@vercel/build-utils
Advanced tools
| import type { BuildResultV2Typical, BuildResultV3, BuilderFunctions, Config } from '../types'; | ||
| export declare const SUPPORTED_AL2023_RUNTIMES: readonly ["nodejs20.x", "nodejs22.x", "nodejs24.x", "provided.al2023", "python3.12", "python3.13", "python3.14", "ruby3.3", "bun1.x", "executable"]; | ||
| type BuildConfigWithVercelConfig = Config & { | ||
| vercelConfig?: { | ||
| functions?: BuilderFunctions; | ||
| }; | ||
| }; | ||
| export interface ValidateBuildResultParams { | ||
| allowInvalidRuntime?: boolean; | ||
| buildConfig?: BuildConfigWithVercelConfig; | ||
| buildResponse: BuildResultV2Typical | BuildResultV3; | ||
| osRelease?: OsRelease | null; | ||
| vercelBaseUrl?: string; | ||
| } | ||
| export interface ValidateBuildResultResult { | ||
| buildOutputMap: BuildResultV2Typical['output']; | ||
| customFunctionConfiguration?: BuilderFunctions[string]; | ||
| } | ||
| type OsRelease = Record<string, string>; | ||
| export declare function validateBuildResult({ allowInvalidRuntime, buildConfig, buildResponse, osRelease, vercelBaseUrl, }: ValidateBuildResultParams): Promise<ValidateBuildResultResult>; | ||
| export {}; |
| "use strict"; | ||
| var __create = Object.create; | ||
| var __defProp = Object.defineProperty; | ||
| var __getOwnPropDesc = Object.getOwnPropertyDescriptor; | ||
| var __getOwnPropNames = Object.getOwnPropertyNames; | ||
| var __getProtoOf = Object.getPrototypeOf; | ||
| var __hasOwnProp = Object.prototype.hasOwnProperty; | ||
| var __export = (target, all) => { | ||
| for (var name in all) | ||
| __defProp(target, name, { get: all[name], enumerable: true }); | ||
| }; | ||
| var __copyProps = (to, from, except, desc) => { | ||
| if (from && typeof from === "object" || typeof from === "function") { | ||
| for (let key of __getOwnPropNames(from)) | ||
| if (!__hasOwnProp.call(to, key) && key !== except) | ||
| __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable }); | ||
| } | ||
| return to; | ||
| }; | ||
| var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps( | ||
| // If the importer is in node compatibility mode or this is not an ESM | ||
| // file that has been converted to a CommonJS file using a Babel- | ||
| // compatible transform (i.e. "__esModule" has not been set), then set | ||
| // "default" to the CommonJS "module.exports" for node compatibility. | ||
| isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target, | ||
| mod | ||
| )); | ||
| var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod); | ||
| var validate_build_result_exports = {}; | ||
| __export(validate_build_result_exports, { | ||
| SUPPORTED_AL2023_RUNTIMES: () => SUPPORTED_AL2023_RUNTIMES, | ||
| validateBuildResult: () => validateBuildResult | ||
| }); | ||
| module.exports = __toCommonJS(validate_build_result_exports); | ||
| var import_minimatch = __toESM(require("minimatch")); | ||
| var import_errors = require("../errors"); | ||
| const SUPPORTED_AL2023_RUNTIMES = [ | ||
| "nodejs20.x", | ||
| "nodejs22.x", | ||
| "nodejs24.x", | ||
| "provided.al2023", | ||
| "python3.12", | ||
| "python3.13", | ||
| "python3.14", | ||
| "ruby3.3", | ||
| "bun1.x", | ||
| "executable" | ||
| ]; | ||
| const DEFAULT_ENTRYPOINT = "."; | ||
| const DEVELOPING_A_RUNTIME_URL = "https://github.com/vercel/vercel/blob/master/DEVELOPING_A_RUNTIME.md"; | ||
| function isSupportedAl2023Runtime(runtime) { | ||
| return SUPPORTED_AL2023_RUNTIMES.some((supported) => supported === runtime); | ||
| } | ||
| async function validateBuildResult({ | ||
| allowInvalidRuntime = false, | ||
| buildConfig, | ||
| buildResponse, | ||
| osRelease, | ||
| vercelBaseUrl | ||
| }) { | ||
| if (!("output" in buildResponse)) { | ||
| throw new import_errors.NowBuildError({ | ||
| code: "NOW_SANDBOX_WORKER_BUILDER_ERROR", | ||
| message: 'The result of "builder.build" must include an `output` property for "@vercel/vc-build".' | ||
| }); | ||
| } | ||
| if (!buildResponse.output || typeof buildResponse.output !== "object") { | ||
| throw new import_errors.NowBuildError({ | ||
| code: "NOW_SANDBOX_WORKER_BUILDER_ERROR", | ||
| message: 'The result of "builder.build" must be an object' | ||
| }); | ||
| } | ||
| const buildOutputMap = getAndVerifyOutputLambdasOrEdgeFuncs(buildResponse); | ||
| if (osRelease?.VERSION === "2023") { | ||
| const invalidRuntimes = []; | ||
| for (const [name, entry] of Object.entries(buildOutputMap)) { | ||
| let lambda; | ||
| if (entry.type === "Prerender") { | ||
| lambda = entry.lambda; | ||
| } else if (entry.type === "Lambda") { | ||
| lambda = entry; | ||
| } | ||
| if (!lambda) | ||
| continue; | ||
| if (!isSupportedAl2023Runtime(lambda.runtime)) { | ||
| invalidRuntimes.push({ name, lambda }); | ||
| } | ||
| } | ||
| if (invalidRuntimes.length > 0 && !allowInvalidRuntime) { | ||
| throw new import_errors.NowBuildError({ | ||
| code: "NOW_SANDBOX_WORKER_INVALID_RUNTIME", | ||
| message: `The following Serverless Functions contain an invalid "runtime": | ||
| ${invalidRuntimes.map(({ name, lambda }) => ` - ${name} (${lambda.runtime})`).join("\n")}`, | ||
| link: getVercelUrl( | ||
| "/docs/functions/runtimes#official-runtimes", | ||
| vercelBaseUrl | ||
| ) | ||
| }); | ||
| } | ||
| } | ||
| const customFunctionConfiguration = getCustomFunctionConfigMaybe(buildConfig); | ||
| if (customFunctionConfiguration?.runtime) { | ||
| throw new import_errors.NowBuildError({ | ||
| code: "NOW_SANDBOX_WORKER_FUNCTION_RUNTIME_VERSION", | ||
| message: `The Community Runtime ${customFunctionConfiguration.runtime} is not using version 3 of the Runtime API. If you are the Runtime author, see the docs by clicking "View Details" above.`, | ||
| link: DEVELOPING_A_RUNTIME_URL | ||
| }); | ||
| } | ||
| return { | ||
| buildOutputMap, | ||
| customFunctionConfiguration | ||
| }; | ||
| } | ||
| function getCustomFunctionConfigMaybe(buildConfig) { | ||
| const functions = buildConfig?.functions ?? buildConfig?.vercelConfig?.functions; | ||
| if (!functions) { | ||
| return; | ||
| } | ||
| for (const [funcPath, config] of Object.entries(functions)) { | ||
| if (funcPath === DEFAULT_ENTRYPOINT || (0, import_minimatch.default)(DEFAULT_ENTRYPOINT, funcPath)) { | ||
| return config; | ||
| } | ||
| } | ||
| return void 0; | ||
| } | ||
| function getVercelUrl(path, vercelBaseUrl = "https://vercel.com") { | ||
| const url = new URL(path, vercelBaseUrl); | ||
| if (url.pathname === "/") { | ||
| return url.href.slice(0, -1); | ||
| } | ||
| return url.href; | ||
| } | ||
| function getAndVerifyOutputLambdasOrEdgeFuncs(buildResponse) { | ||
| return buildResponse.output; | ||
| } | ||
| // Annotate the CommonJS export names for ESM import in node: | ||
| 0 && (module.exports = { | ||
| SUPPORTED_AL2023_RUNTIMES, | ||
| validateBuildResult | ||
| }); |
+10
-0
| # @vercel/build-utils | ||
| ## 13.19.0 | ||
| ### Minor Changes | ||
| - [services] move Python workers to v2beta triggers with private routing ([#15920](https://github.com/vercel/vercel/pull/15920)) | ||
| ### Patch Changes | ||
| - Added a shared build result validation helper in `@vercel/build-utils` for existing callers. ([#16030](https://github.com/vercel/vercel/pull/16030)) | ||
| ## 13.18.0 | ||
@@ -4,0 +14,0 @@ |
+1
-0
@@ -48,2 +48,3 @@ import FileBlob from './file-blob'; | ||
| export { getBuildResultMetadata, type BuildResultMetadata, } from './collect-build-result/get-build-result-metadata'; | ||
| export { validateBuildResult, SUPPORTED_AL2023_RUNTIMES, type ValidateBuildResultParams, type ValidateBuildResultResult, } from './collect-build-result/validate-build-result'; | ||
| export { getLambdaByOutputPath } from './collect-build-result/get-lambda-by-output-path'; | ||
@@ -50,0 +51,0 @@ export { isRouteMiddleware } from './collect-build-result/is-route-middleware'; |
+0
-2
@@ -523,3 +523,2 @@ /// <reference types="node" /> | ||
| topics?: ServiceTopics; | ||
| consumer?: string; | ||
| /** custom prefix to inject service URL env vars */ | ||
@@ -740,3 +739,2 @@ envPrefix?: string; | ||
| topics?: ServiceTopics; | ||
| consumer?: string; | ||
| /** Custom prefix to use to inject service URL env vars */ | ||
@@ -743,0 +741,0 @@ envPrefix?: string; |
+1
-1
| { | ||
| "name": "@vercel/build-utils", | ||
| "version": "13.18.0", | ||
| "version": "13.19.0", | ||
| "license": "Apache-2.0", | ||
@@ -5,0 +5,0 @@ "main": "./dist/index.js", |
Sorry, the diff of this file is too big to display
Network access
Supply chain riskThis module accesses the network.
Found 1 instance in 1 package
Shell access
Supply chain riskThis module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Found 1 instance in 1 package
Dynamic require
Supply chain riskDynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 11 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 3 instances in 1 package
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
Found 1 instance in 1 package
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Found 1 instance in 1 package
Network access
Supply chain riskThis module accesses the network.
Found 1 instance in 1 package
Shell access
Supply chain riskThis module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Found 1 instance in 1 package
Dynamic require
Supply chain riskDynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 11 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 3 instances in 1 package
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
Found 1 instance in 1 package
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Found 1 instance in 1 package
1778506
0.58%148
1.37%43625
0.61%