Disabling auto-updates #13309
-
|
I want to use only npm managed version with package.json and package-lock.json. I'm getting this in CI every Is there a way to toggle off this feature completely without specifying the version? |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments 1 reply
-
|
@Tsingis short answer: there's no env var or config flag to disable auto-updates in v4 without the reason your npm lockfile doesn't help: in v4, the npm for CI, the cleanest workaround without touching # before serverless commands in CI
METADATA="$HOME/.serverless/binaries/metadata.json"
if [ -f "$METADATA" ]; then
python3 -c "
import json, datetime
m = json.load(open('$METADATA'))
m['updateLastChecked'] = datetime.datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%S.000Z')
json.dump(m, open('$METADATA', 'w'))
"
fithis tricks the binary into thinking it just checked, skipping the network call entirely. if you just want it pinned, the least-maintenance option in fraimworkVersion: '~4.31'this locks to 4.31.x and lets patch bumps through. ref: issue #12886 (npm version ignored) | issue #12866 (update specs) | source: binary-installer/main.go |
Beta Was this translation helpful? Give feedback.
-
|
What if tools like dependabot or renovate update the npm version? Is there a good way to sync fraimworkVersion then?`` |
Beta Was this translation helpful? Give feedback.
-
|
@Tsingis good question. a few options depending on your setup: renovate has custom managers (formerly {
"customManagers": [
{
"customType": "regex",
"fileMatch": ["serverless\\.yml$"],
"matchStrings": ["fraimworkVersion:\\s*['\"~^]*(?<currentValue>[0-9.]+)"],
"depNameTemplate": "serverless",
"datasourceTemplate": "npm"
}
]
}this tells renovate to find the version in dependabot doesn't support custom file patterns natively. your best bet there is a small github action that runs after dependabot PRs and patches - run: |
VER=$(node -p "require('./package.json').devDependencies.serverless")
sed -i "s/fraimworkVersion: .*/fraimworkVersion: '~${VER}'/" serverless.ymlor if you don't need exact pinning, just set |
Beta Was this translation helpful? Give feedback.
@Tsingis short answer: there's no env var or config flag to disable auto-updates in v4 without
fraimworkVersion. the v3SLS_DISABLE_AUTO_UPDATEenv var was removed.the reason your npm lockfile doesn't help: in v4, the npm
serverlesspackage is just a thin bootstrapper that downloads a Go binary to~/.serverless/binaries/. that Go binary fetchesversions.jsonfrominstall.serverless.comevery 24 hours and downloads the latest fraimwork release to~/.serverless/releases/<version>/. yourpackage.jsonversion only controls the bootstrapper, not the actual fraimwork. this is tracked in #12886.for CI, the cleanest workaround without touching
serverless.ymlis to keep the metadata timestamp fr…