[dependabot]

Removes adm-zip. It's no longer used after updating ancestor dependency serverless. These dependencies need to be updated together.

Removes adm-zip

Updates serverless from 3.40.0 to 4.45.0

Release notes

Sourced from serverless's releases.

4.45.0

Features

• Web apps: run Express, Fastify, Hono, Next.js and other Node.js HTTP servers on AWS Lambda Web Functions. Define a server under the new top-level webApps block and serverless deploy packages it (bundling TypeScript with esbuild), uploads it, creates the web function and its HTTPS endpoint, and prints the endpoint URL. Your code starts a server and listens on process.env.PORT, as it does locally; there is no handler to export and no adapter to install. Web apps take the same provider settings as functions for environment variables, IAM, VPC and tags, can require IAM-signed requests (url.authorizer: aws_iam), and can serve a custom domain through Amazon CloudFront, with several web apps sharing one hostname by basePath. serverless invoke --web-app, serverless logs --web-app, serverless info, serverless diff, serverless rollback and serverless agent inspect --web-apps cover them too. Read more in the Web Apps guide, and try the Express, Next.js and custom domain examples. (#13987, #13989)

provider:
  name: aws
  region: us-east-1
  domains:
    - name: shop.example.com
      webApp: site # every path the other entry doesn't match
    - name: shop.example.com
      basePath: api # /api and /api/*
      webApp: api
webApps:
site:
entry: .next/standalone/server.js
build: false
package:
patterns: ['!', '.next/standalone/']
api:
entry: src/server.ts

serverless invoke --web-app api --path /api/health

• Sandboxes upload only the files they need. A sandbox with a local artifact directory no longer uploads local dependency and cache directories (node_modules, .venv, venv, __pycache__, .pytest_cache, .mypy_cache) at any depth. With artifact: ., the default packaging exclusions for functions (such as .git and .serverless) apply as well. The new sandboxes.<name>.package.patterns works like functions.<name>.package.patterns, and the Dockerfile at the root of the artifact is always included. serverless dev --sandbox builds its local image from the same files. Read more in Choosing the files. (#13990, #13997)

sandboxes:
  api:
    artifact: ./app
    package:
      patterns:
        - '!app/tests/**'
        - 'app/node_modules/**' # re-include vendored dependencies

Note If a sandbox's artifact directory holds files the new defaults leave out, such as node_modules, the first deploy after upgrading rebuilds its image once and updates it in place; no resource is replaced.

• Unchanged deploys are skipped for services without functions. A service with only web apps, sandboxes, agents or resources now prints No changes to deploy when its code and configuration are unchanged and its stack holds the last deploy, as services with functions already did. After a deploy that failed or rolled back, deploys run until one updates the stack again. Read more in Deployment Bucket. (#13989, #13996)

• serverless invoke --sandbox sends request headers. Repeat --header 'Name: value' to add headers, for example --header 'Content-Type: application/json' with --data. Options that only apply to functions and agents, such as --qualifier or --log, now stop the command with an error such as ✖ --qualifier is not available with --sandbox. Read more in Invoking a Sandbox. (#13989)

... (truncated)

Commits

• 8cfe954 chore: release 4.45.0 (#14000)
• f34b503 fix(analytics): stop false failures and report agent inspect runs (#13999)
• 746bf5b feat(sandboxes): filter artifact files with package patterns and defaults (#1...
• 8707057 test(auth): wait for the login socket instead of a fixed number of turns (#13...
• d0d34c0 fix(aws): account for S3 second-precision times in change detection (#13996)
• 7d0609d fix: use HTTPS_PROXY and the proxy CA for Serverless API requests (#13995)
• 22b561d fix(aws): apply proxy configuration to the credential chain (#13994)
• 699d316 docs(aws): clarify web app domain, role and packaging details (#13993)
• dfd3948 fix(domains): create dualstack domains when IPv6 records are requested (#13986)
• 20660f7 fix: route proxied API requests through undici's fetch on Node.js 26 (#13992)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for serverless since your current version.

Install script changes

This version modifies postinstall script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.