chore(deps): bump adm-zip and serverless

[dependabot]

Removes adm-zip. It's no longer used after updating ancestor dependency serverless. These dependencies need to be updated together.

Removes adm-zip

Updates serverless from 3.40.0 to 4.44.0

Release notes

Sourced from serverless's releases.

4.44.0

Features

• A new Dev Mode: your deployed stage, running your code on your machine. serverless dev has been rebuilt from the ground up. Point it at a deployed stage and the stage's real traffic runs the code in your working copy: API requests, queue messages, streams, direct invokes and MCP tool calls. Your code runs with each function's deployed environment variables and IAM role, and every response goes back to the real caller. There is no CloudFormation deployment to wait for: a 30-function stage attaches in about 20 seconds. Save a file and the next request runs the new code. Press Ctrl+C when you're done and every function is back to its deployed configuration, with nothing to redeploy. It works for Node.js, TypeScript and Python functions in any region with AWS IoT Core, and it is built to be driven by AI coding agents as well as by you (see below). Functions in other runtimes, container images and Lambda@Edge keep running their deployed code, and the session says why for each one. Read more in the Dev Mode guide and the serverless dev reference, and try the aws-dev-mode example.

serverless deploy --stage alice   # optional: a stage that was never deployed is deployed first
serverless dev --stage alice

Dev ϟ Mode
Developing "my-service" on stage "alice" (us-east-1)
✔ Dev Mode on · 2 of 2 functions (11.1s)
endpoint: POST - https://xxxxxxxxxx.execute-api.us-east-1.amazonaws.com/jobs
Press h for keys, Ctrl+C or q to restore your functions and exit.
→ λ api ── POST /jobs · e9cd80e1

│ queued job d85afef5-7976-4160-8ae0-fee60a400f50

← λ api (202) 485ms · cold start 98ms · e9cd80e1
→ λ worker ── SQS JobsQueue · ed7c3b14

│ job d85afef5-7976-4160-8ae0-fee60a400f50: 4 words

← λ worker (ok) 1ms · cold start 162ms · ed7c3b14
⟳ Reloaded (11ms)
✔ Dev Mode off · 2 functions restored (3.0s)

• Dev Mode for scripts and AI coding agents. serverless dev --detach starts the session in the background and returns once it is ready. serverless dev status, dev wait, dev stop, dev requests and dev replay <requestId> work against that session, or one running in another terminal, each with one JSON result on --json and exit codes 0 (ok), 1 (error, or a person has to act), 3 (a function could not be attached or restored) and 124 (out of time). Under a detected AI agent, a foreground serverless dev points the agent to this loop, and the new bundled Agent Skill serverless-dev-mode teaches it offline. Read more under Using Dev Mode from an AI agent and Machine-readable output.

serverless dev --detach --json                                      # start in the background
serverless dev status --json                                        # the session, its functions, endpoints and a cursor
serverless dev wait --for invocation --function api --after <cursor> --json
serverless dev requests --json                                      # the recorded invocations and their files
serverless dev replay <requestId> --json                            # run a recorded event again on the new code
serverless dev stop --timeout 100s --json                           # restore the functions and end the session

• Choose functions, confirm, dry-run, keep. serverless dev --function <name> and --skip-function <name> pick the functions; --take-over takes functions another live session holds; --approve shows the changes and asks before any function is changed; --dry-run runs the read-only checks (sign-in, AWS identity, AWS IoT Core endpoint and connection, the IAM role, the stack, each function, the layers) and prints the changes without making any; --on-exit keep leaves the functions in Dev Mode, and serverless dev restore --stage <stage> --region <region> restores them later, or after a session that was killed. In a terminal, single keys control the session: h for the keys, r to rebuild, v for details, s for the session, q to restore and exit.

• serverless dev setup creates the Dev Mode IAM role for accounts where developers cannot. An administrator runs it once per account and region, with --permissions-boundary and --path where needed, also outside a service directory and without a Serverless sign-in; developers then need only iam:GetRole on the role. Read more under dev setup.

... (truncated)

Commits

• b4ad1af chore: release 4.44.0 (#13978)
• e137f66 fix(dev): connect to AWS IoT Core from regions more than 250 ms away (#13979)
• 55fca81 fix(dev): handle first use of a region, streamed MCP replies and IAM role pat...
• ef9f091 ci: queue release runs on main instead of overlapping them (#13976)
• c1faa39 ci: spread integration shards across regions and tolerate throttling (#13975)
• 2fb6110 fix(sandboxes): refuse cross-site requests to the local MicroVMs emulator (#1...
• 95c2134 chore(deps): bump the pip group across 5 directories with 1 update (#13955)
• 54a56ca chore(deps): bump the uv group across 4 directories with 1 update (#13950)
• 75dd50f chore(deps-dev): bump the dev-dependencies group across 1 directory with 7 up...
• 81c7479 chore(deps): bump the patch-updates group across 1 directory with 4 updates (...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for serverless since your current version.

Install script changes

This version modifies postinstall script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.