msvc	0.71.0	0.72.0
@oxfmt/binding-win32-x64-msvc	0.71.0	0.72.0

Bumps the npm group with 24 updates in the /example directory:

Package	From	To
@aws-lambda-powertools/logger	2.35.0	2.36.0
@modelcontextprotocol/core	2.3.0	2.3.1
@modelcontextprotocol/server	2.3.0	2.3.1
oxfmt	0.71.0	0.72.0
@aws-lambda-powertools/commons	2.35.0	2.36.0
@oxfmt/binding-android-arm-eabi	0.71.0	0.72.0
@oxfmt/binding-android-arm64	0.71.0	0.72.0
@oxfmt/binding-darwin-arm64	0.71.0	0.72.0
@oxfmt/binding-darwin-x64	0.71.0	0.72.0
@oxfmt/binding-freebsd-x64	0.71.0	0.72.0
@oxfmt/binding-linux-arm-gnueabihf	0.71.0	0.72.0
@oxfmt/binding-linux-arm-musleabihf	0.71.0	0.72.0
@oxfmt/binding-linux-arm64-gnu	0.71.0	0.72.0
@oxfmt/binding-linux-arm64-musl	0.71.0	0.72.0
@oxfmt/binding-linux-ppc64-gnu	0.71.0	0.72.0
@oxfmt/binding-linux-riscv64-gnu	0.71.0	0.72.0
@oxfmt/binding-linux-riscv64-musl	0.71.0	0.72.0
@oxfmt/binding-linux-s390x-gnu	0.71.0	0.72.0
@oxfmt/binding-linux-x64-gnu	0.71.0	0.72.0
@oxfmt/binding-linux-x64-musl	0.71.0	0.72.0
@oxfmt/binding-openharmony-arm64	0.71.0	0.72.0
@oxfmt/binding-win32-arm64-msvc	0.71.0	0.72.0
@oxfmt/binding-win32-ia32-msvc	0.71.0	0.72.0
@oxfmt/binding-win32-x64-msvc	0.71.0	0.72.0

Bumps the npm group with 24 updates in the /package directory:

Package	From	To
@aws-lambda-powertools/logger	2.35.0	2.36.0
@modelcontextprotocol/core	2.3.0	2.3.1
@modelcontextprotocol/server	2.3.0	2.3.1
oxfmt	0.71.0	0.72.0
@aws-lambda-powertools/commons	2.35.0	2.36.0
@oxfmt/binding-android-arm-eabi	0.71.0	0.72.0
@oxfmt/binding-android-arm64	0.71.0	0.72.0
@oxfmt/binding-darwin-arm64	0.71.0	0.72.0
@oxfmt/binding-darwin-x64	0.71.0	0.72.0
@oxfmt/binding-freebsd-x64	0.71.0	0.72.0
@oxfmt/binding-linux-arm-gnueabihf	0.71.0	0.72.0
@oxfmt/binding-linux-arm-musleabihf	0.71.0	0.72.0
@oxfmt/binding-linux-arm64-gnu	0.71.0	0.72.0
@oxfmt/binding-linux-arm64-musl	0.71.0	0.72.0
@oxfmt/binding-linux-ppc64-gnu	0.71.0	0.72.0
@oxfmt/binding-linux-riscv64-gnu	0.71.0	0.72.0
@oxfmt/binding-linux-riscv64-musl	0.71.0	0.72.0
@oxfmt/binding-linux-s390x-gnu	0.71.0	0.72.0
@oxfmt/binding-linux-x64-gnu	0.71.0	0.72.0
@oxfmt/binding-linux-x64-musl	0.71.0	0.72.0
@oxfmt/binding-openharmony-arm64	0.71.0	0.72.0
@oxfmt/binding-win32-arm64-msvc	0.71.0	0.72.0
@oxfmt/binding-win32-ia32-msvc	0.71.0	0.72.0
@oxfmt/binding-win32-x64-msvc	0.71.0	0.72.0

Updates @aws-lambda-powertools/logger from 2.35.0 to 2.36.0

Release notes

Sourced from @​aws-lambda-powertools/logger's releases.

v2.36.0

Summary

In this release, we've expanded the Lambda layer to include all 14 published Powertools packages. Data Masking, Signer, Kafka, and Validation are now available directly from the layer, making it easier to use these utilities without bundling the Powertools packages separately.

Important for Lambda layer users: We've changed how the layers are built and no longer include the AWS SDK for JavaScript v3 clients we previously bundled. We still recommend bundling the SDK packages your function needs so you control their versions. Your bundled SDK takes precedence; if you don't bundle one, Powertools falls back to the SDK provided by the Lambda Node.js runtime. Remove any build exclusions that assumed the Powertools layer supplied the SDK.

We've also made JSON-only Kafka consumers easier to bundle and added Parser support for WITH_METADATA deliveries from the new enhanced Custom Event Bus in Amazon EventBridge.

We've fixed Valkey-backed idempotency when using @valkey/valkey-glide. Previously, the persistence layer passed Redis-client write options that Glide ignored, so records and locks could be written without expiry or conditional-write protection. The persistence layer now passes the correct options, restoring the expected record expiry and protection against duplicate processing. If you use Valkey Glide, we recommend upgrading.

Other Idempotency fixes keep operations tied to the correct record when your handler modifies its input or multiple idempotent functions share a persistence instance, preventing stuck in-progress records and incorrect updates. The HTTP Event Handler also preserves binary response bodies and correctly handles responses with no body, so you can serve files or return 204 No Content without workarounds.

This release also includes several other bug fixes, minor improvements, and documentation updates, with the help of the community.

⭐ Congratulations to @​pttydou, @​vaibhav8a, @​sabaighani, @​vahidshaik1901, @​Provokke, @​victoriademina, @​proton0210, and @​karthiksenv for their first PRs merged in the project, and thanks to @​vishwakt for their many contributions to this release 🎉

More utilities in the Lambda layer

Docs

The Lambda layer now includes all 14 published Powertools packages. Data Masking, Signer, Kafka, and Validation were previously missing, so you can now use those utilities from the layer rather than bundling the Powertools packages separately.

The layer also no longer bundles AWS SDK v3 clients. This avoids mixing layer-provided clients with a different SDK version from the Lambda runtime, which could cause failures when using the DynamoDB DocumentClient.

EventBridge Custom Event Bus support

Docs

Parser now supports WITH_METADATA subscriber deliveries from the new enhanced Custom Event Bus in Amazon EventBridge, which is distinct from Custom Event Bus – Classic. Each delivered record contains the event in Data, optional custom metadata in Metadata, and delivery information in SystemMetadata, such as whether the event is live or replayed.

import { parse } from '@aws-lambda-powertools/parser';
import { EventBridgeWithMetadataEnvelope } from '@aws-lambda-powertools/parser/envelopes';
import { z } from 'zod';
const orderSchema = z.object({
orderId: z.string(),
amount: z.number(),
});
export const handler = async (event: unknown) => {
const orders = parse(event, EventBridgeWithMetadataEnvelope, orderSchema);
return orders;
};

Use EventBridgeWithMetadataRecordSchema or EventBridgeWithMetadataSchema when you need to retain the event and its metadata. The record schema also supports single-object deliveries.

Simpler Kafka bundles

... (truncated)

Changelog

Sourced from @​aws-lambda-powertools/logger's changelog.

2.36.0 (2026-10-06)

Improvements

• commons extract InvokeStore fallback into InvocationScoped (#5615) (e352cb0)
• tracer track fetch subsegments per request (#5746) (b75385f)
• idempotency make DynamoDB error check minification-resistant (#5775) (991fb88)
• event-handler simplify HTTP event parsing (#5686) (69b0b75)

Bug Fixes

• parameters include request options in cache key (#5623) (a02f7bc)
• idempotency pass cache SET options in the Valkey Glide shape (#5737) (3015a43)
• idempotency bind operations to their own key prefix on a shared store (#5708) (006a472)
• idempotency complete and delete the record acquired at operation start (#5717) (daa6e7c)
• idempotency keep payload validation hash on cache record completion (#5706) (c0dac7a)
• idempotency retain cache locks without execution deadlines (#5680) (504e1cd)
• idempotency delete only acquired records in the Middy onError hook (#5676) (9267cb3)
• parser accept real Cognito trigger events from common flows (#5777) (c77facf)
• parser accept multi-value headers in VPC Lattice v2 events (#5773) (40fb84e)
• parser accept documented SES receipt event variants (#5772) (13257dd)
• parser keep PhysicalResourceId in CloudFormation events (#5767) (f9cce6a)
• parser keep transform errors as the ParseError cause (#5745) (b898ec4)
• parser keep Lambda authorizer context in the REST API event schema (#5749) (077d1f1)
• parser stop malformed base64 from escaping safeParse (#5666) (11a18a3)
• batch throw when a synchronous processor gets a promise-returning handler (#5650) (cb36243)
• batch populate response() before full batch throw and normalize non-Error throws (#5625) (f71fd53)
• event-handler honor Accept-Encoding q-values in compression (#5725) (881a1f4)
• event-handler handle empty proxy response bodies (#5701) (9f39aef)
• event-handler preserve binary Web Response bodies (#5700) (e093a3d)
• event-handler stop recursive HTTP error handler dispatch (#5703) (4fbfc3e)
• event-handler ignore body on GET/HEAD requests when converting to Web Request (#5683) (51bc98c)
• event-handler honour isBase64Encoded and binary bodies on proxy results (#5668) (e133a45)
• event-handler fail invocation on UnauthorizedException in onPublish (#5621) (8d496bb)
• event-handler handle +json content types and bodyless responses (#5570) (770ab06)
• kafka lazily import Avro and Protobuf codecs so JSON-only consumers bundle (#5578) (0b7521b)
• data-masking honor throwOnMissingField consistently and resolve paths before masking (#5630) (b93417d)

Features

• parser support EventBridge WITH_METADATA deliveries (#5776) (58f4bb2)

Maintenance

• signer bump the aws-sdk-v3 group across 1 directory with 54 updates (#5759) (a3ff940)
• signer bump the aws-sdk-v3 group across 1 directory with 33 updates (#5659) (1ba493c)
• signer bump the aws-sdk-v3 group across 1 directory with 54 updates (#5589) (abb5597)
• signer bump the aws-sdk-v3 group across 1 directory with 55 updates (#5571) (1e5fe1b)

Commits

• 0595159 chore(ci): bump version to 2.36.0 (#5791)
• 8008f4d chore(deps): apply available npm audit fixes (#5790)
• 7e8fb7e chore(deps-dev): bump @​types/node from 26.6.3 to 26.6.4 (#5785)
• a835ffd chore(deps-dev): bump @​redis/client from 6.2.1 to 6.3.0 (#5786)
• 04b94ae chore(deps-dev): bump @​biomejs/biome from 2.5.14 to 2.5.15 (#5782)
• 533248a test(batch): add Lambda Managed Instances isolation coverage (#5768)
• c77facf fix(parser): accept real Cognito trigger events from common flows (#5777)
• ad7b0b9 chore(deps-dev): bump @​aws/durable-execution-sdk-js from 2.4.0 to 2.6.0 (#5781)
• 923e4f7 docs(parser): fix schema names in built-in schemas table (#5784)
• e0e7475 chore(deps-dev): bump the vitest group across 1 directory with 2 updates (#5779)
• Additional commits viewable in compare view

Updates @modelcontextprotocol/core from 2.3.0 to 2.3.1

Commits

• fcef852 Version Packages (#2953)
• e8b7f05 docs: one opening note in the server and client package READMEs (#2955)
• 5a18673 feat(server-legacy): add expectedResource to requireBearerAuth (#2952)
• 3ab61c6 docs: update the README banners (#2940)
• 8aabbdc test(e2e): expect SdkHttpError after a second 401 from onUnauthorized (#2936)
• 33fecfb test(e2e): cover tools/call without arguments (#2933)
• 818f782 docs: state the principles in CLAUDE.md and shorten REVIEW.md (#2938)
• See full diff in compare view

Updates @modelcontextprotocol/server from 2.3.0 to 2.3.1

Release notes

Sourced from @​modelcontextprotocol/server's releases.

@​modelcontextprotocol/server-legacy@​2.3.1

Patch Changes

• #2952 5a18673 Thanks @​claude! - requireBearerAuth in @modelcontextprotocol/server-legacy takes the optional expectedResource that @modelcontextprotocol/server 2.3.0 and @modelcontextprotocol/sdk 1.32.0 added: the resource the token must be issued for (its audience), usually the server's URL. When it is set, a token is accepted only if the verifier reports that value in AuthInfo.resource; the two are compared as strings, ignoring a fragment and one trailing slash. A token reported for another value, or for none, is answered 401 invalid_token with the usual WWW-Authenticate challenge. When it is not set, nothing changes. The package stays frozen otherwise; this option is added so that its requireBearerAuth matches the 1.x middleware it is a copy of.

• Updated dependencies []:

  • @​modelcontextprotocol/core@​2.3.1

@​modelcontextprotocol/server@​2.3.1

Patch Changes

• Updated dependencies []:
  • @​modelcontextprotocol/core@​2.3.1

Commits

• fcef852 Version Packages (#2953)
• e8b7f05 docs: one opening note in the server and client package READMEs (#2955)
• 5a18673 feat(server-legacy): add expectedResource to requireBearerAuth (#2952)
• 3ab61c6 docs: update the README banners (#2940)
• 8aabbdc test(e2e): expect SdkHttpError after a second 401 from onUnauthorized (#2936)
• 33fecfb test(e2e): cover tools/call without arguments (#2933)
• 818f782 docs: state the principles in CLAUDE.md and shorten REVIEW.md (#2938)
• See full diff in compare view

Updates oxfmt from 0.71.0 to 0.72.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.72.0

💥 BREAKING CHANGES

• e2c68b1 oxfmt: [BREAKING] Format parser:markdown files by oxc_formatter_markdown (#27256) (leaysgur)

🚀 Features

• b538e3c formatter_css: Parse embedded CSS as a block's contents (#27284) (leaysgur)

🐛 Bug Fixes

• 71e400b formatter_markdown: Fixed remaining issues found by fuzz (#27334) (leaysgur)
• 7d0e54d formatter_markdown: Preserve line breaks around Chinese/Japanese characters in all proseWrap (#27331) (leaysgur)
• e9ae2d8 formatter_css: Fix layouts found in mdn-content repo (css-in-md) (#27326) (leaysgur)
• df85b4c oxfmt: Keep blank lines after a line break in Prettier Doc to IR (#27325) (leaysgur)
• 7f65b75 formatter: Format assignment target property as assignment-like (#27289) (leaysgur)
• 6c08f2a formatter_css: Apply the url() import exception to a lone comma group (#27288) (leaysgur)
• 1967302 formatter_css: Hug a spaced ident ( only at the at-rule prelude head (#27283) (leaysgur)
• 2445064 formatter_markdown: Keep a preserved line break before a delimiter row that opens no table (#27278) (leaysgur)
• dd72fbf formatter_markdown: Keep container columns as spaces under useTabs (#27277) (leaysgur)
• 1686018 oxfmt: Make one state conditionalGroup fit up to first hardline (#27275) (leaysgur)
• fd4ddce formatter_json: Flatten block comment only array|object (#27274) (leaysgur)
• 267557c formatter,oxfmt: Embed only original JSDoc plugin supported languages (#27241) (leaysgur)
• 2606c60 oxfmt: Do not re-include a file below an excluded directory with a negated pattern (#27237) (Nicolas Le Cam)
• c2de02b formatter: Decide embedded template layout from AST, not source shape (#27218) (leaysgur)
• c9e1224 formatter: Handle quoteProps: consistent for patterns and computed keys (#27216) (leaysgur)
• 36e14df formatter: Keep comments between callee and its opener on the callee side (#27172) (leaysgur)
• 6da7657 oxfmt: Render diagnostics with source in Stdin mode (#27130) (leaysgur)
• e9b2ec5 oxfmt/lsp: Reload .prettierignore on watched file change (#27129) (leaysgur)
• 30eb463 oxfmt: Check global ignores before resolving nested config in Stdin mode (#27128) (leaysgur)

⚡ Performance

• 72f42a3 formatter_markdown: Pre-allocate the IR buffer (#27333) (leaysgur)
• cea47e3 formatter_core: Avoid exponential will_break check on nested interned (#27211) (leaysgur)
• 0aba566 oxfmt: Do not resolve root js config from nested context (#27147) (leaysgur)

📚 Documentation

• 51506c6 formatter_css: Record divergences found in mdn-content (css-in-md) (#27327) (leaysgur)
• 656b81c formatter_markdown: Record unclosed fences closing at a directive's closer (#27279) (leaysgur)
• 66545bf formatter_markdown: Record setext heading wrap divergence (#27221) (leaysgur)
• af4b269 oxfmt: Document why format() API does not take cwd (#27131) (leaysgur)

Commits

• 2bd08eb release(apps): oxlint v1.87.0 && oxfmt v0.72.0 (#27341)
• See full diff in compare view

Updates @aws-lambda-powertools/commons from 2.35.0 to 2.36.0

Release notes

Sourced from @​aws-lambda-powertools/commons's releases.

v2.36.0

Summary

In this release, we've expanded the Lambda layer to include all 14 published Powertools packages. Data Masking, Signer, Kafka, and Validation are now available directly from the layer, making it easier to use these utilities without bundling the Powertools packages separately.

Important for Lambda layer users: We've changed how the layers are built and no longer include the AWS SDK for JavaScript v3 clients we previously bundled. We still recommend bundling the SDK packages your function needs so you control their versions. Your bundled SDK takes precedence; if you don't bundle one, Powertools falls back to the SDK provided by the Lambda Node.js runtime. Remove any build exclusions that assumed the Powertools layer supplied the SDK.

We've also made JSON-only Kafka consumers easier to bundle and added Parser support for WITH_METADATA deliveries from the new enhanced Custom Event Bus in Amazon EventBridge.

We've fixed Valkey-backed idempotency when using @valkey/valkey-glide. Previously, the persistence layer passed Redis-client write options that Glide ignored, so records and locks could be written without expiry or conditional-write protection. The persistence layer now passes the correct options, restoring the expected record expiry and protection against duplicate processing. If you use Valkey Glide, we recommend upgrading.

Other Idempotency fixes keep operations tied to the correct record when your handler modifies its input or multiple idempotent functions share a persistence instance, preventing stuck in-progress records and incorrect updates. The HTTP Event Handler also preserves binary response bodies and correctly handles responses with no body, so you can serve files or return 204 No Content without workarounds.

This release also includes several other bug fixes, minor improvements, and documentation updates, with the help of the community.

⭐ Congratulations to @​pttydou, @​vaibhav8a, @​sabaighani, @​vahidshaik1901, @​Provokke, @​victoriademina, @​proton0210, and @​karthiksenv for their first PRs merged in the project, and thanks to @​vishwakt for their many contributions to this release 🎉

More utilities in the Lambda layer

Docs

The Lambda layer now includes all 14 published Powertools packages. Data Masking, Signer, Kafka, and Validation were previously missing, so you can now use those utilities from the layer rather than bundling the Powertools packages separately.

The layer also no longer bundles AWS SDK v3 clients. This avoids mixing layer-provided clients with a different SDK version from the Lambda runtime, which could cause failures when using the DynamoDB DocumentClient.

