Skip to content

chore(deps): bump picomatch, serverless, serverless-offline and serverless-python-requirements in /examples/serverless-python-fastapi - #300

Merged
ulises-jeremias merged 1 commit into
mainfrom
dependabot/npm_and_yarn/examples/serverless-python-fastapi/multi-bc4b6c790b
Jul 27, 2026
Merged

chore(deps): bump picomatch, serverless, serverless-offline and serverless-python-requirements in /examples/serverless-python-fastapi#300
ulises-jeremias merged 1 commit into
mainfrom
dependabot/npm_and_yarn/examples/serverless-python-fastapi/multi-bc4b6c790b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 26, 2026

Copy link
Copy Markdown
Contributor

Removes picomatch. It's no longer used after updating ancestor dependencies picomatch, serverless, serverless-offline and serverless-python-requirements. These dependencies need to be updated together.

Removes picomatch

Updates serverless from 3.34.0 to 4.40.0

Release notes

Sourced from serverless's releases.

4.40.0

Features

  • Lambda self-managed code storage. Setting provider.deploymentBucket.codeStorageMode: reference makes Lambda run function and layer code directly from your deployment bucket instead of copying it into Lambda-managed storage, so your code no longer counts against the Lambda code storage quota. Every deployment pins each function and layer to the exact uploaded S3 object version, so later uploads never affect what runs. Because deployment artifacts back live Lambda versions in this mode, automatic post-deploy artifact cleanup is disabled — retire artifacts that no longer back any function or layer version with serverless prune --includeArtifacts (also available as custom.prune.includeArtifacts). Read more in the deployment bucket guide and the prune CLI reference, and see the aws-node-self-managed-code-storage example. (#13725)
provider:
  deploymentBucket:
    codeStorageMode: reference # default: copy
# Keep the 3 most recent function versions, then retire deployment
# artifacts that no longer back any surviving function or layer version
serverless prune -n 3 --includeArtifacts

Note reference mode requires a versioned deployment bucket that Lambda is allowed to read. The Framework-managed deployment bucket is configured automatically; custom buckets are validated and the deployment stops with instructions when a prerequisite is missing.

  • Compose: run a command on an exact subset of services. The --service option now accepts a comma-separated list for deploy, remove, info, print, and package. The command runs on exactly the named services, ordered by dependsOn; services not named are left untouched, and their outputs stay available for ${param:...} resolution — so a subset can reference services already deployed elsewhere. Read more in the Compose guide. (#13705)
serverless deploy --service=service-a,service-d --stage my-feature
  • Removed Serverless Container Framework and Serverless AI Framework. These products are no longer part of the CLI. Projects with a serverless.containers.* or serverless.ai.* configuration file now get a clear error with guidance: pin frameworkVersion: "4.39.0" (the last version supporting them) and the CLI automatically runs that version for the project. (#13698)
frameworkVersion: '4.39.0'

Bug Fixes

  • Fixed corrupted bundles when multiple functions share a handler file. The built-in esbuild packaging ran one build per function, so functions sharing a handler file wrote the same output concurrently — occasionally producing a corrupted bundle that failed at Lambda startup with Runtime.UserCodeSyntaxError. Each unique handler file is now built exactly once and reused across the functions that share it, which also removes the redundant rebuilds. (#13716, #13717) - Thanks @​dekpient for the report!
  • Fixed unchanged services being redeployed on every deploy. Artifacts produced by the built-in esbuild packaging embedded fresh file timestamps on every build, so identical code always looked changed to deploy change detection. Archive entry timestamps are now pinned, identical content produces byte-identical artifacts, and unchanged deployments are skipped as intended. (#13696)
  • Fixed the shared IAM role accumulating permissions for functions with dedicated roles. When only some functions use per-function IAM roles, the shared execution role no longer collects event-source and feature grants belonging to functions that have their own role — previously its inline policy grew with every function and could exceed the IAM policy size limit ("Maximum policy size exceeded"). Dedicated per-function roles also now receive grants that previously only existed on the shared role, including Kinesis enhanced fan-out consumer actions, stream onFailure destination grants, and kms:Decrypt for kmsKeyArn. (#13704)
  • Fixed a crash when frameworkVersion is "*". Version ranges without a concrete version, such as '*', no longer throw TypeError: Cannot read properties of null (reading 'major'). Since such ranges accept every version, the version check is skipped for them; all other values behave as before — pinning a different major version still fails with the version mismatch error, and invalid version strings still fail under configValidationMode: error. (#13714)
  • Safer development-dependency exclusion during packaging. When the production dependency listing cannot be determined, packaging now stops with a clear error instead of risking an artifact that excludes production dependencies (opt out with package.excludeDevDependencies: false); when no dependency listing is available at all, exclusion is skipped with a warning and the artifact ships fully functional. Dependency listing output is also captured directly rather than through the shell, making packaging robust in temporary directories containing spaces or special characters. (#13724, #13699)
  • Hardened validation of pinned canary versions in the installer. Malformed canary version values are rejected with a clear error, and release downloads are contained to the expected releases directory. (#13700)

Maintenance

  • Updated multiple dependencies:
    • Bumped the AWS SDK group with 36 updates (#13715)
    • Upgraded adm-zip to v0.6.0 (#13720)
    • Upgraded fast-uri to v3.1.4 (#13722)
    • Upgraded js-yaml to v4.3.0 (#13712)
    • Upgraded body-parser to v2.3.0 in the Bedrock AgentCore examples, addressing GHSA-v422-hmwv-36x6 (#13723)

... (truncated)

Commits
  • e2c559e chore: release 4.40.0 (#13726)
  • a5ad2d6 feat(aws): support Lambda self-managed code storage (reference mode) (#13725)
  • 60badd3 fix(packaging): stop packaging when the production dependency listing is unav...
  • eb0af13 fix(aws): scope shared IAM role to functions without dedicated per-function r...
  • 8159e96 fix(esbuild): build shared handler files once to prevent corrupted bundles (#...
  • 052eb97 chore(deps): bump the npm_and_yarn group across 5 directories with 1 update (...
  • c425f77 feat(compose): accept a comma-separated service list in --service (#13705)
  • 570a830 chore(deps): bump fast-uri from 3.1.3 to 3.1.4 (#13722)
  • 0acff69 chore(deps): bump adm-zip from 0.5.18 to 0.6.0 (#13720)
  • 3dcbfa7 chore: standardize development toolchain on Node 24 LTS and npm 12 (#13721)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for serverless since your current version.

Install script changes

This version modifies postinstall script that runs during installation. Review the package contents before updating.


Updates serverless-offline from 11.6.0 to 14.7.4

Release notes

Sourced from serverless-offline's releases.

v14.7.4

What's Changed

New Contributors

Full Changelog: dherault/serverless-offline@v14.7.3...v14.7.4

v14.7.3

What's Changed

Full Changelog: dherault/serverless-offline@v14.7.2...v14.7.3

v14.7.2

What's Changed

New Contributors

Full Changelog: dherault/serverless-offline@v14.7.1...v14.7.2

v14.7.1

What's Changed

New Contributors

Full Changelog: dherault/serverless-offline@v14.7.0...v14.7.1

v14.7.0

What's Changed

Full Changelog: dherault/serverless-offline@v14.6.0...v14.7.0

v14.6.0

What's Changed

... (truncated)

Changelog

Sourced from serverless-offline's changelog.

v14.7.4

v14.7.3

16 June 2026

v14.7.2

8 June 2026

v14.7.1

27 May 2026

v14.7.0

... (truncated)

Commits

Updates serverless-python-requirements from 6.0.0 to 6.1.2

Release notes

Sourced from serverless-python-requirements's releases.

6.1.2 (2025-02-11)

Bug Fixes

  • Use absolute paths to ensure compatibility with v4 Compose (#854) (bceb737)

Comparison since last release

6.1.1 (2024-06-03)

Maintanance improvements

Comparison since last release

6.1.0 (2024-03-27)

Features

Bug Fixes

Comparison since last release

Changelog

Sourced from serverless-python-requirements's changelog.

6.1.2 (2025-02-11)

Bug Fixes

  • Use absolute paths to ensure compatibility with v4 Compose (#854) (bceb737)

6.1.1 (2024-06-03)

6.1.0 (2024-03-27)

Features

Bug Fixes

6.0.1 (2023-10-22)

Bug Fixes

Maintenance Improvements

Commits
  • b58ce60 chore: Release v6.1.2 (#855)
  • bceb737 fix: Use absolute paths to ensure compatibility with v4 Compose (#854)
  • 57f7c6b chore: Release 6.1.1 (#840)
  • d2e492f chore: Update serverless dependency
  • 6e806c0 ci: Update actions to latest versions
  • 840d28d chore: Release v6.1.0
  • ca617bb chore: Bump dependencies
  • fa9ac03 Add docker rootless feature flag and its implementation for supporting docke ...
  • 549aba0 test: Bump node version in test configs
  • 27b70f4 fix: Ensure proper support for mixed runtimes and architectures (#815)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump picomatch, serverless, serverless-offline and serve…
a5bf5f6 
…rless-python-requirements

Removes [picomatch](https://github.com/micromatch/picomatch). It's no longer used after updating ancestor dependencies [picomatch](https://github.com/micromatch/picomatch), [serverless](https://github.com/serverless/serverless), [serverless-offline](https://github.com/dherault/serverless-offline) and [serverless-python-requirements](https://github.com/UnitedIncome/serverless-python-requirements). These dependencies need to be updated together.


Removes `picomatch`

Updates `serverless` from 3.34.0 to 4.40.0
- [Release notes](https://github.com/serverless/serverless/releases)
- [Changelog](https://github.com/serverless/serverless/blob/main/RELEASE_PROCESS.md)
- [Commits](https://github.com/serverless/serverless/compare/v3.34.0...sf-core@4.40.0)

Updates `serverless-offline` from 11.6.0 to 14.7.4
- [Release notes](https://github.com/dherault/serverless-offline/releases)
- [Changelog](https://github.com/dherault/serverless-offline/blob/master/CHANGELOG.md)
- [Commits](dherault/serverless-offline@v11.6.0...v14.7.4)

Updates `serverless-python-requirements` from 6.0.0 to 6.1.2
- [Release notes](https://github.com/UnitedIncome/serverless-python-requirements/releases)
- [Changelog](https://github.com/serverless/serverless-python-requirements/blob/master/CHANGELOG.md)
- [Commits](serverless/serverless-python-requirements@v6.0.0...v6.1.2)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version:
  dependency-type: indirect
- dependency-name: serverless
  dependency-version: 4.40.0
  dependency-type: direct:development
- dependency-name: serverless-offline
  dependency-version: 14.7.4
  dependency-type: direct:development
- dependency-name: serverless-python-requirements
  dependency-version: 6.1.2
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 26, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 26, 2026
@github-actions

github-actions Bot commented Jul 26, 2026

Copy link
Copy Markdown
Messages
📖

📋 Missing Summary - Can you add a Summary? To do so, add a ## Description section to your PR description. This is a good place to explain the motivation for making this change.
📖 Thanks! We ❤️ small PRs!

Generated by 🚫 dangerJS against a5bf5f6

@ulises-jeremias
ulises-jeremias merged commit 60ab000 into main Jul 27, 2026
14 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/examples/serverless-python-fastapi/multi-bc4b6c790b branch July 27, 2026 13:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ulises-jeremias ulises-jeremias Awaiting requested review from ulises-jeremias ulises-jeremias is a code owner
@edamico edamico Awaiting requested review from edamico edamico is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ulises-jeremias