serverless/serverless sf-core@4.32.0

4.32.0

on GitHub

Features

Serverless Framework

• Added support for .NET 10 runtime (dotnet10). (#13330, #13331) - Thanks @mungojam!

provider:
  name: aws
  runtime: dotnet10

• Added --on-exit=remove option for Dev Mode. When exiting serverless dev with Ctrl+C, this option prompts to remove the deployed service stack, streamlining teardown after development. (#13342, #13321)

serverless dev --on-exit=remove

• Added accessMode configuration for API Gateway custom domains. You can now set the API Gateway endpoint access mode to basic or strict for REST API domains managed through API Gateway V1. (#13329, #13332, #13343)

custom:
  domain:
    name: api.example.com
    apiType: rest
    securityPolicy: SecurityPolicy_TLS13_2025_EDGE
    accessMode: strict

Note
The accessMode setting requires an enhanced securityPolicy (e.g., SecurityPolicy_TLS13_2025_EDGE) and is only supported for REST API domains. HTTP API and WebSocket domains use API Gateway V2, which does not support this setting.

Bug Fixes

Serverless Framework

• Fixed Dev Mode connection breakage from large MQTT payloads. Requests or responses exceeding AWS IoT Core's 128 KB MQTT payload limit would silently break the connection, leaving the CLI in a zombie state where it appeared connected but all subsequent invocations failed. The Framework now checks payload sizes proactively and returns clear error messages instead of breaking the connection. (#13313)
• Fixed S3 upload failure when deploying symlinked artifacts. AWS SDK v3 uses lstatSync to determine file size for multipart uploads, which returns the symlink size instead of the target file size. This caused "Expected N part(s) but uploaded M part(s)" errors when plugins like serverless-python-requirements cache artifacts as symlinks. The Framework now passes an explicit ContentLength to S3. (#13317)

Maintenance

• Upgraded AWS SDK v3 from 3.968.0 to 3.982.0 (#13303, #13314, #13334)
• Upgraded @modelcontextprotocol/sdk from 1.25.3 to 1.26.0 — security fix for cross-client response data leak (#13323)
• Upgraded mongodb from 7.0.0 to 7.1.0 (#13337)
• Upgraded jackson-core, jackson-databind, jackson-annotations, and jackson-datatype-joda to 2.21.0 in Java invoke-local wrapper (#13340)
• Upgraded fast-xml-parser to 5.3.4 (#13311)
• Upgraded esbuild from 0.27.2 to 0.27.3 (#13336)
• Upgraded axios from 1.13.3 to 1.13.5 (#13319, #13336)
• Upgraded zod from 4.3.5 to 4.3.6 (#13305)
• Upgraded semver from 7.7.3 to 7.7.4 (#13336)
• Upgraded dotenv from 17.2.3 to 17.2.4 (#13336)
• Upgraded prettier from 3.8.0 to 3.8.1 (#13304)
• Upgraded globals from 17.0.0 to 17.3.0 (#13318, #13335)
• Upgraded aws-actions/configure-aws-credentials from 5.1.1 to 6.0.0 (#13333)
• Upgraded actions/checkout from 6.0.1 to 6.0.2, actions/setup-python from 6.1.0 to 6.2.0 (#13302)
• Pinned @axiomhq/js below v1.4.0 to maintain Node.js 18 compatibility (#13324)