EventBridge Custom Event Bus support

Docs

Parser now supports WITH_METADATA subscriber deliveries from the new enhanced Custom Event Bus in Amazon EventBridge, which is distinct from Custom Event Bus – Classic. Each delivered record contains the event in Data, optional custom metadata in Metadata, and delivery information in SystemMetadata, such as whether the event is live or replayed.

import { parse } from '@aws-lambda-powertools/parser';
import { EventBridgeWithMetadataEnvelope } from '@aws-lambda-powertools/parser/envelopes';
import { z } from 'zod';
const orderSchema = z.object({
orderId: z.string(),
amount: z.number(),
});
export const handler = async (event: unknown) => {
const orders = parse(event, EventBridgeWithMetadataEnvelope, orderSchema);
return orders;
};

Use EventBridgeWithMetadataRecordSchema or EventBridgeWithMetadataSchema when you need to retain the event and its metadata. The record schema also supports single-object deliveries.

Simpler Kafka bundles

... (truncated)

Changelog

Sourced from @​aws-lambda-powertools/commons's changelog.

2.36.0 (2026-10-06)

Improvements

• commons extract InvokeStore fallback into InvocationScoped (#5615) (e352cb0)
• tracer track fetch subsegments per request (#5746) (b75385f)
• idempotency make DynamoDB error check minification-resistant (#5775) (991fb88)
• event-handler simplify HTTP event parsing (#5686) (69b0b75)

Bug Fixes

• parameters include request options in cache key (#5623) (a02f7bc)
• idempotency pass cache SET options in the Valkey Glide shape (#5737) (3015a43)
• idempotency bind operations to their own key prefix on a shared store (#5708) (006a472)
• idempotency complete and delete the record acquired at operation start (#5717) (daa6e7c)
• idempotency keep payload validation hash on cache record completion (#5706) (c0dac7a)
• idempotency retain cache locks without execution deadlines (#5680) (504e1cd)
• idempotency delete only acquired records in the Middy onError hook (#5676) (9267cb3)
• parser accept real Cognito trigger events from common flows (#5777) (c77facf)
• parser accept multi-value headers in VPC Lattice v2 events (#5773) (40fb84e)
• parser accept documented SES receipt event variants (#5772) (13257dd)
• parser keep PhysicalResourceId in CloudFormation events (#5767) (f9cce6a)
• parser keep transform errors as the ParseError cause (#5745) (b898ec4)
• parser keep Lambda authorizer context in the REST API event schema (#5749) (077d1f1)
• parser stop malformed base64 from escaping safeParse (#5666) (11a18a3)
• batch throw when a synchronous processor gets a promise-returning handler (#5650) (cb36243)
• batch populate response() before full batch throw and normalize non-Error throws (#5625) (f71fd53)
• event-handler honor Accept-Encoding q-values in compression (#5725) (881a1f4)
• event-handler handle empty proxy response bodies (#5701) (9f39aef)
• event-handler preserve binary Web Response bodies (#5700) (e093a3d)
• event-handler stop recursive HTTP error handler dispatch (#5703) (4fbfc3e)
• event-handler ignore body on GET/HEAD requests when converting to Web Request (#5683) (51bc98c)
• event-handler honour isBase64Encoded and binary bodies on proxy results (#5668) (e133a45)
• event-handler fail invocation on UnauthorizedException in onPublish (#5621) (8d496bb)
• event-handler handle +json content types and bodyless responses (#5570) (770ab06)
• kafka lazily import Avro and Protobuf codecs so JSON-only consumers bundle (#5578) (0b7521b)
• data-masking honor throwOnMissingField consistently and resolve paths before masking (#5630) (b93417d)

Features

• parser support EventBridge WITH_METADATA deliveries (#5776) (58f4bb2)

Maintenance

• signer bump the aws-sdk-v3 group across 1 directory with 54 updates (#5759) (a3ff940)
• signer bump the aws-sdk-v3 group across 1 directory with 33 updates (#5659) (1ba493c)
• signer bump the aws-sdk-v3 group across 1 directory with 54 updates (#5589) (abb5597)
• signer bump the aws-sdk-v3 group across 1 directory with 55 updates (#5571) (1e5fe1b)

