chore(deps): bump the python-dependencies group across 1 directory with 7 updates

[dependabot]

Bumps the python-dependencies group with 7 updates in the / directory:

Package	From	To
aws-lambda-powertools	3.34.0	3.35.0
pyjwt	2.13.0	2.14.0
boto3	1.43.88	1.43.97
botocore	1.43.88	1.43.97
confluent-kafka	2.15.0	2.15.1
psycopg2	2.9.12	2.9.13
psycopg2-binary	2.9.12	2.9.13

Updates aws-lambda-powertools from 3.34.0 to 3.35.0

Release notes

Sourced from aws-lambda-powertools's releases.

v3.35.0

Summary

This release includes an important security improvement for Data Masking and a significant cold start optimization for Parser.

We are happy to welcome six new contributors in this release: @​Adityaj0, @​manshahH, @​ErezMizrahi, @​wuodar, @​MohammedAlkindi, and @​TanbirRamim. Thank you for taking the time to report problems, work through reviews, and improve the prokject.

Data Masking now fails closed

Previously, an error while applying a masking rule could emit a warning and return the original value unchanged. Since callers received a normal return value, they could continue logging or storing data believing that masking had succeeded.

Data Masking now raises DataMaskingError when a masking provider fails, a masking path is invalid, or a regular expression cannot be compiled. Existing Data Masking exceptions now inherit from this common base exception.

from aws_lambda_powertools.utilities.data_masking import DataMasking
from aws_lambda_powertools.utilities.data_masking.exceptions import DataMaskingError
data_masker = DataMasking()
try:
masked = data_masker.erase(
{"customer": {"email": "customer@example.com"}},
masking_rules={"customer.email": {"regex_pattern": "[", "mask_format": "*"}},
)
except DataMaskingError:
# Stop processing the payload when masking cannot be completed.
raise

Missing fields continue to follow the existing raise_on_missing_field setting. With its default value, a missing field raises DataMaskingFieldNotFoundError; when explicitly disabled, Data Masking emits a warning and continues.

See #8446 for the complete change.

Faster Parser imports

Importing parse or event_parser previously loaded all 16 Parser envelope modules, even when the application did not use an envelope.

Envelopes and BaseEnvelope are now loaded only when first accessed. Existing public imports continue to work, so no application changes are required.

In the Lambda benchmark contributed in #8405, this reduced INIT_DURATION by approximately 900ms on arm64 with Python 3.13 and 1024MB of memory. The exact improvement depends on the function and packaging configuration.

Thank you @​ErezMizrahi for finding this and working through the compatibility details with us.

Changes

• fix(metrics): stop spurious overwrite warnings from set_default_dimensions (#8403) by @​vishwakt
• chore(feature_flags): warn on empty schema and empty rules (#8430) by @​dreamorosi
• fix(event_handler): match generic alias response models in OpenAPI schema (#8453) by @​TanbirRamim
• fix(feature_flags): handle same-hour midnight rollover and reject malformed HH:MM (#8428) by @​dreamorosi
• test(shared): compare abs_lambda_path against a normalised path (#8457) by @​MohammedAlkindi

... (truncated)

Changelog

Sourced from aws-lambda-powertools's changelog.

[v3.35.0] - 2026-09-15

Maintenance

• version bump
• deps: bump valkey-glide from 2.5.1 to 2.5.2 (#8459)

Commits

• 4770746 chore: version bump
• d7d5168 chore(deps): bump valkey-glide from 2.5.1 to 2.5.2 (#8459)
• 440e3ec chore(deps-dev): bump cdklabs-generative-ai-cdk-constructs from 0.1.318 to 0....
• 226f384 chore(deps-dev): bump types-python-dateutil from 2.9.0.20260518 to 2.9.0.2026...
• b712d3c chore(deps): bump aws-encryption-sdk from 4.0.6 to 4.0.7 (#8460)
• a5b8045 chore(deps): bump avro from 1.12.1 to 1.12.2 (#8462)
• 94b9d5e fix(metrics): stop spurious overwrite warnings from set_default_dimensions (#...
• 14af77f chore(feature_flags): warn on empty schema and empty rules (#8430)
• 362a797 fix(event_handler): match generic alias response models in OpenAPI schema (#8...
• 237f4db fix(feature_flags): missing context key never satisfies a condition (#8429)
• Additional commits viewable in compare view

Updates pyjwt from 2.13.0 to 2.14.0

Release notes

Sourced from pyjwt's releases.

