@vercel/python 25.1.3 → 27.0.0

package/dist/index.js

@@ -5523,11 +5523,18 @@ var UvRunner = class {
   }
   /**
    * Run a `uv pip` command (e.g., `uv pip install`).
+   *
+   * Only packages the builder adds on top of the user's dependencies are
+   * installed this way. Their pins carry no hashes, so the user's
+   * UV_REQUIRE_HASHES is dropped; uv also rejects `--no-require-hashes`
+   * while it is set.
    */
   async pip(options) {
     const { venvPath, projectDir, args } = options;
     const fullArgs = ["pip", ...args];
-    await this.runUvCmd(fullArgs, projectDir, venvPath);
+    await this.runUvCmd(fullArgs, projectDir, venvPath, {
+      UV_REQUIRE_HASHES: void 0
+    });
   }
   /**
    * Run a command through `uv run` inside the active virtual environment.
@@ -5559,13 +5566,13 @@ var UvRunner = class {
       );
     }
   }
-  async runUvCmd(args, cwd, venvPath) {
+  async runUvCmd(args, cwd, venvPath, env) {
     const pretty = `uv ${args.join(" ")}`;
     (0, import_build_utils2.debug)(`Running "${pretty}"...`);
     try {
       await (0, import_execa2.default)(this.uvPath, args, {
         cwd,
-        env: this.getVenvEnv(venvPath)
+        env: { ...this.getVenvEnv(venvPath), ...env }
       });
     } catch (err) {
       const error = new Error(
@@ -9243,20 +9250,21 @@ async function doInstallInjectedDevPackage(pkg, opts) {
     `Installing ${pkg.name} into ${targetDir} (type: ${isLocalDev ? "local" : "pypi"}, source: ${dep})`
   );
   const pip = uvPath ? { cmd: uvPath, prefix: ["pip", "install"] } : { cmd: pythonBin, prefix: ["-m", "pip", "install"] };
-  const excludeOverride = uvPath ? ["--exclude-newer-package", `${pkg.name}=false`] : [];
+  const uvOverrides = uvPath ? ["--exclude-newer-package", `${pkg.name}=false`, "--no-require-hashes"] : [];
   const extras = pkg.envOverride || isLocalDev ? [] : pkg.extraRequirements ?? [];
   const spawnArgs = [
     ...pip.prefix,
     "--target",
     targetDir,
-    ...excludeOverride,
+    ...uvOverrides,
     ...extras,
     dep
   ];
   await new Promise((resolve4, reject) => {
     const child = (0, import_child_process2.spawn)(pip.cmd, spawnArgs, {
       cwd: workPath,
-      env: getProtectedUvEnv(env),
+      // uv rejects `--no-require-hashes` while UV_REQUIRE_HASHES is set.
+      env: { ...getProtectedUvEnv(env), UV_REQUIRE_HASHES: void 0 },
       stdio: ["inherit", "pipe", "pipe"]
     });
     child.stdout?.on("data", (data) => {
@@ -9407,7 +9415,7 @@ async function getMultiServicePythonRunner(workPath, env, systemPython, uvPath)
   env.PATH = `${binDir}${import_path13.delimiter}${env.PATH || ""}`;
   return { command: pythonBin, args: [] };
 }
-async function getPersistentServer(serverKey, isStale) {
+async function claimPersistentServer(serverKey, isStale) {
   while (true) {
     const existing = PERSISTENT_SERVERS.get(serverKey);
     if (existing) {
@@ -9424,9 +9432,19 @@ async function getPersistentServer(serverKey, isStale) {
     }
     const pending = PENDING_STARTS.get(serverKey);
     if (!pending)
-      return null;
+      break;
     await pending;
   }
+  let start;
+  const ready = new Promise(
+    (resolve4, reject) => {
+      start = { resolve: resolve4, reject };
+    }
+  );
+  ready.catch(() => {
+  });
+  PENDING_STARTS.set(serverKey, ready);
+  return start;
 }
 async function spawnPersistentServer({
   serverKey,
@@ -9538,31 +9556,22 @@ var startProxyDevServer = async ({
     );
   }
   const serverKey = `${workPath}::proxy::${entrypoint}`;
-  const existing = await getPersistentServer(serverKey);
-  if (existing) {
-    return existing;
+  const start = await claimPersistentServer(serverKey);
+  if ("port" in start) {
+    return start;
   }
   if (!restoreWarnings)
     restoreWarnings = silenceNodeWarnings();
   installGlobalCleanupHandlers();
-  const proxySource = (0, import_fs13.readFileSync)((0, import_path13.join)(workPath, entrypoint), "utf8");
-  if (!await (0, import_python_analysis9.containsTopLevelCallable)(proxySource, handlerFunction)) {
-    throw new import_build_utils15.NowBuildError({
-      code: "PYTHON_HANDLER_NOT_FOUND",
-      message: `Handler function "${handlerFunction}" not found in ${entrypoint}. Ensure it is defined at the module's top level.`
-    });
-  }
   const env = { ...process.env, ...meta.env || {} };
-  let resolveChildReady;
-  let rejectChildReady;
-  const childReady = new Promise(
-    (resolve4, reject) => {
-      resolveChildReady = resolve4;
-      rejectChildReady = reject;
-    }
-  );
-  PENDING_STARTS.set(serverKey, childReady);
   try {
+    const proxySource = (0, import_fs13.readFileSync)((0, import_path13.join)(workPath, entrypoint), "utf8");
+    if (!await (0, import_python_analysis9.containsTopLevelCallable)(proxySource, handlerFunction)) {
+      throw new import_build_utils15.NowBuildError({
+        code: "PYTHON_HANDLER_NOT_FOUND",
+        message: `Handler function "${handlerFunction}" not found in ${entrypoint}. Ensure it is defined at the module's top level.`
+      });
+    }
     const { pythonPath: systemPython } = getDefaultPythonVersion(meta);
     const uvPath = await findUvBinary(systemPython);
     if (uvPath) {
@@ -9616,11 +9625,11 @@ var startProxyDevServer = async ({
       onStdout,
       onStderr
     });
-    resolveChildReady({ port, pid });
+    start.resolve({ port, pid });
     return { port, pid, shutdown: async () => {
     } };
   } catch (err) {
-    rejectChildReady(err);
+    start.reject(err);
     throw err;
   } finally {
     PENDING_STARTS.delete(serverKey);
@@ -9647,83 +9656,74 @@ var startDevServer = async (opts) => {
   const scheduleEnv = scheduleFunction ? { ...env } : void 0;
   const serviceName = service?.name ?? (typeof meta.serviceName === "string" ? meta.serviceName : void 0);
   const serverKey = scheduleFunction ? `${workPath}::schedule::${scheduleFunction.outputPath}` : serviceName ? `${workPath}::${framework}::${serviceName}` : `${workPath}::${framework}`;
-  const existing = await getPersistentServer(
+  if (!framework && !scheduleFunction) {
+    return null;
+  }
+  const start = await claimPersistentServer(
     serverKey,
     (info) => !!scheduleFunction && (info.scheduleModule !== scheduleModule || !(0, import_util2.isDeepStrictEqual)(info.scheduleEnv, scheduleEnv))
   );
-  if (existing) {
-    return existing;
-  }
-  if (!framework && !scheduleFunction) {
-    return null;
+  if ("port" in start) {
+    return start;
   }
   if (!restoreWarnings)
     restoreWarnings = silenceNodeWarnings();
   installGlobalCleanupHandlers();
-  const entrypoint = rawEntrypoint === "<detect>" ? void 0 : rawEntrypoint;
-  const isPyprojectEntrypoint = entrypoint === "pyproject.toml";
-  let resolved;
-  const handlerFunction = typeof config?.handlerFunction === "string" ? config.handlerFunction : void 0;
-  const isPyQueueSidecar = config?.pythonQueueSidecar === "subscriber" || config?.pythonQueueSidecar === "workflow";
-  let detected;
-  if (scheduleHandlerPath && scheduleModule) {
-    const entrypoint2 = import_path13.posix.join(".vercel/python", scheduleHandlerPath);
-    (0, import_fs13.mkdirSync)((0, import_path13.dirname)((0, import_path13.join)(workPath, entrypoint2)), { recursive: true });
-    (0, import_fs13.writeFileSync)((0, import_path13.join)(workPath, entrypoint2), scheduleModule);
-    detected = { entrypoint: { entrypoint: entrypoint2, variableName: "app" } };
-  } else if (isPyprojectEntrypoint) {
-    const declaredEntrypoint = await getVercelToolsEntrypoint(
-      workPath,
-      opts.repoRootPath
-    );
-    detected = declaredEntrypoint ? { entrypoint: declaredEntrypoint } : null;
-  } else {
-    detected = await detectPythonEntrypoint(
-      framework,
-      workPath,
-      entrypoint ? {
-        filePath: entrypoint,
-        // Schedule-triggered services create their own "app" wrapper dynamically.
-        // Other services use handlerFunction as the entrypoint variable name.
-        varName: service && (0, import_build_utils15.isScheduleTriggeredService)(service) ? void 0 : handlerFunction ?? (isPyQueueSidecar ? "app" : void 0)
-      } : void 0,
-      service,
-      opts.repoRootPath
-    );
-  }
-  let hookResult;
-  if (detected?.entrypoint) {
-    resolved = detected.entrypoint;
-  } else if (!isPyprojectEntrypoint) {
-    hookResult = await runFrameworkHook(framework, {
-      pythonEnv: env,
-      workPath,
-      entrypoint,
-      detected: detected ?? void 0
-    });
-    resolved = hookResult?.entrypoint;
-  }
-  if (!resolved) {
-    if (detected?.error) {
-      throw detected.error;
+  try {
+    const entrypoint = rawEntrypoint === "<detect>" ? void 0 : rawEntrypoint;
+    const isPyprojectEntrypoint = entrypoint === "pyproject.toml";
+    let resolved;
+    const handlerFunction = typeof config?.handlerFunction === "string" ? config.handlerFunction : void 0;
+    const isPyQueueSidecar = config?.pythonQueueSidecar === "subscriber" || config?.pythonQueueSidecar === "workflow";
+    let detected;
+    if (scheduleHandlerPath && scheduleModule) {
+      const entrypoint2 = import_path13.posix.join(".vercel/python", scheduleHandlerPath);
+      (0, import_fs13.mkdirSync)((0, import_path13.dirname)((0, import_path13.join)(workPath, entrypoint2)), { recursive: true });
+      (0, import_fs13.writeFileSync)((0, import_path13.join)(workPath, entrypoint2), scheduleModule);
+      detected = { entrypoint: { entrypoint: entrypoint2, variableName: "app" } };
+    } else if (isPyprojectEntrypoint) {
+      const declaredEntrypoint = await getVercelToolsEntrypoint(
+        workPath,
+        opts.repoRootPath
+      );
+      detected = declaredEntrypoint ? { entrypoint: declaredEntrypoint } : null;
+    } else {
+      detected = await detectPythonEntrypoint(
+        framework,
+        workPath,
+        entrypoint ? {
+          filePath: entrypoint,
+          // Schedule-triggered services create their own "app" wrapper dynamically.
+          // Other services use handlerFunction as the entrypoint variable name.
+          varName: service && (0, import_build_utils15.isScheduleTriggeredService)(service) ? void 0 : handlerFunction ?? (isPyQueueSidecar ? "app" : void 0)
+        } : void 0,
+        service,
+        opts.repoRootPath
+      );
     }
-    throw new import_build_utils15.NowBuildError({
-      code: isPyprojectEntrypoint ? "PYTHON_PYPROJECT_NOTHING_TO_BUILD" : "PYTHON_ENTRYPOINT_NOT_FOUND",
-      message: isPyprojectEntrypoint ? 'Entrypoint "pyproject.toml" does not declare a web app. Set "tool.vercel.entrypoint" in pyproject.toml.' : "No Python entrypoint could be detected. Please specify an entrypoint file."
