@sveltejs/adapter-vercel - npm Package Compare versions

Comparing version 5.1.1 to 5.2.0

files/edge.js

@@ -15,2 +15,3 @@ import { Server } from 'SERVER';
 	await initialized;
+
 	return server.respond(request, {
@@ -17,0 +18,0 @@ getClientAddress() {

index.js

@@ -7,2 +7,3 @@ import fs from 'node:fs';
 import { get_pathname, pattern_to_src } from './utils.js';
+import { VERSION } from '@sveltejs/kit';
 
@@ -61,4 +62,9 @@ const name = '@sveltejs/adapter-vercel';
 
-			const static_config = static_vercel_config(builder, defaults);
+			builder.log.minor('Copying assets...');
 
+			builder.writeClient(dirs.static);
+			builder.writePrerendered(dirs.static);
+
+			const static_config = static_vercel_config(builder, defaults, dirs.static);
+
 			builder.log.minor('Generating serverless function...');
@@ -179,3 +185,7 @@
 							regions: config.regions,
-							entrypoint: 'index.js'
+							entrypoint: 'index.js',
+							framework: {
+								slug: 'sveltekit',
+								version: VERSION
+							}
 						},
@@ -369,7 +379,2 @@ null,
 
-			builder.log.minor('Copying assets...');
-
-			builder.writeClient(dirs.static);
-			builder.writePrerendered(dirs.static);
-
 			builder.log.minor('Writing routes...');
@@ -427,4 +432,5 @@
  * @param {import('.').Config} config
+ * @param {string} dir
  */
-function static_vercel_config(builder, config) {
+function static_vercel_config(builder, config, dir) {
 	/** @type {any[]} */
@@ -470,16 +476,56 @@ const prerendered_redirects = [];
 
+	const routes = [
+		...prerendered_redirects,
+		{
+			src: `/${builder.getAppPath()}/immutable/.+`,
+			headers: {
+				'cache-control': 'public, immutable, max-age=31536000'
+			}
+		}
+	];
+
+	// https://vercel.com/docs/deployments/skew-protection
+	if (process.env.VERCEL_SKEW_PROTECTION_ENABLED) {
+		routes.push({
+			src: '/.*',
+			has: [
+				{
+					type: 'header',
+					key: 'Sec-Fetch-Dest',
+					value: 'document'
+				}
+			],
+			headers: {
+				'Set-Cookie': `__vdpl=${process.env.VERCEL_DEPLOYMENT_ID}; Path=${builder.config.kit.paths.base}/; SameSite=Strict; Secure; HttpOnly`
+			},
+			continue: true
+		});
+
+		// this is a dreadful hack that is necessary until the Vercel Build Output API
+		// allows you to set multiple cookies for a single route. essentially, since we
+		// know that the entry file will be requested immediately, we can set the second
+		// cookie in _that_ response rather than the document response
+		const base = `${dir}/${builder.config.kit.appDir}/immutable/entry`;
+		const entry = fs.readdirSync(base).find((file) => file.startsWith('start.'));
+
+		if (!entry) {
+			throw new Error('Could not find entry point');
+		}
+
+		routes.splice(-2, 0, {
+			src: `/${builder.getAppPath()}/immutable/entry/${entry}`,
+			headers: {
+				'Set-Cookie': `__vdpl=; Path=/${builder.getAppPath()}/version.json; SameSite=Strict; Secure; HttpOnly`
+			},
+			continue: true
+		});
+	}
+
+	routes.push({
+		handle: 'filesystem'
+	});
+
 	return {
 		version: 3,
-		routes: [
-			...prerendered_redirects,
-			{
-				src: `/${builder.getAppPath()}/immutable/.+`,
-				headers: {
-					'cache-control': 'public, immutable, max-age=31536000'
-				}
-			},
-			{
-				handle: 'filesystem'
-			}
-		],
+		routes,
 		overrides,
@@ -597,3 +643,7 @@ images
 				launcherType: 'Nodejs',
-				experimentalResponseStreaming: !config.isr
+				experimentalResponseStreaming: !config.isr,
+				framework: {
+					slug: 'sveltekit',
+					version: VERSION
+				}
 			},
@@ -600,0 +650,0 @@ null,

package.json

 {
   "name": "@sveltejs/adapter-vercel",
-  "version": "5.1.1",
+  "version": "5.2.0",
   "description": "A SvelteKit adapter that creates a Vercel app",
@@ -36,3 +36,3 @@ "repository": {
     "vitest": "^1.2.0",
-    "@sveltejs/kit": "^2.5.3"
+    "@sveltejs/kit": "^2.5.4"
   },
@@ -39,0 +39,0 @@ "peerDependencies": {

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

31771

increased by4.77%

Lines of code

846

increased by5.49%

Worsened metrics

Number of low supply chain risk alerts

4

increased by100%

No dependency changes