@vercel/build-utils
Advanced tools
+6
-0
| # @vercel/build-utils | ||
| ## 13.22.1 | ||
| ### Patch Changes | ||
| - f0d7d32: Disable response streaming for lambdas with `awsLambdaHandler` set inside `getLambdaSupportsStreaming`. This closes a gap where non-Node builders (e.g. `@vercel/redwood`) constructed `NodejsLambda` with `awsLambdaHandler` but no explicit `supportsResponseStreaming`, causing `finalizeLambda` to silently flip streaming on for AWS custom handlers. With the gate now enforced centrally in `finalizeLambda`, the equivalent `@vercel/node` build-time check from #16266 is consolidated away — all builders go through the same gate. | ||
| ## 13.22.0 | ||
@@ -4,0 +10,0 @@ |
| interface LambdaLike { | ||
| awsLambdaHandler?: string; | ||
| handler: string; | ||
@@ -15,7 +16,15 @@ launcherType?: string; | ||
| /** | ||
| * Determines if a Lambda should have streaming enabled. If | ||
| * `forceStreamingRuntime` is true, streaming is always enabled. If the | ||
| * setting is defined it will be honored. Enabled by default for Node.js. | ||
| * Determines if a Lambda should have streaming enabled. | ||
| * | ||
| * AWS custom handlers cannot stream — the handler contract returns a | ||
| * response object, not a stream — so they always resolve to `false`, | ||
| * even when `forceStreamingRuntime` is set. This mirrors | ||
| * `deserializeLambda`, which also refuses to force streaming on lambdas | ||
| * with an `awsLambdaHandler` set. | ||
| * | ||
| * Otherwise: if `forceStreamingRuntime` is true, streaming is always | ||
| * enabled. If the setting is defined it will be honored. Enabled by | ||
| * default for Node.js. | ||
| */ | ||
| export declare function getLambdaSupportsStreaming(lambda: LambdaLike, forceStreamingRuntime: boolean): Promise<SupportsStreamingResult>; | ||
| export {}; |
@@ -25,2 +25,5 @@ "use strict"; | ||
| async function getLambdaSupportsStreaming(lambda, forceStreamingRuntime) { | ||
| if (lambda.awsLambdaHandler) { | ||
| return { supportsStreaming: false }; | ||
| } | ||
| if (forceStreamingRuntime) { | ||
@@ -27,0 +30,0 @@ return { supportsStreaming: true }; |
+3
-3
| { | ||
| "name": "@vercel/build-utils", | ||
| "version": "13.22.0", | ||
| "version": "13.22.1", | ||
| "license": "Apache-2.0", | ||
@@ -56,4 +56,4 @@ "main": "./dist/index.js", | ||
| "yazl": "2.5.1", | ||
| "@vercel/routing-utils": "6.2.0", | ||
| "@vercel/error-utils": "2.1.0" | ||
| "@vercel/error-utils": "2.1.0", | ||
| "@vercel/routing-utils": "6.2.0" | ||
| }, | ||
@@ -60,0 +60,0 @@ "scripts": { |
Sorry, the diff of this file is too big to display
Network access
Supply chain riskThis module accesses the network.
Found 1 instance in 1 package
Dynamic require
Supply chain riskDynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 11 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 3 instances in 1 package
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
Found 1 instance in 1 package
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Found 1 instance in 1 package
Network access
Supply chain riskThis module accesses the network.
Found 1 instance in 1 package
Dynamic require
Supply chain riskDynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 11 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 3 instances in 1 package
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
Found 1 instance in 1 package
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Found 1 instance in 1 package
1756069
0.06%43941
0.03%