Bump serverless from 4.41.1 to 4.42.0 in /serverless

[dependabot]

Bumps serverless from 4.41.1 to 4.42.0.

Release notes

Sourced from serverless's releases.

4.42.0

Features

• Non-bundled esbuild services are packaged like classic packaging, with TypeScript compiled in place. With build.esbuild.bundle: false, the Framework now packages your whole service the way classic packaging does: locally imported helper files are compiled and included (previously only each handler file was), JavaScript and other files are copied as they are, the project layout is preserved, and every compiled file is emitted in the module format its nearest package.json declares (.mts → .mjs, .cts → .cjs). A new build.esbuild.tsconfig option selects which TypeScript compiles, function-level build: false is accepted as a boolean, and files that esbuild plugins write into the build directory now ship in the artifact. Thanks @​visrut-at-handldigital and @​ewsbr for the reports. (#12744, #13163, #13850) Read more in the Building guide.

build:
  esbuild:
    bundle: false
    # optional — tsconfig.json is picked up automatically; point at a build-specific
    # config (for example one that excludes tests/**) to narrow what gets compiled
    tsconfig: tsconfig.build.json

• Compose: reference other services through the variable system, including services deployed to a different stage. A new service resolver reads a service's outputs in serverless-compose.yml: ${service:<service>.<Output>} resolves at the current stage and deploys that service first; a named instance with a stage pins the stage, so application services on personal stages can read a database service that lives once on a shared stage. References accept fallbacks and nesting like any other variable, configuration mistakes are reported before anything deploys, and the existing ${<service>.<Output>} form keeps working unchanged. (#13843) Read more in the Compose guide and try the shared-services Compose example.

# serverless-compose.yml
stages:
  default:
    resolvers:
      shared:
        type: service
        stage: shared-infra # the long-lived stage where orders-db lives
services:
orders-db:
path: orders-db
api:
path: api
params:
tableName: ${service:orders-db.TableName} # same stage as this run; deploys orders-db first
dbHost: ${shared:orders-db.Host} # read from orders-db@shared-infra, without deploying it here

• AWS variable resolvers make fewer requests and retry throttling. ${cf:stackName.outputKey} now issues one DescribeStacks call per stack per run instead of one per referenced output — services deployed together with Compose share those calls, and cached reads are refreshed after each Compose service deploy — and ${aws:accountId} is resolved once per run. All AWS resolvers (${cf:}, ${ssm:}, ${s3:}, ${aws:accountId}) retry throttled requests with the AWS SDK's standard exponential backoff, up to 10 attempts by default; AWS_MAX_ATTEMPTS / AWS_RETRY_MODE and the matching ~/.aws/config keys take precedence. --verbose shows each retry, --debug prints a per-API request summary, and exhausted retries fail with a dedicated error naming the API, the attempts made, and the remediations. Expired credentials during variable resolution now produce the familiar "AWS credentials appear to have expired" message. (#13848) Read more in the CloudFormation outputs and SSM variable guides.

Note ${cf:stackName} without an output key is now rejected before any request is made (expected '<stackName>.<outputKey>'), instead of issuing a request and failing with a generic message. This also applies when a fallback is present: ${cf:stackName, 'default'} previously resolved to the fallback and now fails validation — write ${cf:stackName.outputKey, 'default'}.

• Terraform state is read once per run. ${terraform:outputs:...} now downloads and parses each Terraform state once per run and shares it across every placeholder and every Compose service, instead of once per referenced output per service. The s3 backend retries throttled reads with the AWS SDK's standard backoff, resolves credentials once per process, and reads a state bucket in another region by following S3's redirect instead of failing with PermanentRedirect. Thanks @​schammah for the detailed report. (#13844, #13852) Read more in the Terraform variables guide.

• MCP servers run in Dev Mode. serverless dev now serves the MCP servers declared under mcp: requests hit the real deployed endpoint — streaming route, authorizer, OAuth discovery and state keys all live — and are answered by your local server module, with edits applied on the next request and no redeploy. The session banner lists each server's endpoint under mcp:, and every request is logged with its JSON-RPC method and target; a JSON-RPC error carried inside a 200 response is called out on the same line. (#13836) Read more in the serverless dev reference and the MCP servers guide; each MCP example now has a "Develop it live" section.

mcp: crm → https://abc123.execute-api.us-east-1.amazonaws.com/dev/crm/mcp
✔ Connected (Ctrl+C to cancel)
→ λ crm ── mcp tools/call get_weather
← λ crm (200) 640ms
</tr></table> 

... (truncated)

Commits

• 75b9a96 chore: release 4.42.0 (#13859)
• c4d993f docs: fill in the details readers need for non-bundled builds, SnapStart imag...
• d8cfc5b fix(resolvers): name AWS APIs without the bundler's class-name suffix (#13861)
• ba53f91 test(esbuild): use native paths and file URLs in non-bundled build tests (#13...
• 0954632 fix(aws): reject package paths at or above the service directory (#13853)
• 3bd7831 chore(deps): bump the npm_and_yarn group across 5 directories with 1 update (...
• 6621a51 chore(deps): bump js-yaml from 4.3.1 to 4.3.2 (#13855)
• aeacd85 fix(resolvers): show AWS credential-setup hint for the default resolver (#13854)
• ab0a18c feat(esbuild): package non-bundled services like classic packaging, with Type...
• ba115d9 feat(resolvers): fetch each Terraform state once per run across Compose servi...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud