chore(deps): bump the python-dependencies group with 6 updates by dependabot[bot] · Pull Request #242 · AbsaOSS/EventGate

dependabot · 2026-10-18T23:53:40Z

Bumps the python-dependencies group with 6 updates:

Package	From	To
aws-lambda-powertools	`3.35.0`	`3.36.0`
boto3	`1.43.110`	`1.43.114`
botocore	`1.43.110`	`1.43.114`
pylint	`4.1.2`	`4.1.3`
black	`26.10.0`	`26.10.1`
moto	`5.2.3`	`5.2.4`

Updates aws-lambda-powertools from 3.35.0 to 3.36.0

Release notes

Sourced from aws-lambda-powertools's releases.

v3.36.0

Summary

This release ships a new Auth utility in alpha, with two pieces: a JWT verifier to protect your APIs and an OAuth2 client to call APIs protected by someone else. It also fixes a handful of bugs across Data Classes, Streaming, Idempotency, Event Handler, Metrics and Feature Flags.

A special thank you to @bfreiberg for the outstanding work on both Auth utilities. They helped and implemented them, wrote the docs and tested it.

Welcome also to our other new contributors @Om-singhaI, @Shubham-Padkonde, @chancesong10 and @chiruu12. Thank you for the reports, the fixes and the patience during reviews.

JWT verification (alpha)

Docs

You can now verify access tokens with JWTVerifier. It fetches and caches the issuer's JWKS, selects the signing key, and checks signature, issuer, audience, expiration and any claim you require. Only asymmetric algorithms are accepted, and errors never include token material.
from aws_lambda_powertools.event_handler import APIGatewayHttpResolver
from aws_lambda_powertools.utilities.auth_alpha import JWTVerifier
app = APIGatewayHttpResolver()
verifier = JWTVerifier(
issuer="https://idp.example.com",
audience="https://orders.example.com",
algorithms=["RS256"],
required_claims=["sub"],
)
@app.get("/orders", middlewares=[verifier.require(scopes=["orders:read"])])
def list_orders():
return {"subject": app.context["claims"]["sub"]}
The middleware returns 401 for missing or invalid tokens and 403 for missing scopes. You can also call verifier.verify(token) directly, use verifier.authorize(event) inside an API Gateway Lambda authorizer, or start from JWTVerifier.cognito() for Amazon Cognito access tokens.

Install it with pip install "aws-lambda-powertools[jwt]". Thank you @bfreiberg for building this with us.

OAuth2 client credentials (alpha)

Docs

You can now call downstream APIs protected by OAuth2 with OAuth2Client. It exchanges your client credentials for a bearer token, caches it, and refreshes it before it expires. Pass the client secret as a callable and it is loaded on every exchange, so it can come straight from Secrets Manager.
from aws_lambda_powertools.utilities.auth_alpha import OAuth2Client
inventory_api = OAuth2Client(
token_url="https://idp.example.com/token",
client_id="orders-service",
client_secret=load_secret,
</tr></table>

... (truncated)

Changelog

Sourced from aws-lambda-powertools's changelog.

[v3.36.0] - 2026-10-15

Bug Fixes

layer: remove urllib3 from the Lambda layer again (#8556)

Maintenance

version bump

Commits

5099d2e chore: version bump
dc47557 fix(layer): remove urllib3 from the Lambda layer again (#8556)
ce161fd chore(deps-dev): bump types-requests from 2.33.0.20260906 to 2.33.0.20261006 ...
5317765 chore(deps-dev): bump aws-cdk from 2.1143.0 to 2.1145.0 in the aws-cdk group ...
a74600c chore(deps-dev): bump nox from 2026.4.10 to 2026.8.17 (#8551)
623fe84 chore(deps-dev): bump aws-cdk-aws-lambda-python-alpha from 2.272.0a0 to 2.273...
ad8a3ac chore(deps): bump the github-actions group with 8 updates (#8549)
d743540 chore(deps-dev): bump ruff from 0.16.10 to 0.17.0 in the dev-dependencies gro...
56c2134 chore(deps-dev): bump sentry-sdk from 2.70.0 to 2.71.0 (#8554)
5b74209 chore(deps): bump release-drafter/release-drafter from 7.7.0 to 7.9.0 in the ...
Additional commits viewable in compare view