-    });
-  }
-  const { entrypoint: entry, variableName } = resolved;
-  const modulePath = scheduleHandlerPath ? generatedPythonPathToModule(scheduleHandlerPath) : entrypointToModule(entry);
-  let resolveChildReady;
-  let rejectChildReady;
-  const childReady = new Promise(
-    (resolve4, reject) => {
-      resolveChildReady = resolve4;
-      rejectChildReady = reject;
+    let hookResult;
+    if (detected?.entrypoint) {
+      resolved = detected.entrypoint;
+    } else if (!isPyprojectEntrypoint) {
+      hookResult = await runFrameworkHook(framework, {
+        pythonEnv: env,
+        workPath,
+        entrypoint,
+        detected: detected ?? void 0
+      });
+      resolved = hookResult?.entrypoint;
     }
-  );
-  PENDING_STARTS.set(serverKey, childReady);
-  try {
+    if (!resolved) {
+      if (detected?.error) {
+        throw detected.error;
+      }
+      throw new import_build_utils15.NowBuildError({
+        code: isPyprojectEntrypoint ? "PYTHON_PYPROJECT_NOTHING_TO_BUILD" : "PYTHON_ENTRYPOINT_NOT_FOUND",
+        message: isPyprojectEntrypoint ? 'Entrypoint "pyproject.toml" does not declare a web app. Set "tool.vercel.entrypoint" in pyproject.toml.' : "No Python entrypoint could be detected. Please specify an entrypoint file."
+      });
+    }
+    const { entrypoint: entry, variableName } = resolved;
+    const modulePath = scheduleHandlerPath ? generatedPythonPathToModule(scheduleHandlerPath) : entrypointToModule(entry);
     const { pythonPath: systemPython } = getDefaultPythonVersion(meta);
     const uvPath = await findUvBinary(systemPython);
     if (uvPath) {
@@ -9981,12 +9981,12 @@ If you are using a virtual environment, activate it before running "vercel dev",
       scheduleModule,
       scheduleEnv
     });
-    resolveChildReady({ port, pid });
+    start.resolve({ port, pid });
     const shutdown = async () => {
     };
     return { port, pid, shutdown, crons, queueSubscriptions };
   } catch (err) {
-    rejectChildReady(err);
+    start.reject(err);
     throw err;
   } finally {
     PENDING_STARTS.delete(serverKey);
@@ -11745,6 +11745,9 @@ async function installInjectedPackage({
       "install",
       "--link-mode",
       "copy",
+      // The pin has no hash, so override `require-hashes` from the user's
+      // uv config. `uv.pip` drops UV_REQUIRE_HASHES.
+      "--no-require-hashes",
       ...pipPlatformArgs,
       ...noExclude,
       ...extras,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/python",
-  "version": "25.1.3",
+  "version": "27.0.0",
   "main": "./dist/index.js",
   "license": "Apache-2.0",
   "homepage": "https://vercel.com/docs/runtimes#official-runtimes/python",
@@ -14,10 +14,10 @@
     "directory": "packages/python"
   },
   "dependencies": {
-    "@vercel/python-analysis": "0.15.0"
+    "@vercel/python-analysis": "0.15.2"
   },
   "peerDependencies": {
-    "@vercel/build-utils": "14.21.3"
+    "@vercel/build-utils": "14.23.0"
   },
   "devDependencies": {
     "@renovatebot/pep440": "4.2.1",
@@ -37,7 +37,7 @@
     "smol-toml": "1.5.2",
     "vitest": "4.1.10",
     "which": "3.0.0",
-    "@vercel/build-utils": "14.21.3",
+    "@vercel/build-utils": "14.23.0",
     "@vercel/error-utils": "2.2.1",
     "@vercel/python-runtime": "0.23.3"
   },