4.44.0

Features

• A new Dev Mode: your deployed stage, running your code on your machine. serverless dev has been rebuilt from the ground up. Point it at a deployed stage and the stage's real traffic runs the code in your working copy: API requests, queue messages, streams, direct invokes and MCP tool calls. Your code runs with each function's deployed environment variables and IAM role, and every response goes back to the real caller. There is no CloudFormation deployment to wait for: a 30-function stage attaches in about 20 seconds. Save a file and the next request runs the new code. Press Ctrl+C when you're done and every function is back to its deployed configuration, with nothing to redeploy. It works for Node.js, TypeScript and Python functions in any region with AWS IoT Core, and it is built to be driven by AI coding agents as well as by you (see below). Functions in other runtimes, container images and Lambda@Edge keep running their deployed code, and the session says why for each one. Read more in the Dev Mode guide and the serverless dev reference, and try the aws-dev-mode example.

  :::bash serverless deploy --stage alice # optional: a stage that was never deployed is deployed first serverless dev --stage alice

  :::text Dev ϟ Mode

  Developing "my-service" on stage "alice" (us-east-1)

  ✔ Dev Mode on · 2 of 2 functions (11.1s)

  endpoint: POST - https://xxxxxxxxxx.execute-api.us-east-1.amazonaws.com/jobs

  Press h for keys, Ctrl+C or q to restore your functions and exit.

  → λ api ── POST /jobs · e9cd80e1 │ queued job d85afef5-7976-4160-8ae0-fee60a400f50 ← λ api (202) 485ms · cold start 98ms · e9cd80e1

  → λ worker ── SQS JobsQueue · ed7c3b14 │ job d85afef5-7976-4160-8ae0-fee60a400f50: 4 words ← λ worker (ok) 1ms · cold start 162ms · ed7c3b14

  ⟳ Reloaded (11ms)

  ✔ Dev Mode off · 2 functions restored (3.0s)

• Dev Mode for scripts and AI coding agents. serverless dev --detach starts the session in the background and returns once it is ready. serverless dev status, dev wait, dev stop, dev requests and dev replay <requestId> work against that session, or one running in another terminal, each with one JSON result on --json and exit codes 0 (ok), 1 (error, or a person has to act), 3 (a function could not be attached or restored) and 124 (out of time). Under a detected AI agent, a foreground serverless dev points the agent to this loop, and the new bundled Agent Skill serverless-dev-mode teaches it offline. Read more under Using Dev Mode from an AI agent and Machine-readable output.

  :::bash serverless dev --detach --json # start in the background serverless dev status --json # the session, its functions, endpoints and a cursor serverless dev wait --for invocation --function api --after <cursor> --json serverless dev requests --json # the recorded invocations and their files serverless dev replay <requestid> --json # run a recorded event again on the new code serverless dev stop --timeout 100s --json # restore the functions and end the session

• Choose functions, confirm, dry-run, keep. serverless dev --function <name> and --skip-function <name> pick the functions; --take-over takes functions another live session holds; --approve shows the changes and asks before any function is changed; --dry-run runs the read-only checks (sign-in, AWS identity, AWS IoT Core endpoint and connection, the IAM role, the stack, each function, the layers) and prints the changes without making any; --on-exit keep leaves the functions in Dev Mode, and serverless dev restore --stage <stage> --region <region> restores them later, or after a session that was killed. In a terminal, single keys control the session: h for the keys, r to rebuild, v for details, s for the session, q to restore and exit.

• serverless dev setup creates the Dev Mode IAM role for accounts where developers cannot. An administrator runs it once per account and region, with --permissions-boundary and --path where needed, also outside a service directory and without a Serverless sign-in; developers then need only iam:GetRole on the role. Read more under dev setup.

  :::bash serverless dev setup --region eu-west-1 --permissions-boundary arn:aws:iam::<account-id>:policy/<boundary> --path /serverless/

• serverless invoke names the record of a call Dev Mode ran. When a running session handled the call on your working copy, invoke adds one line on stderr, Dev Mode: handled by your working copy · request <id> · <file>, and with --log the log lines from your machine. Stdout and exit codes are unchanged.

• serverless deploy, remove, rollback --timestamp and deploy function restore functions a Dev Mode session left behind. Before their own work, they read the service's functions with lambda:GetFunction and restore any that still carry Dev Mode configuration, printing Restored 2 functions from Dev Mode (<owner>, less than a minute ago). A stage that never ran Dev Mode sees no change in output. remove and rollback --timestamp now call lambda:GetFunction and skip the check when it is denied; remove also deletes Dev Mode's payload objects from the deployment bucket. The check never changes a command's exit code.

• NO_COLOR and FORCE_COLOR apply to every command. A non-empty NO_COLOR turns colours off for log lines, the spinner, prompts and diff output; FORCE_COLOR=0 or false turns them off and any other FORCE_COLOR value turns them on, whatever the terminal. Read more under Colors.

Note Dev Mode replaces the earlier serverless dev, which deployed a stand-in function through CloudFormation. If you used it:

• A stage set up by the earlier version shows its functions as legacy_shim until one serverless deploy of that stage; after that, Dev Mode attaches them.
• The prod and production stages are refused. Use a personal or development stage.
• Any region with AWS IoT Core works; the fixed region list is gone.
• Function roles no longer receive iot:*, and Dashboard observability is no longer turned off during a session.
• serverless dev exits with 0, 1, 3 or 124 instead of always 0.
• Dev Mode uses new IAM permissions in the stage's account and region, mainly AWS Lambda, AWS IoT Core and iam:GetRole. The full policy is under Permissions.
• The first session in an account and region creates two Lambda layers (serverless-dev-x86_64, serverless-dev-arm64) and one IAM role (serverless-dev-broker-<region>, unless serverless dev setup created it already), which later sessions reuse.

• The CLI adapts its output for AI coding agents. When a command runs under a detected AI coding agent (Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot and others), it never opens a prompt, shows progress as plain lines instead of an animated spinner, and prints no color codes, including when the agent runs commands inside a terminal. Sign-in prompts are replaced by guidance on which keys to set. Any other tool can identify itself as an agent with AI_AGENT, and FORCE_COLOR keeps colors. People at a terminal, CI and piped runs see the same output as before. (#13923) Read more under Non-interactive use: CI and AI agents.

  :::bash AI_AGENT=my-agent serverless deploy --stage alice # a tool that is not detected identifies itself

Bug Fixes

• Config validation no longer fails with TypeError: formats0 is not a function. Since 4.36.0, a serverless.yml value checked against a schema format, such as a string cloudFront event origin, an ALB OIDC authorizer URL or an S3 lifecycle rule ExpirationDate, stopped every command with this error, whatever the configValidationMode. These values validate again. (#13931) If you ran a version from 4.36.0 to 4.43.0 earlier the same day and still see the error after upgrading, delete ~/.serverless/artifacts/ajv-validate-* once; until midnight the validator that version cached is reused.
• Parallel first deploys into a new account and region share one deployment bucket. When several deploys start at once where the shared deployment bucket does not exist yet, such as parallel CI jobs, one of them creates the bucket and the others wait for it and use it. Previously only one of them completed and the others stopped with an SSM error such as ParameterAlreadyExists or TooManyUpdates. (#13933)
• Parallel runs on Windows no longer fail with EPERM while caching the config validator. When another run cached the same validator first, the run now uses that copy. (#13932)
• Layers keep dependencies that the service lists as devDependencies. Development dependency exclusion no longer removes a layer's own node_modules packages that share a name with a service devDependency; it now applies to a layer only when the layer's path is the service directory. Thanks @pflugs30 for the report. (#10750, [#13909]) Read more in the Layers guide.
• An http authorizer whose arn is a CloudFormation intrinsic asks for a name instead of failing with TypeError: functionArn.split is not a function. Thanks @wippa-studios for the fix. (#3212, [#13901])
• serverless info lists every AppSync API key, reading all pages instead of the first one. Thanks @cuishuang for the fix. (#13866)
• Deploys complete on Node.js 26. On Node.js 26, AWS SDK v2 requests could stop waiting for a response: serverless deploy hung in a terminal (the --debug log ending at S3.listObjectsV2) and exited 0 without deploying in CI. Requests now complete on every supported Node.js version, without SLS_AWS_SDK=3. (#13971)
• The npm package downloads the Framework through a proxy on Node.js 26. With serverless installed from npm, every download through an HTTP(S) proxy failed on Node.js 26 with fetch failed: invalid onError method. (#13918)
• The local MicroVMs API that serverless dev --sandbox runs only answers local requests. It now refuses requests whose Host is not a local name (127.0.0.1, localhost, [::1], host.docker.internal or the address it is bound to) and requests that carry an Origin header, so a web page open in your browser cannot reach it during a session. Calls from your terminal and from containers through host.docker.internal work as before. (#13946)
• AWS sign-in cache files are created owner-only. The files written by serverless login aws and serverless login aws sso are created with mode 0600 in the same step that writes them, and an existing file is set to 0600 before it is rewritten. (#13913)
• NO_PROXY=* now bypasses the proxy for Dev Mode and for the Framework's own requests to the Serverless Dashboard, AWS STS and AWS SSM. Before, * matched nothing and these requests went through the proxy.
• Cleaner spacing in terminal output. One blank line before an error block instead of two when a command ends with an error under a spinner, and no doubled blank line above a spinner. Confirmation prompts echo · yes or · no instead of · true or · false.
• A positional word that looks like a number is kept as typed in the "command not found" message (report 123456e7 instead of report 1234560000000).

Maintenance

• Bumped the AWS SDK group with 112 updates across three bumps (#13910, [#13914], [#13968])
• Upgraded @grpc/grpc-js to v1.14.5 (#13922) — GHSA-m9gg-hp2v-232j, GHSA-f596-whhp-79r4
• Upgraded ip-address to v10.7.2 (#13922) — GHSA-j6r3-76f7-8jcv, GHSA-h3mg-xc3c-68pw, GHSA-rpw4-54j3-4h4q, GHSA-2vr4-cq9g-pvrc
• Upgraded fast-uri to v3.1.8 (#13922) — GHSA-hrr3-gc8f-f4qj
• Upgraded simple-git to v4.0.2 (#13924)
• Upgraded undici to v6.29.0 in the npm package (#13918)
• Upgraded @modelcontextprotocol/sdk to v1.32.1 (#13912, [#13959])
• Upgraded @aws-cdk/cloudformation-diff to v2.187.5 (#13912)
• Upgraded @graphql-tools/merge to v9.2.6 (#13912, [#13967])
• Upgraded filesize to v11.0.26 (#13912, [#13915], [#13967])
• Upgraded fs-extra to v11.4.1 (#13912)
• Upgraded get-tsconfig to v4.14.3 (#13912)
• Upgraded joi to v17.13.8 (#13912)
• Upgraded jszip to v3.10.2 (#13912)
• Upgraded p-map to v7.0.8 (#13912)
• Upgraded tsx to v4.23.15 (#13912)
• Upgraded Jackson to v2.22.3 in the Java invoke local wrapper (#13908)
• Upgraded shell-quote to v1.12.0 (#13958)
• Upgraded traverse to v0.6.14 (#13967)
• Upgraded proxy-addr to v2.0.8 (#13956)
• Removed promise-queue; AWS request queues use p-limit (#13902)
• Removed is-docker (#13892)
• Added mqtt v5.16.0
• Added ws v8.21.3
• Added @aws-sdk/client-iot-data-plane v3.1139.0
• Added @aws-sdk/s3-request-presigner v3.1139.0
• Added @aws-sdk/core v3.978.1
• Added @smithy/signature-v4 v5.7.3
• Added string-width v7.2.0
• Added https-proxy-agent v8.0.0 to @serverless/util
• Removed aws-iot-device-sdk