Announcing the LocalStack for AWS 2026.10.0 Release

Introduction

LocalStack for AWS 2026.10.0 is now available. This release introduces Lambda Web Functions for running Node.js web applications and APIs as HTTP servers in Lambda Web sandboxes. You can create functions, immutable revisions, and HTTPS endpoints, then run the application locally with Docker or Kubernetes.

The release also adds native EventBridge Scheduler emulation with support for AWS service targets, universal AWS SDK targets, retry policies, and dead-letter queues. API Gateway WebSocket APIs move to the shared gateway endpoint, while REST API imports and exports preserve more OpenAPI, documentation, security, model, and integration settings. Other changes cover S3 Files, AWS Batch, AppSync, Step Functions, CloudFormation, EC2, and the LocalStack Docker image.

How to upgrade?

To upgrade to LocalStack for AWS 2026.10.0, use lstk, which authenticates the session and pulls the latest image when started with:

lstk

If using Docker CLI or Docker Compose, update the Docker image:

docker pull localstack/localstack-pro:2026.10.0

Both Docker Hub images (localstack/localstack and localstack/localstack-pro) are supported and contain the same image. Refer to the 2026.03.0 release notes for details about the consolidated image and auth token requirement.

What’s new in LocalStack for AWS 2026.10.0?

• Lambda Web Functions
• EventBridge Scheduler emulation and targets
• API Gateway WebSocket API migration
• API Gateway REST APIs
• CloudFormation updates
• S3 Files and S3
• Other provider and runtime changes
• Deprecations and removals
• Conclusion

Lambda Web Functions

Lambda Web Functions run web applications and APIs as HTTP servers without adapting them to Lambda event handlers. LocalStack supports functions, immutable revisions, and HTTPS endpoints for nodejs24.x applications running in Docker containers or Kubernetes pods.

Endpoints support weighted traffic shifting, IAM authentication, response streaming, and scaling and throttling controls. HomeRegion endpoints can also deploy the latest revision automatically. The available endpoint types are HomeRegion, PerRegion, and MultiRegion. LocalStack serves their domains under localhost.localstack.cloud.

Lambda Web Functions also support hot reloading from a local host directory. Set a revision’s codeConfig.s3Object.bucket to hot-reload and its key to the absolute host path. LocalStack restarts the application when files change, so updated code runs without creating a new revision or redeploying the function.

Application output is available in CloudWatch Logs.

CloudFormation can deploy Lambda Web functions, endpoints, and revisions, including supported updates and immutable revision replacement. Lambda Web Functions are available on all plans, starting with Hobby.

Refer to the Lambda Web Functions documentation for the current limitations and supported behavior.

EventBridge Scheduler emulation and targets

EventBridge Scheduler now uses a native provider that runs one-time, rate, and cron schedules. Schedules can deliver to SQS, SNS, Lambda, EventBridge, Kinesis, Step Functions, ECS, Firehose, CodePipeline, and universal AWS SDK targets. Scheduling honors time zones, start and end dates, state, retry policies, and dead-letter queues.

Schedule creation and updates reject invalid target parameters, universal target inputs, retry policies, and past start dates. Dead-letter messages use EXHAUSTED_RETRY_CONDITION only when the retry policy rules out another attempt.

For local tests, send a POST request to /_aws/scheduler/schedules/<schedule-arn>/trigger to run a schedule immediately.

Schedule groups support the Resource Groups Tagging API. The Cloud Control API can read and list schedules and schedule groups. GetResource finds schedules in the default group, while ListResources returns schedules from all groups.

API Gateway WebSocket API migration

API Gateway WebSocket APIs now use the shared gateway endpoint. Their ApiEndpoint changes from ws://localhost.localstack.cloud:<port> to ws://<api-id>.execute-api.localhost.localstack.cloud:4566, the same shape as other API types. Clients can also use the path-style URL ws://localhost.localstack.cloud:4566/_aws/execute-api/<api-id>/<stage>. Set APIGW_WEBSOCKETS_LEGACY_PORT=1 during migration if a client still requires a per-API port. LocalStack then also serves each WebSocket API on its own port and returns that port as ApiEndpoint. This compatibility setting is deprecated and will be removed. Refer to the WebSocket API documentation for both endpoint formats.

Routes with ApiKeyRequired now enforce API keys. Custom domains support WebSocket mappings with the same protocol-mixing restrictions as AWS. Idle connections close after 10 minutes, all connections close after 2 hours, and messages larger than 128 KiB are rejected. A bug that prevented route and integration responses from working after a persistence restore is fixed.

API Gateway REST APIs

API Gateway REST API import now supports merge and overwrite behavior while preserving existing resource identifiers. Merge keeps omitted resources and settings, while overwrite resets unlisted customized gateway responses. Failed imports leave the existing API unchanged.

• Imports keep integration settings, path-level parameters, content-type-specific models, gateway responses, and documentation parts from the definition. A root-level API key requirement applies to every method, Swagger 2.0 root-level security is rejected, and returned API policies expand execute-api resources to the API ARN.
• Request validation, mapping templates, and binary body handling use the request content type. Lambda proxy integrations receive a base64-encoded body only when the request Content-Type matches a configured binary media type, and a UTF-8 body otherwise. Custom gateway responses apply to errors, repeated request headers resolve to their last value in Lambda proxy events and mapping templates, and IAM authorization requires X-Amz-Date or Date.
• Integrations enforce timeoutInMillis, which defaults to 29 seconds, and return HTTP 504 on timeout. A slow Lambda proxy integration is not invoked a second time.
• GetExport uses the selected stage deployment and can include integrations, authorizers, validators, gateway responses, security settings, and published documentation.

CloudFormation updates

CloudFormation can create and update Lambda functions with FileSystemConfigs. Removing the property sends an empty configuration and detaches the S3 Files or EFS mount. An update changes inline function code only when the Code property changes, which keeps CodeSha256 stable for unrelated stack updates.

S3 Files and S3

S3 Files mounts in Lambda functions and ECS tasks now work when LOCALSTACK_HOST uses a different port from the gateway. With IAM enforcement enabled, file systems whose role uses the documented AWS policies start, and a role that cannot write to the bucket puts the file system into the error state. Export failures are available through the user.s3files.status attribute, and synchronization preserves object metadata written by other clients.

S3 rejects user-defined object metadata larger than 2 KB with MetadataTooLarge.

Other provider and runtime changes

Other changes include:

• AWS Batch supports bulk cancellation and termination and returns job timestamps in epoch milliseconds.
• AppSync VTL resolvers support Java String methods such as trim(), toLowerCase(), and toUpperCase() on $ctx values, and $1 replacement groups in replaceAll.
• Step Functions apigateway:invoke tasks send each element of a list-valued header as a separate header value and reject header values that are not lists of strings with States.Runtime.
• Terminated or deleted EC2 instances, including self-managed EKS nodes, no longer leave empty anonymous Docker volumes.

Deprecations and removals

Git URL installation for LocalStack extensions is no longer supported. Install an extension from PyPI, or build it locally and install it with a file:// URL.

The legacy API Gateway providers and the legacy REST API implementation are removed. PROVIDER_OVERRIDE_APIGATEWAY, PROVIDER_OVERRIDE_APIGATEWAYV2, and PROVIDER_OVERRIDE_APIGATEWAYMANAGEMENTAPI values that select legacy, legacy_pro, next_gen, or next_gen_pro are ignored with a warning.

The LocalStack Docker image no longer includes curl or binutils. Custom scripts and derived images that require these utilities must install them explicitly. Removing binutils eliminates 69 low-severity OS CVEs that Debian does not plan to fix in trixie while preserving Java runtime image generation.

Conclusion

Upgrade to LocalStack for AWS 2026.10.0 to run Lambda Web Functions locally, test one-time and recurring EventBridge Scheduler schedules, and use the updated API Gateway providers. Review the Lambda Web documentation, API Gateway migration notes, and extension installation change before updating existing environments. Report problems or parity gaps through GitHub Discussions.