npmpackage.info

Gathering detailed insights and metrics for @vercel/nft

Other packages similar to @vercel/nft

@vercel/webpack-nft

0.0.14

@vercel/experimental-nft

0.0.4

Node.js module trace

@vercel/nft-next-plugin

0.0.13

## Installation

@vercel/experimental-nft-linux-x64

0.0.4

Node.js module trace

@vercel/nft

Node.js dependency tracing utility

0.29.0

1,379

MIT

JavaScript

323.43 kB

134,241,095 6

Installations

npm install @vercel/nft

Developer Guide

BETA

Typescript

Yes

Module System

CommonJS

Min. Node Version

>=18

Node Version

18.20.5

NPM Version

10.2.5 Pull Requests

Open

7

Total

336

Closed

27

Merged

302

Issues

Open

32

Total

116

Closed

84

Releases

100

0.29.0

Published on 02 Jan 2025

0.28.0

Published on 02 Jan 2025

0.27.10

Published on 19 Dec 2024

0.27.9

Published on 09 Dec 2024

0.27.8

Published on 09 Dec 2024

0.27.7

Published on 29 Nov 2024

View all 100 releases

Contributors

104

View all 104 contributors

Languages

JavaScript

TypeScript

CSS

JavaScript (89.78%)

TypeScript (10.21%)

Developer

vercel

Download Statistics

Total Downloads

134,241,095

Last Day

115,904

Last Week

786,125

Last Month

6,335,208

Last Year

74,243,449

GitHub Statistics

1,379 Stars

412 Commits

150 Forks

54 Watching

7 Branches

104 Contributors

Maintainers

Package Meta Information

Latest Version

0.29.0

Package Id

@vercel/nft@0.29.0

Unpacked Size

323.43 kB

Size

58.46 kB

File Count

NPM Version

10.2.5

Node Version

18.20.5

Publised On

02 Jan 2025

Total Downloads

Cumulative downloads

Total Downloads

134,241,095

Last day

-17.7%

115,904

Compared to previous day

Last week

-50.1%

786,125

Compared to previous week

Last month

-4.4%

6,335,208

Compared to previous month

Last year

93.7%

74,243,449

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

@mapbox/node-pre-gyp @rollup/pluginutils acorn acorn-import-attributes async-sema bindings estree-walker glob graceful-fs node-gyp-build picomatch resolve-from

Dev Dependencies

104

@azure/cosmos @bugsnag/js @datadog/pprof @ffmpeg-installer/ffmpeg @google-cloud/bigquery @google-cloud/firestore @opentelemetry/api @sentry/node @tpluscode/sparql-builder @types/bindings @types/estree @types/glob @types/graceful-fs @types/node @types/picomatch @vercel/git-hooks @vercel/style-guide analytics-node apollo-server-express argon2 auth0 axios azure-storage bcrypt browserify-middleware bull bullmq camaro chromeless consolidate copy cowsay es-get-iterator esbuild esm express fast-glob fetch-h2 firebase firebase-admin fluent-ffmpeg geo-tz geoip-lite graphql highlights hot-shots ioredis isomorphic-unfetch jest jimp jugglingdb koa leveldown lighthouse loopback mailgun mariadb memcached microtime mongoose mysql oracledb paraphrase passport passport-google-oauth passport-trakt path-platform pdf2json pdfkit pg phantomjs-prebuilt pixelmatch playwright-core polyfill-library prettier prismjs pug react react-dom redis remark-parse remark-prism rimraf rxjs saslprep semver sequelize serialport sharp shiki socket.io socket.io-client stripe swig tiny-json-http twilio typescript uglify-js unified vm2 vue vue-server-renderer when zeromq

Versions

Node File Trace

Used to determine exactly which files (including node_modules) are necessary for the application runtime.

This is similar to @vercel/ncc except there is no bundling performed and therefore no reliance on webpack. This achieves the same tree-shaking benefits without moving any assets or binaries.

Usage

Installation

1npm i @vercel/nft

Usage

Provide the list of source files as input:

1const { nodeFileTrace } = require('@vercel/nft');
2const files = ['./src/main.js', './src/second.js'];
3const { fileList } = await nodeFileTrace(files);

The list of files will include all node_modules modules and assets that may be needed by the application code.

Options

Base

The base path for the file list - all files will be provided as relative to this base.

By default the process.cwd() is used:

1const { fileList } = await nodeFileTrace(files, {
2  base: process.cwd(),
3});

Any files/folders above the base are ignored in the listing and analysis.

Process Cwd

When applying analysis certain functions rely on the process.cwd() value, such as path.resolve('./relative') or even a direct process.cwd() invocation.

Setting the processCwd option allows this analysis to be guided to the right path to ensure that assets are correctly detected.

1const { fileList } = await nodeFileTrace(files, {
2  processCwd: path.resolve(__dirname),
3});

By default processCwd is the same as base.

Exports & Imports

By default tracing of the Node.js "exports" and "imports" fields is supported, with the "node", "require", "import" and "default" conditions traced as defined.

Alternatively the explicit list of conditions can be provided:

1const { fileList } = await nodeFileTrace(files, {
2  conditions: ['node', 'production'],
3});

Only the "node" export should be explicitly included (if needed) when specifying the exact export condition list. The "require", "import" and "default" conditions will always be traced as defined, no matter what custom conditions are set.

Exports Only

When tracing exports the "main" / index field will still be traced for Node.js versions without "exports" support.

This can be disabled with the exportsOnly option:

1const { fileList } = await nodeFileTrace(files, {
2  exportsOnly: true,
3});

Any package with "exports" will then only have its exports traced, and the main will not be included at all. This can reduce the output size when targeting Node.js 12.17.0 or newer.

Paths

Status: Experimental. May change at any time.

Custom resolution path definitions to use.

1const { fileList } = await nodeFileTrace(files, {
2  paths: {
3    'utils/': '/path/to/utils/',
4  },
5});

Trailing slashes map directories, exact paths map exact only.

Hooks

The following FS functions can be hooked by passing them as options:

readFile(path): Promise<string>
stat(path): Promise<FS.Stats>
readlink(path): Promise<string>
resolve(id: string, parent: string): Promise<string | string[]>

Advanced Resolving

When providing a custom resolve hook you are responsible for returning one or more absolute paths to resolved files based on the id input. However it may be the case that you only want to augment or override the resolve behavior in certain cases. You can use nft's underlying resolver by importing it. The builtin resolve function expects additional arguments that need to be forwarded from the hook

resolve(id: string, parent: string, job: Job, isCjs: boolean): Promise<string | string[]>

Here is an example showing one id being resolved to a bespoke path while all other paths being resolved by the built-in resolver

1const { nodeFileTrace, resolve } = require('@vercel/nft');
2const files = ['./src/main.js', './src/second.js'];
3const { fileList } = await nodeFileTrace(files, {
4  resolve: async (id, parent, job, isCjs) => {
5    if (id === './src/main.js') {
6      return '/path/to/some/resolved/main/file.js';
7    } else {
8      return resolve(id, parent, job, isCjs);
9    }
10  },
11});

TypeScript

The internal resolution supports resolving .ts files in traces by default.

By its nature of integrating into existing build systems, the TypeScript compiler is not included in this project - rather the TypeScript transform layer requires separate integration into the readFile hook.

File IO Concurrency

In some large projects, the file tracing logic may process many files at the same time. In this case, if you do not limit the number of concurrent files IO, OOM problems are likely to occur.

We use a default of 1024 concurrency to balance performance and memory usage for fs operations. You can increase this value to a higher number for faster speed, but be aware of the memory issues if the concurrency is too high.

1const { fileList } = await nodeFileTrace(files, {
2  fileIOConcurrency: 2048,
3});

Analysis

Analysis options allow customizing how much analysis should be performed to exactly work out the dependency list.

By default as much analysis as possible is done to ensure no possibly needed files are left out of the trace.

To disable all analysis, set analysis: false. Alternatively, individual analysis options can be customized via:

1const { fileList } = await nodeFileTrace(files, {
2  // default
3  analysis: {
4    // whether to glob any analysis like __dirname + '/dir/' or require('x/' + y)
5    // that might output any file in a directory
6    emitGlobs: true,
7    // whether __filename and __dirname style
8    // expressions should be analyzed as file references
9    computeFileReferences: true,
10    // evaluate known bindings to assist with glob and file reference analysis
11    evaluatePureExpressions: true,
12  },
13});

Ignore

Custom ignores can be provided to skip file inclusion (and consequently analysis of the file for references in turn as well).

1const { fileList } = await nodeFileTrace(files, {
2  ignore: ['./node_modules/pkg/file.js'],
3});

Ignore will also accept a function or globs.

Note that the path provided to ignore is relative to base.

Cache

To persist the file cache between builds, pass an empty cache object:

1const cache = Object.create(null);
2const { fileList } = await nodeFileTrace(['index.ts'], { cache });
3// later:
4{
5  const { fileList } = await nodeFileTrace(['index.ts'], { cache });
6}

Note that cache invalidations are not supported so the assumption is that the file system is not changed between runs.

Reasons

To get the underlying reasons for individual files being included, a reasons object is also provided by the output:

1const { fileList, reasons } = await nodeFileTrace(files);

The reasons output will then be an object of the following form:

1{
2  [file: string]: {
3    type: 'dependency' | 'asset' | 'sharedlib',
4    ignored: true | false,
5    parents: string[]
6  }
7}

reasons also includes files that were ignored as ignored: true, with their ignoreReason.

Every file is included because it is referenced by another file. The parents list will contain the list of all files that caused this file to be included.

No vulnerabilities found.

10

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

10

Maintained

Determines if the project is "actively maintained".

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

License

Determines if the project has defined a license.

10

Security-Policy

Determines if the project has published a security policy.

10

Packaging

Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.

3

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Fuzzing

Determines if the project uses fuzzing.

0

SAST

Determines if the project uses static code analysis.

0

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

Reason

55 existing vulnerabilities detected

Details

Warn: Project is vulnerable to: GHSA-fpm5-vv97-jfwg
Warn: Project is vulnerable to: GHSA-wf5p-g6vw-rhxx
Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7
Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
Warn: Project is vulnerable to: GHSA-gp2j-mg4w-2rh5
Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
Warn: Project is vulnerable to: GHSA-gxpj-cx7g-858c
Warn: Project is vulnerable to: GHSA-wm7h-9275-46v2
Warn: Project is vulnerable to: GHSA-phwq-j96m-2c2q
Warn: Project is vulnerable to: GHSA-ghr5-ch3p-vcr6
Warn: Project is vulnerable to: GHSA-4gmj-3p3h-gm8h
Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx
Warn: Project is vulnerable to: GHSA-mpg4-rc92-vx8v
Warn: Project is vulnerable to: GHSA-3wf4-68gx-mph8
Warn: Project is vulnerable to: GHSA-pfrx-2q88-qq97
Warn: Project is vulnerable to: GHSA-rc47-6667-2j5j
Warn: Project is vulnerable to: GHSA-w7q9-p3jq-fmhm
Warn: Project is vulnerable to: GHSA-xvf7-4v9q-58w6
Warn: Project is vulnerable to: GHSA-wgfq-7857-4jcc
Warn: Project is vulnerable to: GHSA-p6mc-m468-83gw
Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
Warn: Project is vulnerable to: GHSA-vh95-rmgr-6w4m / GHSA-xvch-5gv4-984h
Warn: Project is vulnerable to: GHSA-m7xq-9374-9rvx
Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55
Warn: Project is vulnerable to: GHSA-r683-j2x4-v87g
Warn: Project is vulnerable to: GHSA-5rrq-pxf6-6jx5
Warn: Project is vulnerable to: GHSA-8fr3-hfg3-gpgp
Warn: Project is vulnerable to: GHSA-gf8q-jrpm-jvxq
Warn: Project is vulnerable to: GHSA-2r2c-g63r-vccr
Warn: Project is vulnerable to: GHSA-cfm4-qjh2-4765
Warn: Project is vulnerable to: GHSA-x4jg-mjrx-434g
Warn: Project is vulnerable to: GHSA-9h6g-pr28-7cqp
Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w
Warn: Project is vulnerable to: GHSA-3965-hpx2-q597
Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg
Warn: Project is vulnerable to: GHSA-cm22-4g7w-348p
Warn: Project is vulnerable to: GHSA-25hc-qcg6-38wj
Warn: Project is vulnerable to: GHSA-2rq5-699j-x7p6
Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
Warn: Project is vulnerable to: GHSA-c9f4-xj24-8jqx
Warn: Project is vulnerable to: GHSA-cf4h-3jhx-xvhq
Warn: Project is vulnerable to: GHSA-cchq-frgv-rjh5
Warn: Project is vulnerable to: GHSA-g644-9gfx-q4q4
Warn: Project is vulnerable to: GHSA-5j4c-8p2g-v4jx
Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
Warn: Project is vulnerable to: GHSA-776f-qx25-q3cc
Warn: Project is vulnerable to: GHSA-h6q6-9hqw-rwfv
Warn: Project is vulnerable to: GHSA-5fg8-2547-mr8q
Warn: Project is vulnerable to: GHSA-crh6-fp67-6883
Warn: Project is vulnerable to: GHSA-p9pc-299p-vxgp

Score

6

/10

Last Scanned on 2025-01-06

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More