Commits

• 0595159 chore(ci): bump version to 2.36.0 (#5791)
• 8008f4d chore(deps): apply available npm audit fixes (#5790)
• 7e8fb7e chore(deps-dev): bump @​types/node from 26.6.3 to 26.6.4 (#5785)
• a835ffd chore(deps-dev): bump @​redis/client from 6.2.1 to 6.3.0 (#5786)
• 04b94ae chore(deps-dev): bump @​biomejs/biome from 2.5.14 to 2.5.15 (#5782)
• 533248a test(batch): add Lambda Managed Instances isolation coverage (#5768)
• c77facf fix(parser): accept real Cognito trigger events from common flows (#5777)
• ad7b0b9 chore(deps-dev): bump @​aws/durable-execution-sdk-js from 2.4.0 to 2.6.0 (#5781)
• 923e4f7 docs(parser): fix schema names in built-in schemas table (#5784)
• e0e7475 chore(deps-dev): bump the vitest group across 1 directory with 2 updates (#5779)
• Additional commits viewable in compare view

Updates @oxfmt/binding-android-arm-eabi from 0.71.0 to 0.72.0

Release notes

Sourced from @​oxfmt/binding-android-arm-eabi's releases.

oxfmt v0.72.0

💥 BREAKING CHANGES

• e2c68b1 oxfmt: [BREAKING] Format parser:markdown files by oxc_formatter_markdown (#27256) (leaysgur)

🚀 Features

• b538e3c formatter_css: Parse embedded CSS as a block's contents (#27284) (leaysgur)

🐛 Bug Fixes

• 71e400b formatter_markdown: Fixed remaining issues found by fuzz (#27334) (leaysgur)
• 7d0e54d formatter_markdown: Preserve line breaks around Chinese/Japanese characters in all proseWrap (#27331) (leaysgur)
• e9ae2d8 formatter_css: Fix layouts found in mdn-content repo (css-in-md) (#27326) (leaysgur)
• df85b4c oxfmt: Keep blank lines after a line break in Prettier Doc to IR (#27325) (leaysgur)
• 7f65b75 formatter: Format assignment target property as assignment-like (#27289) (leaysgur)
• 6c08f2a formatter_css: Apply the url() import exception to a lone comma group (#27288) (leaysgur)
• 1967302 formatter_css: Hug a spaced ident ( only at the at-rule prelude head (#27283) (leaysgur)
• 2445064 formatter_markdown: Keep a preserved line break before a delimiter row that opens no table (#27278) (leaysgur)
• dd72fbf formatte...

  Description has been truncated

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@aws-lambda-powertools/logger	2.36.0	🟢 9.3	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool 🟢 10 update tool detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices 🟢 5 badge detected: Passing Vulnerabilities 🟢 4 6 existing vulnerabilities detected SAST 🟢 10 SAST tool is run on all commits Packaging 🟢 10 packaging workflow detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Fuzzing 🟢 10 project is fuzzed Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 11 contributing companies or organizations
npm/@modelcontextprotocol/server	2.3.1	Unknown	Unknown
npm/oxfmt	^0.72.0	Unknown	Unknown
npm/@aws-lambda-powertools/logger	2.36.0	🟢 9.3	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool 🟢 10 update tool detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices 🟢 5 badge detected: Passing Vulnerabilities 🟢 4 6 existing vulnerabilities detected SAST 🟢 10 SAST tool is run on all commits Packaging 🟢 10 packaging workflow detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Fuzzing 🟢 10 project is fuzzed Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 11 contributing companies or organizations
npm/@modelcontextprotocol/core	2.3.1	Unknown	Unknown
npm/@modelcontextprotocol/server	2.3.1	Unknown	Unknown
npm/oxfmt	^0.72.0	Unknown	Unknown

Scanned Files

• example/package.json
• package/package.json