Skip to content

chore(deps): bump tar, npm and serverless#734

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-581f0a3ade
Closed

chore(deps): bump tar, npm and serverless#734
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-581f0a3ade

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Removes tar. It's no longer used after updating ancestor dependencies tar, npm and serverless. These dependencies need to be updated together.

Removes tar

Updates npm from 11.16.0 to 11.18.0

Release notes

Sourced from npm's releases.

v11.18.0

11.18.0 (2026-06-29)

Features

Bug Fixes

Documentation

Dependencies

Chores

arborist: 9.9.0

9.9.0 (2026-06-29)

Features

Bug Fixes

... (truncated)

Changelog

Sourced from npm's changelog.

11.18.0 (2026-06-29)

Features

Bug Fixes

Documentation

Dependencies

Chores

11.17.0 (2026-06-11)

Features

Bug Fixes

... (truncated)

Commits
  • a9c8c06 chore: release 11.18.0
  • f79b37f chore: dev dependency updates
  • 54656b6 deps: undici@6.27.0
  • 31c4773 deps: brace-expansion@5.0.7
  • e773c77 deps: tar@7.5.19
  • f05f6af deps: semver@7.8.5
  • 3021ad6 feat(arborist): extend replace-registry-host with URL prefix matching (#6110)...
  • 598ffdb fix(sbom): percent-encode vcs_url qualifier in generated purls (#9693)
  • f3f2465 fix(exec): prevent shared binPaths pollution across workspace runs (#9692)
  • 05793d0 fix: output all the required parameters for npm token list (#9691)
  • Additional commits viewable in compare view

Updates serverless from 3.40.0 to 4.38.1

Release notes

Sourced from serverless's releases.

4.38.1

Maintenance

  • Upgraded undici to 6.27.0, clearing security advisories reported against earlier versions of the bundled HTTP client: a Set-Cookie SameSite attribute downgrade (GHSA-g8m3-5g58-fq7m), HTTP header injection via Set-Cookie percent-decoding (GHSA-p88m-4jfj-68fv), and a WebSocket client denial-of-service (GHSA-vxpw-j846-p89q). (#13657)

4.38.0

Features

  • Ruby 4.0 runtime support. Functions can now target the ruby4.0 Lambda runtime. (#13613)

    provider:
  name: aws
  runtime: ruby4.0

  • New ${aws:partition} variable. Resolves to the AWS partition for the deployment region (e.g. aws, aws-cn, aws-us-gov) with no network call or credentials required. Makes ARNs in your configuration portable across commercial, GovCloud, and China partitions. (#12441, #13633)

    provider:
  iam:
    role:
      managedPolicies:
        - arn:${aws:partition}:iam::aws:policy/AmazonS3ReadOnlyAccess

  • AgentCore: Python 3.14 support. Agent runtimes can now target python3.14. Runtime validation is also stronger, with supported runtimes validated against a single allowlist. (#13645)

    # AgentCore agent configuration
runtime: python3.14

Bug Fixes

  • API Gateway custom stage now used for the service endpoint URL and stage tags. When provider.apiGateway.stage is set to a value different from the deployment stage, the ServiceEndpoint output URL and the API Gateway stage tags now use that configured stage. Previously they used the deployment stage, producing an incorrect endpoint URL and attempting to tag a stage that did not exist. (#13636)

    provider:
  apiGateway:
    stage: customstage   # now reflected in ServiceEndpoint + stage tags

  • Variable resolution no longer drops placeholders during re-entrant resolution. A JavaScript or TypeScript ${file(...)} resolver that calls resolveVariable() or resolveConfigurationProperty() mid-resolution opens a nested resolution pass. Under certain async timing this could leave the outer resolution looking inactive, causing a later nested placeholder to be left unresolved. Each pass now preserves and restores its context so the full dependency chain resolves reliably. (#13635)

  • AgentCore: unpinned the default Buildpacks builder image and added a builder override. The previously hard-pinned heroku/builder digest is no longer used by default. (#13647, #13646)

Maintenance

  • Bumped the AWS SDK group with 34 updates (#13632)

... (truncated)

Commits
  • fb7ac39 chore: release 4.38.1 (#13658)
  • 7565a78 chore(deps): bump undici (#13657)
  • 56e78c1 chore: release 4.38.0 (#13651)
  • 27dacea chore(deps): bump golang.org/x/mod in /binary-installer (#13650)
  • 384a7e4 fix(agentcore): unpin heroku/builder digest; add artifact.image.builder overr...
  • ea79235 fix(api-gateway): use resolved API Gateway stage for stage tags and service e...
  • a2804b0 chore(deps): bump the npm_and_yarn group across 13 directories with 2 updates...
  • 90183bc chore(deps): update package-lock.json (#13648)
  • 64e189c feat(agentcore): support Python 3.14 and improve agent runtime validation (#1...
  • 312a842 chore(deps): bump the actions group with 2 updates (#13641)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for serverless since your current version.

Install script changes

This version modifies postinstall script that runs during installation. Review the package contents before updating.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 15, 2026
@dependabot
chore(deps): bump tar, npm and serverless
e35a3c8 
Removes [tar](https://github.com/isaacs/node-tar). It's no longer used after updating ancestor dependencies [tar](https://github.com/isaacs/node-tar), [npm](https://github.com/npm/cli) and [serverless](https://github.com/serverless/serverless). These dependencies need to be updated together.


Removes `tar`

Updates `npm` from 11.16.0 to 11.18.0
- [Release notes](https://github.com/npm/cli/releases)
- [Changelog](https://github.com/npm/cli/blob/v11.18.0/CHANGELOG.md)
- [Commits](npm/cli@v11.16.0...v11.18.0)

Updates `serverless` from 3.40.0 to 4.38.1
- [Release notes](https://github.com/serverless/serverless/releases)
- [Changelog](https://github.com/serverless/serverless/blob/main/RELEASE_PROCESS.md)
- [Commits](https://github.com/serverless/serverless/compare/v3.40.0...sf-core@4.38.1)

---
updated-dependencies:
- dependency-name: npm
  dependency-version: 11.17.0
  dependency-type: indirect
- dependency-name: serverless
  dependency-version: 4.37.0
  dependency-type: direct:development
- dependency-name: tar
  dependency-version:
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-581f0a3ade branch from d30d25c to e35a3c8 Compare July 8, 2026 02:02
@sid88in sid88in closed this Jul 8, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 8, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/multi-581f0a3ade branch July 8, 2026 02:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@sid88in