Merge branch 'main' into chore/ci_input_sanitization

Author: dreamorosi

.github/workflows/make-release.yml

@@ -52,6 +52,7 @@ jobs:
         with:
           node-version: "22"
           cache: "npm"
+          registry-url: 'https://registry.npmjs.org'
       - name: Setup auth tokens
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/publish-package.yml

@@ -43,6 +43,7 @@ jobs:
         with:
           node-version: "22"
           cache: "npm"
+          registry-url: 'https://registry.npmjs.org'
       - name: Setup auth tokens
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

CHANGELOG.md

@@ -1,5 +1,28 @@
 # Change Log
 
+## [2.27.0](https://github.com/aws-powertools/powertools-lambda-typescript/compare/v2.26.1...v2.27.0) (2025-09-24)
+
+### Bug Fixes
+
+- **batch** fixed the build issue with Batch processor due to missing dependencies ([#4498](https://github.com/aws-powertools/powertools-lambda-typescript/issues/4498)) ([ef67b43](https://github.com/aws-powertools/powertools-lambda-typescript/commit/ef67b43921f1d67b06b3257fb0f96c74e0d6dbae))
+- **event-handler** fixed CORS behaviour not aligned with CORS spec   ([#4512](https://github.com/aws-powertools/powertools-lambda-typescript/issues/4512)) ([dd368fa](https://github.com/aws-powertools/powertools-lambda-typescript/commit/dd368fa3eb08a86c2d5aad3cf9b832d7a8288486))
+- **event-handler** run global middleware on all requests for REST API ([#4507](https://github.com/aws-powertools/powertools-lambda-typescript/issues/4507)) ([49d5f8a](https://github.com/aws-powertools/powertools-lambda-typescript/commit/49d5f8a4f36a5af26c573f7706347f34ec70689e))
+
+### Improvements
+
+- **event-handler** rename HttpErrorCodes to HttpStatusCodes ([#4543](https://github.com/aws-powertools/powertools-lambda-typescript/issues/4543)) ([e53aa88](https://github.com/aws-powertools/powertools-lambda-typescript/commit/e53aa8816325f21510706e3f9e62fb0a76692915))
+- **event-handler** made error handler responses versatile ([#4536](https://github.com/aws-powertools/powertools-lambda-typescript/issues/4536)) ([f08b366](https://github.com/aws-powertools/powertools-lambda-typescript/commit/f08b366b79152d338ebefb5a25caacade6846919))
+- **event-handler** changed path parameter in middleware and routehandler signature ([#4532](https://github.com/aws-powertools/powertools-lambda-typescript/issues/4532)) ([278fca0](https://github.com/aws-powertools/powertools-lambda-typescript/commit/278fca0491ce9cb955326523557c3ddf9d03dbc5))
+- **event-handler** change the Middleware and RequestContext signatures ([#4530](https://github.com/aws-powertools/powertools-lambda-typescript/issues/4530)) ([a05c074](https://github.com/aws-powertools/powertools-lambda-typescript/commit/a05c07411629d1e23a9cb3fec8a78cf23bd8dd0c))
+
+### Features
+
+- **event-handler** implemented route prefixes in HTTP event handler ([#4523](https://github.com/aws-powertools/powertools-lambda-typescript/issues/4523)) ([8913854](https://github.com/aws-powertools/powertools-lambda-typescript/commit/89138542cd9e195555299f401646ae94d0bb50ee))
+- **event-handler** throw error when middleware does not await next() ([#4511](https://github.com/aws-powertools/powertools-lambda-typescript/issues/4511)) ([b0b43e8](https://github.com/aws-powertools/powertools-lambda-typescript/commit/b0b43e862fb189941fe9db220580884e7707d541))
+- **event-handler** add CORS middleware support ([#4477](https://github.com/aws-powertools/powertools-lambda-typescript/issues/4477)) ([972cd1f](https://github.com/aws-powertools/powertools-lambda-typescript/commit/972cd1f86b6ea01c93abef5e6cde7876360196f1))
+- **event-handler** added compress middleware for the REST API event handler ([#4495](https://github.com/aws-powertools/powertools-lambda-typescript/issues/4495)) ([320e0dc](https://github.com/aws-powertools/powertools-lambda-typescript/commit/320e0dcaa07476de3b7d07209ef27379b9d4900a))
+
+
 ## [2.26.1](https://github.com/aws-powertools/powertools-lambda-typescript/compare/v2.26.0...v2.26.1) (2025-09-15)
 
 ### Bug Fixes

README.md

@@ -5,7 +5,8 @@
 ![GitHub Release](https://img.shields.io/github/v/release/aws-powertools/powertools-lambda-typescript?style=flat)
 [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=aws-powertools_powertools-lambda-typescript&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=aws-powertools_powertools-lambda-typescript)
 [![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=aws-powertools_powertools-lambda-typescript&metric=security_rating)](https://sonarcloud.io/summary/new_code?id=aws-powertools_powertools-lambda-typescript)
-[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/aws-powertools/powertools-lambda-typescript/badge)](https://api.securityscorecards.dev/projects/github.com/aws-powertools/powertools-lambda-typescript)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/aws-powertools/powertools-lambda-typescript/badge)](https://scorecard.dev/viewer/?uri=github.com/aws-powertools/powertools-lambda-typescript)
+
 [![Discord](https://img.shields.io/badge/Discord-Join_Community-7289da.svg)](https://discord.gg/B8zZKbbyET)
 
 Powertools for AWS Lambda (TypeScript) is a developer toolkit to implement Serverless [best practices and increase developer velocity](https://docs.powertools.aws.dev/lambda/typescript/latest/#features).

docs/features/event-handler/rest.md

@@ -128,7 +128,7 @@ Please [check this issue](https://github.com/aws-powertools/powertools-lambda-ty
 
 ### Accessing request details
 
-You can access request details such as headers, query parameters, and body using the `Request` object provided to your route handlers and middleware functions via `reqCtx.request`.
+You can access request details such as headers, query parameters, and body using the `Request` object provided to your route handlers and middleware functions via `reqCtx.req`.
 
 ### Handling not found routes
 
@@ -148,6 +148,8 @@ You can use the `errorHandler()` method as a higher-order function or class meth
 
 This allows you to catch and return custom error responses, or perform any other error handling logic you need.
 
+Error handlers receive the error object and the request context as arguments, and can return a [`Response` object](#returning-response-objects) or a JavaScript object that will be auto-serialized as per the [response auto-serialization](#response-auto-serialization) section.
+
 !!! tip "You can also pass a list of error classes to the `errorHandler()` method."
 
 === "index.ts"
@@ -158,15 +160,17 @@ This allows you to catch and return custom error responses, or perform any other
 
 ### Throwing HTTP errors
 
-You can throw HTTP errors in your route handlers to return specific HTTP status codes and messages. Event Handler provides a set of built-in HTTP error classes that you can use to throw common HTTP errors.
+You can throw HTTP errors in your route handlers to stop execution and return specific HTTP status codes and messages. Event Handler provides a set of built-in HTTP error classes that you can use to throw common HTTP errors.
 
 This ensures that your Lambda function doesn't fail but returns a well-defined HTTP error response to the client.
 
 If you need to send custom headers or a different response structure/code, you can use the [Response](#returning-response-objects) object instead.
 
+!!! tip "You can throw HTTP errors in your route handlers, middleware, or custom error handlers!"
+
 === "index.ts"
 
-    ```ts hl_lines="3 10"
+    ```ts hl_lines="3 11"
     --8<-- "examples/snippets/event-handler/rest/gettingStarted_throwing_http_errors.ts:3"
     ```
 
@@ -194,15 +198,21 @@ All error classes accept optional parameters for custom messages and additional
 
 ### Route prefixes
 
-!!! note "Coming soon"
-
 When defining multiple routes related to a specific resource, it's common to have a shared prefix. For example, you might have several routes that all start with `/todos`.
 
 For example, if you have a custom domain `api.example.com` and you want to map it to the `/v1` base path of your API. In this case, all the requests will contain `/v1/<resource>` in the path, requiring you to repeat the `/v1` prefix in all your route definitions.
 
-At the moment, you have to manually include the prefix in each route definition, however we are planning to add support for route prefixes in a future release.
+To avoid repeating the prefix in each route definition, you can use the `prefix` constructor parameter when creating a new `Router` instance, and we'll automatically strip it from the request path before matching routes. After mapping a path prefix, the new root path will automatically be mapped to the path argument of `/`.
+
+=== "index.ts"
+
+    ```ts hl_lines="4 7"
+    --8<-- "examples/snippets/event-handler/rest/gettingStarted_route_prefix.ts:3"
+    ```
 
-Please [check this issue](https://github.com/aws-powertools/powertools-lambda-typescript/issues/4513) for more details and examples, and add 👍 if you would like us to prioritize it.
+This is also useful when splitting routes into separate files (see [Split routers](#split-routers) section) or when using [API mappings](https://docs.aws.amazon.com/apigateway/latest/developerguide/rest-api-mappings.html){target="_blank"} to map custom domains to specific base paths.
+
+For example, when using `prefix: '/pay'`, there is no difference between a request path of `/pay` and `/pay/`; and the path argument would be defined as `/`.
 
 ## Advanced
 
@@ -213,9 +223,8 @@ incoming request and your route handler. They provide a way to implement cross-c
 concerns like authentication, logging, validation, and response transformation without
 cluttering your route handlers.
 
-Each middleware function receives the following arguments:
+Each middleware function receives two arguments:
 
-* **params** - Route parameters extracted from the URL path
 * **reqCtx** - Request context containing the event, Lambda context, request, and response objects
 * **next** - A function to pass control to the next middleware in the chain
 
@@ -312,6 +321,11 @@ that no post-processing of your request will occur.
 A common pattern to create reusable middleware is to implement a factory functions that
 accepts configuration options and returns a middleware function.
 
+!!! note "Always `await next()` unless returning early"
+    Middleware functions must always call `await next()` to pass control to the next middleware
+    in the chain, unless you are intentionally returning early by returning a `Response` or
+    JSON object.
+
 === "index.ts"
 
     ```ts hl_lines="20-21 36 41"