chore(deps): bump tar, serverless and serverless-offline in /python

[dependabot]

Removes tar. It's no longer used after updating ancestor dependencies tar, serverless and serverless-offline. These dependencies need to be updated together.

Removes tar

Updates serverless from 3.40.0 to 4.38.1

Release notes

Sourced from serverless's releases.

4.38.1

Maintenance

• Upgraded undici to 6.27.0, clearing security advisories reported against earlier versions of the bundled HTTP client: a Set-Cookie SameSite attribute downgrade (GHSA-g8m3-5g58-fq7m), HTTP header injection via Set-Cookie percent-decoding (GHSA-p88m-4jfj-68fv), and a WebSocket client denial-of-service (GHSA-vxpw-j846-p89q). (#13657)

4.38.0

Features

• Ruby 4.0 runtime support. Functions can now target the ruby4.0 Lambda runtime. (#13613)

  provider:
    name: aws
    runtime: ruby4.0

• New ${aws:partition} variable. Resolves to the AWS partition for the deployment region (e.g. aws, aws-cn, aws-us-gov) with no network call or credentials required. Makes ARNs in your configuration portable across commercial, GovCloud, and China partitions. (#12441, #13633)

  provider:
    iam:
      role:
        managedPolicies:
          - arn:${aws:partition}:iam::aws:policy/AmazonS3ReadOnlyAccess

• AgentCore: Python 3.14 support. Agent runtimes can now target python3.14. Runtime validation is also stronger, with supported runtimes validated against a single allowlist. (#13645)

  # AgentCore agent configuration
  runtime: python3.14

Bug Fixes

• API Gateway custom stage now used for the service endpoint URL and stage tags. When provider.apiGateway.stage is set to a value different from the deployment stage, the ServiceEndpoint output URL and the API Gateway stage tags now use that configured stage. Previously they used the deployment stage, producing an incorrect endpoint URL and attempting to tag a stage that did not exist. (#13636)

  provider:
    apiGateway:
      stage: customstage   # now reflected in ServiceEndpoint + stage tags

• Variable resolution no longer drops placeholders during re-entrant resolution. A JavaScript or TypeScript ${file(...)} resolver that calls resolveVariable() or resolveConfigurationProperty() mid-resolution opens a nested resolution pass. Under certain async timing this could leave the outer resolution looking inactive, causing a later nested placeholder to be left unresolved. Each pass now preserves and restores its context so the full dependency chain resolves reliably. (#13635)

• AgentCore: unpinned the default Buildpacks builder image and added a builder override. The previously hard-pinned heroku/builder digest is no longer used by default. (#13647, #13646)

Maintenance

• Bumped the AWS SDK group with 34 updates (#13632)

... (truncated)

Commits

• fb7ac39 chore: release 4.38.1 (#13658)
• 7565a78 chore(deps): bump undici (#13657)
• 56e78c1 chore: release 4.38.0 (#13651)
• 27dacea chore(deps): bump golang.org/x/mod in /binary-installer (#13650)
• 384a7e4 fix(agentcore): unpin heroku/builder digest; add artifact.image.builder overr...
• ea79235 fix(api-gateway): use resolved API Gateway stage for stage tags and service e...
• a2804b0 chore(deps): bump the npm_and_yarn group across 13 directories with 2 updates...
• 90183bc chore(deps): update package-lock.json (#13648)
• 64e189c feat(agentcore): support Python 3.14 and improve agent runtime validation (#1...
• 312a842 chore(deps): bump the actions group with 2 updates (#13641)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for serverless since your current version.

Install script changes

This version modifies postinstall script that runs during installation. Review the package contents before updating.

