Skip to content

chore(deps): bump js-yaml, serverless and serverless-offline in /examples/serverless-cognito-local - #339

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/examples/serverless-cognito-local/multi-5406fa7c9c
Open

chore(deps): bump js-yaml, serverless and serverless-offline in /examples/serverless-cognito-local#339
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/examples/serverless-cognito-local/multi-5406fa7c9c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 11, 2026

Copy link
Copy Markdown
Contributor

Removes js-yaml. It's no longer used after updating ancestor dependencies js-yaml, serverless and serverless-offline. These dependencies need to be updated together.

Removes js-yaml

Updates serverless from 3.40.0 to 4.41.0

Release notes

Sourced from serverless's releases.

4.41.0

Features

  • Host MCP servers on AWS Lambda. A new mcp section in serverless.yml deploys official MCP TypeScript SDK servers behind API Gateway with response streaming. You write one SDK module; the Framework owns the endpoint, streaming, packaging, and the OAuth protected-resource discovery document. Servers can be protected with your own API Gateway authorizers or with the MCP SDK's built-in in-server token verification, and each server behaves as an ordinary function — logs, invoke, metrics, rollback, and deploy function work unchanged. MCP servers share one REST API, stage, and custom domain with each other and with http functions. Optional sealed request state lets tools round-trip data across elicitation retries without server-side storage. (#13778, #13784) Read more in the MCP servers guide and explore the MCP examples. A bundled serverless-mcp Agent Skill teaches AI coding agents (Claude Code, Codex, Cursor) how to build and operate MCP servers with the Framework — install it into your service with the agent skills install command:
serverless agent skills install
mcp:
  servers:
    crm:
      server: src/server.mjs
      authorizer:
        name: verifyToken
      oauthDiscovery:
        issuer: https://example.us.auth0.com
functions:
verifyToken:
handler: src/authorizer.handler

Bug Fixes

  • Per-function artifacts are now included in change detection. Deployments that only changed a prebuilt per-function package.artifact were silently skipped, so new code never shipped; the artifact content now participates in the change hash. (#13771)
  • Compose package and print no longer wipe deployed service state. Running a read-only command in a Compose project cleared the recorded outputs of already-deployed services, breaking later cross-service references and removals. Thanks @​tmatilai for the detailed report. (#13437, #13792)
  • Files named like code modules no longer hijack project detection. A template.mjs in the project root made the CLI treat the directory as a SAM/CloudFormation project and hide normal commands; detection is now restricted to SAM-supported template extensions. Thanks @​tomchiverton for the report. (#13738, #13739)
  • esbuild outExtension is honored end-to-end. Custom output extensions (e.g. .js → .mjs) now flow through bundling, packaging, deployment, and invoke local, with clear validation for unsupported mappings. (#13740)
  • esbuild config-file sourcemap setting controls source-map support. With sourcemap: false in an esbuild config file, the Framework no longer force-enables --enable-source-maps in the function's NODE_OPTIONS. Thanks @​maximepichou for the report. (#12997, #13741)
  • Compose services with packages: external resolve root dependencies. Dependencies hoisted to the Compose project root are now traced and packaged when a service's esbuild config marks packages external. Thanks @​joe-price-jt for the report. (#12957, #13742)
  • Function URL invokeMode accepts any casing. Values like response_stream or Buffered are now normalized instead of failing validation. (#13756)
  • Sandbox dev images build for the Docker daemon's architecture. Dev images previously targeted the host architecture, producing emulated (slow or failing) containers when the daemon reported a different one. (#13787)
  • No spinner animations on zero-width terminals. CI providers that report a zero-column terminal (e.g. CircleCI) were flooded with spinner frames; animations now stay disabled there. Thanks @​Kinnersley-Studio for the report. (#13786, #13788)

Maintenance

... (truncated)

Commits
  • d20837c chore: release 4.41.0 (#13793)
  • 7c8c59f fix(compose): stop package and print from wiping deployed service state (#13792)
  • d9d6868 ci(binary-installer): sign windows binary with Azure Artifact Signing (#13791)
  • 8ae60cd chore(deps): bump js-yaml from 3.15.0 to 3.15.1 (#13790)
  • 5931987 chore(deps): bump js-yaml from 4.3.0 to 4.3.1 (#13789)
  • 4b3753a feat(mcp): user-supplied authorizers and OAuth discovery for MCP servers (#13...
  • 183f25e fix(sandboxes): build dev images for the Docker daemon's architecture (#13787)
  • 469e819 fix(cli): never enable spinner animations on zero-width terminals (#13788)
  • 7fbc70d chore(deps): bump the aws-sdk group across 1 directory with 37 updates (#13780)
  • 4da6754 chore(deps): bump tsx in the patch-updates group across 1 directory (#13782)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for serverless since your current version.

