4.40.0

Features

• Lambda self-managed code storage. Setting provider.deploymentBucket.codeStorageMode: reference makes Lambda run function and layer code directly from your deployment bucket instead of copying it into Lambda-managed storage, so your code no longer counts against the Lambda code storage quota. Every deployment pins each function and layer to the exact uploaded S3 object version, so later uploads never affect what runs. Because deployment artifacts back live Lambda versions in this mode, automatic post-deploy artifact cleanup is disabled — retire artifacts that no longer back any function or layer version with serverless prune --includeArtifacts (also available as custom.prune.includeArtifacts). Read more in the deployment bucket guide and the prune CLI reference, and see the aws-node-self-managed-code-storage example. (#13725)

provider:
  deploymentBucket:
    codeStorageMode: reference # default: copy

# Keep the 3 most recent function versions, then retire deployment
# artifacts that no longer back any surviving function or layer version
serverless prune -n 3 --includeArtifacts

Note
reference mode requires a versioned deployment bucket that Lambda is allowed to read. The Framework-managed deployment bucket is configured automatically; custom buckets are validated and the deployment stops with instructions when a prerequisite is missing.

• Compose: run a command on an exact subset of services. The --service option now accepts a comma-separated list for deploy, remove, info, print, and package. The command runs on exactly the named services, ordered by dependsOn; services not named are left untouched, and their outputs stay available for ${param:...} resolution — so a subset can reference services already deployed elsewhere. Read more in the Compose guide. (#13705)

serverless deploy --service=service-a,service-d --stage my-feature

• Removed Serverless Container Framework and Serverless AI Framework. These products are no longer part of the CLI. Projects with a serverless.containers.* or serverless.ai.* configuration file now get a clear error with guidance: pin frameworkVersion: "4.39.0" (the last version supporting them) and the CLI automatically runs that version for the project. (#13698)

frameworkVersion: '4.39.0'

Bug Fixes

• Fixed corrupted bundles when multiple functions share a handler file. The built-in esbuild packaging ran one build per function, so functions sharing a handler file wrote the same output concurrently — occasionally producing a corrupted bundle that failed at Lambda startup with Runtime.UserCodeSyntaxError. Each unique handler file is now built exactly once and reused across the functions that share it, which also removes the redundant rebuilds. (#13716, #13717) - Thanks @dekpient for the report!
• Fixed unchanged services being redeployed on every deploy. Artifacts produced by the built-in esbuild packaging embedded fresh file timestamps on every build, so identical code always looked changed to deploy change detection. Archive entry timestamps are now pinned, identical content produces byte-identical artifacts, and unchanged deployments are skipped as intended. (#13696)
• Fixed the shared IAM role accumulating permissions for functions with dedicated roles. When only some functions use per-function IAM roles, the shared execution role no longer collects event-source and feature grants belonging to functions that have their own role — previously its inline policy grew with every function and could exceed the IAM policy size limit ("Maximum policy size exceeded"). Dedicated per-function roles also now receive grants that previously only existed on the shared role, including Kinesis enhanced fan-out consumer actions, stream onFailure destination grants, and kms:Decrypt for kmsKeyArn. (#13704)
• Fixed a crash when frameworkVersion is "*". Version ranges without a concrete version, such as '*', no longer throw TypeError: Cannot read properties of null (reading 'major'). Since such ranges accept every version, the version check is skipped for them; all other values behave as before — pinning a different major version still fails with the version mismatch error, and invalid version strings still fail under configValidationMode: error. (#13714)
• Safer development-dependency exclusion during packaging. When the production dependency listing cannot be determined, packaging now stops with a clear error instead of risking an artifact that excludes production dependencies (opt out with package.excludeDevDependencies: false); when no dependency listing is available at all, exclusion is skipped with a warning and the artifact ships fully functional. Dependency listing output is also captured directly rather than through the shell, making packaging robust in temporary directories containing spaces or special characters. (#13724, #13699)
• Hardened validation of pinned canary versions in the installer. Malformed canary version values are rejected with a clear error, and release downloads are contained to the expected releases directory. (#13700)

Maintenance

• Updated multiple dependencies:
  • Bumped the AWS SDK group with 36 updates (#13715)
  • Upgraded adm-zip to v0.6.0 (#13720)
  • Upgraded fast-uri to v3.1.4 (#13722)
  • Upgraded js-yaml to v4.3.0 (#13712)
  • Upgraded body-parser to v2.3.0 in the Bedrock AgentCore examples, addressing GHSA-v422-hmwv-36x6 (#13723)
  • Upgraded Jackson to v2.22.1 in the Java local-invocation runtime wrapper (#13694)
  • Upgraded tsx to v4.23.0 (#13711) and filesize to v11.0.22 (#13710)
  • Updated aws-actions/configure-aws-credentials in the actions group (#13707)
• Regenerated the dependency lockfile from scratch so declared security overrides are applied consistently to all resolutions (#13713)