@vercel/build-utils - npm Package Compare versions

Comparing version 12.2.1 to 12.2.2

CHANGELOG.md

 # @vercel/build-utils
 
+## 12.2.2
+
+### Patch Changes
+
+- Allow Node.js 24 behind env var feature flag ([#14160](https://github.com/vercel/vercel/pull/14160))
+
 ## 12.2.1
@@ -4,0 +10,0 @@

dist/fs/node-version.js

@@ -103,5 +103,15 @@ "use strict";
 function getNodeVersionByMajor(major) {
-  return NODE_VERSIONS.find((v) => v.major === major);
+  return getOptions().find((v) => v.major === major);
 }
 function getOptions() {
+  if (process.env.VERCEL_ALLOW_NODEJS_24 === "1") {
+    return [
+      new import_types.NodeVersion({
+        major: 24,
+        range: "24.x",
+        runtime: "nodejs24.x"
+      }),
+      ...NODE_VERSIONS
+    ];
+  }
   return NODE_VERSIONS;
@@ -108,0 +118,0 @@ }

package.json

 {
   "name": "@vercel/build-utils",
-  "version": "12.2.1",
+  "version": "12.2.2",
   "license": "Apache-2.0",
@@ -5,0 +5,0 @@ "main": "./dist/index.js",

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 10 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 3 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 9 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 3 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1363294

0.04%

Lines of code

31192

0.06%

Worsened metrics

Number of low supply chain risk alerts

39

2.63%

No dependency changes