[dependabot]

Removes adm-zip. It's no longer used after updating ancestor dependency serverless. These dependencies need to be updated together.

Removes adm-zip

Updates serverless from 3.40.0 to 4.46.0

Release notes

Sourced from serverless's releases.

4.46.0

Features

• Run web apps in serverless dev. serverless dev now runs a service's web apps on your machine, in the same session as its functions and with no redeploy. Requests to the web app's real URL (and a custom domain in front of it) reach your local server, which gets the deployed environment variables and the web app's execution-role credentials. A local URL on localhost serves it with your framework's hot reload. Set webApps.<name>.dev.command to start a dev server such as next dev, or leave it out to run entry from source. When your machine doesn't answer in time, the deployed code answers instead, and stopping the session puts the deployed code back. --web-app and --skip-web-app choose which web apps run, and --local-only keeps the real URL on the deployed code. Requests are recorded for serverless dev requests and serverless dev replay, as invocations are. Read more in the Dev Mode guide and the serverless dev reference, and try the Next.js example. (#14059)

webApps:
  site:
    entry: .next/standalone/server.js
    dev:
      command: next dev --hostname 127.0.0.1 # run with PORT and HOSTNAME set

serverless dev --stage alice --web-app site

• Subscribe functions to EventBridge Custom Event Buses. When eventBus is a Custom Event Bus (its ARN, a variable that resolves to one, or a Ref or Fn::GetAtt … EventBusArn to an AWS::EventsV2::EventBus in resources), the eventBridge event subscribes the function to it. Functions receive arrays of up to 10 events per call, with AWS's retry policy. New settings switch each default: ordering: fifo for ordered delivery, batchSize, maximumBatchingWindow, async, resumePosition and role. The Framework creates one delivery role per service. Bus names, the default bus and Classic event bus ARNs work as before. serverless agent inspect shows the subscribers and buses. Read more in Custom Event Bus, and try the Compose example. (#14051)

functions:
  processOrder:
    handler: handler.process
    events:
      - eventBridge:
          eventBus: !GetAtt OrdersBus.EventBusArn
          ordering: fifo
          pattern:
            source:
              - orders.service
resources:
Resources:
OrdersBus:
Type: AWS::EventsV2::EventBus
Properties:
Name: orders

• serverless invoke reaches durable functions. Without --qualifier, serverless invoke now targets the alias a durable function's deploy publishes. The durable execution ARN is printed (Durable execution started: <arn> with --type Event), and the new --json flag prints one object with the status code, qualifier, executed version, durable execution ARN, function error, payload and log. A synchronous invoke of a function whose executionTimeout is above 900 seconds stops before calling Lambda and suggests --type Event. durableConfig now also applies to OS-only runtimes from provided.al2023 (for example Go) and to container image functions. Read more in Durable Functions and invoking durable functions. (#14049)

serverless invoke -f checkout --type Event --durable-execution-name order-1042 --json

Note Before this release, durableConfig on a container image function deployed the function without durable execution. It now takes effect, and Lambda sets durable configuration only when a function is created, so the next deploy of such a function stops and rolls back with nothing changed. Remove durableConfig to keep the function as it is, or give the function a new name to make it durable.

• Prune sandbox image versions. Every deploy that changes a sandbox's artifact builds a new version of its image, and AWS limits each image to 50 versions by default. serverless prune -n <number> and custom.prune.automatic now also delete older image versions, keeping the live version, the given number of older ones, and versions a MicroVM still uses. The new --sandbox <name> limits a run to one sandbox. Each deploy also deletes the sandbox zips that no remaining deployment points to, so every deployment serverless deploy list shows can still be rolled back. Sandbox zips now use provider.deploymentPrefix. Read more in Prune and Image versions and cleanup. (#13906, #14016)

... (truncated)

Commits

• 128e6b4 chore: release 4.46.0 (#14062)
• fa524f7 test(dev): bound the web app fixture's query numbers and tighten two test ser...
• d17f14a docs: complete the durable Go example and update sandbox rollback notes (#14060)
• 2ebc222 feat(dev): run web apps in serverless dev (#14059)
• 0ef3f76 chore(deps): bump the patch-updates group across 1 directory with 3 updates (...
• 9c5a2ae chore(deps): bump serverless-scaleway-functions (#14058)
• 9fd8428 chore(deps): bump the aws-sdk group across 1 directory with 41 updates (#14055)
• 11f4df1 chore(deps-dev): bump the dev-dependencies group across 1 directory with 2 up...
• 1ee8ea7 chore(deps): bump the dev-mode-bridge group (#14054)
• fdfaa30 chore(deps): bump actions/setup-python (#14052)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for serverless since your current version.

Install script changes

This version modifies postinstall script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.