Updates boto3 from 1.43.110 to 1.43.114

Commits

432fa17 Merge branch 'release-1.43.114'
bf4aed7 Bumping version to 1.43.114
fa3e3f2 Add changelog entries from botocore
69ed308 Merge branch 'release-1.43.113'
3abaa49 Merge branch 'release-1.43.113' into develop
741f8d9 Bumping version to 1.43.113
ad1c6b5 Add changelog entries from botocore
9ca5e36 Merge branch 'release-1.43.112'
f5581ba Merge branch 'release-1.43.112' into develop
6f065c3 Bumping version to 1.43.112
Additional commits viewable in compare view

Updates botocore from 1.43.110 to 1.43.114

Commits

fca45a8 Merge branch 'release-1.43.114'
d178cb7 Bumping version to 1.43.114
b7ed9a9 Update endpoints model
cd68b6e Update to latest models
44a636c Raise the Request/Response Syntax doc section limit to 2,000 lines (#3823)
5f4e0c0 Merge branch 'release-1.43.113'
42f5cfb Merge branch 'release-1.43.113' into develop
0bc9a33 Bumping version to 1.43.113
d7ce073 Update endpoints model
6b11f3e Update to latest models
Additional commits viewable in compare view

Updates pylint from 4.1.2 to 4.1.3

Release notes

Sourced from pylint's releases.

v4.1.3

What's new in Pylint 4.1.3?

Release date: 2026-10-11

False Positives Fixed

Fixed a false positive for attribute-defined-outside-init when an attribute is assigned inside the setter of an old-style, non-decorator property(fget, fset) call. The decorator form (@property / @x.setter) was already exempted by the fix for #409; the classic call form was not.

Closes #3325

Fix a false positive for used-before-assignment when a name bound by an earlier target of the same assignment is used by a later target, as in a = b[a] = 0.

Closes #5955

Fix a no-member false positive in a comprehension inside a branch that cannot run, such as if sys.platform == "win32": on Linux. Like the rest of the branch, the comprehension is no longer checked for missing members.

Closes #7240

Fix a false positive for used-before-assignment when a name bound by a tuple or list target of a with item is used by a later item of the same with statement.

Closes #7545

Fix false positives such as not-callable, not-an-iterable, unpacking-non-sequence and no-member on the result of a function whose body is only ..., like @overload and .pyi stubs. Such calls were inferred as returning None. This affected sqlalchemy.func, pydantic.Field, and the torch functions wrapped by _add_docstr, such as torch.linalg.qr.

Closes #8138 Closes #9218 Closes #9354 Closes #10087

Fix a false positive for protected-access when a subclass of a subscripted generic base, such as class Child(Parent[T]), accesses a protected member through that base, such as Parent._foo(self).

Closes #8600

... (truncated)

Commits

e75de10 Bump pylint to 4.1.3, update changelog (#11637)
591f6e2 [Backport maintenance/4.1.x] Fix protected-access false positive through a su...
a537920 [Backport maintenance/4.1.x] Ignore discard variable type redefinitions (#11635)
4a8f61c [Backport maintenance/4.1.x] Fix duplicate-code crash when min-similarity-lin...
41fa1c4 [Backport maintenance/4.1.x] [pyreverse] Fix hang/RecursionError with --all-a...
a05e2f3 [Backport maintenance/4.1.x] Fix used-before-assignment false positive for ...
ea7996b [Backport maintenance/4.1.x] Error when several output formats write to stdou...
479c037 [Backport maintenance/4.1.x] Fix IndexError when Enum init has no argumen...
e6aa780 [Backport maintenance/4.1.x] Fix unreachable false positive for raising gener...
fc58d0b [Backport maintenance/4.1.x] Fix pyreverse crash on classes with EmptyNode in...
Additional commits viewable in compare view

Updates black from 26.10.0 to 26.10.1

Release notes

Sourced from black's releases.

26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)

Keep repeated lines outside the selected --line-ranges unchanged (#5436)

Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)

Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)

Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)

Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)

Preview style

Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)

Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)

Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)

Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)

Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)

Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)

Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

Configuration

Add --cache-dir to configure the cache directory from the command line (#5433)

Don't cache a file as formatted after formatting or checking it with --line-ranges,

... (truncated)

Changelog

Sourced from black's changelog.

Version 26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)

Keep repeated lines outside the selected --line-ranges unchanged (#5436)

Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)

Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)

Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)

Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)

Preview style

Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)

Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)

Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)

Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)

Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)

Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)

Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

Configuration

Add --cache-dir to configure the cache directory from the command line (#5433)

... (truncated)

Commits

258e7db Prepare release 26.10.1 (#5511)
ac1f715 Action: validate required-version better (#5510)
fe241cc Avoid splitting trailers when earlier bracket split exceeds length due to com...
4fb2897 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#5500)
6d0f557 Bump actions/download-artifact from 8.0.1 to 8.0.2 (#5501)
c45f21d Handle PEP 695 type parameter whitespace in whitespace() (#5504)
8ec61a7 Skip UTF-8 BOM when reading .gitignore (#5497)
c9b1148 Fix module docstring last_line_length when docstring ends with newline (#5494)
eb88358 Parenthesize expressions with parameter comments in preview (#3113) (#5442)
939fa93 Keep the parentheses around a right-hand side when a dict value's parentheses...
Additional commits viewable in compare view

Updates moto from 5.2.3 to 5.2.4

Changelog

Sourced from moto's changelog.

5.2.4

Docker Digest for 5.2.4: sha256:120b1589c6df7e35d2092935f6ff724486bb2c4189d0e36ce795baba1400ffd2

General:
    * The `aws-xray-sdk` dependency now has a lower limit of 2.10.0, allowing us to drop the `setuptools` dependency
New Services:
* Bedrock AgentCore:
    * create_event()
    * delete_event()
    * get_event()
    * list_events()

New Methods:

* CloudFront:

* create_function()

* delete_function()

* describe_function()

* get_function()

* list_functions()

* create_key_value_store()

* delete_key_value_store()

* describe_key_value_store()

* list_key_value_stores()

* update_key_value_store()
* CodePipeline:
    * get_pipeline_execution()
    * list_pipeline_executions()
    * start_pipeline_execution()


DMS:

modify_replication_instance()



EC2:

create_traffic_mirror_session()
delete_traffic_mirror_session()
describe_traffic_mirror_sessions()
disable_image()
enable_image()
modify_traffic_mirror_session()



ElastiCache:

modify_replication_group()



ECR:

batch_check_layer_availability()
complete_layer_upload()

... (truncated)