Updates serverless-offline from 13.9.0 to 14.7.3

Release notes

Sourced from serverless-offline's releases.

v14.7.3

What's Changed

• Code review fixes: env leak, worker-thread, WS cleanup, HTTP/ALB handlers by @​dherault in dherault/serverless-offline#1894
• Run npm audit fix by @​dherault in dherault/serverless-offline#1895

Full Changelog: dherault/serverless-offline@v14.7.2...v14.7.3

v14.7.2

What's Changed

• Implement authorizer override logic by @​joshf in dherault/serverless-offline#1891

New Contributors

• @​joshf made their first contribution in dherault/serverless-offline#1891

Full Changelog: dherault/serverless-offline@v14.7.1...v14.7.2

v14.7.1

What's Changed

• fix: invalid cookie error by @​blasttoys in dherault/serverless-offline#1885

New Contributors

• @​blasttoys made their first contribution in dherault/serverless-offline#1885

Full Changelog: dherault/serverless-offline@v14.7.0...v14.7.1

v14.7.0

What's Changed

• Improve ruby performance by @​naomichi-y in dherault/serverless-offline#1873

Full Changelog: dherault/serverless-offline@v14.6.0...v14.7.0

v14.6.0

What's Changed

• Fix tests by @​dherault in dherault/serverless-offline#1886
• ci: bump actions/setup-go@v5 by @​dnalborczyk in dherault/serverless-offline#1821
• chore: replace fs-extra with native Node.js fs APIs by @​roli-lpci in dherault/serverless-offline#1876
• Add ruby 3.4 support by @​naomichi-y in dherault/serverless-offline#1878
• chore(aws-sdk): bump client-lambda version (fixing critical vulnerability) by @​robertmaier in dherault/serverless-offline#1884
• Resolves #1771 by @​apokryfos in dherault/serverless-offline#1772
• Update dependencies by @​dherault in dherault/serverless-offline#1889

New Contributors

• @​roli-lpci made their first contribution in dherault/serverless-offline#1876
• @​robertmaier made their first contribution in dherault/serverless-offline#1884
• @​apokryfos made their first contribution in dherault/serverless-offline#1772

Full Changelog: dherault/serverless-offline@v14.5.0...v14.6.0

... (truncated)

Changelog

Sourced from serverless-offline's changelog.

v14.7.3

• Run npm audit fix [#1895](https://github.com/dherault/serverless-offline/issues/1895)
• Code review fixes: env leak, worker-thread, WS cleanup, HTTP/ALB handlers [#1894](https://github.com/dherault/serverless-offline/issues/1894)
• Update dependencies d9790bf
• Edit README and add CLAUDE 0d54c13
• Run prettier ad32cd9
• Clean up HTTP/ALB request handlers 1214d29
• Remove redundant authorizer-context block in WebSocketClients f5e55f5
• Run prettier 2c662e2
• Fix PythonRunner mutating the global process.env 6b865db
• Edit CI 35d77bd
• Return after posting error in worker-thread helper 2af817e

v14.7.2

8 June 2026

• Implement authorizer override logic [#1891](https://github.com/dherault/serverless-offline/issues/1891)
• Edit README 26d25e6
• Run npm i b0513f8
• Run prettier on README and CHANGELOG 665121f
• Improve import, fix tests 23bcbd6
• Lint 707c01e
• Prettier 495f5ba
• Edit scripts c3fa62c

v14.7.1

27 May 2026

• fix: invalid cookie error [#1885](https://github.com/dherault/serverless-offline/issues/1885)
• Edit script 7fd39fc
• chore(generateHapicookie): revised with feedback add test cases 4d6fa83
• chore: make generateHapicookie more robust 35ba124
• chore(generateHapiCookie): added test cases, cater for max-age with expires attribute scenario 56cde0e
• chore(generateHapiCookie): test case update 7b5692e
• chore: remove redundant import 52988b2
• chore: remove redundant import 19347ae

v14.7.0

22 May 2026

• Improve ruby performance [#1873](https://github.com/dherault/serverless-offline/issues/1873)
• Edit CHANGELOG 0486ff5
• Install auto-changelog c3f8e85
• Update dependencies 3ff34fb
• Update mocha bc7fd5b
• Add hot reload 146b625

... (truncated)

Commits

• bd05bfd 14.7.3
• b7c7b7f Merge pull request #1895 from dherault/npm-audit-fix
• d9790bf Update dependencies
• 5588a64 Run npm audit fix
• 9a8405b Merge pull request #1894 from dherault/claude-review
• 2c662e2 Run prettier
• 0d54c13 Edit README and add CLAUDE
• 35d77bd Edit CI
• 1214d29 Clean up HTTP/ALB request handlers
• f5e55f5 Remove redundant authorizer-context block in WebSocketClients
• Additional commits viewable in compare view

[dependabot]

Superseded by #520.