@vercel/build-utils - npm Package Compare versions

Comparing version 13.5.0 to 13.6.0

CHANGELOG.md

 # @vercel/build-utils
 
+## 13.6.0
+
+### Minor Changes
+
+- Find entrypoints for django projects. ([#15167](https://github.com/vercel/vercel/pull/15167))
+
+### Patch Changes
+
+- Rename fetch to nodeFetch in cases where it is an import from node-fetch ([#15234](https://github.com/vercel/vercel/pull/15234))
+
+- [@vercel/build-utils] fix uncaught exception in streamToBuffer when stream exceeds max Buffer size ([#15276](https://github.com/vercel/vercel/pull/15276))
+
+- Remove source and destination typo suggestions for routes schema ([#15014](https://github.com/vercel/vercel/pull/15014))
+
+- Support function overrides in backends builder ([#15214](https://github.com/vercel/vercel/pull/15214))
+
+- Updated dependencies [[`b3a96cc4f276ce8d16c695eabd499d3a17e73aa8`](https://github.com/vercel/vercel/commit/b3a96cc4f276ce8d16c695eabd499d3a17e73aa8)]:
+  - @vercel/python-analysis@0.8.0
+
 ## 13.5.0
@@ -4,0 +23,0 @@

dist/errors.js

@@ -80,4 +80,2 @@ "use strict";
   routes: {
-    source: "src",
-    destination: "dest",
     header: "headers",
@@ -84,0 +82,0 @@ method: "methods"

dist/fs/stream-to-buffer.js

@@ -45,11 +45,15 @@ "use strict";
       }
-      switch (buffers.length) {
-        case 0:
-          resolve(Buffer.allocUnsafe(0));
-          break;
-        case 1:
-          resolve(buffers[0]);
-          break;
-        default:
-          resolve(Buffer.concat(buffers));
+      try {
+        switch (buffers.length) {
+          case 0:
+            resolve(Buffer.allocUnsafe(0));
+            break;
+          case 1:
+            resolve(buffers[0]);
+            break;
+          default:
+            resolve(Buffer.concat(buffers));
+        }
+      } catch (concatErr) {
+        reject(concatErr);
       }
@@ -56,0 +60,0 @@ });

dist/index.d.ts

@@ -5,3 +5,3 @@ import FileBlob from './file-blob';
 import { Lambda, createLambda, getLambdaOptionsFromFunction, sanitizeConsumerName } from './lambda';
-import { NodejsLambda } from './nodejs-lambda';
+import { NodejsLambda, type NodejsLambdaOptions } from './nodejs-lambda';
 import { Prerender } from './prerender';
@@ -23,2 +23,3 @@ import download, { downloadFile, DownloadedFiles, isSymbolicLink, isDirectory } from './fs/download';
 import { validateNpmrc } from './validate-npmrc';
+export type { NodejsLambdaOptions };
 export { FileBlob, FileFsRef, FileRef, Lambda, NodejsLambda, createLambda, Prerender, download, downloadFile, DownloadedFiles, getWriteableDirectory, glob, GlobOptions, rename, spawnAsync, getScriptName, installDependencies, runPackageJsonScript, execCommand, spawnCommand, walkParentDirs, getNodeBinPath, getNodeBinPaths, getSupportedNodeVersion, isBunVersion, getSupportedBunVersion, detectPackageManager, runNpmInstall, NpmInstallOutput, runBundleInstall, runPipInstall, PipInstallResult, runShellScript, runCustomInstallCommand, resetCustomInstallCommandSet, getEnvForPackageManager, getNodeVersion, getPathForPackageManager, getLatestNodeVersion, getDiscontinuedNodeVersions, getSpawnOptions, getPlatformEnv, getPrefixedEnvVars, getServiceUrlEnvVars, streamToBuffer, streamToBufferChunks, debug, isSymbolicLink, isDirectory, getLambdaOptionsFromFunction, sanitizeConsumerName, scanParentDirs, findPackageJson, getIgnoreFilter, cloneEnv, hardLinkDir, traverseUpDirectories, validateNpmrc, };
@@ -25,0 +26,0 @@ export { EdgeFunction } from './edge-function';

dist/nodejs-lambda.d.ts

 import { Lambda, LambdaOptionsWithFiles } from './lambda';
-interface NodejsLambdaOptions extends LambdaOptionsWithFiles {
+export interface NodejsLambdaOptions extends LambdaOptionsWithFiles {
     shouldAddHelpers: boolean;
@@ -16,2 +16,1 @@ shouldAddSourcemapSupport: boolean;
 }
-export {};

dist/python.d.ts

@@ -11,1 +11,14 @@ import FileFsRef from './file-fs-ref';
 }): Promise<boolean>;
+/**
+ * For Django projects: read manage.py if present and return the value set for
+ * DJANGO_SETTINGS_MODULE (e.g. from os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'app.settings')).
+ * Returns null if manage.py is missing or the pattern is not found.
+ */
+export declare function getDjangoSettingsModule(workPath: string): Promise<string | null>;
+/**
+ * For Django projects: resolve the ASGI or WSGI application entrypoint by reading
+ * DJANGO_SETTINGS_MODULE from manage.py, loading that settings file, and
+ * returning the file path for ASGI_APPLICATION or WSGI_APPLICATION (e.g.
+ * 'myapp.asgi.application' -> 'myapp/asgi.py'). Returns null if any step fails.
+ */
+export declare function getDjangoEntrypoint(workPath: string): Promise<string | null>;

dist/python.js

@@ -31,2 +31,4 @@ "use strict";
 __export(python_exports, {
+  getDjangoEntrypoint: () => getDjangoEntrypoint,
+  getDjangoSettingsModule: () => getDjangoSettingsModule,
   isPythonEntrypoint: () => isPythonEntrypoint
@@ -36,2 +38,3 @@ });
 var import_fs = __toESM(require("fs"));
+var import_path = require("path");
 var import_python_analysis = require("@vercel/python-analysis");
@@ -51,5 +54,56 @@ var import_debug = __toESM(require("./debug"));
 }
+async function getDjangoSettingsModule(workPath) {
+  const managePath = (0, import_path.join)(workPath, "manage.py");
+  try {
+    const content = await import_fs.default.promises.readFile(managePath, "utf-8");
+    const value = await (0, import_python_analysis.parseDjangoSettingsModule)(content);
+    if (value) {
+      (0, import_debug.default)(`Django DJANGO_SETTINGS_MODULE from manage.py: ${value}`);
+      return value;
+    }
+  } catch {
+    (0, import_debug.default)("manage.py not found or unreadable, skipping Django settings module");
+  }
+  return null;
+}
+async function getDjangoEntrypoint(workPath) {
+  const settingsModule = await getDjangoSettingsModule(workPath);
+  if (!settingsModule)
+    return null;
+  const settingsPath = (0, import_path.join)(
+    workPath,
+    `${settingsModule.replace(/\./g, "/")}.py`
+  );
+  try {
+    const settingsContent = await import_fs.default.promises.readFile(settingsPath, "utf-8");
+    const asgiApplication = await (0, import_python_analysis.getStringConstant)(
+      settingsContent,
+      "ASGI_APPLICATION"
+    );
+    if (asgiApplication) {
+      const modulePath = asgiApplication.split(".").slice(0, -1).join("/");
+      const asgiPath = `${modulePath}.py`;
+      (0, import_debug.default)(`Django ASGI entrypoint from ${settingsModule}: ${asgiPath}`);
+      return asgiPath;
+    }
+    const wsgiApplication = await (0, import_python_analysis.getStringConstant)(
+      settingsContent,
+      "WSGI_APPLICATION"
+    );
+    if (wsgiApplication) {
+      const modulePath = wsgiApplication.split(".").slice(0, -1).join("/");
+      const wsgiPath = `${modulePath}.py`;
+      (0, import_debug.default)(`Django WSGI entrypoint from ${settingsModule}: ${wsgiPath}`);
+      return wsgiPath;
+    }
+  } catch {
+    (0, import_debug.default)(`Failed to read or parse settings file: ${settingsPath}`);
+  }
+  return null;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  getDjangoEntrypoint,
+  getDjangoSettingsModule,
   isPythonEntrypoint
 });

package.json

 {
   "name": "@vercel/build-utils",
-  "version": "13.5.0",
+  "version": "13.6.0",
   "license": "Apache-2.0",
@@ -14,3 +14,3 @@ "main": "./dist/index.js",
   "dependencies": {
-    "@vercel/python-analysis": "0.7.0"
+    "@vercel/python-analysis": "0.8.0"
   },
@@ -55,3 +55,3 @@ "devDependencies": {
     "@vercel/error-utils": "2.0.3",
-    "@vercel/routing-utils": "5.3.3"
+    "@vercel/routing-utils": "6.0.0"
   },
@@ -58,0 +58,0 @@ "scripts": {

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 11 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 3 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 11 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 3 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1413554

0.41%

Lines of code

32375

0.39%

Dependency changes

• + Added

  @vercel/python-analysis@0.8.0
  (transitive)

• - Removed

  @vercel/python-analysis@0.7.0
  (transitive)

• Updated

  @vercel/python-analysis@0.8.0