[github-actions]

🤖 I have created a release beep boop

0.2.0 (2026-10-22)

Features

• add cloudformation template for sns fan-out deployment (1e88f2c)
• add configurable batch size, batching window, and concurrency scaling to CloudFormation (8cd1714)
• add DasFiltersDir and kms:GenerateDataKey to CloudFormation templates (f9fc20e)
• complete S3 DAS log processing pipeline (1857c28)
• default KmsKeyArn to wildcard for multi-account support in CloudFormation (1d02515)
• deploy: add DLQ, log retention, and existing destination bucket to CloudFormation (#18) (#25) (b67e0b7)
• deploy: align CloudFormation template path to deploy/cloudformation/lambda.yaml and add cfn-ci (73d439e)
• handle s3:TestEvent gracefully without false error alarms (closes #19) (70cf6d8)
• implement multi-filter matching engine with single-decrypt fanout and self-routing (40628c6)
• provide Processor.Handler method for clean dependency injection (closes #4) (0cc0972)
• support configurable filter path with LAMBDA_TASK_ROOT and in-memory caching (#20) (e3c8124)
• support Lambda function reserved concurrency in CloudFormation templates (25460e5)
• support modern EventBridge and classic SNS ingestion with error prefix filtering (3bcef2f)
• support multiple input s3 buckets and exclude error manifests in EventBridge (95fe1f5)
• support per-filter destination S3 bucket and KMS encryption key (f2373ca)

Bug Fixes

• add missing Dockerfiles for CI/CD pipeline (e50edc7)
• allow decrypting non-committing algorithm suites for RDS DAS payloads (f2552fd)
• cfn: correct AWSLambdaBasicExecutionRole managed policy ARN format (9120ab3)
• implement SQS partial batch failure handling (#3) (#23) (029989b)
• inspect magic header bytes to decompress GZIP, ZLIB, and raw JSON payloads (fc77ed3)
• prevent S3 response body resource leak using deferred close (closes #7) (42cdb98)
• prevent silent error swallowing and add observability to Parquet converter (closes #9) (79b9282)
• sanitize nil string representation in parquet conversion (3a59b3f)
• support BC and custom key provider namespaces via MultiKeyring for RDS DAS decryption (6c2e98e)
• support multi-record concatenated Firehose payloads in S3 chunks (cdd8e25)
• switch SQS queues to SqsManagedSseEnabled to allow service principal delivery (7c0984a)
• URL-decode S3 object keys from event notifications before GetObject (closes #14) (0b98a61)
• use golang:1.26-alpine to match go.mod requirements (9366951)
• validate RDS resource ID before KMS decrypt and log diagnostics (closes #5) (102a8a6)

Performance Improvements

• eliminate redundant JSON marshal/unmarshal in convertJSONToParquet (#16) (#26) (7e5a45d)

---

This PR was generated with Release Please. See documentation.