PyJWT 2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

Changelog

Sourced from pyjwt's changelog.

v2.14.0 <https://github.com/jpadilla/pyjwt/compare/2.13.0...2.14.0>__

Security

- Harden HMAC key validation against public-key material supplied as JWK,
  JWKS, array, encoded, BOM-prefixed, DER, or PEM input. See
  `GHSA-r6x4-923q-g947 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947>`__,
  `GHSA-ffc3-869f-jxw9 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9>`__,
  `GHSA-p4g4-x82p-q773 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773>`__,
  and `GHSA-w2cx-738m-mc7w <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w>`__.
- Reject automatic redirects when ``PyJWKClient`` fetches a JWKS, preventing
  redirected destinations from being treated as trusted key sources. See
  `GHSA-9v7f-9g4p-ffgj <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj>`__.
- Limit repeated JWKS refreshes caused by unknown key IDs while preserving
  normal key-rotation behavior. See
  `GHSA-2gx3-rcp4-g85q <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q>`__.
- Handle deeply nested and malformed JWS/JWK input without uncaught recursion
  errors or whole-set parsing failures. See
  `GHSA-8wjv-2p76-3863 <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863>`__
  and `GHSA-w6j9-cwv2-h6wq <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq>`__.
- Enforce compact JWS encoding rules during decoding. See
  `GHSA-hxm8-2xgr-2p9m <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m>`__.
- Reject detached-payload arguments for attached JWS inputs. Thanks to `@xclow3n
  <https://github.com/xclow3n>`__ for reporting this behavior; fixed in commit
  `37b54877 <https://github.com/jpadilla/pyjwt/commit/37b54877bf7bea67e8149130e96929e3ec798122>`__.
Fixed

- Apply HMAC key validation consistently when keys are loaded through
  ``PyJWK`` and ``PyJWKClient``. See
  `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
- Reject empty HMAC keys when represented as JWKs.
  See `GHSA-pxh4-856f-4h89 &lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89&gt;`__.
Fixed



Raise the documented PyJWTError subclass instead of leaking a

TypeError when the exp, nbf, or iat claim decodes to a

non-numeric, non-string value such as a list, dict, or null.

Commits

• c6fe464 release: prepare v2.14.0
• f541302 style: apply Ruff formatting
• 801cd12 fix: reject public JWK container HMAC keys
• af8181c fix: reject empty HMAC keys from JWKs
• ba4853a Throttle repeated PyJWKClient refreshes
• 2798504 fix: reject DER public keys as HMAC secrets
• 8b4e233 fix: reject loader-accepted PEM variants
• 1f8180a fix: format JWS tests
• cff1ac5 Fix redirect handler return annotation
• 0a795b8 Reject redirects in PyJWKClient fetches
• Additional commits viewable in compare view

Updates boto3 from 1.43.88 to 1.43.97

Commits

• ed7de96 Merge branch 'release-1.43.97'
• 275709c Bumping version to 1.43.97
• a5c0088 Add changelog entries from botocore
• 2be9967 Merge branch 'release-1.43.96'
• bc62489 Merge branch 'release-1.43.96' into develop
• 6e1774a Bumping version to 1.43.96
• ef6f957 Add changelog entries from botocore
• 238d6ec Update PyPI package summary to add Boto3 (#4846)
• 2d18ca8 Add root workspace folder to gitignore (#4847)
• 3061d22 Merge branch 'release-1.43.95'
• Additional commits viewable in compare view

Updates botocore from 1.43.88 to 1.43.97

Commits

• 7ffc568 Merge branch 'release-1.43.97'
• fbb8f49 Bumping version to 1.43.97
• e4ed5da Update to latest models
• 7b05bf7 Merge customizations for SocialMessaging
• 04d4c18 Expose calculated checksum on StreamingChecksumBody (#3799)
• 9da9912 Merge branch 'release-1.43.96'
• 7c1daa3 Merge branch 'release-1.43.96' into develop
• edef4a7 Bumping version to 1.43.96
• bafb058 Update to latest models
• 4cd222f Merge branch 'release-1.43.95'
• Additional commits viewable in compare view

Updates confluent-kafka from 2.15.0 to 2.15.1

Release notes

Sourced from confluent-kafka's releases.

v2.15.1

Fixes

• DeserializingConsumer and DeserializingShareConsumer now deserialize the message key before the value, matching SerializingProducer and the Java client. When both key and value fail to deserialize, the key error is now surfaced instead of the value error.
• Minor fix for subjectPrefix parameter in subjects API (#2311)
• Fix race conditions (#2315)
• Fix segmentation fault after calling AdminClient.delete_records() followed by another Admin API call (e.g. list_topics()) on Python 3.14.
• Use asyncio.get_running_loop() instead of asyncio.get_event_loop() to avoid creating a new event loop and raise an error in case a loop isn't available (@​AlexCai26, #2339).

confluent-kafka-python 2.15.1 is based on librdkafka 2.15.1, see the librdkafka release notes for a complete list of changes, enhancements, fixes and upgrade considerations.

Changelog

Sourced from confluent-kafka's changelog.

v2.15.1

Fixes

• DeserializingConsumer and DeserializingShareConsumer now deserialize the message key before the value, matching SerializingProducer and the Java client. When both key and value fail to deserialize, the key error is now surfaced instead of the value error.
• Minor fix for subjectPrefix parameter in subjects API (#2311)
• Fix race conditions (#2315)
• Fix segmentation fault after calling AdminClient.delete_records() followed by another Admin API call (e.g. list_topics()) on Python 3.14.
• Use asyncio.get_running_loop() instead of asyncio.get_event_loop() to avoid creating a new event loop and raise an error in case a loop isn't available (@​AlexCai26, #2339).

confluent-kafka-python 2.15.1 is based on librdkafka 2.15.1, see the librdkafka release notes for a complete list of changes, enhancements, fixes and upgrade considerations.

Commits

• 1a6f60f 2.15.1 (#2355)
• e4d47f7 2.15.1rc2: make validation pass on setup_all_versions.py (#2354)
• a67b660 2.15.1rc1 (#2353)
• 5cd8358 Fix thread-unsafe decimal context in protobuf_to_decimal (#2349)
• 80a730c Invoke isort as a binary, not via python -m, to support isort>=9.0.0 (#2344)
• 14286ea fix(aio): use get_running_loop() instead of get_event_loop() in AIOConsumer (...
• eea3931 DGS-24222 Add support for inline validation rules (#2326)
• 253e0c6 Fix reference counting in delete_records Admin API (#2328)
• 8905a07 Fix consume() breaking out of chunked loop on first result (#2235)
• aa1d54e Use tink[gcpkms] extra to fix missing GCP KMS dependencies (#2327)
• Additional commits viewable in compare view

Updates psycopg2 from 2.9.12 to 2.9.13

Changelog

Sourced from psycopg2's changelog.

Current release

What's new in psycopg 2.9.13 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.15 (:ticket:[#1848](https://github.com/psycopg/psycopg2/issues/1848)).
• Fix parsing of malformed bytea input.
• Fix parsing of malformed int64 input in arrays (:ticket:[#1847](https://github.com/psycopg/psycopg2/issues/1847)).
• Add a pyproject.toml file to declare a PEP 517 build backend (:ticket:[#1788](https://github.com/psycopg/psycopg2/issues/1788)).
• Drop support for Python 3.9.

What's new in psycopg 2.9.12 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Fix infinite loop with malformed interval (:ticket:1835).

What's new in psycopg 2.9.11 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.14.
• Avoid a segfault passing more arguments than placeholders if Python is built with assertions enabled (:ticket:[#1791](https://github.com/psycopg/psycopg2/issues/1791)).
• Add riscv64 platform binary packages (:ticket:[#1813](https://github.com/psycopg/psycopg2/issues/1813)).
• ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 18.
• Drop support for Python 3.8.

What's new in psycopg 2.9.10 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.13.
• Receive notifications on commit (:ticket:[#1728](https://github.com/psycopg/psycopg2/issues/1728)).
• ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 17.
• Drop support for Python 3.7.

What's new in psycopg 2.9.9 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.12.
• Drop support for Python 3.6.

What's new in psycopg 2.9.8

... (truncated)

Commits

• f650e7a chore: bump to release 2.9.13
• 368c8a1 chore!: drop support for Python 3.9
• 9b39e65 chore: drop scaleway build support
• 2ca7041 fix: fix handling of PostgreSQL 18 exceptions
• 5385c02 Build CPython 3.15 wheels
• 1d32e1f ci: only attempt triggering documentation refresh when pushing on main repo
• 433e7b7 chore: add pyproject.toml file to declare a PEP 517 build backend
• 8fb80bc fix: fix parsing of malformed int64 input in arrays
• f98014a fix: fix parsing of malformed bytea input
• 822b79c chore: bump dependencies in binary package
• Additional commits viewable in compare view

Updates psycopg2-binary from 2.9.12 to 2.9.13

Changelog

Sourced from psycopg2-binary's changelog.

Current release

What's new in psycopg 2.9.13 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.15 (:ticket:[#1848](https://github.com/psycopg/psycopg2/issues/1848)).
• Fix parsing of malformed bytea input.
• Fix parsing of malformed int64 input in arrays (:ticket:[#1847](https://github.com/psycopg/psycopg2/issues/1847)).
• Add a pyproject.toml file to declare a PEP 517 build backend (:ticket:[#1788](https://github.com/psycopg/psycopg2/issues/1788)).
• Drop support for Python 3.9.

What's new in psycopg 2.9.12 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Fix infinite loop with malformed interval (:ticket:1835).

What's new in psycopg 2.9.11 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.14.
• Avoid a segfault passing more arguments than placeholders if Python is built with assertions enabled (:ticket:[#1791](https://github.com/psycopg/psycopg2/issues/1791)).
• Add riscv64 platform binary packages (:ticket:[#1813](https://github.com/psycopg/psycopg2/issues/1813)).
• ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 18.
• Drop support for Python 3.8.

What's new in psycopg 2.9.10 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.13.
• Receive notifications on commit (:ticket:[#1728](https://github.com/psycopg/psycopg2/issues/1728)).
• ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 17.
• Drop support for Python 3.7.

What's new in psycopg 2.9.9 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.12.
• Drop support for Python 3.6.

What's new in psycopg 2.9.8

... (truncated)

Commits

• f650e7a chore: bump to release 2.9.13
• 368c8a1 chore!: drop support for Python 3.9
• 9b39e65 chore: drop scaleway build support
• 2ca7041 fix: fix handling of PostgreSQL 18 exceptions
• 5385c02 Build CPython 3.15 wheels
• 1d32e1f ci: only attempt triggering documentation refresh when pushing on main repo
• 433e7b7 chore: add pyproject.toml file to declare a PEP 517 build backend
• 8fb80bc fix: fix parsing of malformed int64 input in arrays
• f98014a fix: fix parsing of malformed bytea input
• 822b79c chore: bump dependencies in binary package
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Summary by CodeRabbit

• Chores
  • Updated development and runtime dependency versions, including AWS tooling, authentication, messaging, database, and PostgreSQL libraries.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 3443ff5d-9621-45b2-9242-11a9a8cb1cc9

📥 Commits

Reviewing files that changed from the base of the PR and between 8a8e9f9 and 21cd45c.

📒 Files selected for processing (2)

• requirements-dev.txt
• requirements.txt

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

Walkthrough

The pull request updates pinned versions for six runtime dependencies and one development dependency.

Changes

Dependency Updates

Layer / File(s)	Summary
Update dependency pins requirements.txt, requirements-dev.txt	Updated pins for AWS Lambda Powertools, PyJWT, boto3, botocore, confluent-kafka, psycopg2, and psycopg2-binary.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies a grouped dependency update across one directory and specifies seven updates. It accurately reflects the main change.
Description check	✅ Passed	The description clearly lists all seven dependency changes and includes detailed release notes. It does not use the template headings or include a related issue, but the substantive change summary is …
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{A rabbit checks the pins at night
Fresh packages hop into sight
Runtime paths stay neat and clear
Development tools gain a cheer
Seven versions change their place
The lockfile meadow keeps its pace}

_{Comment @coderabbitai help to get the list of available commands.}