Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
serverless-esbuild
Advanced tools
Serverless plugin for zero-config JavaScript and TypeScript code bundling using extremely fast esbuild
The serverless-esbuild npm package is a Serverless Framework plugin that allows you to use esbuild to bundle your JavaScript and TypeScript code. It is designed to optimize the deployment of serverless functions by providing fast and efficient builds.
Bundling JavaScript
This configuration demonstrates how to bundle a simple JavaScript function using esbuild. The 'bundle' option is set to true to enable bundling, and other options like 'minify', 'sourcemap', and 'target' are configured to optimize the build.
module.exports = {
service: 'my-service',
frameworkVersion: '2',
plugins: ['serverless-esbuild'],
provider: {
name: 'aws',
runtime: 'nodejs14.x'
},
functions: {
hello: {
handler: 'handler.hello'
}
},
custom: {
esbuild: {
bundle: true,
minify: false,
sourcemap: true,
target: 'node14',
platform: 'node',
external: ['aws-sdk']
}
}
};
Transpiling TypeScript
This configuration shows how to use esbuild to transpile TypeScript code. The 'tsconfig' option points to the TypeScript configuration file, enabling TypeScript support in the build process.
module.exports = {
service: 'my-service',
frameworkVersion: '2',
plugins: ['serverless-esbuild'],
provider: {
name: 'aws',
runtime: 'nodejs14.x'
},
functions: {
hello: {
handler: 'handler.hello'
}
},
custom: {
esbuild: {
bundle: true,
minify: false,
sourcemap: true,
target: 'node14',
platform: 'node',
external: ['aws-sdk'],
tsconfig: 'tsconfig.json'
}
}
};
Including External Dependencies
This configuration demonstrates how to include external dependencies in the build process. The 'external' option specifies dependencies that should not be bundled, and the 'packager' option specifies the package manager to use.
module.exports = {
service: 'my-service',
frameworkVersion: '2',
plugins: ['serverless-esbuild'],
provider: {
name: 'aws',
runtime: 'nodejs14.x'
},
functions: {
hello: {
handler: 'handler.hello'
}
},
custom: {
esbuild: {
bundle: true,
minify: false,
sourcemap: true,
target: 'node14',
platform: 'node',
external: ['aws-sdk'],
packager: 'yarn'
}
}
};
The serverless-webpack plugin integrates Webpack into the Serverless Framework. It allows for bundling, minification, and transpilation of JavaScript and TypeScript code. Compared to serverless-esbuild, serverless-webpack offers more extensive configuration options but may have slower build times.
The serverless-bundle plugin is a zero-config plugin that uses Webpack and Babel to bundle your Serverless functions. It simplifies the setup process by providing sensible defaults. While it is easier to use, it may not offer the same level of customization as serverless-esbuild.
The serverless-plugin-typescript plugin adds TypeScript support to the Serverless Framework. It compiles TypeScript to JavaScript before deployment. Unlike serverless-esbuild, it does not bundle the code, which may result in larger deployment packages.
Serverless Framework plugin for zero-config JavaScript and TypeScript code bundling using promising fast & furious esbuild
bundler and minifier
sls package
, sls deploy
, sls deploy function
Serverless Invoke Local
& serverless-offline
# install `serverless-esbuild` and `esbuild`
yarn add --dev serverless-esbuild esbuild
# or
npm install -D serverless-esbuild esbuild
# or
pnpm install -D serverless-esbuild esbuild
Add the following plugin to your serverless.yml
:
plugins:
- serverless-esbuild
By default, no configuration is required, but you can override the default behavior via the custom.esbuild
section in the serverless.yml
file.
custom:
esbuild:
bundle: true
minify: false
See example folder for some example configurations.
Option | Description | Default |
---|---|---|
Esbuild Options | This plugin can take almost any Esbuild Javascript Build Option. | Default Esbuild Options |
concurrency | The number of concurrent bundle operations to run at once. eg. 8 . NOTE: This can be memory intensive and could produce slower builds. | Infinity |
zipConcurrency | The number of concurrent zip operations to run at once. eg. 8 . NOTE: This can be memory intensive and could produce slower builds. | Infinity |
exclude | An array of dependencies to exclude from the Lambda. This is passed to the esbuild external option. Set to * to disable packaging node_modules | ['aws-sdk'] |
installExtraArgs | Optional arguments passed to npm or yarn for external dependency resolution. eg. ['--legacy-peer-deps'] for npm v7+ to use legacy peerDependency resolution behavior | [] |
keepOutputDirectory | Keeps the .esbuild output folder. Useful for debugging. | false |
nativeZip | Uses the system's zip executable to create archives. NOTE: This will produce non-deterministic archives which causes a Serverless deployment update on every deploy. | false |
outputBuildFolder | The output folder for Esbuild builds within the work folder. You will also need to manually override the watch ignore config if used. | '.build' |
outputWorkFolder | The output folder for this plugin where all the bundle preparation is done. You will also need to manually override the watch ignore config if used. | '.esbuild' |
outputFileExtension | The file extension used for the bundled output file. This will override the esbuild outExtension option | '.js' |
packagePath | Path to the package.json file for external dependency resolution. | './package.json' |
packager | Packager to use for external dependency resolution. Values: npm , yarn , pnpm | 'npm' |
packagerOptions | Extra options for packagers for external dependency resolution. | Packager Options |
watch | Watch options for serverless-offline . | Watch Options |
skipBuild | Avoid rebuilding lambda artifacts in favor of reusing previous build artifacts. | false |
skipRebuild | A boolean defining whether rebuild is avoided. Generally rebuild produces faster builds but in some context scenarios with many lambdas or low memory computer (like Github Actions) it can cause memory leaks. | false |
skipBuildExcludeFns | An array of lambda names that will always be rebuilt if skipBuild is set to true and bundling individually. This is helpful for dynamically generated functions like serverless-plugin-warmup. | [] |
stripEntryResolveExtensions | A boolean that determines if entrypoints using custom file extensions provided in the resolveExtensions ESbuild setting should be stripped of their custom extension upon packing the final bundle for that file. Example: myLambda.custom.ts would result in myLambda.js instead of myLambda.custom.js . | |
disposeContext | An option to disable the disposal of the context.(Functions can override the global disposeContext configuration by specifying their own disposeContext option in their individual configurations.) | true |
The following esbuild
options are automatically set.
Option | Default | Notes |
---|---|---|
bundle | true | Esbuild requires this for use with external |
entryPoints | N/A | Cannot be overridden |
outDir | N/A | Cannot be overridden |
platform | 'node' | Set format to esm to enable ESM support |
target | 'node18' | We dynamically set this. See Supported Runtimes |
watch | N/A | Cannot be overridden |
Option | Description | Default |
---|---|---|
scripts | A string or array of scripts to be executed, currently only supports 'scripts' for npm, pnpm and yarn | undefined |
noInstall | [Yarn only] A boolean that deactivates the install step | false |
ignoreLockfile | [Yarn only] A boolean to bypass lockfile validation, typically paired with external dependencies because we generate a new package.json with only the externalized dependencies. | false |
Option | Description | Default |
---|---|---|
pattern | An anymatch-compatible definition for the watcher to respond to | ./**/*.(js|ts) (watches all .js and .ts files) |
ignore | An anymatch-compatible definition for the watcher to ignore | ['.esbuild', 'dist', 'node_modules', '.build'] |
chokidar | Any Chokidar option | { ignoreInitial: true } |
Option | Description | Default |
---|---|---|
skipEsbuild | Set this property to true on a function definition to skip esbuild | undefined |
This plugin will automatically set the esbuild target
for the following supported Serverless runtimes:
Runtime | Target |
---|---|
nodejs20.x | node20 |
nodejs18.x | node18 |
nodejs16.x | node16 |
nodejs14.x | node14 |
nodejs12.x | node12 |
This plugin is compatible with the serverless-google-cloudfunctions plugin, and will set the runtimes accordingly.
Runtime | Target |
---|---|
nodejs20 | node20 |
nodejs18 | node18 |
nodejs16 | node16 |
nodejs14 | node14 |
nodejs12 | node12 |
This plugin is compatible with the serverless-azure-functions plugin, and will set the runtimes accordingly.
Runtime | Target |
---|---|
nodejs18 | node18 |
nodejs16 | node16 |
nodejs14 | node14 |
nodejs12 | node12 |
Please Note When using this package in conjunction with the serverless-azure-functions
plugin, the following additional configuration is required to ensure function apps are built correctly:
package:
patterns: ["host.json", "**/function.json"],
If you wish to use this plugin alongside non Node functions like Python or functions with images, this plugin will automatically ignore any function which does not contain a handler or use a supported Node.js runtime.
Note: If you are using Python functions with Serverless Offline you will need to change the outputWorkFolder
and outputBuildFolder
to folder names without fullstops.
Esbuild configuration can be defined by a config file.
custom:
esbuild:
config: './esbuild.config.js'
// esbuild.config.js
module.exports = (serverless) => ({
external: ['lodash'],
plugins: [],
});
Serverless Package Configuration will behave in the same way as native packaging. You can use patterns
, include
and exclude
to include extra files into your bundles.
Packages that are marked as external
and exist in the package.json's dependencies
will be installed and included with your build under node_modules
. You can customize this with a number of options.
custom:
esbuild:
external:
- lodash
packager: yarn
packagePath: absolute/path/to/package.json
packagerOptions:
scripts:
- echo 'Hello World!'
- rm -rf node_modules
installExtraArgs:
- '--legacy-peer-deps'
To easily mark all the dependencies
in package.json
as external
, you can utilize esbuild-node-externals
plugin.
To mark one or more individual packages as external, use the following configuration:
custom:
esbuild:
external:
- 'my-package-name'
- 'another-package-name'
Note: The Esbuild plugins API is still experimental
You can configure esbuild plugins by passing a plugins' configuration file:
custom:
esbuild:
plugins: plugins.js
The plugins' configuration file must be a javascript file exporting an array of plugins (see examples/individually/plugins.js
for a dummy plugin example):
let myPlugin = {
name: 'my-plugin',
setup(build) {
// plugin implementation
},
};
// default export should be an array of plugins
module.exports = [myPlugin];
or a function that accepts serverless
instance and returns an array of plugins (see issue #168 for an example):
module.exports = (serverless) => {
const myPlugin = {
name: 'my-plugin',
setup(build) {
// plugin implementation with `serverless` instance access
console.log('sls custom options', serverless.service.custom);
},
};
// an array of plugins must be returned
return [myPlugin];
};
As long as the plugin is properly installed, all regular Serverless operations sls package
, sls deploy
, sls deploy function
, sls invoke local
, sls offline
will automatically compile using serverless-esbuild
.
You can specify a custom entrypoint for ESBuild by specifying the esbuildEntrypoint
field in your function definition.
export const myLambdaFunction = {
handler: '/opt/nodejs/node_modules/my_custom_extension/handler.handler',
esbuildEntrypoint: './handler.main',
};
The plugin integrates very well with serverless-offline to simulate AWS Lambda and AWS API Gateway locally.
Add the plugins to your serverless.yml
file and make sure that serverless-esbuild
precedes serverless-offline
as the order is important:
plugins: ...
- serverless-esbuild
...
- serverless-offline
...
Run serverless offline
or serverless offline start
to start the Lambda/API simulation.
In comparison to serverless offline
, the start
command will fire an init
and a end
lifecycle hook which is needed for serverless-offline
and e.g. serverless-dynamodb-local
to switch off resources (see below)
Automatic compilation is available while using the plugin with serverless-offline
.
custom:
esbuild:
watch:
pattern: ['src/**/*.ts'] # match only typescript files in src directory
ignore: ['temp/**/*']
Note: When overriding the ignore pattern, remember to ignore .build
directory to avoid endless compilation.
Configure your service the same as mentioned above, but additionally add the serverless-dynamodb-local
plugin as follows:
plugins:
- serverless-esbuild
- serverless-dynamodb-local
- serverless-offline
Run serverless offline start
.
This plugin supports the Serverless Invoke Local functionality and will automatically compile the selected function.
serverless-analyze-bundle-plugin
: a plugin that allow users to analyze the bundle of a lambdaInspired by serverless-plugin-typescript and serverless-webpack
FAQs
Serverless plugin for zero-config JavaScript and TypeScript code bundling using extremely fast esbuild
The npm package serverless-esbuild receives a total of 210,244 weekly downloads. As such, serverless-esbuild popularity was classified as popular.
We found that serverless-esbuild demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.