serverless

Features

• Non-bundled esbuild services are packaged like classic packaging, with TypeScript compiled in place. With build.esbuild.bundle: false, the Framework now packages your whole service the way classic packaging does: locally imported helper files are compiled and included (previously only each handler file was), JavaScript and other files are copied as they are, the project layout is preserved, and every compiled file is emitted in the module format its nearest package.json declares (.mts → .mjs, .cts → .cjs). A new build.esbuild.tsconfig option selects which TypeScript compiles, function-level build: false is accepted as a boolean, and files that esbuild plugins write into the build directory now ship in the artifact. Thanks @visrut-at-handldigital and @ewsbr for the reports. (#12744, #13163, #13850) Read more in the Building guide.

build:
  esbuild:
    bundle: false
    # optional — tsconfig.json is picked up automatically; point at a build-specific
    # config (for example one that excludes tests/**) to narrow what gets compiled
    tsconfig: tsconfig.build.json

• Compose: reference other services through the variable system, including services deployed to a different stage. A new service resolver reads a service's outputs in serverless-compose.yml: ${service:<service>.<Output>} resolves at the current stage and deploys that service first; a named instance with a stage pins the stage, so application services on personal stages can read a database service that lives once on a shared stage. References accept fallbacks and nesting like any other variable, configuration mistakes are reported before anything deploys, and the existing ${<service>.<Output>} form keeps working unchanged. (#13843) Read more in the Compose guide and try the shared-services Compose example.

# serverless-compose.yml
stages:
  default:
    resolvers:
      shared:
        type: service
        stage: shared-infra # the long-lived stage where orders-db lives

services:
  orders-db:
    path: orders-db
  api:
    path: api
    params:
      tableName: ${service:orders-db.TableName} # same stage as this run; deploys orders-db first
      dbHost: ${shared:orders-db.Host} # read from orders-db@shared-infra, without deploying it here

• AWS variable resolvers make fewer requests and retry throttling. ${cf:stackName.outputKey} now issues one DescribeStacks call per stack per run instead of one per referenced output — services deployed together with Compose share those calls, and cached reads are refreshed after each Compose service deploy — and ${aws:accountId} is resolved once per run. All AWS resolvers (${cf:}, ${ssm:}, ${s3:}, ${aws:accountId}) retry throttled requests with the AWS SDK's standard exponential backoff, up to 10 attempts by default; AWS_MAX_ATTEMPTS / AWS_RETRY_MODE and the matching ~/.aws/config keys take precedence. --verbose shows each retry, --debug prints a per-API request summary, and exhausted retries fail with a dedicated error naming the API, the attempts made, and the remediations. Expired credentials during variable resolution now produce the familiar "AWS credentials appear to have expired" message. (#13848) Read more in the CloudFormation outputs and SSM variable guides.

Note ${cf:stackName} without an output key is now rejected before any request is made (expected '<stackName>.<outputKey>'), instead of issuing a request and failing with a generic message. This also applies when a fallback is present: ${cf:stackName, 'default'} previously resolved to the fallback and now fails validation — write ${cf:stackName.outputKey, 'default'}.

• Terraform state is read once per run. ${terraform:outputs:...} now downloads and parses each Terraform state once per run and shares it across every placeholder and every Compose service, instead of once per referenced output per service. The s3 backend retries throttled reads with the AWS SDK's standard backoff, resolves credentials once per process, and reads a state bucket in another region by following S3's redirect instead of failing with PermanentRedirect. Thanks @schammah for the detailed report. (#13844, #13852) Read more in the Terraform variables guide.

• MCP servers run in Dev Mode. serverless dev now serves the MCP servers declared under mcp: requests hit the real deployed endpoint — streaming route, authorizer, OAuth discovery and state keys all live — and are answered by your local server module, with edits applied on the next request and no redeploy. The session banner lists each server's endpoint under mcp:, and every request is logged with its JSON-RPC method and target; a JSON-RPC error carried inside a 200 response is called out on the same line. (#13836) Read more in the serverless dev reference and the MCP servers guide; each MCP example now has a "Develop it live" section.

mcp: crm → https://abc123.execute-api.us-east-1.amazonaws.com/dev/crm/mcp
✔ Connected (Ctrl+C to cancel)
→ λ crm ── mcp tools/call get_weather
← λ crm (200) 640ms

• Provisioned mode for sqs, kafka, and msk events. The new provisionedPollers event property enables AWS Lambda's provisioned mode for event source mappings: a dedicated pool of pollers with min/max bounds, plus group on kafka and msk to share poller capacity across mappings. provisionedPollers: false disables the mode on an existing mapping. Combining it with maximumConcurrency, or setting min above max, fails at packaging time instead of at deployment. Thanks @sra17 for the request. (#13024, #13835) Read more in the SQS, Kafka, and MSK event guides.

functions:
  worker:
    handler: handler.main
    events:
      - sqs:
          arn: arn:aws:sqs:us-east-1:123456789012:orders
          provisionedPollers:
            min: 2
            max: 50

Note Provisioned pollers are billed while the mapping exists. Removing the property does not disable the mode on an already-deployed mapping — set provisionedPollers: false to turn it off.

• SnapStart for container-image functions. snapStart: true now documents and validates the container-image case: functions built on the AWS base images for Java 11+, Python 3.12+ and .NET 8+ need nothing else, other images declare readiness with the com.amazonaws.lambda.feature.snapstart="Allow" label or runtime hooks, and the guide explains how event sources reach the snapshot and what retained versions cost. Configuring snapStart with ephemeralStorageSize above 512 MB now fails at packaging, before any image is built or pushed. Thanks @iiro for the request. (#13834, #13847) Read more in the SnapStart section of the functions guide and try the container SnapStart example.

