GitShow/vercel/nft
vercel

nft

Node.js dependency tracing utility

by vercel
static-analysis
Star on GitHubForkWebsitenpm

JavaScript

1.7k stars180 forks53 contributorsActive · 1w agoSince 20191.10.2MIT

Meet the team

See all 53 on GitHub →
styfle
styfle199 contributions
dependabot[bot]Bot
dependabot[bot]113 contributions
guybedford
guybedford76 contributions
ijjk
ijjk20 contributions
thomashohn
thomashohn13 contributions
jeffsee55
jeffsee558 contributions
benmccann
benmccann5 contributions
CopilotBot
Copilot3 contributions

Languages

View on GitHub →
JavaScript89.2%
TypeScript10.8%
CSS0%

Commit activity

Last 12 weeks · 15 commits

Full graph →

Community health

3 of 6 standards met

Community profile →
75
✓README✓License○Contributing○Code of Conduct○Issue Template✓PR Template

Recent PRs & issues

Active · Last activity 1w ago
See all on GitHub →
linyiru
Missing exports target: fileList gets a bare package.json plus only a soft warning — traced output fails at runtime with a misleading MODULE_NOT_FOUNDOpenIssue

Summary When a dependency's -resolved entry file is missing on disk (e.g. a package manager left a package directory in a torn state: from one version, from another), : 1. records a warning in (good), but 2. still emits the package's alone into , with no entry file and no marker of the failure. Deploying that file set produces a delayed, misleading runtime failure: Node finds the , resolves its map, and crashes with — a deep internal path that implicates the package rather than the trace/install. If nft emitted nothing for the package, the runtime error would at least be the legible . Reproduction (self-contained) Output (nft 1.10.2, Node 22): Copy to a deploy target and run there: Note the warning's full message already contains that exact path — the diagnostic exists at trace time, but nothing in the emitted file set reflects it. Real-world impact This is not hypothetical: we traced a production 500 on a Vercel serverless function to exactly this artifact shape — the deployed function filesystem contained 's 11.x but not the file its map resolves to, and every SSR request to the affected route failed with the deep above, via a runtime chain (). The build had succeeded with a green log (the consumer pipeline does not surface ). Diagnosing it took build-log forensics plus local reconstruction of the file-set shape; a visible trace-time diagnostic would have answered it immediately. There is also a fully self-contained Next.js-level reproduction (green , zero warnings, deployed standalone output 500s / silently drops page metadata): https://github.com/linyiru/next-silent-tracing-failure Suggestions (any subset would help) 1. When exports resolution fails because the target file does not exist, don't emit the bare for that package (or tag it in the result), so the shipped artifact fails legibly instead of pointing at the package's internals. 2. Offer an opt-in strict mode (e.g. ) so CI/builders can hard-fail on this class of trace failure. 3. At minimum, document that may contain -only entries for packages whose resolution failed, and that consumers should surface — the major consumers (Next.js output file tracing, the Vercel builder) currently swallow them. Environment: 1.10.2, Node.js 22.22, macOS/Linux (reproduced on both).

linyiru · 13h ago
cmpadden
fix: resolve package import wildcard trailersOpenPR

Summary resolve import/export wildcard patterns that include a trailer, such as match both the pattern prefix and trailer before substituting the captured wildcard use Node-compatible pattern precedence and reject patterns containing multiple wildcards add an trace fixture covering mapped through Context NFT previously recognized wildcard keys only when they ended in . A valid import map such as: therefore failed to resolve . Consumers such as Nitro/nf3 would trace the package entry point but omit the internal target, producing an incomplete deployment artifact that failed at runtime with . Related reproduction and downstream workaround: https://github.com/cmpadden/eve-repro-nitro-wildcard-package-imports https://github.com/vercel/eve/pull/1181 Regression testing The new fixture imports and expects in the trace. Before this change, both the cwd-based and root-based fixture variants failed because the marker file was absent. After the resolver change, both variants pass. Validation performed: — 1,475 tests passed

cmpadden · 2w ago
timfish
Traced file set depends on the Node version running the trace (`module-sync` gated on build-time Node >= 22)OpenIssue

Whether a package's export target is traced depends on the Node.js version running ( in ), not on what supported runtimes resolve. Node's CJS loader matches from 20.19, so every Node 20.x build (including latest 20.20.2) omits a file that even its own runtime resolves — pruned output crashes with with no build/deploy version skew at all. Minimal repro: https://github.com/timfish/repro-nft-module-sync — fails on Node 20.x, passes on Node 22; and the trace disagree within a single process. Related: the wildcard-exports branch from #584 has the mirror problem — on Node >= 22 it emits only the target (fallback gated on , default ), breaking older deploy runtimes. Possible directions — happy to PR whichever you prefer: 1. Default to (#584 already emits both targets behind it) 2. Drop the version gates and always dual-emit 3. Correct the version check ( → also 20.19+) — still leaves build-vs-deploy version skew unsound Seen in the wild via : Nitro server bundles (nuxt/solidstart/tanstack prod servers crash at boot) and AWS Lambda layers built on Node 20.

timfish · 2w ago

Recent fixes

View closed PRs →
styfle
fix: emit libvips shared library for sharp@0.35MergedPR

Problem reorganized its prebuilt binaries. The platform package (e.g. ) loads its native addon, which in turn dlopens the libvips shared library (//) from a sibling package, . Because that load happens inside the compiled binary rather than via a JS , static analysis never saw it, so the shared library was missing from the trace and the bundled app failed at runtime with / dlopen errors. The previous special case keyed on , which moved to , so it silently stopped firing. Fix Two complementary mechanisms, covering old and new sharp: sharp ≥ 0.35* — already runs whenever a file is emitted and globs the binary's own package for shared libraries. It now also reads that package's and emits the shared libraries from each package (resolved relative to the root, with so pnpm symlink layouts work). This is version-independent: it follows the declared dependency () rather than hardcoding paths. sharp /lib/libvips-cpp.pnpm test test/integration.test.jssharp.jssharp-pnpm.js` (sharp 0.33.2 → special-case path) 🤖 Generated with Claude Code

styfle · 1w ago
lovell
chore: upgrade sharp to latest v0.35.3MergedPR

~~Extends the sharp "special case" with additional ESM/CJS-specific paths added in v0.35.0.~~ No longer requires the "special case" from 0.35.2 onwards. https://github.com/lovell/sharp/pull/4509 https://github.com/lovell/sharp/issues/4543 The existing path check remains to support older versions ~~and future-proof for when we switch to ESM-only~~.

lovell · 1mo ago
Structured data for AI agents

Repository: vercel/nft. Description: Node.js dependency tracing utility Stars: 1663, Forks: 180. Primary language: JavaScript. Languages: JavaScript (89.2%), TypeScript (10.8%), CSS (0%). License: MIT. Homepage: https://npmjs.com/@vercel/nft Topics: static-analysis. Latest release: 1.10.2 (2mo ago). Open PRs: 13, open issues: 43. Last activity: 1w ago. Community health: 75%. Top contributors: styfle, dependabot[bot], guybedford, ijjk, thomashohn, jeffsee55, benmccann, Copilot, Timer, lucleray and others.

·@ofershap

Replace github.com with gitshow.dev