[dependabot]

Bumps the python-dependencies group with 4 updates: aws-lambda-powertools, boto3, botocore and pytest-mock.

Updates aws-lambda-powertools from 3.36.0 to 3.37.0

Release notes

Sourced from aws-lambda-powertools's releases.

v3.37.0

Summary

This release adds support for the AppConfig Agent Lambda extension in Parameters and Feature Flags, brings Depends() injection to middlewares in Event Handler, and ships the Lambda layer with precompiled bytecode for faster cold starts. It also fixes bugs across Event Handler, Streaming, Idempotency, Circuit Breaker, Data Classes and Parser.

We are happy to welcome seven new contributors in this release: @​abhinavs1920, @​AtulJoshi1206, @​unknownhackerworld, @​LuisFigueroaG, @​ArfiArfath21, @​vyrnsynx and @​reginaldalfret. Thank you for the reports, the fixes and the patience during reviews. Thanks also to @​LemonCondor, @​xili-ytl, @​chiruu12 and @​exg for coming back with more.

AppConfig Agent Lambda extension

Docs

The AppConfig Agent runs as a Lambda extension next to your function, polls AppConfig for you and serves the configuration over localhost. Reading from it takes a couple of milliseconds instead of a round trip to the service, and your function doesn't need an SDK client for it.

You can now read from the extension with AppConfigExtensionProvider:

from aws_lambda_powertools.utilities.parameters import AppConfigExtensionProvider
provider = AppConfigExtensionProvider(environment="prod", application="orders")
config = provider.get("features", transform="json")

Feature Flags support it too. Pass use_extension=True to AppConfigStore, or use AppConfigExtensionStore:

from aws_lambda_powertools.utilities.feature_flags import AppConfigExtensionStore, FeatureFlags
store = AppConfigExtensionStore(environment="prod", application="orders", name="features")
feature_flags = FeatureFlags(store=store)

The extension is configured through its own environment variables, such as AWS_APPCONFIG_EXTENSION_PREFETCH_LIST and AWS_APPCONFIG_EXTENSION_POLL_INTERVAL_SECONDS, and you attach the AWS-AppConfig-Extension layer to your function. The docs list the variables and the layer ARNs.

Depends() in middlewares

Docs

Function-based middlewares can now declare Depends() parameters, the same way route handlers do. Dependencies are resolved before the middleware runs, share the per-request cache with the route, and honour dependency_overrides in tests.

def user_middleware(
    app: APIGatewayHttpResolver,
    next_middleware: NextMiddleware,
    user_dao: Annotated[UserDao, Depends(get_user_dao)],
):
    sub = app.current_event.request_context.authorizer.jwt_claim.get("sub")
    if sub and (user := user_dao.get(sub)):
        app.append_context(user=user)
    return next_middleware(app)
</tr></table>

... (truncated)

Changelog

Sourced from aws-lambda-powertools's changelog.

[v3.37.0] - 2026-10-22

Bug Fixes

• event_handler: resolve Depends() and Request params with a None default on Python 3.10 (#8649)

Maintenance

• version bump

Commits

• 0b9ab28 chore: version bump
• 7a5b1ac fix(event_handler): resolve Depends() and Request params with a None default ...
• 4fe0d6d fix(circuit_breaker): start a fresh probe success streak on each probe electi...
• d82a695 chore(deps): bump fastjsonschema, isort, ijson, cfn-lint and ruff (#8647)
• 31180f0 chore(deps): bump the github-actions group with 2 updates (#8644)
• 0f64f28 feat(event_handler): support Depends() injection in function-based middleware...
• bdd370b chore(docs): migrate docs build from MkDocs to Zensical (#8585)
• 43bab8d fix(event_handler): handle exceptions raised in Depends() like route exceptio...
• 93e577c fix(event_handler): route VPC Lattice requests that carry a query string (#8572)
• f58cd87 fix(idempotency): serialize PydanticSerializer output in JSON mode (#8570)
• Additional commits viewable in compare view

Updates boto3 from 1.43.114 to 1.43.118

Commits

• 185b1bd Merge branch 'release-1.43.118'
• 732c473 Bumping version to 1.43.118
• b087cd3 Add changelog entries from botocore
• 69e35c3 Backfill 1.43.117 changelog entry for CA bundle fix (#4861)
• 3667679 Merge branch 'release-1.43.117'
• ea13634 Merge branch 'release-1.43.117' into develop
• 94f6b3e Bumping version to 1.43.117
• 1eba892 Add changelog entries from botocore
• cfa4808 Bump https://github.com/astral-sh/ruff-pre-commit (#4860)
• dbaa95d Merge branch 'release-1.43.116'
• Additional commits viewable in compare view

Updates botocore from 1.43.114 to 1.43.118

Commits

• 444e17a Merge branch 'release-1.43.118'
• e6a2aa0 Bumping version to 1.43.118
• f704c6a Update endpoints model
• f623757 Update to latest models
• 9313a4d Backfill 1.43.117 changelog entry for CA bundle fix (#3839)
• ece3056 Merge branch 'release-1.43.117'
• 9dc596d Merge branch 'release-1.43.117' into develop
• 5c706c0 Bumping version to 1.43.117
• 27fc40e Update to latest models
• 0a6c7b6 Remove Comodo AAA root from vendored cert bundle (#3838)
• Additional commits viewable in compare view

Updates pytest-mock from 3.16.0 to 3.17.0

Release notes

Sourced from pytest-mock's releases.

v3.17.0

2026-10-17

• #641: Failures of mock assertions such as assert_called_with are again reported only once, instead of two or three times with the original error from the mock module chained before them.
• #642: Mock assertion failures no longer show misleading introspection when they are not about the arguments of the last call: assert_called, assert_called_once, assert_not_called, assert_any_call, their await counterparts, and assert_called_once_with/assert_awaited_once_with when the mock was not called (awaited) exactly once. The introspection also no longer reports arguments passed by position versus by keyword as different for autospecced mocks, and no longer shows empty Args:/Kwargs: sections when assertion rewriting is not available.
• #643: assert_has_calls and assert_has_awaits failures no longer show pytest introspection, which compared the expected and actual calls position by position and so reported differences between unrelated calls. The mock's own message, listing the expected and actual calls, is still shown.

v3.16.1

2026-10-17

• #617: Fixed assert_has_calls raising ValueError instead of AssertionError (or showing misleading introspection) when the expected calls are plain tuples rather than call(...) objects, such as (args, kwargs) entries of another mock's call_args_list, (args,), (kwargs,), (name, args) or (name, kwargs).
• #621: Fixed mocker.stop() sometimes stopping the wrong mock, for example with mocks from mocker.create_autospec.
• #621: mocker.stop() now undoes the most recent patch first when the same object is used in several patches.
• #623: Fixed misleading introspection in assert_has_awaits failures, and assert_has_calls/assert_has_awaits raising IndexError instead of AssertionError when calls is passed by keyword.
• #624: Clear spy_return_iter after a spied synchronous or asynchronous function raises, matching spy_return.
• #627: Document async_stub await assertions and the distinction between call and await tracking.
• #629: Fixed mocker.resetall() skipping the mocks patched with mocker.patch.multiple(), both the ones it creates and the ones passed explicitly.
• #630: mocker.resetall() now also resets spy_return and spy_exception of spies, like it already did for spy_return_list and spy_return_iter, and no longer overwrites attributes with these names on mocks that are not spies.
• #633: Fixed spies on classmethod, staticmethod, builtins and classes returning a MagicMock instead of calling the spied code after mocker.resetall(side_effect=True). Resetting a spy's side_effect now goes back to calling the spied code, also clearing any side_effect set on the spy.

Changelog

Sourced from pytest-mock's changelog.

3.17.0

2026-10-17

• [#641](https://github.com/pytest-dev/pytest-mock/issues/641) <https://github.com/pytest-dev/pytest-mock/pull/641>_: Failures of mock assertions such as assert_called_with are again reported only once, instead of two or three times with the original error from the mock module chained before them.
• [#642](https://github.com/pytest-dev/pytest-mock/issues/642) <https://github.com/pytest-dev/pytest-mock/pull/642>_: Mock assertion failures no longer show misleading introspection when they are not about the arguments of the last call: assert_called, assert_called_once, assert_not_called, assert_any_call, their await counterparts, and assert_called_once_with/assert_awaited_once_with when the mock was not called (awaited) exactly once. The introspection also no longer reports arguments passed by position versus by keyword as different for autospecced mocks, and no longer shows empty Args:/Kwargs: sections when assertion rewriting is not available.
• [#643](https://github.com/pytest-dev/pytest-mock/issues/643) <https://github.com/pytest-dev/pytest-mock/pull/643>_: assert_has_calls and assert_has_awaits failures no longer show pytest introspection, which compared the expected and actual calls position by position and so reported differences between unrelated calls. The mock's own message, listing the expected and actual calls, is still shown.

3.16.1

2026-10-17

• [#617](https://github.com/pytest-dev/pytest-mock/issues/617) <https://github.com/pytest-dev/pytest-mock/pull/617>_: Fixed assert_has_calls raising ValueError instead of AssertionError (or showing misleading introspection) when the expected calls are plain tuples rather than call(...) objects, such as (args, kwargs) entries of another mock's call_args_list, (args,), (kwargs,), (name, args) or (name, kwargs).
• [#621](https://github.com/pytest-dev/pytest-mock/issues/621) <https://github.com/pytest-dev/pytest-mock/pull/621>_: Fixed mocker.stop() sometimes stopping the wrong mock, for example with mocks from mocker.create_autospec.
• [#621](https://github.com/pytest-dev/pytest-mock/issues/621) <https://github.com/pytest-dev/pytest-mock/pull/621>_: mocker.stop() now undoes the most recent patch first when the same object is used in several patches.
• [#623](https://github.com/pytest-dev/pytest-mock/issues/623) <https://github.com/pytest-dev/pytest-mock/pull/623>_: Fixed misleading introspection in assert_has_awaits failures, and assert_has_calls/assert_has_awaits raising IndexError instead of AssertionError when calls is passed by keyword.
• [#624](https://github.com/pytest-dev/pytest-mock/issues/624) <https://github.com/pytest-dev/pytest-mock/pull/624>_: Clear spy_return_iter after a spied synchronous or asynchronous function raises, matching spy_return.
• [#627](https://github.com/pytest-dev/pytest-mock/issues/627) <https://github.com/pytest-dev/pytest-mock/pull/627>_: Document async_stub await assertions and the distinction between call and await tracking.
• [#629](https://github.com/pytest-dev/pytest-mock/issues/629) <https://github.com/pytest-dev/pytest-mock/pull/629>_: Fixed mocker.resetall() skipping the mocks patched with mocker.patch.multiple(), both the ones it creates and the ones passed explicitly.
• [#630](https://github.com/pytest-dev/pytest-mock/issues/630) <https://github.com/pytest-dev/pytest-mock/pull/630>_: mocker.resetall() now also resets spy_return and spy_exception of spies, like it already did for spy_return_list and spy_return_iter, and no longer overwrites attributes with these names on mocks that are not spies.
• [#633](https://github.com/pytest-dev/pytest-mock/issues/633) <https://github.com/pytest-dev/pytest-mock/pull/633>_: Fixed spies on classmethod, staticmethod, builtins and classes returning a MagicMock instead of calling the spied code after mocker.resetall(side_effect=True). Resetting a spy's side_effect now goes back to calling the spied code, also clearing any side_effect set on the spy.

Commits

• 5c2f207 Release 3.17.0
• 9625271 Bump the minor version for releases that change existing behavior
• 34b87ae Drop introspection from assert_has_calls and assert_has_awaits (#643)
• 866520f Only show introspection for failures about the call arguments (#642)
• 5ab41c1 Do not chain the original mock error to wrapped assertion failures (#641)
• 1916b14 Merge pull request #635 from nicoddemus/docs-contributing-resetall
• 212fcd9 Document resetall, the changelog format and running tests with tox
• 9374b2c Merge pull request #634 from pytest-dev/release-3.16.1
• fab730d Release 3.16.1
• d26d41b Merge pull request #627 from xiehuanyi/docs/async-stub-awaits-20261012-r2
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: f8a9d980-3350-4711-9ee3-fbb705927b60

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}