@depup/serverless 4.41.1-depup.0 → 4.42.0-depup.0

package/README.md

@@ -13,8 +13,8 @@ npm install @depup/serverless
 
 | Field | Value |
 |-------|-------|
-| Original | [serverless](https://www.npmjs.com/package/serverless) @ 4.41.1 |
-| Processed | 2026-08-30 |
+| Original | [serverless](https://www.npmjs.com/package/serverless) @ 4.42.0 |
+| Processed | 2026-09-13 |
 | Smoke test | failed |
 | Deps updated | 1 |
 
@@ -22,7 +22,7 @@ npm install @depup/serverless
 
 | Dependency | From | To |
 |------------|------|-----|
-| undici | 6.28.0 | ^8.10.0 |
+| undici | 6.28.1 | ^8.10.2 |
 
 ---
 

package/binary.js

@@ -10,6 +10,44 @@ const error = (msg) => {
   process.exit(1)
 }
 
+// fetch() reports every network-level failure as a bare "fetch failed" and
+// hides the actual reason (DNS, TLS, connection refused) in the `cause`
+// chain, so the chain has to be included for failures to be diagnosable
+// from install logs.
+const describeNode = (e) => {
+  if (!(e instanceof Error)) return String(e)
+  const message = e.message || e.name
+  return e.code ? `${message} (${e.code})` : message
+}
+
+const describeError = (err) => {
+  if (!(err instanceof Error)) return String(err)
+  const parts = []
+  // A cyclic cause chain would otherwise hang the process — worse than exiting
+  const seen = new Set()
+  let node = err
+  while (node !== undefined && node !== null && !seen.has(node)) {
+    seen.add(node)
+    parts.push(describeNode(node))
+    if (Array.isArray(node.errors) && node.errors.length > 0) {
+      parts.push(node.errors.map(describeNode).join(', '))
+    }
+    node = node instanceof Error ? node.cause : undefined
+  }
+  return parts.join(': ')
+}
+
+// Shell convention for a process ended by a signal: 128 + signal number
+const signalExitCode = (signal) => {
+  const signalNumber = os.constants.signals[signal]
+  return signalNumber ? 128 + signalNumber : 1
+}
+
+// spawnSync reports a signal-terminated child as `status: null`; passing
+// that to process.exit() would report success.
+const childExitCode = ({ status, signal }) =>
+  status !== null ? status : signalExitCode(signal)
+
 const formatHostName = (hostname) => hostname.replace(/^\.*/, '.').toLowerCase()
 
 const parseNoProxyZone = (zone) => {
@@ -22,7 +60,11 @@ const parseNoProxyZone = (zone) => {
 }
 
 const shouldBypassProxy = (requestURL) => {
-  const noProxy = process.env.NO_PROXY || process.env.no_proxy || ''
+  const noProxy =
+    process.env.NO_PROXY ||
+    process.env.no_proxy ||
+    process.env.npm_config_noproxy ||
+    ''
   if (noProxy === '*') return true
   if (noProxy === '') return false
 
@@ -30,8 +72,10 @@ const shouldBypassProxy = (requestURL) => {
     requestURL.port || (requestURL.protocol === 'https:' ? '443' : '80')
   const hostname = formatHostName(requestURL.hostname)
 
+  // npm exports array-form `noproxy[]=` entries newline-joined
   return noProxy
-    .split(',')
+    .split(/[,\n]/)
+    .filter((zone) => zone.trim() !== '')
     .map(parseNoProxyZone)
     .some((noProxyZone) => {
       const isMatchedAt = hostname.indexOf(noProxyZone.hostname)
@@ -45,16 +89,33 @@ const shouldBypassProxy = (requestURL) => {
     })
 }
 
+// npm applies the proxy settings from .npmrc to its own downloads but does
+// not translate them into HTTP(S)_PROXY for lifecycle scripts — they reach
+// this script only as npm_config_* variables, so those serve as fallbacks
+// when no proxy environment variables are set. Scheme mapping mirrors npm's
+// own (npm-registry-fetch: `httpsProxy || proxy`): `https-proxy` is preferred
+// for https requests and `proxy` is the fallback for both schemes.
 const getProxyUrl = (url) => {
   const requestURL = new URL(url)
 
   if (shouldBypassProxy(requestURL)) return null
 
   if (requestURL.protocol === 'http:') {
-    return process.env.HTTP_PROXY || process.env.http_proxy || null
+    return (
+      process.env.HTTP_PROXY ||
+      process.env.http_proxy ||
+      process.env.npm_config_proxy ||
+      null
+    )
   }
   if (requestURL.protocol === 'https:') {
-    return process.env.HTTPS_PROXY || process.env.https_proxy || null
+    return (
+      process.env.HTTPS_PROXY ||
+      process.env.https_proxy ||
+      process.env.npm_config_https_proxy ||
+      process.env.npm_config_proxy ||
+      null
+    )
   }
   return null
 }
@@ -103,7 +164,7 @@ class Binary {
       })
       errorMsg +=
         '\n\nCorrect usage: new Binary("my-binary", "https://example.com/binary/download.tar.gz", "v1.0.0")'
-      error(errorMsg)
+      throw new Error(errorMsg)
     }
     this.url = url
     this.name = name
@@ -133,14 +194,17 @@ class Binary {
     }
   }
 
-  install(suppressLogs = false) {
+  // Downloads the binary. Rejects on any failure — how a failure is handled
+  // (warn vs abort) is decided by the entrypoints (postInstall.js, run.js),
+  // never here.
+  async install(suppressLogs = false) {
     if (this.exists()) {
       if (!suppressLogs) {
         console.error(
           `${this.name} is already installed, skipping installation.`,
         )
       }
-      return Promise.resolve()
+      return
     }
 
     // maxRetries/retryDelay cover transient EBUSY/EPERM on Windows, where
@@ -158,40 +222,35 @@ class Binary {
       console.error(`Downloading release from ${this.url}`)
     }
 
-    process.on('SIGINT', () => {
-      error('Could not download Serverless')
+    const abort = (signal) => {
       this.removeBinary()
-    })
+      console.error('Serverless Framework binary download was interrupted')
+      process.exit(signalExitCode(signal))
+    }
+    process.on('SIGINT', abort)
+    process.on('SIGTERM', abort)
 
-    process.on('SIGTERM', () => {
-      error('Could not download Serverless')
+    try {
+      const proxyUrl = getProxyUrl(this.url)
+      const fetchOptions = proxyUrl
+        ? { dispatcher: new ProxyAgent(proxyUrl) }
+        : {}
+      const res = await fetch(this.url, fetchOptions)
+      if (!res.ok) {
+        throw new Error(`HTTP ${res.status}: ${res.statusText}`)
+      }
+      const buffer = await res.arrayBuffer()
+      writeFileSync(this.binaryPath, Buffer.from(buffer), { mode: 0o755 })
+      if (!suppressLogs) {
+        console.error(`${this.name} has been installed!`)
+      }
+    } catch (e) {
       this.removeBinary()
-    })
-
-    const proxyUrl = getProxyUrl(this.url)
-    const fetchOptions = proxyUrl
-      ? { dispatcher: new ProxyAgent(proxyUrl) }
-      : {}
-
-    return fetch(this.url, fetchOptions)
-      .then((res) => {
-        if (!res.ok) {
-          throw new Error(`HTTP ${res.status}: ${res.statusText}`)
-        }
-        return res.arrayBuffer()
-      })
-      .then((buffer) => {
-        writeFileSync(this.binaryPath, Buffer.from(buffer), { mode: 0o755 })
-      })
-      .then(() => {
-        if (!suppressLogs) {
-          console.error(`${this.name} has been installed!`)
-        }
-      })
-      .catch((e) => {
-        error(`Error fetching release: ${e.message}`)
-        this.removeBinary()
-      })
+      throw e
+    } finally {
+      process.removeListener('SIGINT', abort)
+      process.removeListener('SIGTERM', abort)
+    }
   }
 
   run() {
@@ -214,11 +273,12 @@ class Binary {
           error(result.error)
         }
 
