@vercel/build-utils 14.7.0 → 14.9.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @vercel/build-utils
 
+## 14.9.0
+
+### Minor Changes
+
+- 392c759: Honor pnpm 12 pins without auto-adopting, and stop passing `--unsafe-perm` to `pnpm install`.
+
+  When Corepack is off, a lockfile-compatible `packageManager` / `devEngines.packageManager` / `engines.pnpm` pin for 12.x selects `/pnpm12` if that directory exists. Unpinned lockfile `9.0` still defaults to pnpm 9/10/11 by project creation date. `pnpm install` no longer includes `--unsafe-perm`, which pnpm 12's Rust CLI rejects.
+
+## 14.8.0
+
+### Minor Changes
+
+- a652a99: Propagate top-level `schedules` from vercel.json into the Build Output API `config.json` during `vercel build`, and validate the property against the schedules schema
+
 ## 14.7.0
 
 ### Minor Changes

package/dist/fs/run-user-scripts.js

@@ -556,7 +556,9 @@ function getInstallCommandForPackageManager(packageManager, args) {
         prettyCommand: "pnpm install",
         // PNPM's install command is similar to NPM's but without the audit nonsense
         // @see options https://pnpm.io/cli/install
-        commandArguments: args.filter((a) => a !== "--prefer-offline").concat(["install", "--unsafe-perm"])
+        // Do not pass `--unsafe-perm`: pnpm 11 treated it as a no-op, but
+        // pnpm 12's Rust CLI rejects unknown flags.
+        commandArguments: args.filter((a) => a !== "--prefer-offline").concat(["install"])
       };
     case "bun":
       return {
@@ -585,7 +587,9 @@ async function runInstallCommand({
   const { commandArguments, prettyCommand } = getInstallCommandForPackageManager(packageManager, args);
   opts.prettyCommand = prettyCommand;
   if (process.env.NPM_ONLY_PRODUCTION) {
-    commandArguments.push("--production");
+    commandArguments.push(
+      packageManager === "pnpm" ? "--prod" : "--production"
+    );
   }
   opts.outputStream = output?.stdout;
   opts.errorStream = output?.stderr;
@@ -812,7 +816,7 @@ To use a different version, set package.json#packageManager or package.json#devE
 }
 const PNPM_10_PREFERRED_AT = /* @__PURE__ */ new Date("2025-02-27T20:00:00Z");
 const PNPM_11_PREFERRED_AT = /* @__PURE__ */ new Date("2026-08-19T20:00:00Z");
-const INSTALLED_PNPM_MAJORS = [11, 10, 9, 8, 7, 6];
+const INSTALLED_PNPM_MAJORS = [12, 11, 10, 9, 8, 7, 6];
 function pnpmPathOverride(major) {
   return {
     path: `/pnpm${major}/node_modules/.bin`,
@@ -882,6 +886,7 @@ function validLockfileForPackageManager(cliType, lockfileVersion, packageManager
       return true;
     case "pnpm":
       switch (packageManagerMajorVersion) {
+        case 12:
         case 11:
         case 10:
           return lockfileVersion === 9;
@@ -1035,7 +1040,7 @@ function applyEnginesPnpm({
       if (major !== void 0) {
         return pnpmPathOverride(major);
       }
-      if (shouldDeferPnpm11UntilImageHasBinary(enginesPnpm, lockfileVersion)) {
+      if (shouldDeferPnpmMajorUntilImageHasBinary(enginesPnpm, lockfileVersion)) {
         warnEnginesPnpmWithoutPin();
         return selected;
       }
@@ -1054,12 +1059,20 @@ function warnEnginesPnpmWithoutPin() {
     `Using package.json#engines.pnpm without corepack and package.json#packageManager could lead to failed builds with ERR_PNPM_UNSUPPORTED_ENGINE. Learn more: https://vercel.com/docs/errors/error-list#pnpm-engine-unsupported`
   );
 }
-function shouldDeferPnpm11UntilImageHasBinary(enginesPnpm, lockfileVersion) {
-  if (isPnpmMajorAvailable(11) || !(0, import_semver.intersects)("11.x", enginesPnpm)) {
-    return false;
+function shouldDeferPnpmMajorUntilImageHasBinary(enginesPnpm, lockfileVersion) {
+  for (const major of INSTALLED_PNPM_MAJORS) {
+    if (major <= 10) {
+      continue;
+    }
+    if (isPnpmMajorAvailable(major) || !(0, import_semver.intersects)(`${major}.x`, enginesPnpm)) {
+      continue;
+    }
+    const version = (0, import_semver.parse)(`${major}.0.0`);
+    if (version && lockfileCompatibleWithPnpm(lockfileVersion, version)) {
+      return true;
+    }
   }
-  const pnpm11 = (0, import_semver.parse)("11.0.0");
-  return Boolean(pnpm11 && lockfileCompatibleWithPnpm(lockfileVersion, pnpm11));
+  return false;
 }
 function validateCorepackPackageManager(cliType, lockfileVersion, corepackPackageManager, enginesPnpmVersionRange) {
   const validatedCorepackPackageManager = validateVersionSpecifier(

