Security Fixes

• Update Go version to address CVE-2025-22871, related to net/http in the Golang stdlib: We’ve reviewed the recent CVE, which generally affects the Go standard library in web servers and web-related functionalities. Since the Serverless Framework is a CLI tool does not rely on running a web server or handling web requests, users are not affected by this vulnerability. The CLI uses a small amount of Go to handle updating to the version set in frameworkCore in serverless.yml. Our update process uses HTTPS with SSL/TLS to securely check for and install new versions, ensuring no risk of exploitation or malicious code injection. All dependencies have been audited, and no vulnerabilities were found. However, upgrading is always a best practice and, we recommend users upgrade to the latest version to ensure they’re on the most secure release. This can be done via the serverless upgrade command, which will update the installer.

Bug Fixes

• Serverless Framework
  • Fixed an issue with proxy support (#13062)

Bug Fixes

• Serverless Container Framework
  • Pinned the Docker image builder version

Features

• Serverless Framework
  • Support for Doppler secrets in Serverless Variables (docs)

service: my-service
provider:
  environment:
    DB_PASSWORD: ${doppler:my-project/DB_PASSWORD}

Features

• Serverless MCP Server

  • Intelligent Error Analysis

    • Introduces the errors-info tool for advanced error pattern detection across AWS services.
    • Automatically discovers and scans log groups from Lambda, API Gateway (REST & HTTP), and other CloudWatch log groups defined in the CFN Stack.
    • Groups similar logs using CloudWatch Logs Insights pattern command.
    • Extracts metadata including regex strings, pattern IDs, frequency ratios, and severity levels.
    • Displays representative examples of each pattern group to reduce noise and improve diagnostics.

  • Confirmation Handling for Queries

    • Adds robust safeguards against accidentally triggering large historical queries.
    • Requires explicit confirmation for:
      • Date ranges older than 1 month
      • Timeframes longer than 3 hours

  • Enhanced Logs Search

    • Improves the logs-search tool with more flexible search behavior.
    • Supports arrays of search terms with implicit OR logic.
    • Enables case-insensitive matching.

  • Integrated Documentation Tool

    • Adds support for browsing Serverless Framework and Serverless Container Framework documentation within the MCP server.
    • Serves markdown files directly - always up to date.
    • Documentation is always tied to the version you are using, ensuring accuracy and consistency with your environment.

  • General Tooling Improvements

    • Improved AWS Credential Error Handling

      • Detects and returns actionable messages for profile, role, or region misconfigurations in all tools.

    • Context Overflow Protection

      • Introduces caps to prevent overloading agents with excessive data:
        • Max log events
        • Max error patterns
        • Max metric datapoints
      • Dynamically adjusts metric periods for larger timeframes.

    • Optimized Lambda Logs Queries

      • Large timeframe metric queries now supported, but error pattern queries are limited to the past 7 days.
      • Provides actionable hints suggesting direct use of the errors-info tool for broader analyses.

    • Service-wide Analysis Support

      • The service-summary tool now supports serviceWideAnalysis, enabling complete resource scanning without requiring specific IDs.
      • Expands usability for agents operating with incomplete context.

Features

• Serverless MCP Server
  • Introduces of a powerful AI-compatible interface for cloud infrastructure. The Serverless MCP Server enables AI agents to diagnose issues, fetch metrics, and analyze resources across cloud services, eliminating the need to dig through web interfaces like the AWS Console.
  • Supports both stdio and HTTP/SSE transports, and includes comprehensive tools for Lambda, API Gateway, DynamoDB, S3, SQS, and CloudWatch.
  • Delivers critical infrastructure insights directly to your AI agent within your IDE - such as Cursor or Windsurf - making debugging and troubleshooting faster and more intuitive than ever.
  • To try it out, use the following in your MCP servers configuration file (mcp_config.json or mcp.json)

{
  "mcpServers": {
    "serverless": {
      "command": "serverless",
      "args": [
        "mcp"
      ]
    }
  }
}

Bug Fixes

• Serverless Framework
  • Fixed = Truncated in Serverless v4 Parameter Values (#13050)

Features

• Serverless Framework
  • Allow setting provisioned concurrency alias (#7209)

Bug Fixes

• Serverless Framework
  • Resolved incorrect region usage in certain cases when resolving CloudFormation outputs via Serverless Variables
• Serverless Compose
  • Fixed handling of service parameters in the remove command (#13041)

Maintenance

• Serverless Framework
  • Upgraded dockerode to address GHSA-pq67-2wwv-3xjx vulnerability

Features

• Serverless Container Framework
  • Added support for user-provided VPCs, IAM roles, and WAF