@vercel/build-utils - npm Package Compare versions

Comparing version 13.8.2 to 13.10.0

CHANGELOG.md

 # @vercel/build-utils
 
+## 13.10.0
+
+### Minor Changes
+
+- [services] support multiple topics for a single worker service ([#15615](https://github.com/vercel/vercel/pull/15615))
+
+- [services] support for specifying an env prefix for each service ([#15641](https://github.com/vercel/vercel/pull/15641))
+
+- Simplify python runtime by always passing in app variable ([#15635](https://github.com/vercel/vercel/pull/15635))
+
+### Patch Changes
+
+- Namespace diagnostics keys by builder and service workspace, and aggregate per-builder `package-manifest.json` files into a single `project-manifest.json` ([#15399](https://github.com/vercel/vercel/pull/15399))
+
+- Updated dependencies [[`ac87d5a5ef5d79b55765e094efc957de987d7ac4`](https://github.com/vercel/vercel/commit/ac87d5a5ef5d79b55765e094efc957de987d7ac4), [`25a6a2daa46baba6e8d7dec90eb49213b8150b8c`](https://github.com/vercel/vercel/commit/25a6a2daa46baba6e8d7dec90eb49213b8150b8c)]:
+  - @vercel/python-analysis@0.11.0
+
+## 13.9.0
+
+### Minor Changes
+
+- Ensure django static files are copied in build output. ([#15557](https://github.com/vercel/vercel/pull/15557))
+
 ## 13.8.2
@@ -4,0 +27,0 @@

dist/get-service-url-env-vars.d.ts

@@ -15,2 +15,3 @@ import type { Service } from './types';
     origin?: string;
+    envPrefix?: string;
 }
@@ -17,0 +18,0 @@ /**

dist/get-service-url-env-vars.js

@@ -51,3 +51,4 @@ "use strict";
     deploymentUrl,
-    origin
+    origin,
+    envPrefix
   } = options;
@@ -76,7 +77,8 @@ const baseUrl = origin || deploymentUrl;
     );
-    if (!(baseEnvVarName in currentEnv)) {
-      envVars[baseEnvVarName] = absoluteUrl;
+    const effectiveBaseEnvVarName = envPrefix ? `${envPrefix}${baseEnvVarName}` : baseEnvVarName;
+    if (!(effectiveBaseEnvVarName in currentEnv)) {
+      envVars[effectiveBaseEnvVarName] = absoluteUrl;
     }
     for (const prefix of frameworkPrefixes) {
-      const prefixedEnvVarName = `${prefix}${baseEnvVarName}`;
+      const prefixedEnvVarName = envPrefix ? `${prefix}${envPrefix}${baseEnvVarName}` : `${prefix}${baseEnvVarName}`;
       if (!(prefixedEnvVarName in currentEnv)) {
@@ -83,0 +85,0 @@ envVars[prefixedEnvVarName] = service.routePrefix;

dist/python.js

@@ -43,3 +43,3 @@ "use strict";
     const content = await import_fs.default.promises.readFile(fsPath, "utf-8");
-    return await (0, import_python_analysis.containsAppOrHandler)(content);
+    return await (0, import_python_analysis.findAppOrHandler)(content) !== null;
   } catch (err) {
@@ -46,0 +46,0 @@ (0, import_debug.default)(`Failed to check Python entrypoint: ${err}`);

dist/schemas.d.ts

@@ -124,1 +124,81 @@ export declare const functionsSchema: {
 };
+/**
+ * JSON Schema for builder-produced `package-manifest.json` files.
+ *
+ * Each builder (e.g. @vercel/python) may emit a `package-manifest.json`
+ * in its diagnostics output.
+ */
+export declare const packageManifestSchema: {
+    readonly type: "object";
+    readonly required: readonly ["runtime", "dependencies"];
+    readonly additionalProperties: false;
+    readonly properties: {
+        readonly version: {
+            readonly type: "string";
+            readonly description: "Manifest schema version, e.g. \"20260304\".";
+        };
+        readonly runtime: {
+            readonly type: "string";
+            readonly description: "Runtime identifier, e.g. \"python\", \"node\".";
+        };
+        readonly runtimeVersion: {
+            readonly type: "object";
+            readonly additionalProperties: false;
+            readonly required: readonly ["resolved"];
+            readonly properties: {
+                readonly requested: {
+                    readonly type: "string";
+                    readonly description: "Version constraint from the project manifest, e.g. \">=3.10\".";
+                };
+                readonly requestedSource: {
+                    readonly type: "string";
+                    readonly description: "File that declared the constraint, e.g. \"pyproject.toml\".";
+                };
+                readonly resolved: {
+                    readonly type: "string";
+                    readonly description: "Actual resolved version, e.g. \"3.12\".";
+                };
+            };
+        };
+        readonly dependencies: {
+            readonly type: "array";
+            readonly items: {
+                readonly type: "object";
+                readonly required: readonly ["name", "type", "scopes", "resolved"];
+                readonly additionalProperties: false;
+                readonly properties: {
+                    readonly name: {
+                        readonly type: "string";
+                    };
+                    readonly type: {
+                        readonly type: "string";
+                        readonly enum: readonly ["direct", "transitive", "peer"];
+                    };
+                    readonly scopes: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "Dependency groups this package belongs to, e.g. [\"main\", \"dev\"].";
+                    };
+                    readonly requested: {
+                        readonly type: "string";
+                        readonly description: "Version specifier as declared, e.g. \"flask>=2.0\".";
+                    };
+                    readonly resolved: {
+                        readonly type: "string";
+                        readonly description: "Resolved version, e.g. \"3.1.0\".";
+                    };
+                    readonly source: {
+                        readonly type: "string";
+                        readonly description: "Package source type, e.g. \"registry\", \"git\", \"path\".";
+                    };
+                    readonly sourceUrl: {
+                        readonly type: "string";
+                        readonly description: "Source URL, e.g. \"https://pypi.org\".";
+                    };
+                };
+            };
+        };
+    };
+};

dist/schemas.js

@@ -22,3 +22,4 @@ "use strict";
   buildsSchema: () => buildsSchema,
-  functionsSchema: () => functionsSchema
+  functionsSchema: () => functionsSchema,
+  packageManifestSchema: () => packageManifestSchema
 });
@@ -177,6 +178,74 @@ module.exports = __toCommonJS(schemas_exports);
 };
+const packageManifestSchema = {
+  type: "object",
+  required: ["runtime", "dependencies"],
+  additionalProperties: false,
+  properties: {
+    version: {
+      type: "string",
+      description: 'Manifest schema version, e.g. "20260304".'
+    },
+    runtime: {
+      type: "string",
+      description: 'Runtime identifier, e.g. "python", "node".'
+    },
+    runtimeVersion: {
+      type: "object",
+      additionalProperties: false,
+      required: ["resolved"],
+      properties: {
+        requested: {
+          type: "string",
+          description: 'Version constraint from the project manifest, e.g. ">=3.10".'
+        },
+        requestedSource: {
+          type: "string",
+          description: 'File that declared the constraint, e.g. "pyproject.toml".'
+        },
+        resolved: {
+          type: "string",
+          description: 'Actual resolved version, e.g. "3.12".'
+        }
+      }
+    },
+    dependencies: {
+      type: "array",
+      items: {
+        type: "object",
+        required: ["name", "type", "scopes", "resolved"],
+        additionalProperties: false,
+        properties: {
+          name: { type: "string" },
+          type: { type: "string", enum: ["direct", "transitive", "peer"] },
+          scopes: {
+            type: "array",
+            items: { type: "string" },
+            description: 'Dependency groups this package belongs to, e.g. ["main", "dev"].'
+          },
+          requested: {
+            type: "string",
+            description: 'Version specifier as declared, e.g. "flask>=2.0".'
+          },
+          resolved: {
+            type: "string",
+            description: 'Resolved version, e.g. "3.1.0".'
+          },
+          source: {
+            type: "string",
+            description: 'Package source type, e.g. "registry", "git", "path".'
+          },
+          sourceUrl: {
+            type: "string",
+            description: 'Source URL, e.g. "https://pypi.org".'
+          }
+        }
+      }
+    }
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   buildsSchema,
-  functionsSchema
+  functionsSchema,
+  packageManifestSchema
 });

dist/types.d.ts

@@ -113,2 +113,4 @@ /// <reference types="node" />
         name?: string;
+        /** The service type (e.g., "web", "cron", "worker"). */
+        type?: ServiceType;
         /** URL path prefix where the service is mounted (e.g., "/api"). */
@@ -388,2 +390,10 @@ routePrefix?: string;
 }
+export interface BuilderVX {
+    version: -1;
+    build: BuildVX;
+    diagnostics?: Diagnostics;
+    prepareCache?: PrepareCache;
+    shouldServe?: ShouldServe;
+    startDevServer?: StartDevServer;
+}
 export interface BuilderV2 {
@@ -496,5 +506,13 @@ version: 2;
     handlerFunction?: string;
-    topic?: string;
+    topics?: string[];
     consumer?: string;
+    /** custom prefix to inject service URL env vars */
+    envPrefix?: string;
 }
+/**
+ * Returns the topics a worker service subscribes to, defaulting to ['default'].
+ */
+export declare function getWorkerTopics(config: {
+    topics?: string[];
+}): [string, ...string[]];
 /** The framework which created the function */
@@ -534,2 +552,9 @@ export interface FunctionFramework {
 }
+export type BuildResultVX = {
+    resultVersion: 2;
+    result: BuildResultV2;
+} | {
+    resultVersion: 3;
+    result: BuildResultV3;
+};
 export type BuildResultV2 = BuildResultV2Typical | BuildResultBuildOutput;
@@ -540,2 +565,3 @@ export interface BuildResultV3 {
 }
+export type BuildVX = (options: BuildOptions) => Promise<BuildResultVX>;
 export type BuildV2 = (options: BuildOptions) => Promise<BuildResultV2>;
@@ -672,4 +698,6 @@ export type BuildV3 = (options: BuildOptions) => Promise<BuildResultV3>;
     schedule?: string;
-    topic?: string;
+    topics?: string[];
     consumer?: string;
+    /** Custom prefix to use to inject service URL env vars */
+    envPrefix?: string;
 }
@@ -676,0 +704,0 @@ /**

dist/types.js

@@ -23,3 +23,4 @@ "use strict";
   NodeVersion: () => NodeVersion,
-  Version: () => Version
+  Version: () => Version,
+  getWorkerTopics: () => getWorkerTopics
 });
@@ -51,2 +52,5 @@ module.exports = __toCommonJS(types_exports);
 }
+function getWorkerTopics(config) {
+  return config.topics?.length ? config.topics : ["default"];
+}
 // Annotate the CommonJS export names for ESM import in node:
@@ -56,3 +60,4 @@ 0 && (module.exports = {
   NodeVersion,
-  Version
+  Version,
+  getWorkerTopics
 });

package.json

 {
   "name": "@vercel/build-utils",
-  "version": "13.8.2",
+  "version": "13.10.0",
   "license": "Apache-2.0",
@@ -14,3 +14,3 @@ "main": "./dist/index.js",
   "dependencies": {
-    "@vercel/python-analysis": "0.10.1"
+    "@vercel/python-analysis": "0.11.0"
   },
@@ -54,4 +54,4 @@ "devDependencies": {
     "json5": "2.2.3",
-    "@vercel/routing-utils": "6.0.2",
-    "@vercel/error-utils": "2.0.3"
+    "@vercel/error-utils": "2.0.3",
+    "@vercel/routing-utils": "6.1.1"
   },
@@ -58,0 +58,0 @@ "scripts": {

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 11 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 3 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 11 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 3 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1424955

0.72%

Lines of code

32600

0.81%

Dependency changes

• + Added

  @vercel/python-analysis@0.11.0
  (transitive)

• - Removed

  @vercel/python-analysis@0.10.1
  (transitive)

• Updated

  @vercel/python-analysis@0.11.0