package/dist/index.js

@@ -37195,7 +37195,9 @@ function getInstallCommandForPackageManager(packageManager, args) {
         prettyCommand: "pnpm install",
         // PNPM's install command is similar to NPM's but without the audit nonsense
         // @see options https://pnpm.io/cli/install
-        commandArguments: args.filter((a) => a !== "--prefer-offline").concat(["install", "--unsafe-perm"])
+        // Do not pass `--unsafe-perm`: pnpm 11 treated it as a no-op, but
+        // pnpm 12's Rust CLI rejects unknown flags.
+        commandArguments: args.filter((a) => a !== "--prefer-offline").concat(["install"])
       };
     case "bun":
       return {
@@ -37224,7 +37226,9 @@ async function runInstallCommand({
   const { commandArguments, prettyCommand } = getInstallCommandForPackageManager(packageManager, args);
   opts.prettyCommand = prettyCommand;
   if (process.env.NPM_ONLY_PRODUCTION) {
-    commandArguments.push("--production");
+    commandArguments.push(
+      packageManager === "pnpm" ? "--prod" : "--production"
+    );
   }
   opts.outputStream = output?.stdout;
   opts.errorStream = output?.stderr;
@@ -37451,7 +37455,7 @@ To use a different version, set package.json#packageManager or package.json#devE
 }
 var PNPM_10_PREFERRED_AT = /* @__PURE__ */ new Date("2025-02-27T20:00:00Z");
 var PNPM_11_PREFERRED_AT = /* @__PURE__ */ new Date("2026-08-19T20:00:00Z");
-var INSTALLED_PNPM_MAJORS = [11, 10, 9, 8, 7, 6];
+var INSTALLED_PNPM_MAJORS = [12, 11, 10, 9, 8, 7, 6];
 function pnpmPathOverride(major) {
   return {
     path: `/pnpm${major}/node_modules/.bin`,
@@ -37521,6 +37525,7 @@ function validLockfileForPackageManager(cliType, lockfileVersion, packageManager
       return true;
     case "pnpm":
       switch (packageManagerMajorVersion) {
+        case 12:
         case 11:
         case 10:
           return lockfileVersion === 9;
@@ -37674,7 +37679,7 @@ function applyEnginesPnpm({
       if (major !== void 0) {
         return pnpmPathOverride(major);
       }
-      if (shouldDeferPnpm11UntilImageHasBinary(enginesPnpm, lockfileVersion)) {
+      if (shouldDeferPnpmMajorUntilImageHasBinary(enginesPnpm, lockfileVersion)) {
         warnEnginesPnpmWithoutPin();
         return selected;
       }
@@ -37693,12 +37698,20 @@ function warnEnginesPnpmWithoutPin() {
     `Using package.json#engines.pnpm without corepack and package.json#packageManager could lead to failed builds with ERR_PNPM_UNSUPPORTED_ENGINE. Learn more: https://vercel.com/docs/errors/error-list#pnpm-engine-unsupported`
   );
 }
-function shouldDeferPnpm11UntilImageHasBinary(enginesPnpm, lockfileVersion) {
-  if (isPnpmMajorAvailable(11) || !(0, import_semver2.intersects)("11.x", enginesPnpm)) {
-    return false;
+function shouldDeferPnpmMajorUntilImageHasBinary(enginesPnpm, lockfileVersion) {
+  for (const major of INSTALLED_PNPM_MAJORS) {
+    if (major <= 10) {
+      continue;
+    }
+    if (isPnpmMajorAvailable(major) || !(0, import_semver2.intersects)(`${major}.x`, enginesPnpm)) {
+      continue;
+    }
+    const version = (0, import_semver2.parse)(`${major}.0.0`);
+    if (version && lockfileCompatibleWithPnpm(lockfileVersion, version)) {
+      return true;
+    }
   }
-  const pnpm11 = (0, import_semver2.parse)("11.0.0");
-  return Boolean(pnpm11 && lockfileCompatibleWithPnpm(lockfileVersion, pnpm11));
+  return false;
 }
 function validateCorepackPackageManager(cliType, lockfileVersion, corepackPackageManager, enginesPnpmVersionRange) {
   const validatedCorepackPackageManager = validateVersionSpecifier(

package/dist/types.d.ts

@@ -565,6 +565,27 @@ export interface Cron {
     path: string;
     schedule: string;
 }
+export interface ScheduleExpression {
+    /** Cron expression describing when the schedule fires (REQUIRED) */
+    cron: string;
+    /** Maximum random delay applied to each firing, e.g. "5m" (OPTIONAL) */
+    jitter?: string;
+}
+export type ScheduleTarget = {
+    /** Build output path of the function to invoke, e.g. "api/cron" */
+    function: string;
+} | {
+    /** Name of the queue topic to publish to */
+    topic: string;
+};
+export interface Schedule {
+    /** Unique name of the schedule within the deployment (REQUIRED) */
+    name: string;
+    expression: ScheduleExpression;
+    target: ScheduleTarget;
+    /** Payload delivered with each firing (OPTIONAL) */
+    payload?: unknown;
+}
 export interface ServiceQueueTopic {
     topic: string;
     retryAfterSeconds?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/build-utils",
-  "version": "14.7.0",
+  "version": "14.9.0",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.js",
@@ -52,8 +52,8 @@
     "vitest": "4.1.10",
     "typescript": "4.9.5",
     "yazl": "2.5.1",
-    "@vercel/error-utils": "2.2.1",
-    "@vercel/routing-utils": "6.5.0"
+    "@vercel/routing-utils": "6.5.0",
+    "@vercel/error-utils": "2.2.1"
   },
   "scripts": {
     "build": "node build.mjs",