Install script changes

This version modifies postinstall script that runs during installation. Review the package contents before updating.


Updates serverless-offline from 9.3.1 to 14.8.0

Release notes

Sourced from serverless-offline's releases.

v14.8.0

What's Changed

Full Changelog: dherault/serverless-offline@v14.7.4...v14.8.0

v14.7.4

What's Changed

New Contributors

Full Changelog: dherault/serverless-offline@v14.7.3...v14.7.4

v14.7.3

What's Changed

Full Changelog: dherault/serverless-offline@v14.7.2...v14.7.3

v14.7.2

What's Changed

New Contributors

Full Changelog: dherault/serverless-offline@v14.7.1...v14.7.2

v14.7.1

What's Changed

New Contributors

Full Changelog: dherault/serverless-offline@v14.7.0...v14.7.1

v14.7.0

What's Changed

... (truncated)

Changelog

Sourced from serverless-offline's changelog.

v14.8.0

v14.7.4

23 June 2026

v14.7.3

16 June 2026

v14.7.2

8 June 2026

... (truncated)

Commits
  • 103beb8 14.8.0
  • 52b2a67 Merge pull request #1904 from dherault/fix/1900-docker-layers
  • b0af43e fix: make custom runtime layers work in the docker runner (#1900)
  • b6e7ff5 Merge pull request #1905 from dherault/fix/in-process-instances-race
  • 1f1b7c6 test: serialize the requests of the in-process idle instance test
  • 84747cf Merge pull request #1903 from dherault/fix/1901-alb-conditions
  • 3af67ca Merge pull request #1902 from dherault/feat/1899-nodejs26-support
  • 6c1530f fix: evaluate alb header, host and query conditions (#1901)
  • 7955860 ci: add Node.js 26 to lint_and_test workflow matrix
  • da9952a feat: add support for the nodejs26.x runtime (#1899)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump js-yaml, serverless and serverless-offline
67dfd7a 
Removes [js-yaml](https://github.com/nodeca/js-yaml). It's no longer used after updating ancestor dependencies [js-yaml](https://github.com/nodeca/js-yaml), [serverless](https://github.com/serverless/serverless) and [serverless-offline](https://github.com/dherault/serverless-offline). These dependencies need to be updated together.


Removes `js-yaml`

Updates `serverless` from 3.40.0 to 4.41.0
- [Release notes](https://github.com/serverless/serverless/releases)
- [Changelog](https://github.com/serverless/serverless/blob/main/RELEASE_PROCESS.md)
- [Commits](https://github.com/serverless/serverless/compare/v3.40.0...sf-core@4.41.0)

Updates `serverless-offline` from 9.3.1 to 14.8.0
- [Release notes](https://github.com/dherault/serverless-offline/releases)
- [Changelog](https://github.com/dherault/serverless-offline/blob/master/CHANGELOG.md)
- [Commits](dherault/serverless-offline@v9.3.1...v14.8.0)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version:
  dependency-type: indirect
- dependency-name: serverless
  dependency-version: 4.41.0
  dependency-type: direct:development
- dependency-name: serverless-offline
  dependency-version: 14.8.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 11, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 11, 2026
@github-actions

github-actions Bot commented Aug 11, 2026

Copy link
Copy Markdown
Messages
📖

📋 Missing Summary - Can you add a Summary? To do so, add a ## Description section to your PR description. This is a good place to explain the motivation for making this change.
📖 Thanks! We ❤️ small PRs!

Generated by 🚫 dangerJS against 67dfd7a

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ulises-jeremias ulises-jeremias Awaiting requested review from ulises-jeremias ulises-jeremias is a code owner
@edamico edamico Awaiting requested review from edamico edamico is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants