fix(lambda): bump @middy/core from 6.4.5 to 7.9.2 in /lambdas

[dependabot]

Bumps @middy/core from 6.4.5 to 7.9.2.

Release notes

Sourced from @​middy/core's releases.

7.9.2

What's Changed

• fix CI issue

Full Changelog: middyjs/middy@7.9.1...7.9.2

7.9.1

What's Changed

• attempt to fix CI fail issue

Note: Use 7.9.2

Full Changelog: middyjs/middy@7.9.0...7.9.1

7.9.0

What's Changed

New middleware: @middy/http-dpop

DPoP (RFC 9449) sender-constrained tokens. Runs after a token verifier, reads the cnf.jkt thumbprint (RFC 7800) off the verified payload, and requires the request to prove possession of that key, so a stolen token is worthless on its own. Verification uses node:crypto only, no peer dependency.

Adoption is incremental: a token without cnf.jkt passes through as an ordinary bearer token until you set required: true. htu is built from origin (or requestContext.domainName), never the client-controlled Host header. Rejections are 401 with WWW-Authenticate: DPoP algs="...". No jti replay cache by design, see the docs for why and for the userland hook.

Docs: https://middy.js.org/docs/middlewares/http-dpop

@middy/http-jwt and @middy/http-paseto

• expectedClaims (new option): claims the payload must carry, compared with strict equality, e.g. { token_use: 'access' }. Absent claim fails like a wrong value. Checked after the signature and before the payload is published. Values must be string/number/boolean; arrays and objects are refused at construction.
• Key rotation: internalKey may now resolve to an array of keys. Tried in order, first success wins, and the signing key's own failure is reported rather than a signature miss from a bystander key. Each entry resolves independently, so a KMS keySpec narrows the algorithm allowlist per key, not middleware-wide. Empty array is a 500, not a silent 401.
• More key shapes: an already-resolved KeyObject or CryptoKey is accepted alongside { publicKey } (KMS), raw SPKI DER, and string secrets. An unsupported shape now throws a labelled 500 instead of leaking a bare TypeError.
• DPoP auth scheme: Authorization: DPoP <token> is parsed alongside Bearer.

CI / infra

• Staged publish audit, workflow hardening, OSSF Scorecard and SAST pipeline updates
• Dependency bumps (GitHub Actions group, 7 updates)
• Docs: DEPENDENCIES, WORKSTATION, SPVS compliance, incident response

Note: CI failed, use 7.9.2

Full Changelog: middyjs/middy@7.8.0...7.9.0

7.8.0

What's Changed

• fix: event-normalizer: SQS bodies that aren't JSON throw SyntaxError (regression in 7.6.8) #1680
• New Middlewares: ecs-* (ECS Runners) by @​willfarrell in middyjs/middy#1628
• feat: support v2 of protocol x402 by @​willfarrell in middyjs/middy#1679

Full Changelog: middyjs/middy@7.7.4...7.8.0

... (truncated)

Commits

• 537f456 chore: version bump
• c46f899 chore: version bump
• 1d4dcd4 chore: version bump
• 4546eec chore: version bump
• 2f8c4a5 feat: fix regressions and hardening
• 8a7e2ce chore: version bump
• 4ef9b97 chore: version bump
• b38881e chore: dep update
• cf532f1 chore: version bump
• fdaaaad chore: version bump
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​middy/core since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@middy/core	^7.9.2	Unknown	Unknown
npm/@middy/core	^7.9.2	Unknown	Unknown
npm/@middy/core	^7.9.2	Unknown	Unknown
npm/@middy/core	^7.9.2	Unknown	Unknown
npm/@middy/core	7.9.2	🟢 9.8	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 Dependency-Update-Tool 🟢 10 update tool detected Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices 🟢 10 badge detected: Gold License 🟢 10 license file detected SAST 🟢 10 SAST tool is run on all commits Vulnerabilities 🟢 8 2 existing vulnerabilities detected Fuzzing 🟢 10 project is fuzzed Packaging 🟢 10 packaging workflow detected Branch-Protection 🟢 10 branch protection is fully enabled on development and all release branches Signed-Releases ⚠️ -1 no releases found CI-Tests 🟢 10 5 out of 5 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 29 contributing companies or organizations
npm/@middy/util	7.9.2	🟢 9.8	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 Dependency-Update-Tool 🟢 10 update tool detected Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices 🟢 10 badge detected: Gold License 🟢 10 license file detected SAST 🟢 10 SAST tool is run on all commits Vulnerabilities 🟢 8 2 existing vulnerabilities detected Fuzzing 🟢 10 project is fuzzed Packaging 🟢 10 packaging workflow detected Branch-Protection 🟢 10 branch protection is fully enabled on development and all release branches Signed-Releases ⚠️ -1 no releases found CI-Tests 🟢 10 5 out of 5 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 29 contributing companies or organizations

Scanned Files

• lambdas/functions/control-plane/package.json
• lambdas/functions/gh-agent-syncer/package.json
• lambdas/functions/termination-watcher/package.json
• lambdas/functions/webhook/package.json
• lambdas/yarn.lock