Skip to content

fix(cli): fix import resolution strategy for builders#15041

Merged
mehulkar merged 10 commits intomainfrom
mk/fix-import-resolution-logic
Feb 13, 2026
Merged

fix(cli): fix import resolution strategy for builders#15041
mehulkar merged 10 commits intomainfrom
mk/fix-import-resolution-logic

Conversation

@mehulkar
Copy link
Copy Markdown
Contributor

@mehulkar mehulkar commented Feb 13, 2026

Previously, if a builder was not found in the local cache directory, we
were always installing it. This was incorrect. We should first check the
CLI's node modules for the builder. This will support environments like
the Vercel build container that pre-install all the builders for
performance.

This also fixes the e2e test for eleventy-v0. This fixture was
incidentally failing to deploy with this bug, because a local
.vercel/builders directory was created with node_modules. The test setup
uses vc deploy, which does not push up the .gitignore file, so eleventy
was then trying to read all of .vercel/builders and building it. This
failed because there HAPPENED to be a file in there that Eleventy could
not process. Through a series of fortunate circumstances, we found this
bug.

Note

Low Risk Change

This PR changes builder import resolution order to check CLI's node_modules before installing, which is a logic change in build tooling but does not affect security, auth, or data integrity.

  • Reorders builder resolution: checks CLI node_modules before triggering install
  • Removes early-exit install path when peerDep not found in cache
  • Adds unit test and .eleventyignore entry for test fixture

Risk assessment for commit cd7917c.

Previously, if a builder was not found in the local cache directory, we
were always installing it. This was incorrect. We should first check the
CLI's node modules for the builder. This will support environments like
the Vercel build container that pre-install all the builders for
performance.

This also fixes the e2e test for eleventy-v0. This fixture was
incidentally failing to deploy with this bug, because a local
.vercel/builders directory was created with node_modules. The test setup
uses vc deploy, which does not push up the .gitignore file, so eleventy
was then trying to read all of .vercel/builders and building it. This
failed because there HAPPENED to be a file in there that Eleventy could
not process. Through a series of fortunate circumstances, we found this
bug.
@changeset-bot
Copy link
Copy Markdown

changeset-bot bot commented Feb 13, 2026

🦋 Changeset detected

Latest commit: cd7917c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
vercel Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Feb 13, 2026

📦 CLI Tarball Ready

The Vercel CLI tarball for this PR is now available!

Quick Test

You can test this PR's CLI directly by running:

npx https://vercel-lqu0tme2j.vercel.sh/tarballs/vercel.tgz --help

Use in vercel.json

To use this CLI version in your project builds, add to your vercel.json:

{
  "build": {
    "env": {
      "VERCEL_CLI_VERSION": "vercel@https://vercel-lqu0tme2j.vercel.sh/tarballs/vercel.tgz"
    }
  }
}

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Feb 13, 2026

🧪 Unit Test Strategy

Comparing: f278d46cd7917c (view diff)

Strategy: Code changed outside of a package - running all unit tests

⚠️ All unit tests will run because global code changes could impact all packages.

Affected packages - 25 (63%)
  1. @vercel/backends
  2. @vercel/cervel
  3. @vercel/elysia
  4. @vercel/express
  5. @vercel/fastify
  6. @vercel/go
  7. @vercel/h3
  8. @vercel/hono
  9. @vercel/hydrogen
  10. @vercel/koa
  11. @vercel/nestjs
  12. @vercel/next
  13. @vercel/node
  14. @vercel/python
  15. @vercel/redwood
  16. @vercel/remix-builder
  17. @vercel/ruby
  18. @vercel/rust
  19. @vercel/static-build
  20. vercel
  21. @vercel/build-utils
  22. @vercel/client
  23. @vercel/firewall
  24. @vercel/fs-detectors
  25. examples
Unaffected packages - 15 (38%)
  1. @vercel-internals/get-package-json
  2. @vercel/cli-auth
  3. @vercel/config
  4. @vercel/detect-agent
  5. @vercel/edge
  6. @vercel/error-utils
  7. @vercel/frameworks
  8. @vercel/functions
  9. @vercel/gatsby-plugin-vercel-builder
  10. @vercel/oidc
  11. @vercel/oidc-aws-credentials-provider
  12. @vercel/python-analysis
  13. @vercel/related-projects
  14. @vercel/routing-utils
  15. @vercel/static-config

Results

  • Unit tests: All affected packages will run unit tests
  • E2E tests: Running in parallel via E2E Tests workflow
  • Type checks: All affected packages will run type checks

This comment is automatically generated based on the affected testing strategy

@mehulkar mehulkar marked this pull request as ready for review February 13, 2026 04:52
@mehulkar mehulkar requested review from a team and ijjk as code owners February 13, 2026 04:52
@mehulkar mehulkar requested a review from jeffsee55 February 13, 2026 04:52
@mehulkar mehulkar merged commit 2aad073 into main Feb 13, 2026
190 checks passed
@mehulkar mehulkar deleted the mk/fix-import-resolution-logic branch February 13, 2026 06:03
mehulkar pushed a commit that referenced this pull request Feb 13, 2026
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and publish to npm
yourself or [setup this action to publish
automatically](https://github.com/changesets/action#with-publishing). If
you're not ready to do a release yet, that's fine, whenever you add more
changesets to main, this PR will be updated.