• New Lambda runtimes, and durable functions on Java and .NET. The Amazon Linux 2023 Java runtimes java8.al2023, java11.al2023, and java17.al2023 — AWS's migration path off the Amazon Linux 2 Java runtimes — and the public-preview runtimes nodejs26.x and python3.15 are now accepted, including by invoke local. durableConfig now also works on Java 17+ and .NET 8+ runtimes. Thanks @mungojam for the request. (#13818, #13819) Read more in the functions guide.

functions:
  api:
    handler: com.example.Handler
    runtime: java17.al2023

Note nodejs26.x and python3.15 are public-preview runtimes on AWS and are not covered by AWS support or SLAs yet. Java and .NET runtimes do not include the durable execution SDK — ship it in your deployment package.

• Sandboxes: customize the operator role. iam.operatorRole accepts the same customization object and external-role forms as iam.buildRole and iam.executionRole, which makes sandboxes on shared (RAM-shared) VPCs possible. Thanks @Hi-Fi for the contribution! (#13800, #13808) Read more in the Sandboxes guide.

sandboxes:
  api:
    artifact: ./app
    vpc:
      subnetIds: [subnet-0123456789abcdef0]
      securityGroupIds: [sg-0123456789abcdef0]
    iam:
      operatorRole:
        statements:
          - Effect: Allow
            Action: ec2:CreateNetworkInterface
            Resource: arn:aws:ec2:us-east-1:111122223333:subnet/subnet-0123456789abcdef0

• Removed the serverless support command. The interactive support-ticket flow and the --summary / --ai / --github / --all report modes were built for a copy-paste workflow that AI coding assistants working directly in the service directory have replaced. serverless support now returns the standard command-not-found error, and the bug-report template asks for the framework version, a redacted serverless.yml, the command run, and its output instead. (#13820)

Bug Fixes

• CloudFormation template URLs use regional S3 endpoints. Deployments passed the deployment bucket's template to CloudFormation through the legacy global s3.amazonaws.com endpoint. When CloudFormation's read of that template was denied by the caller's IAM policy, the failure surfaced as S3's redirect message ("The bucket you are attempting to access must be addressed using the specified endpoint") instead of the actual Access Denied. Template URLs now use s3.<region>.amazonaws.com, so the real cause is reported; --aws-s3-accelerate and the alerts external stack follow the same rule. (#6539, #13829)
• npm install no longer fails when the CLI download fails. The serverless npm package downloads the CLI during postinstall; blocked egress, an unconfigured proxy, or TLS interception previously aborted the whole npm install. The install now completes with a warning and the download is retried on the first serverless run, which still fails clearly if the download is impossible. Proxy settings from .npmrc (https-proxy, proxy, noproxy) are honored during installation when no proxy environment variables are set, error messages include the underlying network error, and a CLI terminated by a signal exits with 128 + signal instead of 0. (#13833) Read more in Installing behind a proxy or firewall.
• --package paths at or above the service directory are rejected. serverless package --package . (or .., or an ancestor directory) emptied the service or parent directory before failing. Such paths now fail early with PACKAGE_PATH_CONTAINS_SERVICE and no files are touched; relative and sibling paths keep working. (#13853)
• The credential-setup hint appears when no AWS credentials are found. With no provider.profile or --aws-profile configured, a missing-credentials error now ends with the setup hint ("Run serverless to set up AWS credentials…"); the hint stays off when a profile was chosen explicitly. (#13854)
• A directory named like a configuration file no longer shadows the real one. A directory called serverless.yml next to a serverless.yaml file made the CLI pick the directory; only regular files are considered now. Thanks @cuishuang for the fix! (#13846)
• Dev Mode labels SNS-triggered invocations correctly. Session logs showed aws:sqs: for SNS events; they now show aws:sns:. (#13836)
• Resolver configuration errors show their intended messages again. Unknown keys in terraform, doppler, vault, and service resolver configurations report the allowed keys (for example Only 'bucket', 'key', and 'region' are allowed in the s3 backend configuration) instead of a generic "Unrecognized key". (#13852)
• MCP server: the docs tool only reads inside the documentation directory, including through symbolic links; the service-summary tool's input schema now matches its implementation (cloudProvider), and service-wide error analysis includes Lambda log groups again. (#13851)

Maintenance

• Bumped the AWS SDK group with 107 updates across three bumps (#13815, #13823, #13839)
• Upgraded toml to v5 (#13838) — integer values in serverless.toml outside the 64-bit range now fail with a parse error instead of being silently rounded
• Upgraded js-yaml to v4.3.2 (#13855)
• Upgraded qs to v6.16.0 (#13827)
• Upgraded fast-uri to v3.1.7 (#13831)
• Upgraded undici to v6.28.1 (#13849)
• Upgraded hono to v4.13.5 (#13805, #13824)
• Upgraded @aws-cdk/cloudformation-diff to v2.187.4 (#13814, #13825)
• Upgraded p-map to v7.0.7 (#13825)
• Upgraded tsx to v4.23.13 (#13814, #13825)
• Upgraded dayjs to v1.11.23 (#13814)
• Upgraded joi to v17.13.6 (#13814)
• Upgraded eventsource-parser to v3.1.1 (#13814)
• Upgraded @graphql-tools/merge to v9.2.3 (#13814)
• Upgraded jackson-databind used by local Java invocation (#13813)
• Upgraded jackson-core used by local Java invocation (#13811)
• Upgraded jackson-datatype-joda used by local Java invocation (#13810)
• Upgraded jest to v30.5.1 (#13840)
• Upgraded lint-staged to v17.4.1 (#13840)
• Upgraded eslint to v10.9.1 (#13824)
• Upgraded globals to v17.11.0 (#13805)
• Upgraded browserslist to v4.28.8 (#13822)

Bug Fixes

• Fixed packaging producing a different artifact on every run. When using the built-in build system, repeated serverless package runs of an unchanged service produced artifacts with different checksums, so change detection could see phantom diffs and redeploy unchanged services. Artifacts are now byte-for-byte identical across runs. (#13794)

• Fixed package.patterns exclusions being ignored in packaged artifacts. When using the built-in build system, negation patterns (!...) are now honored when packaging function artifacts — both for combined-service packaging and with package.individually. Function-level patterns are merged after service-level patterns, so function settings win on conflict, matching classic packaging behavior. (#13795)

Maintenance

• Framework-managed custom resources now run on Node.js 24. Deployments that use existing S3 buckets, existing Cognito User Pools, EventBridge events, or the API Gateway CloudWatch role pick up the nodejs24.x runtime automatically on the next deploy. No action is needed. Thanks @Hiroki-Aoki for raising this! (#13802, #13807)
• Bumped the AWS SDK group with 37 updates (#13796)
• Upgraded esbuild to v0.28.2 (#13798)
• Upgraded tsx to v4.23.11 (#13798)
• Upgraded ws to v8.21.3 (#13798)
• Upgraded eslint to v10.8.1 (#13797)
• Upgraded lint-staged to v17.3.0 (#13797)
• Upgraded hono to v4.13.1 (#13797)
• Upgraded globals to v17.9.0 (#13797)

Features

• Host MCP servers on AWS Lambda. A new mcp section in serverless.yml deploys official MCP TypeScript SDK servers behind API Gateway with response streaming. You write one SDK module; the Framework owns the endpoint, streaming, packaging, and the OAuth protected-resource discovery document. Servers can be protected with your own API Gateway authorizers or with the MCP SDK's built-in in-server token verification, and each server behaves as an ordinary function — logs, invoke, metrics, rollback, and deploy function work unchanged. MCP servers share one REST API, stage, and custom domain with each other and with http functions. Optional sealed request state lets tools round-trip data across elicitation retries without server-side storage. (#13778, #13784) Read more in the MCP servers guide and explore the MCP examples. A bundled serverless-mcp Agent Skill teaches AI coding agents (Claude Code, Codex, Cursor) how to build and operate MCP servers with the Framework — install it into your service with the agent skills install command:

serverless agent skills install

mcp:
  servers:
    crm:
      server: src/server.mjs
      authorizer:
        name: verifyToken
      oauthDiscovery:
        issuer: https://example.us.auth0.com

functions:
  verifyToken:
    handler: src/authorizer.handler

Bug Fixes

• Per-function artifacts are now included in change detection. Deployments that only changed a prebuilt per-function package.artifact were silently skipped, so new code never shipped; the artifact content now participates in the change hash. (#13771)
• Compose package and print no longer wipe deployed service state. Running a read-only command in a Compose project cleared the recorded outputs of already-deployed services, breaking later cross-service references and removals. Thanks @tmatilai for the detailed report. (#13437, #13792)
• Files named like code modules no longer hijack project detection. A template.mjs in the project root made the CLI treat the directory as a SAM/CloudFormation project and hide normal commands; detection is now restricted to SAM-supported template extensions. Thanks @tomchiverton for the report. (#13738, #13739)
• esbuild outExtension is honored end-to-end. Custom output extensions (e.g. .js → .mjs) now flow through bundling, packaging, deployment, and invoke local, with clear validation for unsupported mappings. (#13740)
• esbuild config-file sourcemap setting controls source-map support. With sourcemap: false in an esbuild config file, the Framework no longer force-enables --enable-source-maps in the function's NODE_OPTIONS. Thanks @maximepichou for the report. (#12997, #13741)
• Compose services with packages: external resolve root dependencies. Dependencies hoisted to the Compose project root are now traced and packaged when a service's esbuild config marks packages external. Thanks @joe-price-jt for the report. (#12957, #13742)
• Function URL invokeMode accepts any casing. Values like response_stream or Buffered are now normalized instead of failing validation. (#13756)
• Sandbox dev images build for the Docker daemon's architecture. Dev images previously targeted the host architecture, producing emulated (slow or failing) containers when the daemon reported a different one. (#13787)
• No spinner animations on zero-width terminals. CI providers that report a zero-column terminal (e.g. CircleCI) were flooded with spinner frames; animations now stay disabled there. Thanks @Kinnersley-Studio for the report. (#13786, #13788)

Maintenance

• Bumped the AWS SDK group with 150 updates across four bumps (#13732, #13752, #13767, #13780)
• Upgraded glob to v13 (#13766)
• Upgraded @hono/node-server to v2 (#13763)
• Upgraded hono to v4.13 (#13774, #13759)
• Upgraded @modelcontextprotocol/sdk (#13759)
• Upgraded fs-extra to v11.4 (#13769)
• Upgraded find-my-way (#13745)
• Upgraded ip-address to v10.4 (#13772)
• Upgraded fast-uri (#13775)
• Upgraded p-map (#13754)
• Upgraded js-yaml to v4.3.1 (#13789)
• Upgraded brace-expansion, resolving CVE-2026-14257 and CVE-2026-69152 (#13757, #13764, #13777)
• Upgraded minimatch and undici (#13764)
• Replaced lodash.uniqby with lodash's uniqBy (#13750)
• Replaced sha256-file with node:crypto (#13748)
• Removed the appdirectory dependency (#13749)
• Removed the rimraf dependency from the installer (#13765)
• Removed unused dependencies (#13747)

Features

• Lambda self-managed code storage. Setting provider.deploymentBucket.codeStorageMode: reference makes Lambda run function and layer code directly from your deployment bucket instead of copying it into Lambda-managed storage, so your code no longer counts against the Lambda code storage quota. Every deployment pins each function and layer to the exact uploaded S3 object version, so later uploads never affect what runs. Because deployment artifacts back live Lambda versions in this mode, automatic post-deploy artifact cleanup is disabled — retire artifacts that no longer back any function or layer version with serverless prune --includeArtifacts (also available as custom.prune.includeArtifacts). Read more in the deployment bucket guide and the prune CLI reference, and see the aws-node-self-managed-code-storage example. (#13725)

provider:
  deploymentBucket:
    codeStorageMode: reference # default: copy

# Keep the 3 most recent function versions, then retire deployment
# artifacts that no longer back any surviving function or layer version
serverless prune -n 3 --includeArtifacts

Note reference mode requires a versioned deployment bucket that Lambda is allowed to read. The Framework-managed deployment bucket is configured automatically; custom buckets are validated and the deployment stops with instructions when a prerequisite is missing.

• Compose: run a command on an exact subset of services. The --service option now accepts a comma-separated list for deploy, remove, info, print, and package. The command runs on exactly the named services, ordered by dependsOn; services not named are left untouched, and their outputs stay available for ${param:...} resolution — so a subset can reference services already deployed elsewhere. Read more in the Compose guide. (#13705)

serverless deploy --service=service-a,service-d --stage my-feature

• Removed Serverless Container Framework and Serverless AI Framework. These products are no longer part of the CLI. Projects with a serverless.containers.* or serverless.ai.* configuration file now get a clear error with guidance: pin frameworkVersion: "4.39.0" (the last version supporting them) and the CLI automatically runs that version for the project. (#13698)

frameworkVersion: '4.39.0'

Bug Fixes

• Fixed corrupted bundles when multiple functions share a handler file. The built-in esbuild packaging ran one build per function, so functions sharing a handler file wrote the same output concurrently — occasionally producing a corrupted bundle that failed at Lambda startup with Runtime.UserCodeSyntaxError. Each unique handler file is now built exactly once and reused across the functions that share it, which also removes the redundant rebuilds. (#13716, #13717) - Thanks @dekpient for the report!
• Fixed unchanged services being redeployed on every deploy. Artifacts produced by the built-in esbuild packaging embedded fresh file timestamps on every build, so identical code always looked changed to deploy change detection. Archive entry timestamps are now pinned, identical content produces byte-identical artifacts, and unchanged deployments are skipped as intended. (#13696)
• Fixed the shared IAM role accumulating permissions for functions with dedicated roles. When only some functions use per-function IAM roles, the shared execution role no longer collects event-source and feature grants belonging to functions that have their own role — previously its inline policy grew with every function and could exceed the IAM policy size limit ("Maximum policy size exceeded"). Dedicated per-function roles also now receive grants that previously only existed on the shared role, including Kinesis enhanced fan-out consumer actions, stream onFailure destination grants, and kms:Decrypt for kmsKeyArn. (#13704)
• Fixed a crash when frameworkVersion is "*". Version ranges without a concrete version, such as '*', no longer throw TypeError: Cannot read properties of null (reading 'major'). Since such ranges accept every version, the version check is skipped for them; all other values behave as before — pinning a different major version still fails with the version mismatch error, and invalid version strings still fail under configValidationMode: error. (#13714)
• Safer development-dependency exclusion during packaging. When the production dependency listing cannot be determined, packaging now stops with a clear error instead of risking an artifact that excludes production dependencies (opt out with package.excludeDevDependencies: false); when no dependency listing is available at all, exclusion is skipped with a warning and the artifact ships fully functional. Dependency listing output is also captured directly rather than through the shell, making packaging robust in temporary directories containing spaces or special characters. (#13724, #13699)
• Hardened validation of pinned canary versions in the installer. Malformed canary version values are rejected with a clear error, and release downloads are contained to the expected releases directory. (#13700)

Maintenance

• Updated multiple dependencies:
  • Bumped the AWS SDK group with 36 updates (#13715)
  • Upgraded adm-zip to v0.6.0 (#13720)
  • Upgraded fast-uri to v3.1.4 (#13722)
  • Upgraded js-yaml to v4.3.0 (#13712)
  • Upgraded body-parser to v2.3.0 in the Bedrock AgentCore examples, addressing GHSA-v422-hmwv-36x6 (#13723)
  • Upgraded Jackson to v2.22.1 in the Java local-invocation runtime wrapper (#13694)
  • Upgraded tsx to v4.23.0 (#13711) and filesize to v11.0.22 (#13710)
  • Updated aws-actions/configure-aws-credentials in the actions group (#13707)
• Regenerated the dependency lockfile from scratch so declared security overrides are applied consistently to all resolutions (#13713)

Features

• Sandboxes — AWS Lambda MicroVMs. First-class support for Firecracker-isolated, snapshot-booted virtual machines that you define declaratively and run on demand, with the serverless operational model (no clusters, pay per run). Define a sandbox from a local Dockerfile directory or a prebuilt s3:// zip, and configure memory, environment, lifecycle hooks, tags, and VPC egress. deploy/remove build and tear down the image and supporting resources; IAM build/execution roles are generated for you, and observability — CloudWatch logs, metric filters, alarms, and a dashboard — is enabled by default and fully customizable.

  sandboxes:
    echo:
      artifact: ./app # local directory that contains a Dockerfile
  

  serverless invoke --sandbox echo          # run it (with --method / --port)
  serverless logs --sandbox echo            # fetch logs
  serverless dev --sandbox echo             # local dev loop with hot reload
  

  Local development. serverless dev --sandbox <name> builds and runs the sandbox container on your machine and hot-reloads it as you edit — no deploy needed to iterate. Requests are relayed to the locally running container, so you get the full run/inspect loop against your real sandbox definition before anything ships to AWS.

  See the Sandboxes guide for the full configuration reference, and the serverless/examples sandboxes directory for deploy-ready examples (minimal, complete, and a self-hosted environment for Claude Managed Agent). (#13663)

• serverless agent commands for AI coding agents. A new command namespace purpose-built for agents (Claude Code, Codex, Cursor) working with a Serverless service. (#13673)

  • serverless agent skills install installs the bundled Agent Skills into the service directory (.claude/skills/, .agents/skills/, or both — auto-detected), teaching agents how to work with the service. Idempotent, auto-refreshing when a newer CLI bundles newer skills, and ejectable per-skill.
  • serverless agent inspect returns the live AWS configuration of a deployed service's resources in a single call — a categorized inventory by default, or expanded raw AWS responses filtered by category (--functions, --api, --iam, --sandboxes, --all, …) or by AWS service. Deterministic, pipe-safe JSON/YAML output, so an agent gets the whole logical-to-physical picture without issuing dozens of aws describe-* calls itself.

  serverless agent skills install
  serverless agent inspect --functions --api
  

  See the Agent Skills guide for how skills are discovered, updated, and ejected, and the agent inspect reference for its full category and AWS-service filtering options.

Maintenance

• Runtime dependency bumps: @aws-sdk/util-arn-parser (#13680), a batch of 11 patch-level updates (#13677), and other routine bumps (#13666).
• Development and CI tooling: dev-dependency group updates (#13676), lint-staged 16 → 17 (#13678), and GitHub Actions bumps (#13667); constrained https-proxy-agent to a range that keeps Node 18 support (#13686).

Maintenance

• Upgraded undici to 6.27.0, clearing security advisories reported against earlier versions of the bundled HTTP client: a Set-Cookie SameSite attribute downgrade (GHSA-g8m3-5g58-fq7m), HTTP header injection via Set-Cookie percent-decoding (GHSA-p88m-4jfj-68fv), and a WebSocket client denial-of-service (GHSA-vxpw-j846-p89q). (#13657)

Features

• Ruby 4.0 runtime support. Functions can now target the ruby4.0 Lambda runtime. (#13613)

  provider:
    name: aws
    runtime: ruby4.0
  

• New ${aws:partition} variable. Resolves to the AWS partition for the deployment region (e.g. aws, aws-cn, aws-us-gov) with no network call or credentials required. Makes ARNs in your configuration portable across commercial, GovCloud, and China partitions. (#12441, #13633)

  provider:
    iam:
      role:
        managedPolicies:
          - arn:${aws:partition}:iam::aws:policy/AmazonS3ReadOnlyAccess
  

• AgentCore: Python 3.14 support. Agent runtimes can now target python3.14. Runtime validation is also stronger, with supported runtimes validated against a single allowlist. (#13645)

  # AgentCore agent configuration
  runtime: python3.14
  

Bug Fixes

• API Gateway custom stage now used for the service endpoint URL and stage tags. When provider.apiGateway.stage is set to a value different from the deployment stage, the ServiceEndpoint output URL and the API Gateway stage tags now use that configured stage. Previously they used the deployment stage, producing an incorrect endpoint URL and attempting to tag a stage that did not exist. (#13636)

  provider:
    apiGateway:
      stage: customstage   # now reflected in ServiceEndpoint + stage tags
  

• Variable resolution no longer drops placeholders during re-entrant resolution. A JavaScript or TypeScript ${file(...)} resolver that calls resolveVariable() or resolveConfigurationProperty() mid-resolution opens a nested resolution pass. Under certain async timing this could leave the outer resolution looking inactive, causing a later nested placeholder to be left unresolved. Each pass now preserves and restores its context so the full dependency chain resolves reliably. (#13635)

• AgentCore: unpinned the default Buildpacks builder image and added a builder override. The previously hard-pinned heroku/builder digest is no longer used by default. (#13647, #13646)

Maintenance

• Bumped the AWS SDK group with 34 updates (#13632)
• Upgraded esbuild to 0.28.1 and tsx to 4.22.4 (#13610, #13644)
• Upgraded Go to 1.26.4 and bumped golang.org/x/sys and golang.org/x/mod for the installer (#13618, #13614, #13650)
• Upgraded the Jackson libraries (databind, core, annotations, datatype-joda) for the Java runtime wrapper (#13619, #13620, #13621, #13637, #13638, #13639, #13640)
• Upgraded graphql to 16.14.0, ajv to 8.20.0, zod to 4.4.3, semver to 7.8.1, hono, @grpc/grpc-js to 1.14.4, and eventsource-parser to 3.1.0 (#13576, #13631, #13577, #13578, #13627, #13630, #13643, #13626)
• Patched a uuid buffer-bounds advisory in the bedrock-agentcore examples (#13617)
• Bumped grouped npm and GitHub Actions dependencies (#13649, #13648, #13641, #13622, #13624, #13625)