Commits

066751a Pre-Release: Up Version Number
8157c01 Prep Release 5.2.4 (#10362)
636f646 ElastiCache: implement modify_replication_group (#10325)
4d37395 Admin: remove setuptools dependency (#10355)
b459380 DSQL: migrate to automated request parsing (#10356)
608bfa9 OSIS: fix ListPipelines pagination (#10301)
fffed29 SESv2: fix ListEmailIdentities pagination (#10331)
1e97404 SQS: fix pagination for ListQueues (#10348)
5cab9c9 Pagination: handle list of strings as result set- #10354 (#10354)
504f61a Core: normalize incoming requests (#10343)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the python-dependencies group with 6 updates: | Package | From | To | | --- | --- | --- | | [aws-lambda-powertools](https://github.com/aws-powertools/powertools-lambda-python) | `3.35.0` | `3.36.0` | | [boto3](https://github.com/boto/boto3) | `1.43.110` | `1.43.114` | | [botocore](https://github.com/boto/botocore) | `1.43.110` | `1.43.114` | | [pylint](https://github.com/pylint-dev/pylint) | `4.1.2` | `4.1.3` | | [black](https://github.com/psf/black) | `26.10.0` | `26.10.1` | | [moto](https://github.com/getmoto/moto) | `5.2.3` | `5.2.4` | Updates `aws-lambda-powertools` from 3.35.0 to 3.36.0 - [Release notes](https://github.com/aws-powertools/powertools-lambda-python/releases) - [Changelog](https://github.com/aws-powertools/powertools-lambda-python/blob/develop/CHANGELOG.md) - [Commits](aws-powertools/powertools-lambda-python@v3.35.0...v3.36.0) Updates `boto3` from 1.43.110 to 1.43.114 - [Release notes](https://github.com/boto/boto3/releases) - [Commits](boto/boto3@1.43.110...1.43.114) Updates `botocore` from 1.43.110 to 1.43.114 - [Commits](boto/botocore@1.43.110...1.43.114) Updates `pylint` from 4.1.2 to 4.1.3 - [Release notes](https://github.com/pylint-dev/pylint/releases) - [Commits](pylint-dev/pylint@v4.1.2...v4.1.3) Updates `black` from 26.10.0 to 26.10.1 - [Release notes](https://github.com/psf/black/releases) - [Changelog](https://github.com/psf/black/blob/main/CHANGES.md) - [Commits](psf/black@26.10.0...26.10.1) Updates `moto` from 5.2.3 to 5.2.4 - [Release notes](https://github.com/getmoto/moto/releases) - [Changelog](https://github.com/getmoto/moto/blob/master/CHANGELOG.md) - [Commits](getmoto/moto@5.2.3...5.2.4) --- updated-dependencies: - dependency-name: aws-lambda-powertools dependency-version: 3.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-dependencies - dependency-name: boto3 dependency-version: 1.43.114 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: botocore dependency-version: 1.43.114 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: pylint dependency-version: 4.1.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: black dependency-version: 26.10.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-dependencies - dependency-name: moto dependency-version: 5.2.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-10-18T23:53:48Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 40961710-9393-4384-9a02-c07bfa9779e8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

dependabot Bot requested review from lsulak, oto-macenauer-absa, petr-pokorny-absa and tmikula-dev as code owners October 18, 2026 23:53

dependabot Bot added auto update Changes by automated library update tool infrastructure Project setup and deployment no RN No release notes required labels Oct 18, 2026

github-actions Bot approved these changes Oct 18, 2026

View reviewed changes

github-actions Bot enabled auto-merge (squash) October 18, 2026 23:53

lsulak approved these changes Oct 19, 2026

View reviewed changes

github-actions Bot merged commit 76b1731 into master Oct 19, 2026
10 of 12 checks passed

github-actions Bot deleted the dependabot/pip/master/python-dependencies-dc192a5c8f branch October 19, 2026 11:41

Navigation Menu

Repository navigation

chore(deps): bump the python-dependencies group with 6 updates - #242

chore(deps): bump the python-dependencies group with 6 updates#242
github-actions[bot] merged 1 commit into
masterfrom
dependabot/pip/master/python-dependencies-dc192a5c8f

dependabot Bot commented on behalf of github Oct 18, 2026

Uh oh!

coderabbitai Bot commented Oct 18, 2026

Review skipped

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 18, 2026

v3.36.0

Summary

JWT verification (alpha)

OAuth2 client credentials (alpha)

[v3.36.0] - 2026-10-15

Bug Fixes

Maintenance

v4.1.3

What's new in Pylint 4.1.3?

False Positives Fixed

26.10.1

Highlights

Stable style

Preview style

Configuration

Version 26.10.1

Highlights

Stable style

Preview style

Configuration

5.2.4

Uh oh!

coderabbitai Bot commented Oct 18, 2026

Review skipped

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant