
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
serverless-graalvm-plugin
Advanced tools
### Description Compiles jars into native packages with GraalVM Native Image reducing cold start and improving overall performance. It relies on locally installed native-image or falls back to using a docker image to do so.
Compiles jars into native packages with GraalVM Native Image reducing cold start and improving overall performance. It relies on locally installed native-image or falls back to using a docker image to do so.
This plugins requires either docker to be installed or native-image and zip
Run
yarn add --dev serverless-graalvm-plugin
or
npm i --save-dev serverless-graalvm-plugin
In order for the plugin to work you need to create runtime-related classes that will serve as a main class for your jars.
Create a runtime class for each of your lambdas. There's an example of such classes in the test project
You will need to modify your build process to generate a runnable jar for each of the lambda functions in your project. Make sure you make the runtime class a main class in your jar and jar is runnable.
There's an example of a gradle build configuration in the test project.
Modify handler and runtime of your lambda functions:
hello-direct:
runtime: provided
handler: not.used
Point package.artifact property to your built jar:
hello-direct:
runtime: provided
handler: not.used
package:
artifact: build/libs/direct-invocation.jar
reflect.json fileCreate a reflect.json file in the root of your project which will act as a reflection configuration file for the GraalVM.
Read more on reflection here
For most of the cases you just need to add your request and response classes there.
resource-config.json fileTo pass resource configuration to the native-image command create a resource-config.json file in the root of your project.
Read more on the resources with GraalVM here.
Sometimes the docker container might crash with out of memory error. Try to increase memory for the container, 4 gb should be enough.
With some CI providers like CircleCI it's hard to make docker commands work inside the build environment.
You might want to install native-image or use a docker image based on oracle/graalvm-ce instead.
By default, there are some errors if you're trying to send https requests from compiled native image. This is fixed inside a docker container that is used by this docker plugin.
If you're not running a docker container the workaround is to modify your local java.security
file that is located in the $JAVA_HOME/jre/lib/security/ directory. You need to remove the SunEC from the providers section.
FAQs
### Description Compiles jars into native packages with GraalVM Native Image reducing cold start and improving overall performance. It relies on locally installed native-image or falls back to using a docker image to do so.
We found that serverless-graalvm-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.