Features

• New serverless diff command for previewing changes against the deployed stack. Packages the service locally and renders a structured diff — resources, IAM grants, security groups, parameters, outputs — against the CloudFormation stack currently in AWS. A Function Code section reports per-function code changes by comparing local zip hashes against each Lambda's CodeSha256. Especially useful in CI and PR-review workflows. --json emits a machine-readable summary; --package <path> reuses an existing artifact directory to skip the auto-package step. Docs. (#13602)

  serverless diff
  serverless diff --json
  serverless diff --package .serverless
  

• TypeScript files supported in ${file()} variable references. The ${file(...)} variable resolver now loads .ts, .mts, and .cts modules in addition to JavaScript, with no separate build step required. All export shapes — default object, async default function, named export, named-export function with property selector, and injected resolveVariable / resolveConfigurationProperty callbacks — behave identically across JavaScript and TypeScript sources. Docs. (#13590)

  // scripts/secrets.ts
  export const getSecrets = async () => ({ apiKey: process.env.API_KEY })
  

  custom:
    secrets: ${file(./scripts/secrets.ts):getSecrets}
  

• Custom .env file locations and explicit opt-out via useDotenv. Previously a boolean. Now accepts a path or array of paths to load additional .env files alongside the local .env / .env.${stage} already loaded automatically — useful for monorepos sharing variables across services. useDotenv: false is now honored as the documented opt-out. Debug logging at core:resolver:env surfaces which files loaded and which keys came from each (visible with SLS_DEBUG=*; keys only, never values). Docs. Closes #10641. (#13597)

  useDotenv: ../shared           # load files from a sibling directory
  # useDotenv:                   # …or a list — earlier entries win
  #   - ./overrides.env
  #   - ../
  # useDotenv: false             # disable all .env loading
  

• CloudWatch Logs Infrequent Access log class. Opt-in logs.logGroupClass: infrequent_access at provider or function level provisions an Infrequent Access log group alongside the standard one, wires Lambda's LoggingConfig.LogGroup to write to it, and applies DeletionPolicy: Retain so its history survives stack updates and removals. The standard sibling is always created so pre-existing logs at the default path are preserved during migration. Services that do not opt in produce an identical CloudFormation template. Docs. Closes #12278. (#13601)

  provider:
    logs:
      lambda:
        logGroupClass: infrequent_access   # service-wide default
  
  functions:
    realTimeReports:
      handler: handler.reports
      logs:
        logGroupClass: standard            # override per function
  

  Note: AWS does not allow the class of an existing log group to be changed in place. serverless logs -f <function> cannot read Infrequent Access groups — use CloudWatch Logs Insights instead. Once an IA log group has been retained out of the stack, re-enabling infrequent_access later for the same function will fail with ResourceAlreadyExistsException unless the orphaned group is first deleted or imported back into the stack.

• Cognito User Pool PreTokenGeneration V2_0 and V3_0 triggers. New opt-in lambdaVersion property on the cognitoUserPool event for the PreTokenGeneration trigger. Accepted values: V1_0 (ID token customization — historic behavior), V2_0 (ID and access token customization), and V3_0 (V2 capabilities plus machine-to-machine client-credentials grants). When omitted, the emitted CloudFormation is byte-identical to before; existing services see no template diff on upgrade. Docs. Closes #12336. (#13588)

  functions:
    preTokenGeneration:
      handler: preToken.handler
      events:
        - cognitoUserPool:
            pool: MyUserPool
            trigger: PreTokenGeneration
            lambdaVersion: V2_0
  

  Note: V2_0 and V3_0 require the Cognito Essentials or Plus feature plan.

• Opt-in Lambda recursive loop detection via recursiveLoop. Maps 1:1 to the AWS Lambda function property of the same name. Accepts allow or terminate (default; case-insensitive). By default AWS terminates a function that invokes itself in a loop — set recursiveLoop: allow for designs that intentionally rely on this pattern. Docs. Closes #12938. (#13583)

  functions:
    hello:
      handler: handler.hello
      recursiveLoop: allow
  

• ECR image retention via provider.ecr.maxImages. Services that deploy Lambda from container images can now bound how much their ECR repository grows. When set, the framework attaches a lifecycle policy that expires the oldest untagged image versions beyond the configured count. Currently-tagged digests are unconditionally safe — only superseded versions can ever be expired. Default behavior (maxImages unset) is unchanged. Docs. Closes #12279. (#13584)

  provider:
    ecr:
      scanOnPush: true
      maxImages: 10
  

• Reconcile command works against large organizations. serverless reconcile previously failed with a Request Entity Too Large error against organizations with thousands of instances (e.g. 5000+). Reconciliation now batches the request and parallelizes CloudFormation stack fetching while respecting API rate limits. Docs. (#13596)

Bug Fixes

• Durable Lambda functions can now be invoked through event sources that wire an unqualified ARN. AWS rejects unqualified invocations of durable functions with InvalidParameterValueException: You cannot invoke a durable function using an unqualified ARN. The framework now publishes a stable alias and points event sources at it. Closes #13587. (#13589)

• MCP SSE server now binds to loopback only. The MCP server's SSE transport was binding to all network interfaces; it now binds to 127.0.0.1 only and installs Host-header validation. Default port (3001) is unchanged. (#13595)

Maintenance

• Bumped the AWS SDK group across one directory with 34 updates (#13605)
• Upgraded @smithy/util-retry (#13607)
• Upgraded qs (#13604)
• Upgraded protobufjs (#13594)
• Upgraded golang.org/x/mod dependency (#13598)
• Bumped the uv group across 5 directories (#13593)
• Upgraded brace-expansion and ws (#13591)

Bug Fixes

• Fixed framework hang during TypeScript configuration loading. Services with multi-file TypeScript configurations (a serverless.ts that imports other .ts files via relative imports) could deadlock during command startup, most reliably reproduced in AWS CodeBuild. The framework now handles nested TypeScript imports without the deadlock. (#13574, #13581)

