Skip to content

chore(deps): bump tar, serverless and serverless-offline in /apps/jira/functions - #11178

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/apps/jira/functions/multi-b49a52f412
Open

chore(deps): bump tar, serverless and serverless-offline in /apps/jira/functions#11178
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/apps/jira/functions/multi-b49a52f412

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Removes tar. It's no longer used after updating ancestor dependencies tar, serverless and serverless-offline. These dependencies need to be updated together.

Removes tar

Updates serverless from 3.31.0 to 4.40.0

Release notes

Sourced from serverless's releases.

4.40.0

Features

  • Lambda self-managed code storage. Setting provider.deploymentBucket.codeStorageMode: reference makes Lambda run function and layer code directly from your deployment bucket instead of copying it into Lambda-managed storage, so your code no longer counts against the Lambda code storage quota. Every deployment pins each function and layer to the exact uploaded S3 object version, so later uploads never affect what runs. Because deployment artifacts back live Lambda versions in this mode, automatic post-deploy artifact cleanup is disabled — retire artifacts that no longer back any function or layer version with serverless prune --includeArtifacts (also available as custom.prune.includeArtifacts). Read more in the deployment bucket guide and the prune CLI reference, and see the aws-node-self-managed-code-storage example. (#13725)
provider:
  deploymentBucket:
    codeStorageMode: reference # default: copy
# Keep the 3 most recent function versions, then retire deployment
# artifacts that no longer back any surviving function or layer version
serverless prune -n 3 --includeArtifacts

Note reference mode requires a versioned deployment bucket that Lambda is allowed to read. The Framework-managed deployment bucket is configured automatically; custom buckets are validated and the deployment stops with instructions when a prerequisite is missing.

  • Compose: run a command on an exact subset of services. The --service option now accepts a comma-separated list for deploy, remove, info, print, and package. The command runs on exactly the named services, ordered by dependsOn; services not named are left untouched, and their outputs stay available for ${param:...} resolution — so a subset can reference services already deployed elsewhere. Read more in the Compose guide. (#13705)
serverless deploy --service=service-a,service-d --stage my-feature
  • Removed Serverless Container Framework and Serverless AI Framework. These products are no longer part of the CLI. Projects with a serverless.containers.* or serverless.ai.* configuration file now get a clear error with guidance: pin frameworkVersion: "4.39.0" (the last version supporting them) and the CLI automatically runs that version for the project. (#13698)
frameworkVersion: '4.39.0'

Bug Fixes

  • Fixed corrupted bundles when multiple functions share a handler file. The built-in esbuild packaging ran one build per function, so functions sharing a handler file wrote the same output concurrently — occasionally producing a corrupted bundle that failed at Lambda startup with Runtime.UserCodeSyntaxError. Each unique handler file is now built exactly once and reused across the functions that share it, which also removes the redundant rebuilds. (#13716, #13717) - Thanks @​dekpient for the report!
  • Fixed unchanged services being redeployed on every deploy. Artifacts produced by the built-in esbuild packaging embedded fresh file timestamps on every build, so identical code always looked changed to deploy change detection. Archive entry timestamps are now pinned, identical content produces byte-identical artifacts, and unchanged deployments are skipped as intended. (#13696)
  • Fixed the shared IAM role accumulating permissions for functions with dedicated roles. When only some functions use per-function IAM roles, the shared execution role no longer collects event-source and feature grants belonging to functions that have their own role — previously its inline policy grew with every function and could exceed the IAM policy size limit ("Maximum policy size exceeded"). Dedicated per-function roles also now receive grants that previously only existed on the shared role, including Kinesis enhanced fan-out consumer actions, stream onFailure destination grants, and kms:Decrypt for kmsKeyArn. (#13704)
  • Fixed a crash when frameworkVersion is "*". Version ranges without a concrete version, such as '*', no longer throw TypeError: Cannot read properties of null (reading 'major'). Since such ranges accept every version, the version check is skipped for them; all other values behave as before — pinning a different major version still fails with the version mismatch error, and invalid version strings still fail under configValidationMode: error. (#13714)
  • Safer development-dependency exclusion during packaging. When the production dependency listing cannot be determined, packaging now stops with a clear error instead of risking an artifact that excludes production dependencies (opt out with package.excludeDevDependencies: false); when no dependency listing is available at all, exclusion is skipped with a warning and the artifact ships fully functional. Dependency listing output is also captured directly rather than through the shell, making packaging robust in temporary directories containing spaces or special characters. (#13724, #13699)
  • Hardened validation of pinned canary versions in the installer. Malformed canary version values are rejected with a clear error, and release downloads are contained to the expected releases directory. (#13700)

Maintenance

  • Updated multiple dependencies:
    • Bumped the AWS SDK group with 36 updates (#13715)
    • Upgraded adm-zip to v0.6.0 (#13720)
    • Upgraded fast-uri to v3.1.4 (#13722)
    • Upgraded js-yaml to v4.3.0 (#13712)
    • Upgraded body-parser to v2.3.0 in the Bedrock AgentCore examples, addressing GHSA-v422-hmwv-36x6 (#13723)

... (truncated)

Commits
  • e2c559e chore: release 4.40.0 (#13726)
  • a5ad2d6 feat(aws): support Lambda self-managed code storage (reference mode) (#13725)
  • 60badd3 fix(packaging): stop packaging when the production dependency listing is unav...
  • eb0af13 fix(aws): scope shared IAM role to functions without dedicated per-function r...
  • 8159e96 fix(esbuild): build shared handler files once to prevent corrupted bundles (#...
  • 052eb97 chore(deps): bump the npm_and_yarn group across 5 directories with 1 update (...
  • c425f77 feat(compose): accept a comma-separated service list in --service (#13705)
  • 570a830 chore(deps): bump fast-uri from 3.1.3 to 3.1.4 (#13722)
  • 0acff69 chore(deps): bump adm-zip from 0.5.18 to 0.6.0 (#13720)
  • 3dcbfa7 chore: standardize development toolchain on Node 24 LTS and npm 12 (#13721)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for serverless since your current version.

Install script changes

This version modifies postinstall script that runs during installation. Review the package contents before updating.


Updates serverless-offline from 13.9.0 to 14.7.4

Release notes

Sourced from serverless-offline's releases.

v14.7.4

What's Changed

New Contributors

Full Changelog: dherault/serverless-offline@v14.7.3...v14.7.4

v14.7.3

What's Changed

Full Changelog: dherault/serverless-offline@v14.7.2...v14.7.3

v14.7.2

What's Changed

New Contributors

Full Changelog: dherault/serverless-offline@v14.7.1...v14.7.2

v14.7.1

What's Changed

New Contributors

Full Changelog: dherault/serverless-offline@v14.7.0...v14.7.1

v14.7.0

What's Changed

Full Changelog: dherault/serverless-offline@v14.6.0...v14.7.0

v14.6.0

What's Changed

... (truncated)

Changelog

Sourced from serverless-offline's changelog.

v14.7.4

v14.7.3

16 June 2026

v14.7.2

8 June 2026

v14.7.1

27 May 2026

v14.7.0

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 27, 2026
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/apps/jira/functions/multi-b49a52f412 branch from cc6b902 to 95efad7 Compare August 1, 2026 16:14
@dependabot
chore(deps): bump tar, serverless and serverless-offline
3e9dbd8 
Removes [tar](https://github.com/isaacs/node-tar). It's no longer used after updating ancestor dependencies [tar](https://github.com/isaacs/node-tar), [serverless](https://github.com/serverless/serverless) and [serverless-offline](https://github.com/dherault/serverless-offline). These dependencies need to be updated together.


Removes `tar`

Updates `serverless` from 3.31.0 to 4.40.0
- [Release notes](https://github.com/serverless/serverless/releases)
- [Changelog](https://github.com/serverless/serverless/blob/main/RELEASE_PROCESS.md)
- [Commits](https://github.com/serverless/serverless/compare/v3.31.0...sf-core@4.40.0)

Updates `serverless-offline` from 13.9.0 to 14.7.4
- [Release notes](https://github.com/dherault/serverless-offline/releases)
- [Changelog](https://github.com/dherault/serverless-offline/blob/master/CHANGELOG.md)
- [Commits](dherault/serverless-offline@v13.9.0...v14.7.4)

---
updated-dependencies:
- dependency-name: serverless
  dependency-version: 4.40.0
  dependency-type: direct:development
- dependency-name: serverless-offline
  dependency-version: 14.7.4
  dependency-type: direct:development
- dependency-name: tar
  dependency-version:
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/apps/jira/functions/multi-b49a52f412 branch from 95efad7 to 3e9dbd8 Compare August 1, 2026 16:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants