@vercel/ruby - npm Package Compare versions

Comparing version 2.2.1 to 2.2.2

vc_init_dev.rb

+"""
+Auto-generated template used by vercel dev (Ruby, Rack)
+Serves static files from PUBLIC_DIR before delegating to the user Rack app.
+
+This file is written to the project at .vercel/ruby/vc_init_dev.rb
+and executed by the dev server launcher.
+"""
+
+require 'rack'
+require 'rack/handler/webrick'
+require 'webrick'
+require 'socket'
+
+$stdout.sync = true
+$stderr.sync = true
+
+USER_ENTRYPOINT = "__VC_DEV_ENTRYPOINT__"
+PUBLIC_DIR = 'public'
+
+def build_user_app
+  if USER_ENTRYPOINT.end_with?('.ru')
+    app, _ = Rack::Builder.parse_file(USER_ENTRYPOINT)
+    app
+  else
+    # For dev we only support Rack entrypoints (.ru) to ensure consistent behavior
+    abort("Unsupported entrypoint: #{USER_ENTRYPOINT}. Please use a Rack config (.ru) file for vercel dev.")
+  end
+end
+
+class StaticThenApp
+  def initialize(app, public_dir)
+    @app = app
+    @public_dir = public_dir
+    @file_server = Rack::File.new(public_dir)
+    @base = File.expand_path(public_dir)
+  end
+
+  def call(env)
+    req_path = env['PATH_INFO'] || '/'
+    # Normalize path and guard against traversal
+    safe = req_path.sub(/^\//, '')
+    full = File.expand_path(safe, @base)
+
+    if full.start_with?(@base + File::SEPARATOR) && File.file?(full)
+      # Delegate to Rack::File which handles HEAD/GET correctly
+      return @file_server.call(env)
+    end
+
+    @app.call(env)
+  end
+end
+
+def static_then_app(user_app)
+  StaticThenApp.new(user_app, PUBLIC_DIR)
+end
+
+host = '127.0.0.1'
+begin
+  sock = TCPServer.new(host, 0)
+  port = sock.addr[1]
+ensure
+  sock&.close
+end
+
+app = static_then_app(build_user_app)
+
+logger = WEBrick::Log.new($stderr)
+logger.level = WEBrick::Log::WARN
+server = WEBrick::HTTPServer.new(
+  BindAddress: host,
+  Port: port,
+  AccessLog: [],
+  Logger: logger
+)
+
+# Mount the Rack app at root
+server.mount '/', Rack::Handler::WEBrick, app
+
+trap('INT') { server.shutdown }
+trap('TERM') { server.shutdown }
+
+puts "Serving on http://#{host}:#{server.config[:Port]}"
+server.start

package.json

 {
   "name": "@vercel/ruby",
   "author": "Nathan Cahill <[e-mail]>",
-  "version": "2.2.1",
+  "version": "2.2.2",
   "license": "Apache-2.0",
@@ -10,3 +10,4 @@ "main": "./dist/index",
     "dist",
-    "vc_init.rb"
+    "vc_init.rb",
+    "vc_init_dev.rb"
   ],
@@ -22,3 +23,3 @@ "repository": {
     "@types/which": "3.0.0",
-    "@vercel/build-utils": "10.6.7",
+    "@vercel/build-utils": "13.0.1",
     "execa": "2.0.4",
@@ -25,0 +26,0 @@ "fs-extra": "^7.0.1",

New alerts

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 9 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Fixed alerts

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 9 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

272203

6.23%

Number of package files

5

25%

Lines of code

7732

6.8%

Worsened metrics

Number of low supply chain risk alerts

60

7.14%

Number of medium supply chain risk alerts

4

100%

No dependency changes