Bump tar, web3 and serverless

[dependabot]

Removes tar. It's no longer used after updating ancestor dependencies tar, web3 and serverless. These dependencies need to be updated together.

Removes tar

Updates web3 from 1.7.5 to 4.16.0

Release notes

Sourced from web3's releases.

web3-eth@4.0.0-alpha.0

Initial alpha release

Install with yarn add web3-eth@4.0.0-alpha.0

web3-core-requestmanager@4.0.0-alpha.0

Initial alpha release

Install with yarn add web3-core-requestmanager@4.0.0-alpha.0

web3-providers-http@4.0.0-alpha.0

Initial alpha release

Install with yarn add web3-providers-http@4.0.0-alpha.0

web3-providers-base@1.0.0-alpha.1

Changed

• Update version to 1.0.0-alpha.1 for web3-providers-base
• Update version to 4.0.0-alpha.0 for web3-utils in web3-providers-base

web3-utils@4.0.0-alpha.0

Initial alpha release

Install with yarn add web3-utils@4.0.0-alpha.0

web3-packagetemplate@1.0.0-alpha.0

Initial alpha release

Install with yarn add web3-packagetemplate@1.0.0-alpha.0

Changelog

Sourced from web3's changelog.

[1.7.5]

Changed

• Replace xhr2-cookies deps to cross-fetch for web3-providers-http (#5085)

Added

• Documentation details about maxFeePerGas and maxPriorityFeePerGas (#5121)
• Added createAccessList types in web3.eth (#5146)

Fixed

• Improving AbstractProvider interface (#5150)
• Fix typos in web3-eth-accounts.rst & TESTING.md (#5047)
• Fix remove wallet using an index when an account address and address lowercase are equal (#5049)
• Improve README.md & Fix typos (#4848)
• Add optional hex formatting parameter for getTransactionReceipt (#5153)
• Fix transactionRoot -> transactionsRoot in BlockHeader (#5083)
• Fix Promise in Accounts.signTransaction() throwing errors that cannot be caught (#4724)
• Fixed unit tests & removed dead code for web3-providers-http (#5228)

Security

• Updated got lib version and fixed other libs using npm audit fix (#5178) (#5254)

[4.0.0-alpha.0]

Note: Yarn is resolving to some old deprecated package versions for 4.0.0-alpha.0 instead of latest alpha versions. A patch bump is posted so yarn users should use 4.0.1-alpha.0 for testing.

Added

web3-errors

• web3-errors new package is created, it has Web3 Error codes and classes

web3-types

• web3-types new package is created, it provides the common data structures and interfaces for web3 modules

web3-validator

• web3-validator new package is created, it has JSON-Schema compatible validator functionality for Web3

Removed

web3-bzz

• This Package is deprecated

... (truncated)

Commits

• aa197b8 add typescript and version bump to changelogs
• 82ceab7 update web3-types
• 2b7cf1c v4.16.0 release
• 926044b chore(deps-dev): bump http-proxy-middleware from 2.0.6 to 2.0.7 (#7407)
• 7a8df69 update typescript version to 5 (#7272)
• 984cb7c chore(deps): bump cross-spawn from 7.0.3 to 7.0.6 (#7404)
• 3b122a2 fix: upgrade @​cookbookdev/docsbot from 4.24.0 to 4.24.4 (#7403)
• 56d4aec Replaces #7390, #7391, & #7400 (#7401)
• 6379aa8 fix: remove force exit from blackbox tests (#7397)
• 5437fbc fix: upgrade @​mdx-js/react from 3.0.1 to 3.1.0 (#7395)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by luu-alex, a new releaser for web3 since your current version.

Updates serverless from 3.22.0 to 4.40.0

Release notes

Sourced from serverless's releases.

4.40.0

Features

• Lambda self-managed code storage. Setting provider.deploymentBucket.codeStorageMode: reference makes Lambda run function and layer code directly from your deployment bucket instead of copying it into Lambda-managed storage, so your code no longer counts against the Lambda code storage quota. Every deployment pins each function and layer to the exact uploaded S3 object version, so later uploads never affect what runs. Because deployment artifacts back live Lambda versions in this mode, automatic post-deploy artifact cleanup is disabled — retire artifacts that no longer back any function or layer version with serverless prune --includeArtifacts (also available as custom.prune.includeArtifacts). Read more in the deployment bucket guide and the prune CLI reference, and see the aws-node-self-managed-code-storage example. (#13725)

provider:
  deploymentBucket:
    codeStorageMode: reference # default: copy

# Keep the 3 most recent function versions, then retire deployment
# artifacts that no longer back any surviving function or layer version
serverless prune -n 3 --includeArtifacts

Note reference mode requires a versioned deployment bucket that Lambda is allowed to read. The Framework-managed deployment bucket is configured automatically; custom buckets are validated and the deployment stops with instructions when a prerequisite is missing.

• Compose: run a command on an exact subset of services. The --service option now accepts a comma-separated list for deploy, remove, info, print, and package. The command runs on exactly the named services, ordered by dependsOn; services not named are left untouched, and their outputs stay available for ${param:...} resolution — so a subset can reference services already deployed elsewhere. Read more in the Compose guide. (#13705)

serverless deploy --service=service-a,service-d --stage my-feature

• Removed Serverless Container Framework and Serverless AI Framework. These products are no longer part of the CLI. Projects with a serverless.containers.* or serverless.ai.* configuration file now get a clear error with guidance: pin frameworkVersion: "4.39.0" (the last version supporting them) and the CLI automatically runs that version for the project. (#13698)

frameworkVersion: '4.39.0'

Bug Fixes

• Fixed corrupted bundles when multiple functions share a handler file. The built-in esbuild packaging ran one build per function, so functions sharing a handler file wrote the same output concurrently — occasionally producing a corrupted bundle that failed at Lambda startup with Runtime.UserCodeSyntaxError. Each unique handler file is now built exactly once and reused across the functions that share it, which also removes the redundant rebuilds. (#13716, #13717) - Thanks @​dekpient for the report!
• Fixed unchanged services being redeployed on every deploy. Artifacts produced by the built-in esbuild packaging embedded fresh file timestamps on every build, so identical code always looked changed to deploy change detection. Archive entry timestamps are now pinned, identical content produces byte-identical artifacts, and unchanged deployments are skipped as intended. (#13696)
• Fixed the shared IAM role accumulating permissions for functions with dedicated roles. When only some functions use per-function IAM roles, the shared execution role no longer collects event-source and feature grants belonging to functions that have their own role — previously its inline policy grew with every function and could exceed the IAM policy size limit ("Maximum policy size exceeded"). Dedicated per-function roles also now receive grants that previously only existed on the shared role, including Kinesis enhanced fan-out consumer actions, stream onFailure destination grants, and kms:Decrypt for kmsKeyArn. (#13704)
• Fixed a crash when frameworkVersion is "*". Version ranges without a concrete version, such as '*', no longer throw TypeError: Cannot read properties of null (reading 'major'). Since such ranges accept every version, the version check is skipped for them; all other values behave as before — pinning a different major version still fails with the version mismatch error, and invalid version strings still fail under configValidationMode: error. (#13714)
• Safer development-dependency exclusion during packaging. When the production dependency listing cannot be determined, packaging now stops with a clear error instead of risking an artifact that excludes production dependencies (opt out with package.excludeDevDependencies: false); when no dependency listing is available at all, exclusion is skipped with a warning and the artifact ships fully functional. Dependency listing output is also captured directly rather than through the shell, making packaging robust in temporary directories containing spaces or special characters. (#13724, #13699)
• Hardened validation of pinned canary versions in the installer. Malformed canary version values are rejected with a clear error, and release downloads are contained to the expected releases directory. (#13700)

Maintenance

• Updated multiple dependencies:
  • Bumped the AWS SDK group with 36 updates (#13715)
  • Upgraded adm-zip to v0.6.0 (#13720)
  • Upgraded fast-uri to v3.1.4 (#13722)
  • Upgraded js-yaml to v4.3.0 (#13712)
  • Upgraded body-parser to v2.3.0 in the Bedrock AgentCore examples, addressing GHSA-v422-hmwv-36x6 (#13723)

... (truncated)

Commits

• e2c559e chore: release 4.40.0 (#13726)
• a5ad2d6 feat(aws): support Lambda self-managed code storage (reference mode) (#13725)
• 60badd3 fix(packaging): stop packaging when the production dependency listing is unav...
• eb0af13 fix(aws): scope shared IAM role to functions without dedicated per-function r...
• 8159e96 fix(esbuild): build shared handler files once to prevent corrupted bundles (#...
• 052eb97 chore(deps): bump the npm_and_yarn group across 5 directories with 1 update (...
• c425f77 feat(compose): accept a comma-separated service list in --service (#13705)
• 570a830 chore(deps): bump fast-uri from 3.1.3 to 3.1.4 (#13722)
• 0acff69 chore(deps): bump adm-zip from 0.5.18 to 0.6.0 (#13720)
• 3dcbfa7 chore: standardize development toolchain on Node 24 LTS and npm 12 (#13721)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for serverless since your current version.

Install script changes

This version modifies postinstall script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	web3@​1.7.5 ⏵ 4.16.0	+6		+19
	serverless@​3.22.0 ⏵ 4.40.0	+9			+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm rimraf is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/serverless@4.40.0 → npm/rimraf@5.0.10 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rimraf@5.0.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report