![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4&s=144)
Commit activity
Last 12 weeks · 3 commits
Community health
2 of 6 standards met
62
✓README✓License○Contributing○Code of Conduct○Issue Template○PR Template
Recent PRs & issues
Active · 7 in progress · Last activity 1mo ago
See all on GitHub →
Related #130 #133 This PR replaces with to reduce the dependency count and package size. Hopefully also reduces security dependency churn, as the scope of is _significantly_ smaller to cover. _Ref: https://npmgraph.js.org/?q=%40vercel%2Ffun#select=tar%407.5.7_ I also removed the workaround added in #138 because handles that safely without workaround. did make the change to address a security vulnerability, but their solution was a bit too broad and affected valid cases like this. We do have the same coverage but are more granular allowing valid resolved symlinks if they are still within the extraction root.
Summary hard-pins an exact, deprecated version of , and the pin is still present in the latest release (). Because it's an exact pin (no range), downstream consumers — including the CLI — can't pick up the fixed transitively even after updating everything. Where (and ) : Why it matters is deprecated on npm — the maintainer's notice reads: "Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version." The current release is . Recent node-tar advisories in the 7.x line (2025–2026) include, among others: GHSA-r6q2-hw4h-h46w — race condition on macOS APFS (High, 8.8) GHSA-9ppj-qmqm-q256 — symlink path traversal (High, 8.2) GHSA-qffp-2rhf-9h96 — hardlink path traversal (High, 8.2) GHSA-34x7-hfp2-rc4v — arbitrary file create/overwrite (High, 8.2) GHSA-8qq5-rm4j-mr97 — file overwrite / symlink poisoning (High, 8.2) Because the pin is exact, this can't be resolved downstream: stays on even after (which correctly moves npm's own copy to ) and reinstalling the CLI. Suggested fix Loosen the pin so patched releases resolve automatically: (or at minimum , matching what in the same dependency tree already uses.) Environment 1.3.0 / 1.3.1 (latest) pulled in via the CLI 54.18.7 npm 11.18.0, Node 24.14.0, macOS
Follow-up to #127, pushed as an internal branch so CI runs with repository access. Updates the README CI status badge to point at the current workflow, fixing the broken badge reported in #126. Original work by @shujanislam in #127 — authorship is preserved on the commit. Closes #126
Recent fixes
This PR fixes the broken CI status badge in the README by updating it to reference the current GitHub Actions workflow file. It resolves the issue caused by an outdated workflow name and restores the correct build status display.
When embedding a NextJS into a Go monorepo, it breaks a lot of workflows using syntax: Do you know of any good workarounds for this? Would love to not have to delete node_modules just to work on the Go side of the project.
Structured data for AI agents
Repository: vercel/fun. Description: ƒun - Local serverless function λ development runtime Stars: 1008, Forks: 43. Primary language: TypeScript. Languages: TypeScript (73.2%), Shell (11.9%), Go (8.5%), Python (4.3%), JavaScript (1.4%). License: Apache-2.0. Latest release: 1.3.1 (5mo ago). Open PRs: 7, open issues: 13. Last activity: 1mo ago. Community health: 62%. Top contributors: TooTallNate, styfle, dependabot[bot], AndyBitz, amio, gscho, thasophearak, trek, EndangeredMassa, mehulkar and others.