chore(deps): bump adm-zip and serverless

[dependabot]

Removes adm-zip. It's no longer used after updating ancestor dependency serverless. These dependencies need to be updated together.

Removes adm-zip

Updates serverless from 3.40.0 to 4.40.0

Release notes

Sourced from serverless's releases.

4.40.0

Features

• Lambda self-managed code storage. Setting provider.deploymentBucket.codeStorageMode: reference makes Lambda run function and layer code directly from your deployment bucket instead of copying it into Lambda-managed storage, so your code no longer counts against the Lambda code storage quota. Every deployment pins each function and layer to the exact uploaded S3 object version, so later uploads never affect what runs. Because deployment artifacts back live Lambda versions in this mode, automatic post-deploy artifact cleanup is disabled — retire artifacts that no longer back any function or layer version with serverless prune --includeArtifacts (also available as custom.prune.includeArtifacts). Read more in the deployment bucket guide and the prune CLI reference, and see the aws-node-self-managed-code-storage example. (#13725)

provider:
  deploymentBucket:
    codeStorageMode: reference # default: copy

# Keep the 3 most recent function versions, then retire deployment
# artifacts that no longer back any surviving function or layer version
serverless prune -n 3 --includeArtifacts

Note reference mode requires a versioned deployment bucket that Lambda is allowed to read. The Framework-managed deployment bucket is configured automatically; custom buckets are validated and the deployment stops with instructions when a prerequisite is missing.

• Compose: run a command on an exact subset of services. The --service option now accepts a comma-separated list for deploy, remove, info, print, and package. The command runs on exactly the named services, ordered by dependsOn; services not named are left untouched, and their outputs stay available for ${param:...} resolution — so a subset can reference services already deployed elsewhere. Read more in the Compose guide. (#13705)

serverless deploy --service=service-a,service-d --stage my-feature

• Removed Serverless Container Framework and Serverless AI Framework. These products are no longer part of the CLI. Projects with a serverless.containers.* or serverless.ai.* configuration file now get a clear error with guidance: pin frameworkVersion: "4.39.0" (the last version supporting them) and the CLI automatically runs that version for the project. (#13698)

frameworkVersion: '4.39.0'

Bug Fixes

• Fixed corrupted bundles when multiple functions share a handler file. The built-in esbuild packaging ran one build per function, so functions sharing a handler file wrote the same output concurrently — occasionally producing a corrupted bundle that failed at Lambda startup with Runtime.UserCodeSyntaxError. Each unique handler file is now built exactly once and reused across the functions that share it, which also removes the redundant rebuilds. (#13716, #13717) - Thanks @​dekpient for the report!
• Fixed unchanged services being redeployed on every deploy. Artifacts produced by the built-in esbuild packaging embedded fresh file timestamps on every build, so identical code always looked changed to deploy change detection. Archive entry timestamps are now pinned, identical content produces byte-identical artifacts, and unchanged deployments are skipped as intended. (#13696)
• Fixed the shared IAM role accumulating permissions for functions with dedicated roles. When only some functions use per-function IAM roles, the shared execution role no longer collects event-source and feature grants belonging to functions that have their own role — previously its inline policy grew with every function and could exceed the IAM policy size limit ("Maximum policy size exceeded"). Dedicated per-function roles also now receive grants that previously only existed on the shared role, including Kinesis enhanced fan-out consumer actions, stream onFailure destination grants, and kms:Decrypt for kmsKeyArn. (#13704)
• Fixed a crash when frameworkVersion is "*". Version ranges without a concrete version, such as '*', no longer throw TypeError: Cannot read properties of null (reading 'major'). Since such ranges accept every version, the version check is skipped for them; all other values behave as before — pinning a different major version still fails with the version mismatch error, and invalid version strings still fail under configValidationMode: error. (#13714)
• Safer development-dependency exclusion during packaging. When the production dependency listing cannot be determined, packaging now stops with a clear error instead of risking an artifact that excludes production dependencies (opt out with package.excludeDevDependencies: false); when no dependency listing is available at all, exclusion is skipped with a warning and the artifact ships fully functional. Dependency listing output is also captured directly rather than through the shell, making packaging robust in temporary directories containing spaces or special characters. (#13724, #13699)
• Hardened validation of pinned canary versions in the installer. Malformed canary version values are rejected with a clear error, and release downloads are contained to the expected releases directory. (#13700)

Maintenance

• Updated multiple dependencies:
  • Bumped the AWS SDK group with 36 updates (#13715)
  • Upgraded adm-zip to v0.6.0 (#13720)
  • Upgraded fast-uri to v3.1.4 (#13722)
  • Upgraded js-yaml to v4.3.0 (#13712)
  • Upgraded body-parser to v2.3.0 in the Bedrock AgentCore examples, addressing GHSA-v422-hmwv-36x6 (#13723)

... (truncated)

Commits

• e2c559e chore: release 4.40.0 (#13726)
• a5ad2d6 feat(aws): support Lambda self-managed code storage (reference mode) (#13725)
• 60badd3 fix(packaging): stop packaging when the production dependency listing is unav...
• eb0af13 fix(aws): scope shared IAM role to functions without dedicated per-function r...
• 8159e96 fix(esbuild): build shared handler files once to prevent corrupted bundles (#...
• 052eb97 chore(deps): bump the npm_and_yarn group across 5 directories with 1 update (...
• c425f77 feat(compose): accept a comma-separated service list in --service (#13705)
• 570a830 chore(deps): bump fast-uri from 3.1.3 to 3.1.4 (#13722)
• 0acff69 chore(deps): bump adm-zip from 0.5.18 to 0.6.0 (#13720)
• 3dcbfa7 chore: standardize development toolchain on Node 24 LTS and npm 12 (#13721)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for serverless since your current version.

Install script changes

This version modifies postinstall script that runs during installation. Review the package contents before updating.