Drop support for node earlier than 20 and fix a bunch of OSS supply chain vulnerabilities

[GrahamCampbell]

No description provided.

[Copilot]

Pull request overview

Drops support for Node.js < 20 and reduces dependency/supply-chain exposure by replacing external utilities with a curated vendored subset and updated AWS credential handling.

Changes:

• Enforces Node.js >= 20 (engines, CLI runtime check, CI matrix updates).
• Vendors a minimal @serverless/utils logging/reporting slice and wires it into startup.
• Reworks AWS credential/provider-chain usage and state bucket access to be profile-aware; adds extensive unit tests and new Mocha test harness setup.

Reviewed changes

Copilot reviewed 63 out of 65 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
test/unit/src/utils/serverless-utils/structure.test.js	Verifies vendored serverless-utils subtree matches the allowlist.
test/unit/src/utils/serverless-utils/log.test.js	Tests plugin-name sanitization + memoized writer behavior.
test/unit/src/utils/serverless-utils/log-reporters/node.test.js	Tests CLI/env-flag mapping for node log reporter initialization.
test/unit/src/utils/aws/remote-provider.test.js	Tests remote provider selection/IMDS-disable behavior.
test/unit/src/utils/aws/get-credential-provider.test.js	Tests AWS_PROFILE fallback + region forwarding.
test/unit/src/utils/aws/get-client-config.test.js	Tests region+credentials config composition.
test/unit/src/utils/aws/from-node-provider-chain.test.js	Tests STS role assumer injection into default provider chain.
test/unit/src/utils/aws/default-provider.test.js	Tests ordering/selection rules in the credential provider chain.
test/unit/src/state/utils/get-state-bucket-region.test.js	Tests region resolution + legacy EU normalization + profile-aware config.
test/unit/src/state/utils/get-state-bucket-name.test.js	Tests configured/CF-derived bucket name resolution + profile-aware CF access.
test/unit/src/state/utils/get-configured-state-bucket-name.test.js	Tests aliasing/validation for existingBucket vs externalBucket.
test/unit/src/state/get-s3-state-storage-from-config.test.js	Tests region selection and profile-aware credentials for S3 state storage.
test/unit/src/state/S3StateStorage.test.js	Tests S3 client constructed with region+credentials.
test/unit/src/load.test.js	Tests in-process components using Context logging APIs.
test/unit/src/components-service.test.js	Adds DAG dependency ordering, cycle detection, and failure-propagation tests.
test/unit/src/cli/is-supported-node-version.test.js	Tests Node version gating helper.
test/unit/src/cli/format-output.test.js	Tests new output formatting behavior and coloring.
test/unit/src/Context.test.js	Tests Context output rendering behavior.
test/unit/components/framework/index.test.js	Tests env passthrough for logging vars to child processes.
test/lib/setup/restore-env.js	Adds env reset between root suites.
test/lib/setup/patch.js	Adds Mocha runner patch + strict unhandledRejection behavior + env defaults.
test/lib/setup/mock-homedir.js	Adds per-process temp homedir and cleanup between root suites.
test/lib/setup/mock-cwd.js	Forces cwd reset to homedir between root suites.
test/lib/setup/log.js	Adds Mocha suite/test logging and buffered log flushing on failure.
test/lib/process-tmp-dir.js	Creates per-process temp dir with cleanup on exit.
test/lib/private/rm-tmp-dir-ignorable-error-codes.js	Shared ignorable error codes for tmp-dir cleanup.
test/fixtures/local-component.js	Fixture component to validate Context logging integration.
src/utils/serverless-utils/policy.js	Defines vendored-path allowlist and upstream version metadata.
src/utils/serverless-utils/log.js	Implements vendored logging facade + plugin writers + style defaults.
src/utils/serverless-utils/log-reporters/node.js	Initializes node log reporter / output wiring / interactive progress.
src/utils/serverless-utils/lib/log/join-text-tokens.js	Joins nested text-token arrays into output strings.
src/utils/serverless-utils/lib/log/get-progress-reporter.js	Provides memoized progress reporters backed by an emitter.
src/utils/serverless-utils/lib/log/get-output-reporter.js	Provides memoized output reporters backed by an emitter.
src/utils/serverless-utils/lib/log-reporters/node/style.js	Applies CLI styling decorators to log style + success prefixing.
src/utils/serverless-utils/lib/log-reporters/node/progress-reporter.js	Implements interactive progress footer rendering.
src/utils/serverless-utils/lib/log-reporters/node/log-reporter.js	Implements serverless-scoped log-node reporter behavior.
src/utils/serverless-utils/README.md	Documents vendored subtree purpose and update procedure.
src/utils/aws/provider-chain/remote-provider.js	Local remote provider (ECS/IMDS) selection logic.
src/utils/aws/provider-chain/from-node-provider-chain.js	Local wrapper to build a node-like provider chain.
src/utils/aws/provider-chain/default-provider.js	Local default credential provider chain implementation.
src/utils/aws/index.js	Exposes AWS helper entrypoints.
src/utils/aws/get-credential-provider.js	Returns credential provider; applies AWS_DEFAULT_PROFILE fallback.
src/utils/aws/get-client-config.js	Returns { region, credentials } config bundle.
src/state/utils/get-state-bucket-region.js	Resolves bucket region using profile-aware AWS client config.
src/state/utils/get-state-bucket-name.js	Uses configured alias handling + profile-aware CF client creation.
src/state/utils/get-configured-state-bucket-name.js	Centralizes configured bucket name resolution + validation.
src/state/get-s3-state-storage-from-config.js	Builds S3 state storage config with profile-aware credentials.
src/index.js	Switches startup log reporter to vendored implementation.
src/cli/is-supported-node-version.js	Adds Node version support check helper.
src/cli/format-output.js	Adds deterministic output formatting with depth/edge-case handling.
src/cli/colors.js	Extends color palette for output formatting.
src/cli/Progresses.js	Prevents multiple SIGINT handlers; uses last-bound instance.
src/Context.js	Replaces prettyoutput with internal format-output.
src/ComponentsService.js	Switches graphlib dependency to @dagrejs/graphlib.
scripts/pkg/config.js	Removes pkg packaging config (standalone binary no longer supported).
scripts/pkg/build.js	Removes pkg build script (standalone binary no longer supported).
prettier.config.js	Replaces shared config with local Prettier settings.
package.json	Updates engines, dependencies, scripts, eslint config, and Mocha setup requires.
components/framework/index.js	Removes pkg-specific subprocess workaround.
bin/serverless-compose	Adds Node>=20 runtime guard and adjusts command start-time tracking.
README.md	Documents Node>=20 requirement and removal of standalone binary distribution.
.npmignore	Updates ignored packaging artifacts.
.gitignore	Normalizes .serverless ignore entry.
.github/workflows/tests.yml	Updates CI to Node 20/22, adds lint and pack smoke test.
.github/workflows/publish.yml	Updates publish workflow to install + test + pack verify.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.