Skip to content

[python-runtime] Vendor runtime dependencies#14827

Merged
elprans merged 4 commits intomainfrom
elprans/python-runtime-vendoring
Feb 3, 2026
Merged

[python-runtime] Vendor runtime dependencies#14827
elprans merged 4 commits intomainfrom
elprans/python-runtime-vendoring

Conversation

@elprans
Copy link
Contributor

@elprans elprans commented Feb 2, 2026

The Python runtime depends on werkzeug and uvicorn to provide
the WSGI and ASGI server glue. Currently, those dependencies are
injected as normal dependencies. This is problematic because we
cannot pin the dependencies as that might conflict with dependencies in
user projects.

Since we only depend on a small set of packages which themselves are
largely dependency-free, we can get away with vendoring the dependencies
directly into the runtime package. Use the vendoring tool, which is
what pip uses to vendor its dependencies.

@elprans elprans requested review from a team as code owners February 2, 2026 15:49
@elprans elprans requested a review from a team February 2, 2026 15:49
@changeset-bot
Copy link

changeset-bot bot commented Feb 2, 2026

🦋 Changeset detected

Latest commit: f4ae44f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages
Name Type
@vercel/python-runtime Minor
@vercel/python Minor
vercel Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions
Copy link
Contributor

github-actions bot commented Feb 2, 2026

📦 CLI Tarball Ready

The Vercel CLI tarball for this PR is now available!

Quick Test

You can test this PR's CLI directly by running:

npx https://vercel-ae1ycwzd2.vercel.sh/tarballs/vercel.tgz --help

Use in vercel.json

To use this CLI version in your project builds, add to your vercel.json:

{
  "build": {
    "env": {
      "VERCEL_CLI_VERSION": "vercel@https://vercel-ae1ycwzd2.vercel.sh/tarballs/vercel.tgz"
    }
  }
}

@github-actions
Copy link
Contributor

github-actions bot commented Feb 2, 2026

🧪 Unit Test Strategy

Comparing: c3104a1f4ae44f (view diff)

Strategy: Affected packages only

✅ Only testing packages that have been modified or depend on modified packages.

Affected packages - 2 (5%)
  1. @vercel/python
  2. vercel
Unaffected packages - 39 (95%)
  1. @vercel-internals/get-package-json
  2. @vercel/backends
  3. @vercel/build-utils
  4. @vercel/cervel
  5. @vercel/cli-auth
  6. @vercel/client
  7. @vercel/config
  8. @vercel/detect-agent
  9. @vercel/edge
  10. @vercel/elysia
  11. @vercel/error-utils
  12. @vercel/express
  13. @vercel/fastify
  14. @vercel/firewall
  15. @vercel/frameworks
  16. @vercel/fs-detectors
  17. @vercel/functions
  18. @vercel/gatsby-plugin-vercel-builder
  19. @vercel/go
  20. @vercel/h3
  21. @vercel/hono
  22. @vercel/hydrogen
  23. @vercel/introspection
  24. @vercel/koa
  25. @vercel/nestjs
  26. @vercel/next
  27. @vercel/node
  28. @vercel/oidc
  29. @vercel/oidc-aws-credentials-provider
  30. @vercel/python-analysis
  31. @vercel/redwood
  32. @vercel/related-projects
  33. @vercel/remix-builder
  34. @vercel/routing-utils
  35. @vercel/ruby
  36. @vercel/rust
  37. @vercel/static-build
  38. @vercel/static-config
  39. examples

Results

  • Unit tests: Only affected packages will run unit tests
  • E2E tests: Handled separately (Version Packages PRs or run-e2e-tests label)
  • Type checks: Only affected packages will run type checks

This comment is automatically generated based on the affected testing strategy

Copy link
Contributor

@ricardo-agz ricardo-agz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice, LGTM

The Python runtime depends on `werkzeug` and `uvicorn` to provide
the WSGI and ASGI server glue.  Currently, those dependencies are
injected as normal dependencies.  This is problematic because we
cannot pin the dependencies as that might conflict with dependencies in
user projects.

Since we only depend on a small set of packages which themselves are
largely dependency-free, we can get away with vendoring the dependencies
directly into the runtime package.  Use the `vendoring` tool, which is
what `pip` uses to vendor its dependencies.

This commit is the result of running `uvx --with=pip vendoring sync` and
purely adds the vendored code without changing the existing imports yet.
Use packages vendored in the previous commit.
Runtime dependencies are now vendored and do not need to be injected
@elprans elprans merged commit e7c5d5f into main Feb 3, 2026
126 checks passed
@elprans elprans deleted the elprans/python-runtime-vendoring branch February 3, 2026 18:45
jeffsee55 pushed a commit that referenced this pull request Feb 3, 2026
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## vercel@50.10.0

### Minor Changes

- feat(cli): Add webhooks command for managing webhooks
([#14789](#14789))

Adds a new `webhooks` command to the Vercel CLI with the following
subcommands:

- `webhooks ls` - List all webhooks with optional `--format json` output
- `webhooks get <id>` - Get details of a specific webhook with optional
`--format json` output
- `webhooks create <url> --event <event>` - Create a new webhook with
specified events
- `webhooks rm <id>` - Remove a webhook with `--yes` flag to skip
confirmation

Webhook event types are fetched dynamically from the OpenAPI spec to
stay in sync with the API.

- Added experimental services support in the CLI new project flow. When
`VERCEL_USE_EXPERIMENTAL_SERVICES=1` is set and a project's
`vercel.json` contains `experimentalServices`, the CLI will detect and
display the configured services during project setup, automatically
selecting the "services" framework preset.
([#14776](#14776))

### Patch Changes

- Improve logsv2 command output format with compact single-line display,
text-based level labels, dynamic column widths, and smart date display
([#14767](#14767))

- Skip update check when running on Vercel to prevent unnecessary worker
spawning in build container
([#14794](#14794))

- fix --help exit codes for marketplace commands
([#14834](#14834))

- Updated dependencies
\[[`687f73cebb6ae1cdd7c7feb0910967de99a17ad6`](687f73c),
[`e7c5d5fd41e124ef7314978b351696d130e89917`](e7c5d5f),
[`c3104a1ae9dbf9048e08bb2fa85605a95b254876`](c3104a1),
[`b029736b4be8dac135bef77283f47e1450faf0a9`](b029736),
[`d36c1ad3ddaf9303041e61a0a41d973b02007988`](d36c1ad),
[`5b31b133970539986ff9e98013d2c364536bd0b5`](5b31b13)]:
    -   @vercel/next@4.15.21
    -   @vercel/python@6.5.0
    -   @vercel/remix-builder@5.5.10
    -   @vercel/backends@0.0.25
    -   @vercel/static-build@2.8.28
    -   @vercel/node@5.5.28
    -   @vercel/express@0.1.36

## @vercel/python@6.5.0

### Minor Changes

- vendor Python runtime dependencies
([#14827](#14827))

- Bump vercel-runtime version automatically on its releases
([#14842](#14842))

## @vercel/python-analysis@0.3.0

### Minor Changes

- initial implementation of Python semantic analysis in Rust
([#14690](#14690))

## @vercel/backends@0.0.25

### Patch Changes

- Improve handling of cjs/esm interop during imports
([#14798](#14798))

## @vercel/cervel@0.0.12

### Patch Changes

- Improve handling of cjs/esm interop during imports
([#14798](#14798))

- Updated dependencies
\[[`d36c1ad3ddaf9303041e61a0a41d973b02007988`](d36c1ad)]:
    -   @vercel/backends@0.0.25

## @vercel/express@0.1.36

### Patch Changes

- Updated dependencies
\[[`d36c1ad3ddaf9303041e61a0a41d973b02007988`](d36c1ad)]:
    -   @vercel/cervel@0.0.12
    -   @vercel/node@5.5.28

## @vercel/fs-detectors@5.7.20

### Patch Changes

- Added experimental services support in the CLI new project flow. When
`VERCEL_USE_EXPERIMENTAL_SERVICES=1` is set and a project's
`vercel.json` contains `experimentalServices`, the CLI will detect and
display the configured services during project setup, automatically
selecting the "services" framework preset.
([#14776](#14776))

## @vercel/functions@3.4.1

### Patch Changes

- Fix InMemoryCache to use JSON serialization for consistency with
RuntimeCache ([#14751](#14751))

InMemoryCache now serializes values with `JSON.stringify()` on set and
deserializes with `JSON.parse()` on get, matching the behavior of
RuntimeCache. This ensures consistent behavior when switching between
cache implementations (e.g., in-memory for development, remote for
production), particularly for types that don't survive JSON round-trips
like `Date`, `Map`, `Set`, and `undefined`.

## @vercel/introspection@0.0.11

### Patch Changes

- Updated dependencies
\[[`d36c1ad3ddaf9303041e61a0a41d973b02007988`](d36c1ad)]:
    -   @vercel/backends@0.0.25

## @vercel/next@4.15.21

### Patch Changes

- Strip routes-manifest.json for determinism
([#14783](#14783))

- Update Next.js adapter version
([#14801](#14801))

## @vercel/remix-builder@5.5.10

### Patch Changes

- [remix] Prevent 404 responses from being cached with immutable headers
([#14828](#14828))

## @vercel/python-runtime@0.3.0

### Minor Changes

- vendor Python runtime dependencies
([#14827](#14827))

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants