Skip to content

fix(lambda): bump @middy/core from 6.4.5 to 7.0.2 in /lambdas#4999

Open
dependabot[bot] wants to merge 5 commits intomainfrom
dependabot/npm_and_yarn/lambdas/middy/core-7.0.2
Open

fix(lambda): bump @middy/core from 6.4.5 to 7.0.2 in /lambdas#4999
dependabot[bot] wants to merge 5 commits intomainfrom
dependabot/npm_and_yarn/lambdas/middy/core-7.0.2

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 16, 2026

Bumps @middy/core from 6.4.5 to 7.0.2.

Release notes

Sourced from @​middy/core's releases.

7.0.2

  • Add in workaround for bundlers that don't honour sideEffects:false. #1548

Full Changelog: middyjs/middy@7.0.1...7.0.2

7.0.1

What's Changed

Full Changelog: middyjs/middy@7.0.0...7.0.1

7.0.0

For full details and upgrade guide see https://middy.js.org/docs/upgrade/6-7

Notable changes

  • Deprecate Node.js v20.x.
  • Add support for Node.js v24.x.
  • Add support for Durable Functions, caused breaking changes to streamifyResponse.
  • LLRT can now be used when using executionModeStandard (default) & executionModeDurableContext
  • Works with new Tenant isolation mode
  • Works with new multi-concurrency on Lambda Managed Instances

What's Changed

... (truncated)

Commits
  • 4ba68bc chore: version bump
  • 8837277 fix: workaround for sideEffects:false not honoured by esbuild
  • be71455 chore: version bump
  • ea25cd3 chore: add in peerDep
  • 9609f3a test: update evals to use newer strict
  • 98eadc7 chore: version bump
  • f0e040e chore: version bump
  • c4d2d75 docs: clean up
  • 7303ee8 fix: update to use standard naming
  • f23ee36 ci: allow context to be durable
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​middy/core since your current version.


Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jan 16, 2026
@dependabot dependabot bot requested a review from a team as a code owner January 16, 2026 19:48
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jan 16, 2026
@github-actions
Copy link
Contributor

github-actions bot commented Jan 16, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 4 package(s) with unknown licenses.
See the Details below.

License Issues

lambdas/functions/control-plane/package.json

PackageVersionLicenseIssue Type
@middy/core^7.1.2NullUnknown License

lambdas/functions/gh-agent-syncer/package.json

PackageVersionLicenseIssue Type
@middy/core^7.1.2NullUnknown License

lambdas/functions/termination-watcher/package.json

PackageVersionLicenseIssue Type
@middy/core^7.1.2NullUnknown License

lambdas/functions/webhook/package.json

PackageVersionLicenseIssue Type
@middy/core^7.1.2NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
npm/@middy/core ^7.1.2 UnknownUnknown
npm/@middy/core ^7.1.2 UnknownUnknown
npm/@middy/core ^7.1.2 UnknownUnknown
npm/@middy/core ^7.1.2 UnknownUnknown
npm/@middy/core 7.1.3 🟢 9.9
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
License🟢 10license file detected
CII-Best-Practices🟢 10badge detected: Gold
Signed-Releases⚠️ -1no releases found
Vulnerabilities🟢 91 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Packaging🟢 10packaging workflow detected
Fuzzing🟢 10project is fuzzed
Branch-Protection🟢 10branch protection is fully enabled on development and all release branches
CI-Tests🟢 106 out of 6 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 29 contributing companies or organizations
npm/@middy/util 7.1.3 🟢 9.9
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
License🟢 10license file detected
CII-Best-Practices🟢 10badge detected: Gold
Signed-Releases⚠️ -1no releases found
Vulnerabilities🟢 91 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Packaging🟢 10packaging workflow detected
Fuzzing🟢 10project is fuzzed
Branch-Protection🟢 10branch protection is fully enabled on development and all release branches
CI-Tests🟢 106 out of 6 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 29 contributing companies or organizations

Scanned Files

  • lambdas/functions/control-plane/package.json
  • lambdas/functions/gh-agent-syncer/package.json
  • lambdas/functions/termination-watcher/package.json
  • lambdas/functions/webhook/package.json
  • lambdas/yarn.lock

@npalm
Copy link
Member

npalm commented Jan 30, 2026

@dependabot rebase

@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/lambdas/middy/core-7.0.2 branch from f66d804 to f209721 Compare January 30, 2026 20:11
@npalm
Copy link
Member

npalm commented Jan 30, 2026

Would be better to test this pr on a deployment due to major bump.

@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/lambdas/middy/core-7.0.2 branch 4 times, most recently from abdba02 to 826f39b Compare February 13, 2026 21:03
@npalm
Copy link
Member

npalm commented Mar 9, 2026

@dependabot rebase

@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/lambdas/middy/core-7.0.2 branch from 826f39b to 62154c0 Compare March 9, 2026 21:10
Bumps [@middy/core](https://github.com/middyjs/middy/tree/HEAD/packages/core) from 6.4.5 to 7.0.2.
- [Release notes](https://github.com/middyjs/middy/releases)
- [Changelog](https://github.com/middyjs/middy/blob/main/docs/RELEASE.md)
- [Commits](https://github.com/middyjs/middy/commits/7.0.2/packages/core)

---
updated-dependencies:
- dependency-name: "@middy/core"
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/lambdas/middy/core-7.0.2 branch from 62154c0 to ede1c40 Compare March 9, 2026 21:12
@npalm npalm marked this pull request as draft March 10, 2026 18:04
@npalm
Copy link
Member

npalm commented Mar 10, 2026

@Brend-Smits @edersonbrilhante I have upgraded manual to Middy 7 with thanks to copilot. Tested (multi-runner) the changes including X-Ray. It looks working smooth. But the middy layer is crucial in Lambda. So would great if one of you can run a double check.

@npalm npalm marked this pull request as ready for review March 10, 2026 18:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant