Commit activity
Last 12 weeks · 1 commit
Community health
3 of 6 standards met
Recent PRs & issues
[!NOTE] This issue was investigated and written with the help of an AI assistant. I checked the reproduction below locally against . Downstream report: https://github.com/unjs/nf3/issues/44 (Playwright/Chromium files) Problem throws and the whole trace fails when an emitted asset is (or symlinks to) a Unix domain socket. Directory asset emission (e.g. ) globs with , so sockets, FIFOs and similar files are still collected. In , assets with no file extension () are passed to to be analyzed as code. calls and then without checking . only ignores and . Opening a socket fails with on Linux and (EOPNOTSUPP) on macOS, so the error escapes and the trace fails. A custom that returns for non-regular files doesn't help either: then throws Module resolution already checks , so a wildcard over the same directory works fine. Only the extensionless asset path is affected. Minimal reproduction (Linux; macOS fails the same way with error -102) Actual: Expected: the trace finishes. Non-regular files are either skipped or emitted as plain assets, but nft doesn't try to read and analyze them. Possible fix In 's asset loop, only treat an extensionless asset as a dependency when ; otherwise emit it as an asset or skip it. Optionally, make (or ) skip non-regular files instead of throwing.
builds a fresh object on every call and copies every global and known top-level binding into it. It runs for most call expressions and variable declarations, so analysis costs calls × bindings. That grows with the square of the file size. Large bundled files, such as a server build that inlines its dependencies, pay the most. only reads by name. This PR passes a that looks each name up in and when it is read, in the same order as before: , then known bindings (shadowed ones still resolve to ), then globals. changes only in the walker, and the walker awaits each call, so a lookup sees the same state as the old copy. Benchmark.** A synthetic file with N top-level constants, each used once (Node 26, script below): On a real 17 MB bundled server file, analysis dropped from 10.2s to 1.4s. On a real app with 5,707 traced files, the traced file list was identical before and after. Benchmark script ``jestmainmainleveldownsharp-pnpmasset-fs-extra` from cwd and from root. 🤖 Generated with Claude Code
Fixes #445. On Windows, resolving an ignore pattern such as produces . Picomatch interprets the backslash in the pattern as an escape, so matching dependencies remain in the trace. Convert resolved patterns and candidate paths to forward slashes only at the glob-matching boundary. The existing outside-base check, callback arguments and returned file paths retain their native-path behavior. Add seven filesystem-based tracing cases for string/array globs, native and absolute patterns, exact paths, callback inputs and entry-point retention. Four of the cases fail on the original Windows implementation and pass with this change. This does not overlap #610's package-resolution changes. Validation: TypeScript build and repository-wide Prettier check pass. Windows Node 24.19.0: the new tests plus the filesystem-concurrency test pass (8 tests). Linux Node 26.7.0: the same 8 tests pass. Windows existing unit/CLI tests plus these tests: 164 pass, 2 fail. Both failures ( and ) also fail with the original source in this checkout, whose is false. They are not introduced by this change. Dependencies were installed from the frozen lockfile with the repository-pinned pnpm 10.33.0 and install scripts disabled. The external-service integration suite was not run. Prepared with Codex assistance; the before/after tests were run locally.
Recent fixes
, and describe the machine running the trace, not the deployment target. Because the static module exposes the real implementations, code like becomes (or the build user's home). With this pulls unrelated files into the trace or throws on unreadable entries ( on macOS). This may also explain some of the extra wildcard scans discussed in #545 (e.g. packages that extract into ), though I have not verified that case. This PR makes these three calls unknown to the static evaluator, so no asset directory is emitted for them. Other members (, , ...) are unchanged. Test:** new unit fixture . Without the fix the "from root" variant globs the temp directory and times out; with it, only the input file is traced. The full unit suite passes locally (Node 26, macOS). Integration tests were not run locally. 🤖 Generated with Claude Code
Repository: vercel/nft. Description: Node.js dependency tracing utility Stars: 1678, Forks: 188. Primary language: JavaScript. Languages: JavaScript (89.1%), TypeScript (10.9%), CSS (0%). License: MIT. Homepage: https://npmjs.com/@vercel/nft Topics: static-analysis. Latest release: 1.11.0 (2mo ago). Open PRs: 19, open issues: 45. Last activity: 2mo ago. Community health: 75%. Top contributors: styfle, dependabot[bot], guybedford, ijjk, thomashohn, jeffsee55, benmccann, Copilot, Timer, lucleray and others.