Bump serverless from 4.6.2 to 4.7.0

[dependabot]

Bumps serverless from 4.6.2 to 4.7.0.

Release notes

Sourced from serverless's releases.

4.7.0

Features

• Serverless Framework
  • Serverless Variables supports Fn::Sub literal values (AWS docs)
• Serverless Container Framework
  • Auto-configures "www" subdomain when a naked domain is specified in domain of a container, so that it points toward the ALB.
  • Adds scale policy for Target Tracking scaling based on request count to ALB.

Maintenance

• Serverless Framework
  • Upgraded bundled esbuild to 0.25.0 to address GHSA-67mh-4wv8-2f99
  • Cleaned up unused dependencies

Bug Fixes

• Serverless Framework
  • Ignores AWS_PROFILE when using Dev Mode to properly use Lambda Function AWS credentials
• Serverless Container Framework
  • Fixes AWS IAM Role creation and injection of temporary credentials in Dev Mode.
  • Fixes cpu and memory configuration for AWS ECS Fargate containers.

4.6.3

Features

• Serverless Framework
  • Added support for ruby3.3 runtime (serverless/serverless#12423)
• Serverless Container Framework
  • Adds auto-scaling, includes min/max/desired, and target tracking auto-scaling for cpu and memory.
  • Auto-calculates desired values to safely deploy at high scale without over/under provisioning current Task count.
  • Improves ALB routing to always recalculate route priorities and save them.
  • Detects incorrect port values and failed health checks to offer users clear feedback, faster, as to why their deployments failed
  • Adds build args to the Docker build process.
  • Improved types and validation around scaling policies and more, with helpful errors.

Maintenance

• Serverless Framework:
  • Removed vulnerable formdiable and tar dependencies (serverless/serverless#12422, serverless/serverless#12442)
  • Cleaned up unused dependencies
• Serverless Container Framework
  • Moved SCF/engine logic out of sf-core and into its own engine packages. This is needed to enable SCF and future frameworks to be used with separate clients, starting with an MCP.
  • Moved AWS utilities to engine as well. Note that some sf-core logic relies on a few of these.

Bug Fixes

• Serverless Framework
  • Serverless Variables ignoringPROP and iot provider name to prevent misinterpreting CloudWatch dynamic labels and IoT Core policy variables (serverless/serverless#13015)
  • Fixed print command to output to stdout not stderr (serverless/serverless#13006)
  • Fixed app name onboarding validation
• Serverless Container Framework
  • Fixes: serverless/containers#4

Commits

• ec4957f chore: automate CLA signing (#13019)
• c4cebae chore: automate CLA signing
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)