• Fixed esbuild version conflicts with the serverless-esbuild plugin. Projects that pinned an esbuild version different from the framework's hit Cannot start service: Host version "X.Y.Z" does not match binary version "A.B.C" errors when running commands like serverless invoke local. Each esbuild instance now resolves its own platform binary independently, so both versions can coexist in the same project. (#13580, #13581)

Maintenance

• Bumped the AWS SDK group with 30 updates (#13575)
• Upgraded protobufjs from 7.5.5 to 7.5.7 (#13573)
• Bumped langsmith across bedrock-agentcore JavaScript examples (#13579)

Features

• Faster, more reliable installs. The Serverless Framework installer no longer needs to download dependencies from the npm registry at install time — everything required is pulled in a single download. Fresh installs also use less disk space (~42 MB saved per framework version). Existing projects work without changes. (#13514)

  Note: Existing users on an older installer will automatically pick up this faster install path the next time they update or fetch a new framework version. To also get the disk-space savings, update the installer with serverless update, or reinstall the serverless npm package.

Bug Fixes

• Patched urllib3 decompression-bomb vulnerability in Python test fixtures. Bumped urllib3 from 2.6.3 to 2.7.0 across all Python lockfiles (poetry, pipenv, pip, uv variants) to resolve GHSA-mf9v-mfxr-j63j. Affects only the test-suite Python environments — no impact on user deployments. (#13568)

• Patched a net/http infinite-loop CVE in the installer runtime. Picks up the upstream fix for CVE-2026-33814 (HTTP/2 CONTINUATION-frame infinite loop when SETTINGS_MAX_FRAME_SIZE=0). All released installers are rebuilt against the patched toolchain. (#13560)

Maintenance

• Patched additional moderate-severity dependency vulnerabilities:
  • Upgraded hono 4.12.14 → 4.12.18, fast-uri 3.0.6 → 3.1.2, fast-xml-builder 1.1.5 → 1.2.0, ip-address 10.1.0 → 10.2.0, and express-rate-limit 8.3.1 → 8.5.1 (#13564)
  • Bumped fast-uri across all 13 bedrock-agentcore JavaScript examples (#13561)
  • Bumped fast-xml-builder (along with two transitives) across all 13 bedrock-agentcore JavaScript examples (#13559)
• Bumped the AWS SDK group with 31 updates from 3.1035.0 to 3.1041.0 (#13565)
• Upgraded mongodb from 7.1.1 to 7.2.0 — adds support for MongoDB's Intelligent Workload Management (#13553)
• Upgraded simple-git from 3.33.0 to 3.36.0 (#13555)
• Bumped the patch-updates group: @slack/web-api 7.15.1 → 7.15.2, fs-extra, and uuid (#13567)
• Bumped dev-dependencies group: eslint 10.2.1 → 10.3.0 and globals (#13566)
• Bumped Jackson Java dependencies in invoke-local runtime wrappers: jackson-core, jackson-databind, jackson-datatype-joda (#13548, #13549, #13550)
• Bumped aws-actions/configure-aws-credentials from v6.1.0 to v6.1.1 in CI workflows (#13563)
• Added toml v4+ to the Dependabot ignore list to preserve Node.js 18 support (#13562)

Bug Fixes

• AppSync: @canonical, @hidden, and @renamed now work on field definitions. The bundled Merged API directive stubs only declared the OBJECT location, so applying these directives to fields failed packaging with errors like Directive "@canonical" may not be used on FIELD_DEFINITION.. They're now declared as OBJECT | FIELD_DEFINITION to match AWS's documented surface. (#13533, #13542). Thanks @PatrykMilewski!

type Query {
  getMessage(id: ID!): Message @renamed(to: "getChatMessage")
  internalField: String @hidden
}

• Python: lambda layer is now built for layer-only services. Services that declared custom.pythonRequirements.layer with no functions: block silently produced an empty CloudFormation stack. The runtime guard now also activates when pythonRequirements.layer is set and the provider runtime starts with python, restoring parity with the standalone serverless-python-requirements plugin. Heads up: services that previously hit this bug will now actually invoke pip on serverless package, so set pythonBin or use dockerizePip if the matching pythonX.Y binary isn't available locally. (#13541)

provider:
  runtime: python3.13
custom:
  pythonRequirements:
    layer: true

• Python: zip entry paths are now normalized to forward slashes on Windows. globSync was preserving Windows backslashes in ZIP archive entries, which broke the ZIP spec and caused import mismatches at runtime. Entries are now written with POSIX-style / separators on every platform, and ci-python.yml also runs Python tests on Windows when Python paths change. (#13307, #13383, #13546). Thanks @Tsingis!

Maintenance

• Patched GHSA-w5hq-g745-h8pq (uuid v3/v5/v6 missing buffer bounds check) in the langgraph-* JavaScript example lockfiles under bedrock-agentcore/examples/javascript/ by bumping nested uuid from 13.0.0 to 13.0.2. Lockfile-only, and these examples aren't shipped in the published package. (#13545)
• Bumped axios from 1.15.0 to 1.15.2 (transitive, lockfile-only) for upstream security-hardening patches. (#13544)

Features

• Added uv dependency-group and optional-dependency controls for Python packaging. Four new custom.pythonRequirements options let you control which extras and groups are included in the deployment package, mirroring the existing Poetry group support. --no-dev is always passed to keep dev dependencies out of Lambda packages by default; opt in via uvWithGroups: [dev] if needed. Read more in the docs. (#13499, #13500) — Thanks @jax-b!

