devDependencies are not excluded all of a sudden...

[QAnders]

Are you certain it's a bug?

• Yes, it looks like a bug

Is the issue caused by a plugin?

• It is not a plugin issue

Are you using the latest v3 release?

• Yes, I'm using the latest v3 release

Is there an existing issue for this?

• I have searched existing issues, it hasn't been reported yet

Issue description

I found the issue for devDependencies not being excluded for the parent directory issue, but we have our serverless.yml in the root, along with te node_modules.

We have had this working fine previously, and the deploy size of the Lambdas has been around 31 MB.

Now we hit 110 MB and the deploy fails as the unpackaged size exceeds 360 MB(!).

Extracting the ZIP I can see that all dependecises are there, e.g. serverless, aws-sdk, eslint etc.

What have I messed up?

Service configuration (serverless.yml) content

frameworkVersion: '3'

package:
  individually: true
  excludeDevDependencies: true
  patterns:
    - '!volume/**' # exclude any Localstack temporary files/directories
    - '!coverage/**'
    - '!db-data/**'
    - '!.serverless/**'
    - '!.vscode/**'
    - '!test/**'
    - '!aws/**'
    - '!dist/**'

### Command name and used flags

sls deploy -s test

### Command output

```shell
The verbose logging shows it is excluding dependencise:

stage: test
Packaging
Excluding development dependencies for function "migrator"
Excluding development dependencies for function "create-access-key"
Excluding development dependencies for function "integrationInternal"
Excluding development dependencies for function "integrationExternal"
Excluding development dependencies for function "internalRoutes"

### Environment information

```shell
Framework Core: 3.38.0 (local)
Plugin: 7.2.2
SDK: 4.5.1

node v18.14.2 (npm v9.5.0)

[QAnders]

The work around for now is to get the list of "real" dependencies is:

1. execute:

rm -r node_modules/
rm package-lock.json
npm install --omit=dev
ls -d node_modules/*/ | sed "s/^/- '/" | sed "s/$/**'/"

2. Copy the list (it's looong) and fix all directory names as e.g. - 'node_modules/@qvalia/**' and add - '!node_modules/**' first under patterns: in serverless.yml (to exclude anything under node_modules)

package:
  patterns:
    - '!node_modules/**
    - 'node_modules/aws4/**'
    - 'node_modules/fake-tag/**'
    - 'node_modules/graphql/**'
#...

3. Run npm i and then deploy!

From having 110MB deployment ZIP this brought us down to 22MB...

EDIT 2025-06-26:
For me the issue boils down to us running Localstack, thus Docker, where we persist the image data in a directory called /volume which is created by Docker.
The developers who run Docker as root has run into this issue with packaging being extremely large, and the reason is that the /volume directory is owned by root and the serverless "user" don't have access to the directory and the "packager" of Serverless is set to fail silently, hence we don't know something went wrong.
I've opened a PR, mostly to highlight the issue...

[Alan-Graton]

Has this being fixed yet?

[QAnders]

We now have the same issue on three more of our repositories... Anyone that has any input to why this is happening?

We have a project (different from the one above) that has been built and managed on Mac only, but as soon as a Windows client running WSL2 (Ubunutu) tried to run the same we got a node_modules of 340 MB on the Windows machine, while the Mac has it at 26 MB.

Comparing the two deployment ZIP packages we can see that on Windows a lot of (all?) devDependencies, including serverless, is included in the ZIP making it massive...

Environment: linux, node 18.14.2, framework 3.39.0 (local), plugin 7.2.3, SDK 4.5.1

[QAnders]

We have two new affected developers that are running native Ubuntu and the other Windows 11 with WSL2 and Ubuntu.

For this new repository where this problem has emerged, looking at the developers using Mac, they have a ZIP size of 28MB, but looking at GitHub Actions doing a deploy using Ubuntu the ZIP size at deploy is only 15MB (using npm ci).

So, the size difference between Mac and Ubuntu (using npm i, not npm ci) is really weird, but it would seem that Serverless is not capable of excluding dependencies as it should...

We've doublechecked the ZIP's and it node_modules that's massive in the ZIP's... E.g. containing Serverless and aws-sdk which is a dependency of serverless even though we, in code, are only using AES SDK v3, s it's clearly dependencies being added...

[donghoon-song]

Experiencing the same problem and temporarily deployed mine using the workaround above.

[QAnders]

This is happening more and more and seems to be an issue on Windows and/or Windows running WSL2!

The latest issues are happening on two laptops now:

Environment: linux, node 20.18.0, framework 3.40.0 (local), plugin 7.2.3, SDK 4.5.1
npm: 11.4.2

Any update on this?

[QAnders]

Anyone stuck on this, check my PR here: https://github.com/serverless/serverless/pull/13097/files

Essentially, if you have any file and/or directory that is forbidden for the user running serverless to access, you'll end up with a silent error and nothing will be excluded from your packaging.