fix(lambda): bump @middy/core from 6.4.5 to 7.7.0 in /lambdas

[dependabot]

Bumps @middy/core from 6.4.5 to 7.7.0.

Release notes

Sourced from @​middy/core's releases.

7.7.0

What's Changed

• Update @aws/durable-execution-sdk-js to v2 - May cause Type breaking change
• Update core to use new SDK for improved executionMode detection

Security hardening

• http-response-serializer — caps media-type length at 128 chars and validates against a media-type grammar before reflecting into Content-Type. Stops ReDoS via attacker-supplied media types and prevents echoing untrusted input.

Bug fixes / edge cases

• Added missing defaults, plus small fixes across http-header-normalizer, http-multipart-body-parser, glue-schema-registry, validator, http-content-negotiation, event-batch-response, http-x402.

Performance

• core/index.js reworked across standard/durable/streamify execution modes.

Tooling / CI (not user-facing)

• Biome → 2.5.0 + config migration; fuzz-test fixes (event-normalizer); mutation-coverage improvements; provenance-attestation source fix.

Docs

• WAF alternative note; typo fixes.
• Deps: bump github/codeql-action 4.35.5 → 4.36.0 (#1656)

Full Changelog: middyjs/middy@7.6.8...7.7.0

7.6.8

What's Changed

• chore(deps): bump github/codeql-action from 4.35.5 to 4.36.0 in the everything group by @​dependabot[bot] in middyjs/middy#1656

Security hardening

• http-response-serializer — caps media-type length at 128 chars and validates against a media-type grammar before reflecting into Content-Type. Stops ReDoS via attacker-supplied media types and prevents echoing

Bug fixes / edge cases

• fix: add in missing defaults, plus small fixes across http-header-normalizer, http-multipart-body-parser, glue-schema-registry, validator, http-content-negotiation, event-batch-response, http-x402.

Performance

• core/index.js reworked (~73 lines) across the standard/durable/streamify execution modes, plus two perf commits (fix: perf optimization, fix: small perf boost).

Tooling / CI (not user-facing)

• Biome bumped to 2.5.0 + config migration (the lint fix from earlier in our session — preset: "recommended", SVG/proto/test overrides).
• Fuzz-test fixes (event-normalizer), mutation-coverage improvements, provenance-attestation source fix.

Docs

• Added a WAF alternative note; typo fixes.

Full Changelog: middyjs/middy@7.6.7...7.6.8

7.6.7

What's Changed

... (truncated)

Commits

• 1efbcf7 chore: version bump
• 64a2ce0 feat: update durable context sdk
• 2d39e9d chore: version bump
• 190fed7 test: improve mutation coverage
• 1a1c4b3 fix: perf optimization
• b308825 chore: version bump
• 77aca7c chore: version bump
• 4045213 test: improve coverage
• 6f2ac34 test: improve mutations
• affcf12 ci: add in mutation testing
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​middy/core since your current version.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 4 package(s) with unknown licenses.

See the Details below.

License Issues

lambdas/functions/control-plane/package.json

Package	Version	License	Issue Type
@middy/core	^7.7.0	Null	Unknown License

lambdas/functions/gh-agent-syncer/package.json

Package	Version	License	Issue Type
@middy/core	^7.7.0	Null	Unknown License

lambdas/functions/termination-watcher/package.json

Package	Version	License	Issue Type
@middy/core	^7.7.0	Null	Unknown License

lambdas/functions/webhook/package.json

Package	Version	License	Issue Type
@middy/core	^7.7.0	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
npm/@middy/core	^7.7.0	Unknown	Unknown
npm/@middy/core	^7.7.0	Unknown	Unknown
npm/@middy/core	^7.7.0	Unknown	Unknown
npm/@middy/core	^7.7.0	Unknown	Unknown
npm/@middy/core	7.7.0	🟢 10	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Dependency-Update-Tool 🟢 10 update tool detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices 🟢 10 badge detected: Gold Signed-Releases ⚠️ -1 no releases found Packaging 🟢 10 packaging workflow detected License 🟢 10 license file detected SAST 🟢 10 SAST tool is run on all commits Vulnerabilities 🟢 10 0 existing vulnerabilities detected Fuzzing 🟢 10 project is fuzzed Branch-Protection 🟢 10 branch protection is fully enabled on development and all release branches CI-Tests 🟢 10 4 out of 4 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 31 contributing companies or organizations
npm/@middy/util	7.7.0	🟢 10	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Dependency-Update-Tool 🟢 10 update tool detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices 🟢 10 badge detected: Gold Signed-Releases ⚠️ -1 no releases found Packaging 🟢 10 packaging workflow detected License 🟢 10 license file detected SAST 🟢 10 SAST tool is run on all commits Vulnerabilities 🟢 10 0 existing vulnerabilities detected Fuzzing 🟢 10 project is fuzzed Branch-Protection 🟢 10 branch protection is fully enabled on development and all release branches CI-Tests 🟢 10 4 out of 4 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 31 contributing companies or organizations

Scanned Files

• lambdas/functions/control-plane/package.json
• lambdas/functions/gh-agent-syncer/package.json
• lambdas/functions/termination-watcher/package.json
• lambdas/functions/webhook/package.json
• lambdas/yarn.lock

[npalm]

@dependabot rebase

[npalm]

Would be better to test this pr on a deployment due to major bump.

[npalm]

@dependabot rebase

[npalm]

@Brend-Smits @edersonbrilhante I have upgraded manual to Middy 7 with thanks to copilot. Tested (multi-runner) the changes including X-Ray. It looks working smooth. But the middy layer is crucial in Lambda. So would great if one of you can run a double check.

[dependabot]

A newer version of @​middy/core exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

[npalm]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[npalm]

@copilot can you fix this pr?

[Copilot]

@copilot can you fix this pr?

Fixed in 8b38581. I updated the webhook test to match the current combined matcher-config error output and re-ran the affected lambda tests.

[edersonbrilhante]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[edersonbrilhante]

@dependabot recreate

[dependabot]

Superseded by #5333.