Bump tar, web3 and serverless

[dependabot]

Removes tar. It's no longer used after updating ancestor dependencies tar, web3 and serverless. These dependencies need to be updated together.

Removes tar

Updates web3 from 1.7.5 to 4.16.0

Release notes

Sourced from web3's releases.

web3-eth@4.0.0-alpha.0

Initial alpha release

Install with yarn add web3-eth@4.0.0-alpha.0

web3-core-requestmanager@4.0.0-alpha.0

Initial alpha release

Install with yarn add web3-core-requestmanager@4.0.0-alpha.0

web3-providers-http@4.0.0-alpha.0

Initial alpha release

Install with yarn add web3-providers-http@4.0.0-alpha.0

web3-providers-base@1.0.0-alpha.1

Changed

• Update version to 1.0.0-alpha.1 for web3-providers-base
• Update version to 4.0.0-alpha.0 for web3-utils in web3-providers-base

web3-utils@4.0.0-alpha.0

Initial alpha release

Install with yarn add web3-utils@4.0.0-alpha.0

web3-packagetemplate@1.0.0-alpha.0

Initial alpha release

Install with yarn add web3-packagetemplate@1.0.0-alpha.0

Changelog

Sourced from web3's changelog.

[1.7.5]

Changed

• Replace xhr2-cookies deps to cross-fetch for web3-providers-http (#5085)

Added

• Documentation details about maxFeePerGas and maxPriorityFeePerGas (#5121)
• Added createAccessList types in web3.eth (#5146)

Fixed

• Improving AbstractProvider interface (#5150)
• Fix typos in web3-eth-accounts.rst & TESTING.md (#5047)
• Fix remove wallet using an index when an account address and address lowercase are equal (#5049)
• Improve README.md & Fix typos (#4848)
• Add optional hex formatting parameter for getTransactionReceipt (#5153)
• Fix transactionRoot -> transactionsRoot in BlockHeader (#5083)
• Fix Promise in Accounts.signTransaction() throwing errors that cannot be caught (#4724)
• Fixed unit tests & removed dead code for web3-providers-http (#5228)

Security

• Updated got lib version and fixed other libs using npm audit fix (#5178) (#5254)

[4.0.0-alpha.0]

Note: Yarn is resolving to some old deprecated package versions for 4.0.0-alpha.0 instead of latest alpha versions. A patch bump is posted so yarn users should use 4.0.1-alpha.0 for testing.

Added

web3-errors

• web3-errors new package is created, it has Web3 Error codes and classes

web3-types

• web3-types new package is created, it provides the common data structures and interfaces for web3 modules

web3-validator

• web3-validator new package is created, it has JSON-Schema compatible validator functionality for Web3

Removed

web3-bzz

• This Package is deprecated

... (truncated)

Commits

• aa197b8 add typescript and version bump to changelogs
• 82ceab7 update web3-types
• 2b7cf1c v4.16.0 release
• 926044b chore(deps-dev): bump http-proxy-middleware from 2.0.6 to 2.0.7 (#7407)
• 7a8df69 update typescript version to 5 (#7272)
• 984cb7c chore(deps): bump cross-spawn from 7.0.3 to 7.0.6 (#7404)
• 3b122a2 fix: upgrade @​cookbookdev/docsbot from 4.24.0 to 4.24.4 (#7403)
• 56d4aec Replaces #7390, #7391, & #7400 (#7401)
• 6379aa8 fix: remove force exit from blackbox tests (#7397)
• 5437fbc fix: upgrade @​mdx-js/react from 3.0.1 to 3.1.0 (#7395)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by luu-alex, a new releaser for web3 since your current version.

Updates serverless from 3.22.0 to 4.38.1

Release notes

Sourced from serverless's releases.

4.38.1

Maintenance

• Upgraded undici to 6.27.0, clearing security advisories reported against earlier versions of the bundled HTTP client: a Set-Cookie SameSite attribute downgrade (GHSA-g8m3-5g58-fq7m), HTTP header injection via Set-Cookie percent-decoding (GHSA-p88m-4jfj-68fv), and a WebSocket client denial-of-service (GHSA-vxpw-j846-p89q). (#13657)

4.38.0

Features

• Ruby 4.0 runtime support. Functions can now target the ruby4.0 Lambda runtime. (#13613)

  provider:
    name: aws
    runtime: ruby4.0

• New ${aws:partition} variable. Resolves to the AWS partition for the deployment region (e.g. aws, aws-cn, aws-us-gov) with no network call or credentials required. Makes ARNs in your configuration portable across commercial, GovCloud, and China partitions. (#12441, #13633)

  provider:
    iam:
      role:
        managedPolicies:
          - arn:${aws:partition}:iam::aws:policy/AmazonS3ReadOnlyAccess

• AgentCore: Python 3.14 support. Agent runtimes can now target python3.14. Runtime validation is also stronger, with supported runtimes validated against a single allowlist. (#13645)

  # AgentCore agent configuration
  runtime: python3.14

Bug Fixes

• API Gateway custom stage now used for the service endpoint URL and stage tags. When provider.apiGateway.stage is set to a value different from the deployment stage, the ServiceEndpoint output URL and the API Gateway stage tags now use that configured stage. Previously they used the deployment stage, producing an incorrect endpoint URL and attempting to tag a stage that did not exist. (#13636)

  provider:
    apiGateway:
      stage: customstage   # now reflected in ServiceEndpoint + stage tags

• Variable resolution no longer drops placeholders during re-entrant resolution. A JavaScript or TypeScript ${file(...)} resolver that calls resolveVariable() or resolveConfigurationProperty() mid-resolution opens a nested resolution pass. Under certain async timing this could leave the outer resolution looking inactive, causing a later nested placeholder to be left unresolved. Each pass now preserves and restores its context so the full dependency chain resolves reliably. (#13635)

• AgentCore: unpinned the default Buildpacks builder image and added a builder override. The previously hard-pinned heroku/builder digest is no longer used by default. (#13647, #13646)

Maintenance

• Bumped the AWS SDK group with 34 updates (#13632)

... (truncated)

Commits

• fb7ac39 chore: release 4.38.1 (#13658)
• 7565a78 chore(deps): bump undici (#13657)
• 56e78c1 chore: release 4.38.0 (#13651)
• 27dacea chore(deps): bump golang.org/x/mod in /binary-installer (#13650)
• 384a7e4 fix(agentcore): unpin heroku/builder digest; add artifact.image.builder overr...
• ea79235 fix(api-gateway): use resolved API Gateway stage for stage tags and service e...
• a2804b0 chore(deps): bump the npm_and_yarn group across 13 directories with 2 updates...
• 90183bc chore(deps): update package-lock.json (#13648)
• 64e189c feat(agentcore): support Python 3.14 and improve agent runtime validation (#1...
• 312a842 chore(deps): bump the actions group with 2 updates (#13641)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for serverless since your current version.

Install script changes

This version modifies postinstall script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	web3@​1.7.5 ⏵ 4.16.0	+6		+19
	serverless@​3.22.0 ⏵ 4.38.1	+2			+2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm rimraf is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/serverless@4.38.1 → npm/rimraf@5.0.10 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/rimraf@5.0.10. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report