Bump software.amazon.lambda:powertools-cloudformation from 2.10.0 to 2.11.0

[dependabot]

Bumps software.amazon.lambda:powertools-cloudformation from 2.10.0 to 2.11.0.

Release notes

Sourced from software.amazon.lambda:powertools-cloudformation's releases.

v2.11.0

Summary

📣 Starting with this release, Powertools for AWS Lambda (Java) requires Java 17 or later. If your functions still run on the java11 runtime, we recommend that you upgrade to Java 21 or 25 to get the latest features and fixes.

This release also adds an S3 bucket allowlist to the Large Messages utility, automatic tenant ID logging for functions that use Lambda tenant isolation, and SnapStart priming for the Large Messages utility. We fixed a bug that stopped SnapStart priming from loading any classes in the Tracing utility, and we updated Jackson and Logback to address 10 CVEs.

🌟 Thanks to @​David-DAM, @​pascalknupper, and @​Pratapchandradeo for contributing for the first time!

⚠️ Java 17 Minimum Version

Upgrade guide

Powertools for AWS Lambda (Java) now compiles to Java 17 bytecode and no longer supports Java 11. Move your functions to the java17, java21, or java25 Lambda runtime before you upgrade. The public API is unchanged, so you don't need to change your code.

The change stays within v2, as our versioning policy allows. Java 11 blocked upgrades to dependencies such as JUnit 6 and protobuf-maven-plugin. See the announcement for details.

✨ Allowed Buckets in Large Messages

Docs

The message sender chooses the S3 bucket in a large message pointer. To limit the buckets the utility reads from and deletes from, pass an allowlist to LargeMessageConfig. If a pointer names a bucket that is not in the list, the utility throws LargeMessageProcessingException before it calls S3. The allowlist is empty by default, and an empty list applies no restriction, so existing functions behave as before. The allowlist works with the @LargeMessage annotation and with the functional API.

We recommend that you also scope your function's IAM policy to the offload bucket.

Basic usage:

import com.amazonaws.services.lambda.runtime.Context;
import com.amazonaws.services.lambda.runtime.RequestHandler;
import com.amazonaws.services.lambda.runtime.events.SQSBatchResponse;
import com.amazonaws.services.lambda.runtime.events.SQSEvent;
import java.util.Set;
import software.amazon.lambda.powertools.largemessages.LargeMessageConfig;
import software.amazon.lambda.powertools.largemessages.LargeMessages;
public class SqsMessageHandler implements RequestHandler<SQSEvent, SQSBatchResponse> {
public SqsMessageHandler() {
    LargeMessageConfig.init().withAllowedBuckets(Set.of(&quot;my-offload-bucket&quot;));
}
@Override
public SQSBatchResponse handleRequest(SQSEvent event, Context context) {
for (SQSEvent.SQSMessage message : event.getRecords()) {
// throws LargeMessageProcessingException if the bucket is not in the allowlist
LargeMessages.processLargeMessage(message, this::processRawMessage);
}
return SQSBatchResponse.builder().build();
}

</tr></table>

... (truncated)

Changelog

Sourced from software.amazon.lambda:powertools-cloudformation's changelog.

[v2.11.0] - 2026-10-06

Bug Fixes

• common: strip leading whitespace in ClassPreLoader (#2560)
• tracing: declare jackson-core and bump X-Ray SDK to 2.21.1 (#2653)

Features

• Support CRaC and priming of powertools large messages (#2533)
• large-messages: add optional allowedBuckets allowlist (#2555)
• logging: add automatic TenantId logging to Logger default properties (#2471)

Maintenance

• bump github/codeql-action from 4.35.5 to 4.36.0 (#2515)
• bump graalvm/setup-graalvm from 1.5.4 to 1.5.6 (#2536)
• bump org.codehaus.mojo:versions-maven-plugin (#2426)
• bump org.apache.maven.plugins:maven-jar-plugin (#2427)
• bump release-drafter/release-drafter from 7.1.0 to 7.1.1 (#2428)
• bump org.graalvm.buildtools:native-maven-plugin (#2425)
• bump github/codeql-action from 4.33.0 to 4.34.1 (#2435)
• bump sam/build-java25 (#2628)
• bump github/codeql-action/upload-sarif from 4.37.8 to 4.38.2 (#2634)
• bump gitpython from 3.1.58 to 3.1.62 in /docs (#2627)
• bump aws.sdk.version from 2.49.5 to 2.54.6 (#2617)
• bump aws-actions/configure-aws-credentials from 6.2.3 to 6.3.0 (#2632)
• bump graalvm/setup-graalvm from 1.6.4 to 1.6.7 (#2637)
• bump release-drafter/release-drafter from 7.7.0 to 7.9.0 (#2638)
• bump soupsieve from 2.8.4 to 2.9 in /docs (#2631)
• bump actions/setup-java from 6.0.0 to 6.0.1 (#2630)
• bump com.amazonaws:aws-lambda-java-serialization (#2601)
• bump gitpython from 3.1.57 to 3.1.58 in /docs (#2606)
• bump graalvm/setup-graalvm from 1.6.3 to 1.6.4 (#2608)
• bump org.apache.logging.log4j:log4j-api from 2.26.0 to 2.26.1 (#2610)
• bump github/codeql-action/upload-sarif from 4.37.4 to 4.37.8 (#2615)
• bump actions/setup-java from 5.7.0 to 6.0.0 (#2616)
• bump aws.sdk.version from 2.48.0 to 2.49.5 (#2594)
• bump release-drafter/release-drafter from 7.6.0 to 7.7.0 (#2595)
• bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.4 (#2596)
• bump actions/setup-java from 5.6.0 to 5.7.0 (#2598)
• bump sam/build-java25 (#2599)
• bump gitpython from 3.1.54 to 3.1.57 in /docs (#2600)
• bump gitpython from 3.1.50 to 3.1.54 in /docs (#2592)
• bump org.junit.jupiter:junit-jupiter from 5.14.3 to 5.14.4 (#2584)
• bump aws-actions/configure-aws-credentials from 6.2.2 to 6.2.3 (#2586)
• bump github/codeql-action/upload-sarif from 4.37.1 to 4.37.3 (#2587)
• bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#2589)
• bump software.amazon.awscdk:aws-cdk-lib (#2591)
• bump sam/build-java25 (#2593)
• bump aws.sdk.version from 2.47.4 to 2.48.0 (#2575)

... (truncated)

Commits

• 000f996 chore(deps): upgrade WireMock to 4.0.0-beta.39 (#2664)
• f2f2e7e chore(v2): drop java 11 support (#2597)
• 2e44849 chore(examples): pin Jackson in CDK infra and Kotlin examples (#2654)
• 8bc27f6 chore(deps): pin lz4-java to 1.11.2 in Kafka utility and example (#2656)
• 4e10c8c chore(examples): remove committed Gradle wrapper from Gradle examples (#2657)
• cf00955 chore: add CODEOWNERS file (#2658)
• a99ebc1 fix(tracing): declare jackson-core and bump X-Ray SDK to 2.21.1 (#2653)
• 5ad48be chore(examples): rename sdk.version to aws.sdk.version in batch example (#2645)
• d04800d chore(deps): bump jackson to 2.22.3 to address CVE-2026-89425 and CVE-2026-89...
• ff28066 chore(deps): bump logback-classic to 1.5.38 to address logback-core CVEs (#2644)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[docwho2]

Auto-approve Dependabot