# Releases
## vercel@50.17.0

### Minor Changes

- Install builder packages on demand
([#15023](#15023))

- Display functions exceeding 250MB uncompressed size limit with total
size and breakdown of largest dependencies (requires environment
variable VERCEL_ANALYZE_BUILD_OUTPUT=1).
([#14067](#14067))

### Patch Changes

- Add `--format=json` option to `vercel integration list` and show
project name in table header when results are scoped to a project
([#15007](#15007))

- Fix builder import resolution from pre-installed depenencies
([#15041](#15041))

- Services routing improvements:
([#15018](#15018))

- Fix route ownership scoping so parent service catch-alls (e.g. Vite
SPA fallback) don't capture sibling service prefixes
- Move shared ownership-guard helpers (`getOwnershipGuard`,
`scopeRouteSourceToOwnership`) to `@vercel/routing-utils`
- Place runtime service function outputs under internal
`/_svc/<service>/index` namespace to prevent filesystem path leakage
    -   Block `/_svc` as a reserved routePrefix in service validation
- Scope all builder-emitted routes (not just route-owning builders) to
their service ownership before merging

-   Updated dependencies \[]:
    -   @vercel/static-build@2.8.37
    -   @vercel/build-utils@13.4.0
    -   @vercel/next@4.15.28
    -   @vercel/redwood@2.4.9
    -   @vercel/rust@1.0.5

## @vercel/client@17.2.41

### Patch Changes

- Updated dependencies
\[[`3cd0b559f1815fdb13f7aa05114bae2b0b0b0e68`](3cd0b55)]:
    -   @vercel/routing-utils@5.3.3
    -   @vercel/build-utils@13.4.0

## @vercel/fs-detectors@5.8.6

### Patch Changes

- Services routing improvements:
([#15018](#15018))

- Fix route ownership scoping so parent service catch-alls (e.g. Vite
SPA fallback) don't capture sibling service prefixes
- Move shared ownership-guard helpers (`getOwnershipGuard`,
`scopeRouteSourceToOwnership`) to `@vercel/routing-utils`
- Place runtime service function outputs under internal
`/_svc/<service>/index` namespace to prevent filesystem path leakage
    -   Block `/_svc` as a reserved routePrefix in service validation
- Scope all builder-emitted routes (not just route-owning builders) to
their service ownership before merging

- Updated dependencies
\[[`3cd0b559f1815fdb13f7aa05114bae2b0b0b0e68`](3cd0b55)]:
    -   @vercel/routing-utils@5.3.3
    -   @vercel/frameworks@3.17.1

## @vercel/routing-utils@5.3.3

### Patch Changes

- Services routing improvements:
([#15018](#15018))

- Fix route ownership scoping so parent service catch-alls (e.g. Vite
SPA fallback) don't capture sibling service prefixes
- Move shared ownership-guard helpers (`getOwnershipGuard`,
`scopeRouteSourceToOwnership`) to `@vercel/routing-utils`
- Place runtime service function outputs under internal
`/_svc/<service>/index` namespace to prevent filesystem path leakage
    -   Block `/_svc` as a reserved routePrefix in service validation
- Scope all builder-emitted routes (not just route-owning builders) to
their service ownership before merging


<!-- VADE_RISK_START -->
> [!NOTE]
> Low Risk Change
>
> This PR is an automated Changesets release that only updates version
numbers in package.json files and adds changelog entries - no source
code changes are present.
> 
> - Deletes changeset markdown files after consuming them
> - Bumps version numbers in 4 package.json files
> - Adds changelog entries documenting previous changes
>
> <sup>Risk assessment for [commit
9186d29](https://github.com/vercel/vercel/commit/9186d293adee9d555b8582f5c1d0cec87689acf1).</sup>
<!-- VADE_RISK_END -->

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
mehulkar added a commit that referenced this pull request Feb 16, 2026
2 commits related moving builders out of the bundle:

- #15023
- #15041

Since it's isn't a clean revert, I've:

- moved builders back into dependencies, and reverted import-builders
and its tests to the commit at 3cd0b55
(parent of
127547d).
No other commits have landed to these files since then, so it seems like
the best way of doing this.

This commit also contains a timestamp update on all builders `.deploy`
files. This is just a way to invalidate the builders so all e2e tests
run on this PR.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants