@Tsingis good question. a few options depending on your setup:

renovate has custom managers (formerly regexManagers) that can match patterns in any file. you can add something like this to your renovate.json:

{
  "customManagers": [
    {
      "customType": "regex",
      "fileMatch": ["serverless\\.yml$"],
      "matchStrings": ["frameworkVersion:\\s*['\"~^]*(?<currentValue>[0-9.]+)"],
      "depNameTemplate": "serverless",
      "datasourceTemplate": "npm"
    }
  ]
}

this tells renovate to find the version in frameworkVersion, treat it as the serverless npm package, and bump it alongside package.json. works well in practice.

dependabot doesn't support custom file patterns natively. your best bet there is a small github action that runs after dependabot PRs and patches serverless.yml to match. something like:

- run: |
    VER=$(node -p "require('./package.json').devDependencies.serverless")
    sed -i "s/frameworkVersion: .*/frameworkVersion: '~${VER}'/" serverless.yml

or if you don't need exact pinning, just set frameworkVersion: '4' in serverless.yml and let it float on all 4.x releases. then the bot bumps in package.json are irrelevant since frameworkVersion already allows the range. least maintenance by far.

@throrin19 yeah, the auto-update behavior in v4 is frustrating for CI. a few things that can help:

pin without duplication pain

you mentioned the renovate/package.json sync issue. the earlier thread above covers using renovate's customManagers to auto-bump frameworkVersion in serverless.yml when the npm package updates. that way you only manage it in one place (renovate handles the rest). a tilde range like ~4.31 in serverless.yml also reduces churn since it accepts patch bumps automatically.

skip the network call in CI

there's no SLS_DISABLE_AUTO_UPDATE env var in v4 (the v3 one was removed). but the update check is time-gated: the Go binary only phones home if 24h have passed since updateLastChecked in ~/.serverless/binaries/metadata.json. in CI you can bump that timestamp before running serverless commands to prevent the check entirely:

METADATA="$HOME/.serverless/binaries/metadata.json"
[ -f "$METADATA" ] && python3 -c "
import json, datetime
m = json.load(open('$METADATA'))
m['updateLastChecked'] = datetime.datetime.utcnow().strftime('%Y-%m-%dT%H:%M:%S.000Z')
json.dump(m, open('$METADATA', 'w'))
"

for fully offline/air-gapped environments

if your CI runners have no internet at all, you'd need to pre-populate ~/.serverless/releases/<version>/ with the correct binary and set frameworkVersion to that exact version. the bootstrapper will skip the download if the release dir already exists for the pinned version.

related issues: #12866 (update specs) | #12692 (version pinning)