4.41.1

4.41.1

Bug Fixes

• Fixed packaging producing a different artifact on every run. When using the built-in build system, repeated serverless package runs of an unchanged service produced artifacts with different checksums, so change detection could see phantom diffs and redeploy unchanged services. Artifacts are now byte-for-byte identical across runs. (#13794)

• Fixed package.patterns exclusions being ignored in packaged artifacts. When using the built-in build system, negation patterns (!...) are now honored when packaging function artifacts — both for combined-service packaging and with package.individually. Function-level patterns are merged after service-level patterns, so function settings win on conflict, matching classic packaging behavior. (#13795)

Maintenance

• Framework-managed custom resources now run on Node.js 24. Deployments that use existing S3 buckets, existing Cognito User Pools, EventBridge events, or the API Gateway CloudWatch role pick up the nodejs24.x runtime automatically on the next deploy. No action is needed. Thanks @Hiroki-Aoki for raising this! (#13802, #13807)
• Bumped the AWS SDK group with 37 updates (#13796)
• Upgraded esbuild to v0.28.2 (#13798)
• Upgraded tsx to v4.23.11 (#13798)
• Upgraded ws to v8.21.3 (#13798)
• Upgraded eslint to v10.8.1 (#13797)
• Upgraded lint-staged to v17.3.0 (#13797)
• Upgraded hono to v4.13.1 (#13797)
• Upgraded globals to v17.9.0 (#13797)

4.41.0

4.41.0

Features

• Host MCP servers on AWS Lambda. A new mcp section in serverless.yml deploys official MCP TypeScript SDK servers behind API Gateway with response streaming. You write one SDK module; the Framework owns the endpoint, streaming, packaging, and the OAuth protected-resource discovery document. Servers can be protected with your own API Gateway authorizers or with the MCP SDK's built-in in-server token verification, and each server behaves as an ordinary function — logs, invoke, metrics, rollback, and deploy function work unchanged. MCP servers share one REST API, stage, and custom domain with each other and with http functions. Optional sealed request state lets tools round-trip data across elicitation retries without server-side storage. (#13778, #13784) Read more in the MCP servers guide and explore the MCP examples. A bundled serverless-mcp Agent Skill teaches AI coding agents (Claude Code, Codex, Cursor) how to build and operate MCP servers with the Framework — install it into your service with the agent skills install command:

serverless agent skills install

mcp:
  servers:
    crm:
      server: src/server.mjs
      authorizer:
        name: verifyToken
      oauthDiscovery:
        issuer: https://example.us.auth0.com

functions:
  verifyToken:
    handler: src/authorizer.handler

Bug Fixes

• Per-function artifacts are now included in change detection. Deployments that only changed a prebuilt per-function package.artifact were silently skipped, so new code never shipped; the artifact content now participates in the change hash. (#13771)
• Compose package and print no longer wipe deployed service state. Running a read-only command in a Compose project cleared the recorded outputs of already-deployed services, breaking later cross-service references and removals. Thanks @tmatilai for the detailed report. (#13437, #13792)
• Files named like code modules no longer hijack project detection. A template.mjs in the project root made the CLI treat the directory as a SAM/CloudFormation project and hide normal commands; detection is now restricted to SAM-supported template extensions. Thanks @tomchiverton for the report. (#13738, #13739)
• esbuild outExtension is honored end-to-end. Custom output extensions (e.g. .js → .mjs) now flow through bundling, packaging, deployment, and invoke local, with clear validation for unsupported mappings. (#13740)
• esbuild config-file sourcemap setting controls source-map support. With sourcemap: false in an esbuild config file, the Framework no longer force-enables --enable-source-maps in the function's NODE_OPTIONS. Thanks @maximepichou for the report. (#12997, #13741)
• Compose services with packages: external resolve root dependencies. Dependencies hoisted to the Compose project root are now traced and packaged when a service's esbuild config marks packages external. Thanks @joe-price-jt for the report. (#12957, #13742)
• Function URL invokeMode accepts any casing. Values like response_stream or Buffered are now normalized instead of failing validation. (#13756)
• Sandbox dev images build for the Docker daemon's architecture. Dev images previously targeted the host architecture, producing emulated (slow or failing) containers when the daemon reported a different one. (#13787)
• No spinner animations on zero-width terminals. CI providers that report a zero-column terminal (e.g. CircleCI) were flooded with spinner frames; animations now stay disabled there. Thanks @Kinnersley-Studio for the report. (#13786, #13788)

