feat(app-tools): support deploy.traceOptions for dependency tracing - #8811
Open
scplay wants to merge 1 commit into
Open
feat(app-tools): support deploy.traceOptions for dependency tracing#8811scplay wants to merge 1 commit into
scplay wants to merge 1 commit into
Conversation
Forward a user-configurable `deploy.traceOptions` to ndepe -> @vercel/nft when tracing server-side dependencies. Tracing runs with the filesystem root as its base, so static analysis of __dirname-based patterns in the server bundle can reach unrelated system directories and abort the build when they are unreadable: EACCES: permission denied, open '/etc/sudoers' There was previously no way to influence tracing from user config, since no deploy preset forwarded ndepe's traceOptions passthrough. Applied to the node, vercel and netlify presets. No defaults are added, so behavior is unchanged when the option is omitted. Refs web-infra-dev#8779
🦋 Changeset detectedLatest commit: ae5ce59 The changes in this PR will be included in the next version bump. This PR includes changesets to release 119 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
✅ Deploy Preview for modernjs-byted ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Forward a user-configurable
deploy.traceOptionsto ndepe -> @vercel/nft when tracing server-side dependencies.Tracing runs with the filesystem root as its base, so static analysis of __dirname-based patterns in the server bundle can reach unrelated system directories and abort the build when they are unreadable:
EACCES: permission denied, open '/etc/sudoers'
There was previously no way to influence tracing from user config, since no deploy preset forwarded ndepe's traceOptions passthrough.
Applied to the node, vercel and netlify presets. No defaults are added, so behavior is unchanged when the option is omitted.
Refs #8779
Summary
Forward a user-configurable
deploy.traceOptionstondepe→@vercel/nftwhen tracing server-side dependencies.
Tracing runs with the filesystem root as its base, so static analysis of
__dirname-based patterns in the server bundle can reach unrelated systemdirectories and abort the build when they are unreadable:
EACCES: permission denied, open '/etc/sudoers'
In my case
@sentry/node-core's Context integration does areaddir('/etc')todetect the Linux distribution, which is enough to pull
/etc/*into the trace.On Linux CI with stale symlinks the same root cause surfaces as
ENOENT: stat '/etc/alternatives/which.sl1.gz'..output/staticis producedcorrectly — only the tracing step fails, so
node_modulesis never emitted into.output.There was previously no way to influence tracing from user config, since no
deploy preset forwarded
ndepe'straceOptionspassthrough. The onlyworkarounds were patching
ndepeor vendoring the deploy plugin.Applied to the
node,vercelandnetlifypresets. No defaults are added, sobehavior is unchanged when the option is omitted.
Usage
ignore patterns resolve against nft's base (/), so etc/** matches /etc/sudoers. nft evaluates ignoreFn before globbing in emitAssetDirectory, so ignored directories are never walked.
Why not traceRoot
A deploy.traceRoot option was suggested in #8779, passed to nft as the tracing base. I prototyped it and it does not work as a passthrough: base in ndepe is not only nft's tracing root but also the root that ndepe resolves nft's results against, and it is hardcoded to "/". nft returns paths relative to base, so narrowing it makes resolveTracedPath("/", "global/my-app/...") produce /global/my-app/... and the trace dies one step later with ENOENT: lstat '/global'. Making traceRoot work requires threading one root through nodeFileTrace, resolveTracedPath and the isSubPath checks, and reconciling it with the separate dependencySearchRoot in the same function — a change to ndepe's path semantics, not an app-tools passthrough.
Why no built-in ignore defaults
Shipping a default system-directory list would fix this with zero config, but those paths are platform-specific (/etc vs /private/etc on macOS, /proc and /sys on Linux, arbitrary mount points in containers), so any built-in list is both incomplete and a silent policy decision made for the user. For the record, ignoring them loses nothing: with base: '/' and no ignore, 228 files under /etc enter nft's fileList, but zero can be attributed by ndepe to an npm package, so none were ever emitted.
Related Links
Refs #8779
Related: vercel/nft#601
Checklist
pnpm run change.