@vercel/backends - npm Package Compare versions

Comparing version 0.0.30 to 0.0.31

./dist/index.mjs

@@ -5,3 +5,3 @@ import { builtinModules, createRequire } from "node:module";
 import { createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
-import { lstat, readFile, rm } from "node:fs/promises";
+import { lstat, readFile, rm, stat } from "node:fs/promises";
 import { dirname as dirname$1, extname as extname$1, isAbsolute, join as join$1, relative } from "node:path";
@@ -682,2 +682,3 @@ import { build as build$2 } from "rolldown";
 	const runNft = async () => {
+		const ignorePatterns = [...args.ignoreNodeModules ? ["**/node_modules/**"] : [], ...args.ignore ? Array.isArray(args.ignore) ? args.ignore : [args.ignore] : []];
 		const nftResult = await nodeFileTrace$1(Array.from(args.localBuildFiles), {
@@ -689,3 +690,3 @@ base: args.repoRootPath,
 			conditions: args.conditions,
-			ignore: args.ignoreNodeModules ? (path) => path.includes("node_modules") : void 0,
+			ignore: ignorePatterns.length > 0 ? ignorePatterns : void 0,
 			async readFile(fsPath) {
@@ -708,7 +709,9 @@ try {
 			if (stats.isSymbolicLink() || stats.isFile()) if (args.ignoreNodeModules) {
-				const content = await readFile(absolutePath, "utf-8");
-				args.files[outputPath] = new FileBlob({
-					data: content,
-					mode: stats.mode
-				});
+				if ((stats.isSymbolicLink() ? await stat(absolutePath) : stats).isFile()) {
+					const content = await readFile(absolutePath, "utf-8");
+					args.files[outputPath] = new FileBlob({
+						data: content,
+						mode: stats.mode
+					});
+				}
 			} else args.files[outputPath] = new FileFsRef({
@@ -791,2 +794,5 @@ fsPath: absolutePath,
 	};
+	const isBunBuiltin = (id) => {
+		return id === "bun" || id.startsWith("bun:");
+	};
 	const isLocalImport = (id) => {
@@ -810,2 +816,6 @@ return !id.startsWith("node:") && !id.includes("node_modules");
 					};
+					if (isBunBuiltin(id)) return {
+						id,
+						external: true
+					};
 					if (resolved?.id && isLocalImport(resolved.id)) localBuildFiles.add(resolved.id);
@@ -910,3 +920,4 @@ else if (!resolved) localBuildFiles.add(join$1(args.workPath, id));
 		span: rolldownSpan ?? new Span({ name: "vc.builder.backends.nft" }),
-		ignoreNodeModules: true
+		ignoreNodeModules: true,
+		ignore: args.config.excludeFiles
 	});
@@ -1431,2 +1442,7 @@ if (!handler) throw new Error(`Unable to resolve build handler for entrypoint: ${args.entrypoint}`);
 		const userBuildResult = await maybeDoBuildCommand(args, downloadResult);
+		const functionConfig = args.config.functions?.[entrypoint];
+		if (functionConfig) {
+			args.config.includeFiles = [...normalizeArray(args.config.includeFiles), ...normalizeArray(functionConfig.includeFiles)];
+			args.config.excludeFiles = [...normalizeArray(args.config.excludeFiles), ...normalizeArray(functionConfig.excludeFiles)];
+		}
 		const rolldownResult = await rolldown({
@@ -1457,5 +1473,9 @@ ...args,
 			ignoreNodeModules: false,
+			ignore: args.config.excludeFiles,
 			conditions: isBun ? ["bun"] : void 0,
 			span: buildSpan
 		});
+		const baseDir = args.repoRootPath || args.workPath;
+		const includeResults = await Promise.all(normalizeArray(args.config.includeFiles).map((pattern) => glob(pattern, baseDir)));
+		for (const matched of includeResults) for (const [relPath, entry] of Object.entries(matched)) files[relPath] = entry;
 		const introspectionResult = await introspectionPromise;
@@ -1495,4 +1515,5 @@ await typescriptPromise;
 };
+const normalizeArray = (value) => Array.isArray(value) ? value : value ? [value] : [];
 
 //#endregion
 export { build, build$1 as cervelBuild, serve as cervelServe, findEntrypoint, findEntrypointOrThrow, getBuildSummary, introspectApp, nodeFileTrace, prepareCache, srvxOptions, version };

dist/index.mjs

@@ -5,3 +5,3 @@ import { builtinModules, createRequire } from "node:module";
 import { createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
-import { lstat, readFile, rm } from "node:fs/promises";
+import { lstat, readFile, rm, stat } from "node:fs/promises";
 import { dirname as dirname$1, extname as extname$1, isAbsolute, join as join$1, relative } from "node:path";
@@ -682,2 +682,3 @@ import { build as build$2 } from "rolldown";
 	const runNft = async () => {
+		const ignorePatterns = [...args.ignoreNodeModules ? ["**/node_modules/**"] : [], ...args.ignore ? Array.isArray(args.ignore) ? args.ignore : [args.ignore] : []];
 		const nftResult = await nodeFileTrace$1(Array.from(args.localBuildFiles), {
@@ -689,3 +690,3 @@ base: args.repoRootPath,
 			conditions: args.conditions,
-			ignore: args.ignoreNodeModules ? (path) => path.includes("node_modules") : void 0,
+			ignore: ignorePatterns.length > 0 ? ignorePatterns : void 0,
 			async readFile(fsPath) {
@@ -708,7 +709,9 @@ try {
 			if (stats.isSymbolicLink() || stats.isFile()) if (args.ignoreNodeModules) {
-				const content = await readFile(absolutePath, "utf-8");
-				args.files[outputPath] = new FileBlob({
-					data: content,
-					mode: stats.mode
-				});
+				if ((stats.isSymbolicLink() ? await stat(absolutePath) : stats).isFile()) {
+					const content = await readFile(absolutePath, "utf-8");
+					args.files[outputPath] = new FileBlob({
+						data: content,
+						mode: stats.mode
+					});
+				}
 			} else args.files[outputPath] = new FileFsRef({
@@ -791,2 +794,5 @@ fsPath: absolutePath,
 	};
+	const isBunBuiltin = (id) => {
+		return id === "bun" || id.startsWith("bun:");
+	};
 	const isLocalImport = (id) => {
@@ -810,2 +816,6 @@ return !id.startsWith("node:") && !id.includes("node_modules");
 					};
+					if (isBunBuiltin(id)) return {
+						id,
+						external: true
+					};
 					if (resolved?.id && isLocalImport(resolved.id)) localBuildFiles.add(resolved.id);
@@ -910,3 +920,4 @@ else if (!resolved) localBuildFiles.add(join$1(args.workPath, id));
 		span: rolldownSpan ?? new Span({ name: "vc.builder.backends.nft" }),
-		ignoreNodeModules: true
+		ignoreNodeModules: true,
+		ignore: args.config.excludeFiles
 	});
@@ -1431,2 +1442,7 @@ if (!handler) throw new Error(`Unable to resolve build handler for entrypoint: ${args.entrypoint}`);
 		const userBuildResult = await maybeDoBuildCommand(args, downloadResult);
+		const functionConfig = args.config.functions?.[entrypoint];
+		if (functionConfig) {
+			args.config.includeFiles = [...normalizeArray(args.config.includeFiles), ...normalizeArray(functionConfig.includeFiles)];
+			args.config.excludeFiles = [...normalizeArray(args.config.excludeFiles), ...normalizeArray(functionConfig.excludeFiles)];
+		}
 		const rolldownResult = await rolldown({
@@ -1457,5 +1473,9 @@ ...args,
 			ignoreNodeModules: false,
+			ignore: args.config.excludeFiles,
 			conditions: isBun ? ["bun"] : void 0,
 			span: buildSpan
 		});
+		const baseDir = args.repoRootPath || args.workPath;
+		const includeResults = await Promise.all(normalizeArray(args.config.includeFiles).map((pattern) => glob(pattern, baseDir)));
+		for (const matched of includeResults) for (const [relPath, entry] of Object.entries(matched)) files[relPath] = entry;
 		const introspectionResult = await introspectionPromise;
@@ -1495,4 +1515,5 @@ await typescriptPromise;
 };
+const normalizeArray = (value) => Array.isArray(value) ? value : value ? [value] : [];
 
 //#endregion
 export { build, build$1 as cervelBuild, serve as cervelServe, findEntrypoint, findEntrypointOrThrow, getBuildSummary, introspectApp, nodeFileTrace, prepareCache, srvxOptions, version };

dist/rolldown/index.d.mts

 import { BuildOptions, Files, Span } from "@vercel/build-utils";
 
 //#region src/rolldown/index.d.ts
-declare const rolldown: (args: Pick<BuildOptions, 'entrypoint' | 'workPath' | 'repoRootPath'> & {
+declare const rolldown: (args: Pick<BuildOptions, 'entrypoint' | 'workPath' | 'repoRootPath' | 'config'> & {
   span?: Span;
@@ -6,0 +6,0 @@ }) => Promise<{

dist/rolldown/index.mjs

@@ -5,3 +5,3 @@ import { builtinModules } from "node:module";
 import { existsSync } from "node:fs";
-import { lstat, readFile } from "node:fs/promises";
+import { lstat, readFile, stat } from "node:fs/promises";
 import { build } from "rolldown";
@@ -97,2 +97,3 @@ import { nodeFileTrace } from "@vercel/nft";
 	const runNft = async () => {
+		const ignorePatterns = [...args.ignoreNodeModules ? ["**/node_modules/**"] : [], ...args.ignore ? Array.isArray(args.ignore) ? args.ignore : [args.ignore] : []];
 		const nftResult = await nodeFileTrace(Array.from(args.localBuildFiles), {
@@ -104,3 +105,3 @@ base: args.repoRootPath,
 			conditions: args.conditions,
-			ignore: args.ignoreNodeModules ? (path) => path.includes("node_modules") : void 0,
+			ignore: ignorePatterns.length > 0 ? ignorePatterns : void 0,
 			async readFile(fsPath) {
@@ -123,7 +124,9 @@ try {
 			if (stats.isSymbolicLink() || stats.isFile()) if (args.ignoreNodeModules) {
-				const content = await readFile(absolutePath, "utf-8");
-				args.files[outputPath] = new FileBlob({
-					data: content,
-					mode: stats.mode
-				});
+				if ((stats.isSymbolicLink() ? await stat(absolutePath) : stats).isFile()) {
+					const content = await readFile(absolutePath, "utf-8");
+					args.files[outputPath] = new FileBlob({
+						data: content,
+						mode: stats.mode
+					});
+				}
 			} else args.files[outputPath] = new FileFsRef({
@@ -206,2 +209,5 @@ fsPath: absolutePath,
 	};
+	const isBunBuiltin = (id) => {
+		return id === "bun" || id.startsWith("bun:");
+	};
 	const isLocalImport = (id) => {
@@ -225,2 +231,6 @@ return !id.startsWith("node:") && !id.includes("node_modules");
 					};
+					if (isBunBuiltin(id)) return {
+						id,
+						external: true
+					};
 					if (resolved?.id && isLocalImport(resolved.id)) localBuildFiles.add(resolved.id);
@@ -325,3 +335,4 @@ else if (!resolved) localBuildFiles.add(join(args.workPath, id));
 		span: rolldownSpan ?? new Span({ name: "vc.builder.backends.nft" }),
-		ignoreNodeModules: true
+		ignoreNodeModules: true,
+		ignore: args.config.excludeFiles
 	});
@@ -328,0 +339,0 @@ if (!handler) throw new Error(`Unable to resolve build handler for entrypoint: ${args.entrypoint}`);

package.json

 {
   "name": "@vercel/backends",
-  "version": "0.0.30",
+  "version": "0.0.31",
   "license": "Apache-2.0",
@@ -37,3 +37,3 @@ "main": "./dist/index.mjs",
     "zod": "3.22.4",
-    "@vercel/build-utils": "13.3.3"
+    "@vercel/build-utils": "13.3.4"
   },
@@ -40,0 +40,0 @@ "peerDependencies": {

New alerts

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 5 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 2 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Fixed alerts

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 5 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 2 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

154638

1.87%

Lines of code

4207

1.28%

Dependency changes

• + Added

  @vercel/build-utils@13.3.4
  (transitive)

• - Removed

  @vercel/build-utils@13.3.3
  (transitive)

• Updated

  @vercel/build-utils@13.3.4