Maintenance

• Bumped the AWS SDK group with 150 updates across four bumps (#13732, #13752, #13767, #13780)
• Upgraded glob to v13 (#13766)
• Upgraded @hono/node-server to v2 (#13763)
• Upgraded hono to v4.13 (#13774, #13759)
• Upgraded @modelcontextprotocol/sdk (#13759)
• Upgraded fs-extra to v11.4 (#13769)
• Upgraded find-my-way (#13745)
• Upgraded ip-address to v10.4 (#13772)
• Upgraded fast-uri (#13775)
• Upgraded p-map (#13754)
• Upgraded js-yaml to v4.3.1 (#13789)
• Upgraded brace-expansion, resolving CVE-2026-14257 and CVE-2026-69152 (#13757, #13764, #13777)
• Upgraded minimatch and undici (#13764)
• Replaced lodash.uniqby with lodash's uniqBy (#13750)
• Replaced sha256-file with node:crypto (#13748)
• Removed the appdirectory dependency (#13749)
• Removed the rimraf dependency from the installer (#13765)
• Removed unused dependencies (#13747)

4.40.0

4.40.0

Features

• Lambda self-managed code storage. Setting provider.deploymentBucket.codeStorageMode: reference makes Lambda run function and layer code directly from your deployment bucket instead of copying it into Lambda-managed storage, so your code no longer counts against the Lambda code storage quota. Every deployment pins each function and layer to the exact uploaded S3 object version, so later uploads never affect what runs. Because deployment artifacts back live Lambda versions in this mode, automatic post-deploy artifact cleanup is disabled — retire artifacts that no longer back any function or layer version with serverless prune --includeArtifacts (also available as custom.prune.includeArtifacts). Read more in the deployment bucket guide and the prune CLI reference, and see the aws-node-self-managed-code-storage example. (#13725)

provider:
  deploymentBucket:
    codeStorageMode: reference # default: copy

# Keep the 3 most recent function versions, then retire deployment
# artifacts that no longer back any surviving function or layer version
serverless prune -n 3 --includeArtifacts

Note
reference mode requires a versioned deployment bucket that Lambda is allowed to read. The Framework-managed deployment bucket is configured automatically; custom buckets are validated and the deployment stops with instructions when a prerequisite is missing.

• Compose: run a command on an exact subset of services. The --service option now accepts a comma-separated list for deploy, remove, info, print, and package. The command runs on exactly the named services, ordered by dependsOn; services not named are left untouched, and their outputs stay available for ${param:...} resolution — so a subset can reference services already deployed elsewhere. Read more in the Compose guide. (#13705)

serverless deploy --service=service-a,service-d --stage my-feature

• Removed Serverless Container Framework and Serverless AI Framework. These products are no longer part of the CLI. Projects with a serverless.containers.* or serverless.ai.* configuration file now get a clear error with guidance: pin frameworkVersion: "4.39.0" (the last version supporting them) and the CLI automatically runs that version for the project. (#13698)

frameworkVersion: '4.39.0'

Bug Fixes

• Fixed corrupted bundles when multiple functions share a handler file. The built-in esbuild packaging ran one build per function, so functions sharing a handler file wrote the same output concurrently — occasionally producing a corrupted bundle that failed at Lambda startup with Runtime.UserCodeSyntaxError. Each unique handler file is now built exactly once and reused across the functions that share it, which also removes the redundant rebuilds. (#13716, #13717) - Thanks @dekpient for the report!
• Fixed unchanged services being redeployed on every deploy. Artifacts produced by the built-in esbuild packaging embedded fresh file timestamps on every build, so identical code always looked changed to deploy change detection. Archive entry timestamps are now pinned, identical content produces byte-identical artifacts, and unchanged deployments are skipped as intended. (#13696)
• Fixed the shared IAM role accumulating permissions for functions with dedicated roles. When only some functions use per-function IAM roles, the shared execution role no longer collects event-source and feature grants belonging to functions that have their own role — previously its inline policy grew with every function and could exceed the IAM policy size limit ("Maximum policy size exceeded"). Dedicated per-function roles also now receive grants that previously only existed on the shared role, including Kinesis enhanced fan-out consumer actions, stream onFailure destination grants, and kms:Decrypt for kmsKeyArn. (#13704)
• Fixed a crash when frameworkVersion is "*". Version ranges without a concrete version, such as '*', no longer throw TypeError: Cannot read properties of null (reading 'major'). Since such ranges accept every version, the version check is skipped for them; all other values behave as before — pinning a different major version still fails with the version mismatch error, and invalid version strings still fail under configValidationMode: error. (#13714)
• Safer development-dependency exclusion during packaging. When the production dependency listing cannot be determined, packaging now stops with a clear error instead of risking an artifact that excludes production dependencies (opt out with package.excludeDevDependencies: false); when no dependency listing is available at all, exclusion is skipped with a warning and the artifact ships fully functional. Dependency listing output is also captured directly rather than through the shell, making packaging robust in temporary directories containing spaces or special characters. (#13724, #13699)
• Hardened validation of pinned canary versions in the installer. Malformed canary version values are rejected with a clear error, and release downloads are contained to the expected releases directory. (#13700)

Maintenance

• Updated multiple dependencies:
  • Bumped the AWS SDK group with 36 updates (#13715)
  • Upgraded adm-zip to v0.6.0 (#13720)
  • Upgraded fast-uri to v3.1.4 (#13722)
  • Upgraded js-yaml to v4.3.0 (#13712)
  • Upgraded body-parser to v2.3.0 in the Bedrock AgentCore examples, addressing GHSA-v422-hmwv-36x6 (#13723)
  • Upgraded Jackson to v2.22.1 in the Java local-invocation runtime wrapper (#13694)
  • Upgraded tsx to v4.23.0 (#13711) and filesize to v11.0.22 (#13710)
  • Updated aws-actions/configure-aws-credentials in the actions group (#13707)
• Regenerated the dependency lockfile from scratch so declared security overrides are applied consistently to all resolutions (#13713)

4.39.0

Features

• Sandboxes — AWS Lambda MicroVMs. First-class support for Firecracker-isolated, snapshot-booted virtual machines that you define declaratively and run on demand, with the serverless operational model (no clusters, pay per run). Define a sandbox from a local Dockerfile directory or a prebuilt s3:// zip, and configure memory, environment, lifecycle hooks, tags, and VPC egress. deploy/remove build and tear down the image and supporting resources; IAM build/execution roles are generated for you, and observability — CloudWatch logs, metric filters, alarms, and a dashboard — is enabled by default and fully customizable.

  sandboxes:
    echo:
      artifact: ./app # local directory that contains a Dockerfile

  serverless invoke --sandbox echo          # run it (with --method / --port)
  serverless logs --sandbox echo            # fetch logs
  serverless dev --sandbox echo             # local dev loop with hot reload

  Local development. serverless dev --sandbox <name> builds and runs the sandbox container on your machine and hot-reloads it as you edit — no deploy needed to iterate. Requests are relayed to the locally running container, so you get the full run/inspect loop against your real sandbox definition before anything ships to AWS.

  See the Sandboxes guide for the full configuration reference, and the serverless/examples sandboxes directory for deploy-ready examples (minimal, complete, and a self-hosted environment for Claude Managed Agent). (#13663)

• serverless agent commands for AI coding agents. A new command namespace purpose-built for agents (Claude Code, Codex, Cursor) working with a Serverless service. (#13673)

  • serverless agent skills install installs the bundled Agent Skills into the service directory (.claude/skills/, .agents/skills/, or both — auto-detected), teaching agents how to work with the service. Idempotent, auto-refreshing when a newer CLI bundles newer skills, and ejectable per-skill.
  • serverless agent inspect returns the live AWS configuration of a deployed service's resources in a single call — a categorized inventory by default, or expanded raw AWS responses filtered by category (--functions, --api, --iam, --sandboxes, --all, …) or by AWS service. Deterministic, pipe-safe JSON/YAML output, so an agent gets the whole logical-to-physical picture without issuing dozens of aws describe-* calls itself.

  serverless agent skills install
  serverless agent inspect --functions --api

  See the Agent Skills guide for how skills are discovered, updated, and ejected, and the agent inspect reference for its full category and AWS-service filtering options.

Maintenance

• Runtime dependency bumps: @aws-sdk/util-arn-parser (#13680), a batch of 11 patch-level updates (#13677), and other routine bumps (#13666).
• Development and CI tooling: dev-dependency group updates (#13676), lint-staged 16 → 17 (#13678), and GitHub Actions bumps (#13667); constrained https-proxy-agent to a range that keeps Node 18 support (#13686).

4.38.1

Maintenance

• Upgraded undici to 6.27.0, clearing security advisories reported against earlier versions of the bundled HTTP client: a Set-Cookie SameSite attribute downgrade (GHSA-g8m3-5g58-fq7m), HTTP header injection via Set-Cookie percent-decoding (GHSA-p88m-4jfj-68fv), and a WebSocket client denial-of-service (GHSA-vxpw-j846-p89q). (#13657)

4.38.0

Features

• Ruby 4.0 runtime support. Functions can now target the ruby4.0 Lambda runtime. (#13613)

  provider:
    name: aws
    runtime: ruby4.0

• New ${aws:partition} variable. Resolves to the AWS partition for the deployment region (e.g. aws, aws-cn, aws-us-gov) with no network call or credentials required. Makes ARNs in your configuration portable across commercial, GovCloud, and China partitions. (#12441, #13633)

  provider:
    iam:
      role:
        managedPolicies:
          - arn:${aws:partition}:iam::aws:policy/AmazonS3ReadOnlyAccess

• AgentCore: Python 3.14 support. Agent runtimes can now target python3.14. Runtime validation is also stronger, with supported runtimes validated against a single allowlist. (#13645)

  # AgentCore agent configuration
  runtime: python3.14

Bug Fixes

• API Gateway custom stage now used for the service endpoint URL and stage tags. When provider.apiGateway.stage is set to a value different from the deployment stage, the ServiceEndpoint output URL and the API Gateway stage tags now use that configured stage. Previously they used the deployment stage, producing an incorrect endpoint URL and attempting to tag a stage that did not exist. (#13636)

  provider:
    apiGateway:
      stage: customstage   # now reflected in ServiceEndpoint + stage tags

• Variable resolution no longer drops placeholders during re-entrant resolution. A JavaScript or TypeScript ${file(...)} resolver that calls resolveVariable() or resolveConfigurationProperty() mid-resolution opens a nested resolution pass. Under certain async timing this could leave the outer resolution looking inactive, causing a later nested placeholder to be left unresolved. Each pass now preserves and restores its context so the full dependency chain resolves reliably. (#13635)

• AgentCore: unpinned the default Buildpacks builder image and added a builder override. The previously hard-pinned heroku/builder digest is no longer used by default. (#13647, #13646)

Maintenance

• Bumped the AWS SDK group with 34 updates (#13632)
• Upgraded esbuild to 0.28.1 and tsx to 4.22.4 (#13610, #13644)
• Upgraded Go to 1.26.4 and bumped golang.org/x/sys and golang.org/x/mod for the installer (#13618, #13614, #13650)
• Upgraded the Jackson libraries (databind, core, annotations, datatype-joda) for the Java runtime wrapper (#13619, #13620, #13621, #13637, #13638, #13639, #13640)
• Upgraded graphql to 16.14.0, ajv to 8.20.0, zod to 4.4.3, semver to 7.8.1, hono, @grpc/grpc-js to 1.14.4, and eventsource-parser to 3.1.0 (#13576, #13631, #13577, #13578, #13627, #13630, #13643, #13626)
• Patched a uuid buffer-bounds advisory in the bedrock-agentcore examples (#13617)
• Bumped grouped npm and GitHub Actions dependencies (#13649, #13648, #13641, #13622, #13624, #13625)

4.37.0

Features

• New serverless diff command for previewing changes against the deployed stack. Packages the service locally and renders a structured diff — resources, IAM grants, security groups, parameters, outputs — against the CloudFormation stack currently in AWS. A Function Code section reports per-function code changes by comparing local zip hashes against each Lambda's CodeSha256. Especially useful in CI and PR-review workflows. --json emits a machine-readable summary; --package <path> reuses an existing artifact directory to skip the auto-package step. Docs. (#13602)

  serverless diff
  serverless diff --json
  serverless diff --package .serverless

• TypeScript files supported in ${file()} variable references. The ${file(...)} variable resolver now loads .ts, .mts, and .cts modules in addition to JavaScript, with no separate build step required. All export shapes — default object, async default function, named export, named-export function with property selector, and injected resolveVariable / resolveConfigurationProperty callbacks — behave identically across JavaScript and TypeScript sources. Docs. (#13590)

  // scripts/secrets.ts
  export const getSecrets = async () => ({ apiKey: process.env.API_KEY })

  custom:
    secrets: ${file(./scripts/secrets.ts):getSecrets}

• Custom .env file locations and explicit opt-out via useDotenv. Previously a boolean. Now accepts a path or array of paths to load additional .env files alongside the local .env / .env.${stage} already loaded automatically — useful for monorepos sharing variables across services. useDotenv: false is now honored as the documented opt-out. Debug logging at core:resolver:env surfaces which files loaded and which keys came from each (visible with SLS_DEBUG=*; keys only, never values). Docs. Closes #10641. (#13597)

  useDotenv: ../shared           # load files from a sibling directory
  # useDotenv:                   # …or a list — earlier entries win
  #   - ./overrides.env
  #   - ../
  # useDotenv: false             # disable all .env loading

• CloudWatch Logs Infrequent Access log class. Opt-in logs.logGroupClass: infrequent_access at provider or function level provisions an Infrequent Access log group alongside the standard one, wires Lambda's LoggingConfig.LogGroup to write to it, and applies DeletionPolicy: Retain so its history survives stack updates and removals. The standard sibling is always created so pre-existing logs at the default path are preserved during migration. Services that do not opt in produce an identical CloudFormation template. Docs. Closes #12278. (#13601)

  provider:
    logs:
      lambda:
        logGroupClass: infrequent_access   # service-wide default
  
  functions:
    realTimeReports:
      handler: handler.reports
      logs:
        logGroupClass: standard            # override per function

  Note: AWS does not allow the class of an existing log group to be changed in place. serverless logs -f <function> cannot read Infrequent Access groups — use CloudWatch Logs Insights instead. Once an IA log group has been retained out of the stack, re-enabling infrequent_access later for the same function will fail with ResourceAlreadyExistsException unless the orphaned group is first deleted or imported back into the stack.

• Cognito User Pool PreTokenGeneration V2_0 and V3_0 triggers. New opt-in lambdaVersion property on the cognitoUserPool event for the PreTokenGeneration trigger. Accepted values: V1_0 (ID token customization — historic behavior), V2_0 (ID and access token customization), and V3_0 (V2 capabilities plus machine-to-machine client-credentials grants). When omitted, the emitted CloudFormation is byte-identical to before; existing services see no template diff on upgrade. Docs. Closes #12336. (#13588)

  functions:
    preTokenGeneration:
      handler: preToken.handler
      events:
        - cognitoUserPool:
            pool: MyUserPool
            trigger: PreTokenGeneration
            lambdaVersion: V2_0

  Note: V2_0 and V3_0 require the Cognito Essentials or Plus feature plan.

• Opt-in Lambda recursive loop detection via recursiveLoop. Maps 1:1 to the AWS Lambda function property of the same name. Accepts allow or terminate (default; case-insensitive). By default AWS terminates a function that invokes itself in a loop — set recursiveLoop: allow for designs that intentionally rely on this pattern. Docs. Closes #12938. (#13583)

  functions:
    hello:
      handler: handler.hello
      recursiveLoop: allow

• ECR image retention via provider.ecr.maxImages. Services that deploy Lambda from container images can now bound how much their ECR repository grows. When set, the framework attaches a lifecycle policy that expires the oldest untagged image versions beyond the configured count. Currently-tagged digests are unconditionally safe — only superseded versions can ever be expired. Default behavior (maxImages unset) is unchanged. Docs. Closes #12279. (#13584)

  provider:
    ecr:
      scanOnPush: true
      maxImages: 10

• Reconcile command works against large organizations. serverless reconcile previously failed with a Request Entity Too Large error against organizations with thousands of instances (e.g. 5000+). Reconciliation now batches the request and parallelizes CloudFormation stack fetching while respecting API rate limits. Docs. (#13596)

Bug Fixes

• Durable Lambda functions can now be invoked through event sources that wire an unqualified ARN. AWS rejects unqualified invocations of durable functions with InvalidParameterValueException: You cannot invoke a durable function using an unqualified ARN. The framework now publishes a stable alias and points event sources at it. Closes #13587. (#13589)

• MCP SSE server now binds to loopback only. The MCP server's SSE transport was binding to all network interfaces; it now binds to 127.0.0.1 only and installs Host-header validation. Default port (3001) is unchanged. (#13595)

Maintenance

• Bumped the AWS SDK group across one directory with 34 updates (#13605)
• Upgraded @smithy/util-retry (#13607)
• Upgraded qs (#13604)
• Upgraded protobufjs (#13594)
• Upgraded golang.org/x/mod dependency (#13598)
• Bumped the uv group across 5 directories (#13593)
• Upgraded brace-expansion and ws (#13591)

4.36.1

Bug Fixes

• Fixed framework hang during TypeScript configuration loading. Services with multi-file TypeScript configurations (a serverless.ts that imports other .ts files via relative imports) could deadlock during command startup, most reliably reproduced in AWS CodeBuild. The framework now handles nested TypeScript imports without the deadlock. (#13574, #13581)

• Fixed esbuild version conflicts with the serverless-esbuild plugin. Projects that pinned an esbuild version different from the framework's hit Cannot start service: Host version "X.Y.Z" does not match binary version "A.B.C" errors when running commands like serverless invoke local. Each esbuild instance now resolves its own platform binary independently, so both versions can coexist in the same project. (#13580, #13581)

Maintenance

• Bumped the AWS SDK group with 30 updates (#13575)
• Upgraded protobufjs from 7.5.5 to 7.5.7 (#13573)
• Bumped langsmith across bedrock-agentcore JavaScript examples (#13579)

4.36.0

Features

• Faster, more reliable installs. The Serverless Framework installer no longer needs to download dependencies from the npm registry at install time — everything required is pulled in a single download. Fresh installs also use less disk space (~42 MB saved per framework version). Existing projects work without changes. (#13514)

  Note: Existing users on an older installer will automatically pick up this faster install path the next time they update or fetch a new framework version. To also get the disk-space savings, update the installer with serverless update, or reinstall the serverless npm package.

Bug Fixes

• Patched urllib3 decompression-bomb vulnerability in Python test fixtures. Bumped urllib3 from 2.6.3 to 2.7.0 across all Python lockfiles (poetry, pipenv, pip, uv variants) to resolve GHSA-mf9v-mfxr-j63j. Affects only the test-suite Python environments — no impact on user deployments. (#13568)

• Patched a net/http infinite-loop CVE in the installer runtime. Picks up the upstream fix for CVE-2026-33814 (HTTP/2 CONTINUATION-frame infinite loop when SETTINGS_MAX_FRAME_SIZE=0). All released installers are rebuilt against the patched toolchain. (#13560)

Maintenance

• Patched additional moderate-severity dependency vulnerabilities:
  • Upgraded hono 4.12.14 → 4.12.18, fast-uri 3.0.6 → 3.1.2, fast-xml-builder 1.1.5 → 1.2.0, ip-address 10.1.0 → 10.2.0, and express-rate-limit 8.3.1 → 8.5.1 (#13564)
  • Bumped fast-uri across all 13 bedrock-agentcore JavaScript examples (#13561)
  • Bumped fast-xml-builder (along with two transitives) across all 13 bedrock-agentcore JavaScript examples (#13559)
• Bumped the AWS SDK group with 31 updates from 3.1035.0 to 3.1041.0 (#13565)
• Upgraded mongodb from 7.1.1 to 7.2.0 — adds support for MongoDB's Intelligent Workload Management (#13553)
• Upgraded simple-git from 3.33.0 to 3.36.0 (#13555)
• Bumped the patch-updates group: @slack/web-api 7.15.1 → 7.15.2, fs-extra, and uuid (#13567)
• Bumped dev-dependencies group: eslint 10.2.1 → 10.3.0 and globals (#13566)
• Bumped Jackson Java dependencies in invoke-local runtime wrappers: jackson-core, jackson-databind, jackson-datatype-joda (#13548, #13549, #13550)
• Bumped aws-actions/configure-aws-credentials from v6.1.0 to v6.1.1 in CI workflows (#13563)
• Added toml v4+ to the Dependabot ignore list to preserve Node.js 18 support (#13562)

4.35.1

Bug Fixes

• AppSync: @canonical, @hidden, and @renamed now work on field definitions. The bundled Merged API directive stubs only declared the OBJECT location, so applying these directives to fields failed packaging with errors like Directive "@canonical" may not be used on FIELD_DEFINITION.. They're now declared as OBJECT | FIELD_DEFINITION to match AWS's documented surface. (#13533, #13542). Thanks @PatrykMilewski!

type Query {
  getMessage(id: ID!): Message @renamed(to: "getChatMessage")
  internalField: String @hidden
}

• Python: lambda layer is now built for layer-only services. Services that declared custom.pythonRequirements.layer with no functions: block silently produced an empty CloudFormation stack. The runtime guard now also activates when pythonRequirements.layer is set and the provider runtime starts with python, restoring parity with the standalone serverless-python-requirements plugin. Heads up: services that previously hit this bug will now actually invoke pip on serverless package, so set pythonBin or use dockerizePip if the matching pythonX.Y binary isn't available locally. (#13541)

provider:
  runtime: python3.13
custom:
  pythonRequirements:
    layer: true

• Python: zip entry paths are now normalized to forward slashes on Windows. globSync was preserving Windows backslashes in ZIP archive entries, which broke the ZIP spec and caused import mismatches at runtime. Entries are now written with POSIX-style / separators on every platform, and ci-python.yml also runs Python tests on Windows when Python paths change. (#13307, #13383, #13546). Thanks @Tsingis!

Maintenance

• Patched GHSA-w5hq-g745-h8pq (uuid v3/v5/v6 missing buffer bounds check) in the langgraph-* JavaScript example lockfiles under bedrock-agentcore/examples/javascript/ by bumping nested uuid from 13.0.0 to 13.0.2. Lockfile-only, and these examples aren't shipped in the published package. (#13545)
• Bumped axios from 1.15.0 to 1.15.2 (transitive, lockfile-only) for upstream security-hardening patches. (#13544)