-        process.exit(result.status)
+        process.exit(childExitCode(result))
       })
       .catch((e) => {
-        error(e.message)
-        process.exit(1)
+        error(
+          `Could not download the Serverless Framework binary: ${describeError(e)}`,
+        )
       })
   }
 }
@@ -240,11 +300,10 @@ const getBinaryName = () => {
   let architecture = os.arch()
 
   if (architecture !== 'arm64' && architecture !== 'x64') {
-    console.error(`Architecture ${architecture} is not supported.`)
-    process.exit(1)
-  } else if (architecture === 'arm64' && osType === 'windows') {
-    console.error(`Platform ${osType} - ${architecture} is not supported.`)
-    process.exit(1)
+    throw new Error(`Architecture ${architecture} is not supported.`)
+  }
+  if (architecture === 'arm64' && osType === 'windows') {
+    throw new Error(`Platform ${osType} - ${architecture} is not supported.`)
   }
 
   if (architecture === 'x64') {
@@ -275,4 +334,8 @@ module.exports = {
   install,
   run,
   getBinary,
+  Binary,
+  childExitCode,
+  describeError,
+  getProxyUrl,
 }

package/changes.json

@@ -1,10 +1,10 @@
 {
   "bumped": {
     "undici": {
-      "from": "6.28.0",
-      "to": "^8.10.0"
+      "from": "6.28.1",
+      "to": "^8.10.2"
     }
   },
-  "timestamp": "2026-08-30T00:59:02.373Z",
+  "timestamp": "2026-09-13T00:59:47.973Z",
   "totalUpdated": 1
 }

package/package.json

@@ -1,13 +1,21 @@
 {
   "name": "@depup/serverless",
-  "version": "4.41.1-depup.0",
+  "version": "4.42.0-depup.0",
   "description": "serverless with all dependencies updated to latest",
   "main": "index.js",
+  "files": [
+    "binary.js",
+    "postInstall.js",
+    "run.js",
+    "changes.json",
+    "README.md"
+  ],
   "scripts": {
     "lint": "eslint",
     "lint:fix": "eslint --fix",
     "prettier": "prettier -c . --ignore-path ../../.prettierignore",
-    "prettier:fix": "prettier -w . --ignore-path ../../.prettierignore"
+    "prettier:fix": "prettier -w . --ignore-path ../../.prettierignore",
+    "test": "node --test \"tests/*.test.js\""
   },
   "keywords": [
     "serverless",
@@ -27,7 +35,7 @@
     "sls": "run.js"
   },
   "dependencies": {
-    "undici": "^8.10.0"
+    "undici": "^8.10.2"
   },
   "devDependencies": {},
   "engines": {
@@ -36,14 +44,14 @@
   "depup": {
     "changes": {
       "undici": {
-        "from": "6.28.0",
-        "to": "^8.10.0"
+        "from": "6.28.1",
+        "to": "^8.10.2"
       }
     },
     "depsUpdated": 1,
     "originalPackage": "serverless",
-    "originalVersion": "4.41.1",
-    "processedAt": "2026-08-30T00:59:03.353Z",
+    "originalVersion": "4.42.0",
+    "processedAt": "2026-09-13T00:59:48.872Z",
     "smokeTest": "failed"
   }
 }

package/postInstall.js

@@ -1,4 +1,17 @@
 #!/usr/bin/env node
 
-const { install: maybeInstall } = require('./binary')
-maybeInstall().then(() => {})
+const { install, describeError } = require('./binary')
+
+// npm aborts the entire `npm install` when this script exits non-zero. A
+// binary that could not be pre-downloaded here is always recoverable — run.js
+// downloads it on first invocation — so no failure in this script justifies
+// failing the install.
+install().catch((e) => {
+  console.error(
+    `Could not pre-download the Serverless Framework binary: ${describeError(e)}\n` +
+      'The download will be retried the first time "serverless" runs. If your ' +
+      'network requires a proxy, set the HTTPS_PROXY environment variable (or ' +
+      "npm's https-proxy setting) and allow access to install.serverless.com. " +
+      'See https://www.serverless.com/framework/docs/getting-started',
+  )
+})

package/run.js

@@ -1,4 +1,14 @@
 #!/usr/bin/env node
 
-const { run, install: maybeInstall } = require('./binary')
-maybeInstall().then(run)
+const { run, install: maybeInstall, describeError } = require('./binary')
+
+// Unlike postInstall.js, a missing binary is fatal here: without it there is
+// nothing to run.
+maybeInstall()
+  .then(run)
+  .catch((e) => {
+    console.error(
+      `Could not download the Serverless Framework binary: ${describeError(e)}`,
+    )
+    process.exit(1)
+  })