[SECURITY] Migrate Serverless Framework from v3 to v4 across all example projects

[ulises-jeremias]

Overview

Several open Dependabot security alerts in this repository trace back to vulnerable transitive dependencies bundled inside Serverless Framework v3. Upgrading to Serverless Framework v4 resolves these at the source, rather than applying workaround patches to each example individually.

This issue tracks the investigation and migration effort across all affected examples.

---

Affected Dependabot Alerts

The following packages are flagged across 15+ examples, and their fix path points to serverless >= 4.0.0:

Package	Severity	Alerts	CVE / Advisory
tar	High	48	GHSA-f5x3-32g6-xq36, GHSA-3jfq-g458-7qm9
adm-zip	High	6	GHSA-54g3-wgp4-r5x2
brace-expansion	High	35	GHSA-v6h2-p8h4-qcjw
decompress	Critical	6	GHSA-x7mh-q3r-mg2q
uuid	Medium	17	GHSA-x7mh-ug5v-39jq
file-type	High	—	GHSA-mwqq-9qge-5fhg

Affected examples:

• examples/serverless-appsync-node-typescript
• examples/serverless-appsync-python
• examples/serverless-cognito-local
• examples/serverless-glue-deployment
• examples/serverless-glue-full-boilerplate
• examples/serverless-neo4j-ec2
• examples/serverless-node-typescript-bundle
• examples/serverless-node-typescript-middy
• examples/serverless-node-typescript-middy-custom-middleware
• examples/serverless-node-typescript-nest
• examples/serverless-s3-local
• examples/serverless-sqs-node-typescript-offline-with-elasticmq
• examples/serverless-sqs-python
• examples/serverless-start-stop-ec2-instance
• examples/serverless-twilio-aws-lambdas-typescript

---

Investigation Scope

Before starting, a contributor should evaluate:

1. Breaking changes in Serverless Framework v4

Serverless Framework v4 introduced breaking changes. Review the official migration guide and v4 changelog to understand what each example may need to change:

• serverless.yml schema changes (service name limits, provider config)
• Removed CLI commands (serverless dashboard, deploy profile changes)
• Plugin API compatibility (some v3 plugins may not support v4)
• Serverless Compose changes

2. Plugin compatibility matrix

Each example uses a different set of plugins. Map which plugins support v4:

Plugin	v4 compatible?
serverless-plugin-typescript	❓
serverless-offline	✅ (already requires v4)
serverless-appsync-simulator	❓
serverless-localstack	❓

3. Licensing model changes

Serverless Framework v4 introduced a new licensing model (subscription required for some team features). Verify that the examples can still be used freely in open-source and educational contexts.

4. Consider per-example vs. bulk migration

Options:

• A) Migrate all at once — update all package.json files to serverless@^4
• B) Migrate one example first — pick the simplest one, migrate it, document what changed, then repeat
• C) Use npm overrides — force patched versions of specific transitive packages without bumping serverless (less clean, but avoids breaking example behaviour)

---

Proposed First Steps

1. Run npm audit in the simplest example (serverless-node-typescript-bundle) and confirm the alerts that point to serverless
2. Try npm install serverless@^4 --save-dev in that example and run sls --version to confirm it works
3. Check if the example's serverless.yml is valid with v4: sls print
4. Document which changes were needed
5. Open a PR for that single example as a reference

---

Validation

# After updating a given example:
cd examples/<example-name>
npm install
npx sls --version       # should show 4.x
npx sls print           # should parse serverless.yml without errors
npm audit               # should show 0 critical/high from serverless-related deps

---

References

• Serverless Framework v4 Migration Guide
• Serverless Framework v4 Release Notes
• npm overrides documentation
• Dependabot security alerts