Bug: get_parameters_by_name mutates the caller's parameters dict, so later global decrypt/transform are ignored #8590

Expected Behaviour

get_parameters_by_name(params, decrypt=True) applies decrypt=True to every parameter without a per-parameter override, no matter how many times params was used before. The input dict is not modified.

Current Behaviour

_overrides = options or {} (ssm.py:716) writes transform and decrypt back into the user's dict. On the first call they are filled with the current globals; on later calls those stale values win over the new global decrypt/transform. Only non-empty override dicts are affected ({} is falsy and gets copied). A module-level PARAMS = {...} reused across invocations, as in the docs, hits this.

Code snippet

from botocore.config import Config
from botocore.stub import Stubber
from aws_lambda_powertools.utilities.parameters import SSMProvider

provider = SSMProvider(boto_config=Config(region_name="us-east-1"))
stub = Stubber(provider.client)
resp = {"Parameters": [{"Name": "/a", "Value": "v", "Type": "String", "Version": 1}]}
stub.add_response("get_parameters", resp, {"Names": ["/a"]})
stub.add_response("get_parameters", resp, {"Names": ["/a"]})   # second call: no WithDecryption sent
stub.activate()

params = {"/a": {"max_age": 0}}
provider.get_parameters_by_name(params)
print(params)  # {'/a': {'max_age': 0, 'transform': None, 'decrypt': False}}   input was mutated
provider.get_parameters_by_name(params, decrypt=True)  # still fetched without decryption

Possible Solution

_overrides = {**(options or {})} so the caller's dict is never written to.

Steps to Reproduce

Run the snippet above (it uses botocore.stub.Stubber, no AWS access needed).

Powertools for AWS Lambda (Python) version

latest

AWS Lambda function runtime

3.13

Packaging format used

PyPi

Debugging logs