vercel 50.3.2 → 50.3.3

package/dist/index.js

@@ -50311,7 +50311,7 @@ var require_package = __commonJS2({
   "../client/package.json"(exports2, module2) {
     module2.exports = {
       name: "@vercel/client",
-      version: "17.2.21",
+      version: "17.2.22",
       main: "dist/index.js",
       typings: "dist/index.d.ts",
       homepage: "https://vercel.com",
@@ -58741,7 +58741,7 @@ var require_utils14 = __commonJS2({
     var import_url20 = __require("url");
     var import_ignore = __toESM4(require_ignore());
     var import_pkg6 = require_pkg();
-    var import_build_utils19 = __require("@vercel/build-utils");
+    var import_build_utils20 = __require("@vercel/build-utils");
     var import_async_sema = require_lib9();
     var import_fs_extra25 = require_lib8();
     var import_readdir_recursive = __toESM4(require_readdir_recursive());
@@ -58934,7 +58934,7 @@ var require_utils14 = __commonJS2({
               maybeRead((0, import_path43.join)(cwd2, ".nowignore"), "")
             ]);
             if (vercelignore && nowignore) {
-              throw new import_build_utils19.NowBuildError({
+              throw new import_build_utils20.NowBuildError({
                 code: "CONFLICTING_IGNORE_FILES",
                 message: "Cannot use both a `.vercelignore` and `.nowignore` file. Please delete the `.nowignore` file.",
                 link: "https://vercel.link/combining-old-and-new-config"
@@ -64123,7 +64123,7 @@ var require_create_deployment = __commonJS2({
     var import_utils6 = require_utils14();
     var import_errors4 = require_errors2();
     var import_error_utils38 = require_dist2();
-    var import_build_utils19 = __require("@vercel/build-utils");
+    var import_build_utils20 = __require("@vercel/build-utils");
     var import_tar_fs2 = __toESM4(require_tar_fs());
     var import_zlib = __require("zlib");
     function buildCreateDeployment() {
@@ -64188,7 +64188,7 @@ var require_create_deployment = __commonJS2({
             const tarStream = import_tar_fs2.default.pack(workPath, {
               entries: fileList.map((file) => (0, import_path43.relative)(workPath, file))
             }).pipe((0, import_zlib.createGzip)());
-            const chunkedTarBuffers = await (0, import_build_utils19.streamToBufferChunks)(tarStream);
+            const chunkedTarBuffers = await (0, import_build_utils20.streamToBufferChunks)(tarStream);
             debug2(`Packed tarball into ${chunkedTarBuffers.length} chunks`);
             files = new Map(
               chunkedTarBuffers.map((chunk, index) => [
@@ -83391,7 +83391,7 @@ var require_detect_builders = __commonJS2({
     var import_path43 = __require("path");
     var import_frameworks8 = __toESM4(require_frameworks());
     var import_is_official_runtime = require_is_official_runtime();
-    var import_build_utils19 = __require("@vercel/build-utils");
+    var import_build_utils20 = __require("@vercel/build-utils");
     var REGEX_MIDDLEWARE_FILES = "middleware.[jt]s";
     var REGEX_VERCEL_PLATFORM_FILES = `api/**,package.json,${REGEX_MIDDLEWARE_FILES}`;
     var REGEX_NON_VERCEL_PLATFORM_FILES2 = `!{${REGEX_VERCEL_PLATFORM_FILES}}`;
@@ -83645,7 +83645,7 @@ var require_detect_builders = __commonJS2({
       }
       if (fileName.endsWith(".py") && options.workPath) {
         const fsPath = (0, import_path43.join)(options.workPath, fileName);
-        const isEntrypoint = await (0, import_build_utils19.isPythonEntrypoint)({ fsPath });
+        const isEntrypoint = await (0, import_build_utils20.isPythonEntrypoint)({ fsPath });
         if (!isEntrypoint) {
           return null;
         }
@@ -149143,6 +149143,60 @@ var init_validate_config = __esm({
   }
 });
 
+// src/util/validate-cron-secret.ts
+import { NowBuildError as NowBuildError5 } from "@vercel/build-utils";
+function validateCronSecret(cronSecret) {
+  if (!cronSecret) {
+    return null;
+  }
+  if (cronSecret !== cronSecret.trim()) {
+    return new NowBuildError5({
+      code: "INVALID_CRON_SECRET",
+      message: "The `CRON_SECRET` environment variable contains leading or trailing whitespace, which is not allowed in HTTP header values.",
+      link: "https://vercel.link/securing-cron-jobs",
+      action: "Learn More"
+    });
+  }
+  const invalidChars = [];
+  for (let i = 0; i < cronSecret.length; i++) {
+    const code2 = cronSecret.charCodeAt(i);
+    const isValidChar = code2 === 9 || // HTAB
+    code2 >= 32 && code2 <= 126;
+    if (!isValidChar) {
+      invalidChars.push({
+        char: cronSecret[i],
+        index: i,
+        code: code2
+      });
+    }
+  }
+  if (invalidChars.length > 0) {
+    const descriptions = invalidChars.slice(0, 3).map(({ code: code2, index }) => {
+      if (code2 < 32) {
+        return `control character (0x${code2.toString(16).padStart(2, "0")}) at position ${index}`;
+      } else if (code2 === 127) {
+        return `DEL character at position ${index}`;
+      } else {
+        return `non-ASCII character (0x${code2.toString(16).padStart(2, "0")}) at position ${index}`;
+      }
+    });
+    const moreCount = invalidChars.length - 3;
+    const moreText = moreCount > 0 ? `, and ${moreCount} more` : "";
+    return new NowBuildError5({
+      code: "INVALID_CRON_SECRET",
+      message: `The \`CRON_SECRET\` environment variable contains characters that are not valid in HTTP headers: ${descriptions.join(", ")}${moreText}. Only visible ASCII characters (letters, digits, symbols), spaces, and tabs are allowed.`,
+      link: "https://vercel.link/securing-cron-jobs",
+      action: "Learn More"
+    });
+  }
+  return null;
+}
+var init_validate_cron_secret = __esm({
+  "src/util/validate-cron-secret.ts"() {
+    "use strict";
+  }
+});
+
 // src/util/input/input-project.ts
 async function inputProject(client2, org, detectedProjectName, autoConfirm = false) {
   const slugifiedName = (0, import_slugify2.default)(detectedProjectName);
@@ -150018,7 +150072,7 @@ import {
   getDiscontinuedNodeVersions,
   getInstalledPackageVersion,
   normalizePath as normalizePath3,
-  NowBuildError as NowBuildError5,
+  NowBuildError as NowBuildError6,
   runNpmInstall,
   runCustomInstallCommand,
   resetCustomInstallCommandSet,
@@ -150227,6 +150281,7 @@ async function main3(client2) {
 }
 async function doBuild(client2, project, buildsJson, cwd, outputDir, span, standalone = false) {
   const { localConfigPath } = client2;
+  const VALID_DEPLOYMENT_ID_PATTERN = /^[a-zA-Z0-9_-]+$/;
   const workPath = join16(cwd, project.settings.rootDirectory || ".");
   const sourceConfigFile = await findSourceVercelConfigFile(workPath);
   let corepackShimDir;
@@ -150287,13 +150342,19 @@ async function doBuild(client2, project, buildsJson, cwd, outputDir, span, stand
   if (validateError) {
     throw validateError;
   }
+  if (localConfig.crons && localConfig.crons.length > 0) {
+    const cronSecretError = validateCronSecret(process.env.CRON_SECRET);
+    if (cronSecretError) {
+      throw cronSecretError;
+    }
+  }
   if (localConfig.customErrorPage) {
     const errorPages = typeof localConfig.customErrorPage === "string" ? [localConfig.customErrorPage] : Object.values(localConfig.customErrorPage);
     for (const page of errorPages) {
       if (page) {
         const src = join16(workPath, page);
         if (!(0, import_fs_extra18.existsSync)(src)) {
-          throw new NowBuildError5({
+          throw new NowBuildError6({
             code: "CUSTOM_ERROR_PAGE_NOT_FOUND",
             message: `The custom error page "${page}" was not found in "${workPath}".`,
             link: "https://vercel.com/docs/projects/project-configuration#custom-error-page"
@@ -150317,7 +150378,7 @@ async function doBuild(client2, project, buildsJson, cwd, outputDir, span, stand
     throw routesResult.error;
   }
   if (localConfig.builds && localConfig.functions) {
-    throw new NowBuildError5({
+    throw new NowBuildError6({
       code: "bad_request",
       message: "The `functions` property cannot be used in conjunction with the `builds` property. Please remove one of them.",
       link: "https://vercel.link/functions-and-builds"
@@ -150495,7 +150556,7 @@ async function doBuild(client2, project, buildsJson, cwd, outputDir, span, stand
       if (buildResult && "output" in buildResult && "runtime" in buildResult.output && "type" in buildResult.output && buildResult.output.type === "Lambda") {
         const lambdaRuntime = buildResult.output.runtime;
         if (getDiscontinuedNodeVersions().some((o) => o.runtime === lambdaRuntime)) {
-          throw new NowBuildError5({
+          throw new NowBuildError6({
             code: "NODEJS_DISCONTINUED_VERSION",
             message: `The Runtime "${build2.use}" is using "${lambdaRuntime}", which is discontinued. Please upgrade your Runtime to a more recent version or consult the author for more details.`,
             link: "https://vercel.link/function-runtimes"
@@ -150628,19 +150689,26 @@ async function doBuild(client2, project, buildsJson, cwd, outputDir, span, stand
     if ("deploymentId" in existingConfig && typeof existingConfig.deploymentId === "string") {
       const deploymentId = existingConfig.deploymentId;
       if (deploymentId.startsWith("dpl_")) {
-        throw new NowBuildError5({
+        throw new NowBuildError6({
           code: "INVALID_DEPLOYMENT_ID",
           message: `The deploymentId "${deploymentId}" cannot start with the "dpl_" prefix. Please choose a different deploymentId in your config.`,
           link: "https://vercel.com/docs/skew-protection#custom-skew-protection-deployment-id"
         });
       }
       if (deploymentId.length > 32) {
-        throw new NowBuildError5({
+        throw new NowBuildError6({
           code: "INVALID_DEPLOYMENT_ID",
           message: `The deploymentId "${deploymentId}" must be 32 characters or less. Please choose a shorter deploymentId in your config.`,
           link: "https://vercel.com/docs/skew-protection#custom-skew-protection-deployment-id"
         });
       }
+      if (!VALID_DEPLOYMENT_ID_PATTERN.test(deploymentId)) {
+        throw new NowBuildError6({
+          code: "INVALID_DEPLOYMENT_ID",
+          message: `The deploymentId "${deploymentId}" contains invalid characters. Only alphanumeric characters (a-z, A-Z, 0-9), hyphens (-), and underscores (_) are allowed.`,
+          link: "https://vercel.com/docs/skew-protection#custom-skew-protection-deployment-id"
+        });
+      }
     }
     if (existingConfig.overrides) {
       overrides.push(existingConfig.overrides);
@@ -150676,25 +150744,33 @@ async function doBuild(client2, project, buildsJson, cwd, outputDir, span, stand
   const mergedImages = mergeImages(localConfig.images, buildResults.values());
   const mergedCrons = mergeCrons(localConfig.crons, buildResults.values());
   const mergedWildcard = mergeWildcard(buildResults.values());
-  const mergedDeploymentId = mergeDeploymentId(
+  const mergedDeploymentId = await mergeDeploymentId(
     existingConfig?.deploymentId,
-    buildResults.values()
+    buildResults.values(),
+    workPath
   );
   if (mergedDeploymentId) {
     if (mergedDeploymentId.startsWith("dpl_")) {
-      throw new NowBuildError5({
+      throw new NowBuildError6({
         code: "INVALID_DEPLOYMENT_ID",
         message: `The deploymentId "${mergedDeploymentId}" cannot start with the "dpl_" prefix. Please choose a different deploymentId in your config.`,
         link: "https://vercel.com/docs/skew-protection#custom-skew-protection-deployment-id"
       });
     }
     if (mergedDeploymentId.length > 32) {
-      throw new NowBuildError5({
+      throw new NowBuildError6({
         code: "INVALID_DEPLOYMENT_ID",
         message: `The deploymentId "${mergedDeploymentId}" must be 32 characters or less. Please choose a shorter deploymentId in your config.`,
         link: "https://vercel.com/docs/skew-protection#custom-skew-protection-deployment-id"
       });
     }
+    if (!VALID_DEPLOYMENT_ID_PATTERN.test(mergedDeploymentId)) {
+      throw new NowBuildError6({
+        code: "INVALID_DEPLOYMENT_ID",
+        message: `The deploymentId "${mergedDeploymentId}" contains invalid characters. Only alphanumeric characters (a-z, A-Z, 0-9), hyphens (-), and underscores (_) are allowed.`,
+        link: "https://vercel.com/docs/skew-protection#custom-skew-protection-deployment-id"
+      });
+    }
   }
   const mergedOverrides = overrides.length > 0 ? Object.assign({}, ...overrides) : void 0;
   const framework = await getFramework(workPath, buildResults);
@@ -150752,7 +150828,7 @@ async function getFramework(cwd, buildResults) {
 }
 function expandBuild(files, build2) {
   if (!build2.use) {
-    throw new NowBuildError5({
+    throw new NowBuildError6({
       code: `invalid_build_specification`,
       message: "Field `use` is missing in build specification",
       link: "https://vercel.com/docs/concepts/projects/project-configuration#builds",
@@ -150761,7 +150837,7 @@ function expandBuild(files, build2) {
   }
   let src = normalize3(build2.src || "**").split(sep2).join("/");
   if (src === "." || src === "./") {
-    throw new NowBuildError5({
+    throw new NowBuildError6({
       code: `invalid_build_specification`,
       message: "A build `src` path resolves to an empty string",
       link: "https://vercel.com/docs/concepts/projects/project-configuration#builds",
@@ -150808,7 +150884,7 @@ function mergeWildcard(buildResults) {
   }
   return wildcard;
 }
-function mergeDeploymentId(existingDeploymentId, buildResults) {
+async function mergeDeploymentId(existingDeploymentId, buildResults, workPath) {
   if (existingDeploymentId) {
     return existingDeploymentId;
   }
@@ -150817,6 +150893,20 @@ function mergeDeploymentId(existingDeploymentId, buildResults) {
       return result.deploymentId;
     }
   }
+  try {
+    const routesManifestPath = join16(workPath, ".next", "routes-manifest.json");
+    if (await import_fs_extra18.default.pathExists(routesManifestPath)) {
+      const routesManifest = await readJSONFile(
+        routesManifestPath
+      );
+      if (routesManifest && !(routesManifest instanceof CantParseJSONFile)) {
+        if (routesManifest.deploymentId) {
+          return routesManifest.deploymentId;
+        }
+      }
+    }
+  } catch {
+  }
   return void 0;
 }
 async function writeFlagsJSON(buildResults, outputDir) {
@@ -150895,6 +150985,7 @@ var init_build2 = __esm({
     init_read_json_file();
     init_build();
     init_validate_config();
+    init_validate_cron_secret();
     init_compile_vercel_config();
     init_help();
     init_pull4();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vercel",
-  "version": "50.3.2",
+  "version": "50.3.3",
   "type": "module",
   "preferGlobal": true,
   "license": "Apache-2.0",
@@ -28,26 +28,26 @@
     "esbuild": "0.27.0",
     "form-data": "^4.0.0",
     "jose": "5.9.6",
-    "@vercel/build-utils": "13.2.7",
-    "@vercel/backends": "0.0.20",
+    "@vercel/build-utils": "13.2.8",
     "@vercel/detect-agent": "1.0.0",
-    "@vercel/express": "0.1.25",
-    "@vercel/elysia": "0.1.18",
-    "@vercel/fastify": "0.1.21",
+    "@vercel/elysia": "0.1.19",
+    "@vercel/express": "0.1.26",
+    "@vercel/fastify": "0.1.22",
     "@vercel/go": "3.3.0",
-    "@vercel/h3": "0.1.27",
-    "@vercel/hono": "0.2.21",
-    "@vercel/hydrogen": "1.3.4",
-    "@vercel/koa": "0.1.1",
-    "@vercel/nestjs": "0.2.22",
-    "@vercel/node": "5.5.19",
-    "@vercel/next": "4.15.13",
+    "@vercel/h3": "0.1.28",
+    "@vercel/hono": "0.2.22",
+    "@vercel/hydrogen": "1.3.5",
+    "@vercel/koa": "0.1.2",
+    "@vercel/nestjs": "0.2.23",
+    "@vercel/node": "5.5.20",
+    "@vercel/next": "4.15.14",
+    "@vercel/redwood": "2.4.8",
     "@vercel/python": "6.1.6",
-    "@vercel/redwood": "2.4.7",
-    "@vercel/remix-builder": "5.5.7",
-    "@vercel/ruby": "2.2.4",
+    "@vercel/remix-builder": "5.5.8",
     "@vercel/rust": "1.0.4",
-    "@vercel/static-build": "2.8.18"
+    "@vercel/ruby": "2.2.4",
+    "@vercel/static-build": "2.8.19",
+    "@vercel/backends": "0.0.21"
   },
   "devDependencies": {
     "@alex_neo/jest-expect-message": "1.0.5",
@@ -174,7 +174,7 @@
     "@vercel-internals/constants": "1.0.4",
     "@vercel-internals/get-package-json": "1.0.0",
     "@vercel-internals/types": "3.0.6",
-    "@vercel/client": "17.2.21",
+    "@vercel/client": "17.2.22",
     "@vercel/error-utils": "2.0.3",
     "@vercel/frameworks": "3.15.5",
     "@vercel/fs-detectors": "5.7.13",