@vercel/build-utils - npm Package Compare versions

Comparing version 9.3.0 to 9.3.1

CHANGELOG.md

 # @vercel/build-utils
 
+## 9.3.1
+
+### Patch Changes
+
+- [build-utils] extract install command specific logic into helper ([#13049](https://github.com/vercel/vercel/pull/13049))
+
+- [build-utils] remove dead node 16 check ([#13047](https://github.com/vercel/vercel/pull/13047))
+
 ## 9.3.0
@@ -4,0 +12,0 @@

dist/fs/run-user-scripts.js

@@ -426,2 +426,41 @@ "use strict";
 }
+async function runInstallCommand({
+  packageManager,
+  args,
+  opts
+}) {
+  const getInstallCommandForPackageManager = (packageManager2, args2) => {
+    switch (packageManager2) {
+      case "npm":
+        return {
+          prettyCommand: "npm install",
+          commandArguments: args2.filter((a) => a !== "--prefer-offline").concat(["install", "--no-audit", "--unsafe-perm"])
+        };
+      case "pnpm":
+        return {
+          prettyCommand: "pnpm install",
+          // PNPM's install command is similar to NPM's but without the audit nonsense
+          // @see options https://pnpm.io/cli/install
+          commandArguments: args2.filter((a) => a !== "--prefer-offline").concat(["install", "--unsafe-perm"])
+        };
+      case "bun":
+        return {
+          prettyCommand: "bun install",
+          // @see options https://bun.sh/docs/cli/install
+          commandArguments: ["install", ...args2]
+        };
+      case "yarn":
+        return {
+          prettyCommand: "yarn install",
+          commandArguments: ["install", ...args2]
+        };
+    }
+  };
+  const { commandArguments, prettyCommand } = getInstallCommandForPackageManager(packageManager, args);
+  opts.prettyCommand = prettyCommand;
+  if (process.env.NPM_ONLY_PRODUCTION) {
+    commandArguments.push("--production");
+  }
+  await spawnAsync(packageManager, commandArguments, opts);
+}
 async function runNpmInstall(destPath, args = [], spawnOpts, meta, nodeVersion) {
@@ -477,41 +516,7 @@ if (meta?.isDev) {
     });
-    let commandArgs;
-    const isPotentiallyBrokenNpm = cliType === "npm" && (nodeVersion?.major === 16 || opts.env.PATH?.includes("/node16/bin-npm7")) && !args.includes("--legacy-peer-deps") && spawnOpts?.env?.ENABLE_EXPERIMENTAL_COREPACK !== "1";
-    if (cliType === "npm") {
-      opts.prettyCommand = "npm install";
-      commandArgs = args.filter((a) => a !== "--prefer-offline").concat(["install", "--no-audit", "--unsafe-perm"]);
-      if (isPotentiallyBrokenNpm && spawnOpts?.env?.VERCEL_NPM_LEGACY_PEER_DEPS === "1") {
-        commandArgs.push("--legacy-peer-deps");
-      }
-    } else if (cliType === "pnpm") {
-      opts.prettyCommand = "pnpm install";
-      commandArgs = args.filter((a) => a !== "--prefer-offline").concat(["install", "--unsafe-perm"]);
-    } else if (cliType === "bun") {
-      opts.prettyCommand = "bun install";
-      commandArgs = ["install", ...args];
-    } else {
-      opts.prettyCommand = "yarn install";
-      commandArgs = ["install", ...args];
-    }
-    if (process.env.NPM_ONLY_PRODUCTION) {
-      commandArgs.push("--production");
-    }
-    try {
-      await spawnAsync(cliType, commandArgs, opts);
-    } catch (err) {
-      const potentialErrorPath = import_path.default.join(
-        process.env.HOME || "/",
-        ".npm",
-        "eresolve-report.txt"
-      );
-      if (isPotentiallyBrokenNpm && !commandArgs.includes("--legacy-peer-deps") && import_fs_extra.default.existsSync(potentialErrorPath)) {
-        console.warn(
-          'Warning: Retrying "Install Command" with `--legacy-peer-deps` which may accept a potentially broken dependency and slow install time.'
-        );
-        commandArgs.push("--legacy-peer-deps");
-        await spawnAsync(cliType, commandArgs, opts);
-      } else {
-        throw err;
-      }
-    }
+    await runInstallCommand({
+      packageManager: cliType,
+      args,
+      opts
+    });
     (0, import_debug.default)(`Install complete [${Date.now() - installTime}ms]`);
@@ -518,0 +523,0 @@ return true;

package.json

 {
   "name": "@vercel/build-utils",
-  "version": "9.3.0",
+  "version": "9.3.1",
   "license": "Apache-2.0",
@@ -5,0 +5,0 @@ "main": "./dist/index.js",

Fixed alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Improved metrics

Lines of code

29976

increased by0.03%

Number of low supply chain risk alerts

26

decreased by-3.7%

Worsened metrics

Total package byte prevSize

1313476

decreased by-0.03%

No dependency changes