custom:
  pythonRequirements:
    uvOptionalDependencies: # → uv export --extra <name>
      - heavy
    uvWithGroups: # → uv export --group <name>
      - prod
    uvWithoutGroups: # → uv export --no-group <name>
      - test
    uvOnlyGroups: # → uv export --only-group <name>
      - lambda

Bug Fixes

• Fixed sls deploy --package failure with the esbuild builder. Esbuild zip artifacts are now written to .serverless/<name>.zip instead of .serverless/build/<name>.zip, matching the path that extended-validate.js reconstructs. The two-process sls package + sls deploy --package .serverless flow no longer fails with MISSING_ARTIFACT_FILE. The .serverless/build/ directory remains the staging area for intermediate build artifacts (compiled JS, package.json, lockfiles, node_modules) — only the final zip moves up. (#12964, #13507)

• Fixed duplicate PATH entries from the binary installer script. The installer used $(grep -q ...) command substitution to detect whether .serverless/bin was already in the shell config; because -q suppresses output, the substitution always returned an empty string and the condition was always true, so a new line was appended on every install. The script now checks the exit status directly and properly quotes $SHELL_CONFIG. (#13394, #13410) — Thanks @gaurav0909-max!

Maintenance

• Patched moderate-severity security vulnerabilities:
  • Upgraded fast-xml-parser from 5.5.8 to 5.7.1 to patch GHSA-gh4j-gqv2-49f6 (XMLBuilder XML comment and CDATA injection via unescaped delimiters) (#13521)
  • Patched GHSA-w5hq-g745-h8pq (uuid v3/v5/v6 missing buffer bounds check) by bumping nested uuid versions and replacing dockerode 4.0.10 with 5.0.0, which drops the uuid dependency entirely (#13530)
  • Upgraded follow-redirects from 1.15.11 to 1.16.0, hono from 4.12.12 to 4.12.14, and protobufjs from 7.5.3 to 7.5.5 to pick up upstream vulnerability patches (#13516)
  • Upgraded fastify to 5.8.5 to patch GHSA-247c-9743-5963 (CVE-2026-33806) and bumped langsmith from 0.5.6 to 0.5.18 across the bedrock-agentcore JS examples (#13496, #13513)
• Bumped the AWS SDK group with 33 updates from 3.1017.0 to 3.1035.0 (#13526) and an additional 3 updates in packages/framework-dist (#13510)
• Upgraded https-proxy-agent from 7.0.6 to 8.0.0 (major version bump — CJS to ESM conversion only, no API or behavior changes; transparent for the workspace which is already ESM) (#13535)
• Upgraded undici from 6.24.1 to 6.25.0 in packages/util (#13536) and packages/sf-core-installer (#13519)
• Upgraded ws from 8.19.0 to 8.20.0 (#13537)
• Upgraded @slack/web-api from 7.14.1 to 7.15.1 (#13538)
• Upgraded @graphql-tools/merge from 9.1.7 to 9.1.9 and bumped grouped patch updates including adm-zip, eventsource-parser, and filesize (#13532)
• Upgraded pytest from 8.4.2 to 9.0.3 in the uv test fixtures (#13503)
• Upgraded golang.org/x/mod from 0.34.0 to 0.35.0 in binary-installer (#13518)

Features

Serverless Framework

• Added S3 Files support for Lambda file system configuration. Lambda functions can now mount Amazon S3 Files in addition to EFS via fileSystemConfig. The file system type is auto-detected from literal ARNs; for CloudFormation references, specify type: s3files explicitly. The framework automatically generates the correct IAM permissions (s3files:ClientMount/s3files:ClientWrite) and validates VPC configuration. Fully backward compatible — existing EFS configurations work unchanged. Read more in the docs. (#13493)

functions:
  hello:
    handler: handler.hello
    fileSystemConfig:
      localMountPath: /mnt/s3data
      arn: arn:aws:s3files:us-east-1:111111111111:file-system/fs-abc123/access-point/fsap-abc123
    vpc:
      securityGroupIds:
        - sg-xxx
      subnetIds:
        - subnet-xxx

When using CloudFormation references, set the type explicitly:

functions:
  hello:
    handler: handler.hello
    fileSystemConfig:
      localMountPath: /mnt/s3data
      arn: !GetAtt MyS3FilesAccessPoint.AccessPointArn
      type: s3files
    vpc:
      securityGroupIds:
        - sg-xxx
      subnetIds:
        - subnet-xxx

Bug Fixes

Serverless Framework

• Fixed min-release-age not being applied during framework distribution builds. The root .npmrc was silently ignored by npm because it reads project config from the nearest package.json directory. Added per-package .npmrc files to packages/framework-dist and packages/sf-core-installer to enforce a 3-day cooldown on newly published dependencies. Also added check-latest: true to CI setup-node steps to ensure consistent npm versions across runners. (#13476)

Maintenance

• Upgraded Go from 1.26.1 to 1.26.2 in binary-installer to fix 5 vulnerabilities in std/crypto/tls, std/crypto/x509, and std/archive/tar (#13492)
• Upgraded hono to 4.12.12 and @hono/node-server to 1.19.13 to fix 6 security vulnerabilities including middleware bypass via repeated slashes (GHSA-wmmm-f939-6g9c, GHSA-92pp-h63x-v22m), path traversal in toSSG() (GHSA-xf4j-xp2r-rqqx), incorrect IP matching (GHSA-xpcf-pg52-r92g), and cookie handling bypasses (GHSA-26pp-8wgv-hjvm, GHSA-r5rp-j6wh-rvv4). Upgraded Pygments to 2.20.0 to fix a ReDoS vulnerability (#13489)
• Upgraded eslint to v10 and @eslint/js to v10 (#13477)