Use dynamic inspection to find django entry points by msullivan · Pull Request #15367 · vercel/vercel

msullivan · 2026-03-04T02:45:11Z

Instead of parsing the manage.py and the settings file,
we instead import it with python and print out the globals in it.

To find the settings file, we run manage.py with a monkeypatch.

This will handle some stuff like sibling imports (from .common import *, discussed in #15354) that we don't handle now, and will provide a
framework for handling other dynamic stuff as well.

I've pulled out some of the existing django identification stuff.

Note

Low Risk Change

This PR replaces static AST-based Django settings parsing with dynamic Python execution that imports and runs manage.py, which introduces potential code execution risks during build but is a refactor of existing build-time behavior rather than a security control change.

New dynamic Django settings discovery executes Python code via execa('python', ['-c', script])
Removes static AST parsing functions (parseDjangoSettingsModule, getDjangoEntrypoint) in favor of runtime imports
Adds Python script that monkeypatches Django and runs manage.py to extract settings

^{Risk assessment for commit 41ffba8.}

changeset-bot · 2026-03-04T02:45:16Z

🦋 Changeset detected

Latest commit: 41ffba8

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 17 packages

Name	Type
@vercel/python-analysis	Minor
@vercel/build-utils	Minor
@vercel/python	Minor
@vercel/backends	Patch
vercel	Patch
@vercel/client	Patch
@vercel/elysia	Patch
@vercel/express	Patch
@vercel/fastify	Patch
@vercel/gatsby-plugin-vercel-builder	Patch
@vercel/h3	Patch
@vercel/hono	Patch
@vercel/koa	Patch
@vercel/nestjs	Patch
@vercel/node	Patch
@vercel/static-build	Patch
@vercel/cervel	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

github-actions · 2026-03-04T02:49:00Z

🧪 Unit Test Strategy

Comparing: 0a78892 → 41ffba8 (view diff)

Strategy: Code changed outside of a package - running all unit tests

⚠️ All unit tests will run because global code changes could impact all packages.

Affected packages - 40 (100%)

@vercel-internals/get-package-json
@vercel/backends
@vercel/build-utils
@vercel/cervel
@vercel/cli-auth
@vercel/client
@vercel/config
@vercel/detect-agent
@vercel/edge
@vercel/elysia
@vercel/error-utils
@vercel/express
@vercel/fastify
@vercel/firewall
@vercel/frameworks
@vercel/fs-detectors
@vercel/functions
@vercel/gatsby-plugin-vercel-builder
@vercel/go
@vercel/h3
@vercel/hono
@vercel/hydrogen
@vercel/koa
@vercel/nestjs
@vercel/next
@vercel/node
@vercel/oidc
@vercel/oidc-aws-credentials-provider
@vercel/python
@vercel/python-analysis
@vercel/redwood
@vercel/related-projects
@vercel/remix-builder
@vercel/routing-utils
@vercel/ruby
@vercel/rust
@vercel/static-build
@vercel/static-config
examples
vercel

Results

Unit tests: All affected packages will run unit tests
E2E tests: Running in parallel via E2E Tests workflow
Type checks: All affected packages will run type checks

This comment is automatically generated based on the affected testing strategy

packages/python/src/start-dev-server.ts

github-actions · 2026-03-04T19:00:40Z

📦 CLI Tarball Ready

The Vercel CLI tarball for this PR is now available!

Quick Test

You can test this PR's CLI directly by running:

npx https://vercel-jpypo3686.vercel.sh/tarballs/vercel.tgz --help

Use in vercel.json

To use this CLI version in your project builds, add to your vercel.json:

{
  "build": {
    "env": {
      "VERCEL_CLI_VERSION": "vercel@https://vercel-jpypo3686.vercel.sh/tarballs/vercel.tgz"
    }
  }
}

Python Runtime Wheel

A vercel-runtime wheel was also built for this PR.
To use in your Python project builds, also set this environment variable:

VERCEL_RUNTIME_PYTHON="vercel-runtime @ https://vercel-jpypo3686.vercel.sh/tarballs/vercel_runtime-0.6.0.dev1772758568+41ffba8-py3-none-any.whl"

Python Workers Wheel

A vercel-workers wheel was also built for this PR.
To use in your Python project builds, also set this environment variable:

VERCEL_WORKERS_PYTHON="vercel-workers @ https://vercel-jpypo3686.vercel.sh/tarballs/vercel_workers-0.1.0.dev1772758568+41ffba8-py3-none-any.whl"

packages/python/src/django.ts

Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>

Instead of statically parsing manage.py with WASM AST to extract the DJANGO_SETTINGS_MODULE value, run manage.py itself with a patched execute_from_command_line to capture the actual settings module from the environment, then load and dump settings in one Python invocation. This handles any way manage.py might set DJANGO_SETTINGS_MODULE (conditionals, variables, etc.), not just os.environ.setdefault. Also removes the now-dead parseDjangoSettingsModule from all layers (WIT, Rust, TypeScript wrapper, re-exports, and tests).

Move the inline Python script from django.ts into vc_django_settings.py, matching the pattern used by vc_init_dev.py. Read it at module load time and pass via python -c to keep sys.path[0] as the project directory.

Move vc_django_settings.py and vc_init_dev.py into a templates/ subdirectory for better organization.

The templates/ directory containing vc_django_settings.py and vc_init_dev.py was not included in the published package, causing ENOENT at import time in CI.

Resolve conflicts keeping containsTopLevelCallable and getStringConstant from main while still removing parseDjangoSettingsModule (replaced by dynamic manage.py execution)

This PR was opened by the [Changesets release](https://github.com/changesets/action) GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated. # Releases ## @vercel/build-utils@13.7.0 ### Minor Changes - [python] add support for module-based entrypoints for cron jobs ([#15393](#15393)) - For the django frontend, dynamically load settings.py instead of parsing it ([#15367](#15367)) ### Patch Changes - Updated dependencies \[[`83e804013528fc54de31082960ae31f58339bd71`](83e8040), [`921314f958c4ec85adb09e020310a5becb7f866c`](921314f)]: - @vercel/python-analysis@0.9.0 ## vercel@50.29.0 ### Minor Changes - Add interactive mode to `webhooks create` and change warning prefix from `WARN!` to `WARNING!` ([#15406](#15406)) ### Patch Changes - Updated dependencies \[[`32e8ba5f593fdeddeb63d241d7806d6c12fffe76`](32e8ba5), [`83e804013528fc54de31082960ae31f58339bd71`](83e8040), [`0f1fa86770a35d0192d64d36cb46d932e1d2a12a`](0f1fa86), [`813f3d324404237e3806530b465625ea33816370`](813f3d3), [`0a78892b1e155eb4b587a8b84c4e6814f750697f`](0a78892), [`9a973a704b7350e19d0c3ac8e110ce55eea795b2`](9a973a7), [`c6f5ac6c11fb7f431b5fb634a7fb321b10c829af`](c6f5ac6), [`921314f958c4ec85adb09e020310a5becb7f866c`](921314f)]: - @vercel/next@4.15.42 - @vercel/build-utils@13.7.0 - @vercel/python@6.21.0 - @vercel/detect-agent@1.1.1 - @vercel/static-build@2.8.46 - @vercel/backends@0.0.42 - @vercel/elysia@0.1.45 - @vercel/express@0.1.54 - @vercel/fastify@0.1.48 - @vercel/go@3.4.3 - @vercel/h3@0.1.54 - @vercel/hono@0.2.48 - @vercel/hydrogen@1.3.5 - @vercel/koa@0.1.28 - @vercel/nestjs@0.2.49 - @vercel/node@5.6.12 - @vercel/redwood@2.4.9 - @vercel/remix-builder@5.6.0 - @vercel/ruby@2.3.2 - @vercel/rust@1.0.5 ## @vercel/fs-detectors@5.9.0 ### Minor Changes - [python] add support for module-based entrypoints for cron jobs ([#15393](#15393)) ### Patch Changes - [python] add support for Python worker services with Django tasks ([#15396](#15396)) ## @vercel/python@6.21.0 ### Minor Changes - [python] add support for module-based entrypoints for cron jobs ([#15393](#15393)) - Avoid doing entry point detection on every request to a python dev server ([#15365](#15365)) - For the django frontend, dynamically load settings.py instead of parsing it ([#15367](#15367)) ### Patch Changes - speed up python entrypoint detection ([#15402](#15402)) - Add Python builder cache preparation for Build Output API v3 cache globs, the builder virtualenv, and the repo-local uv cache. ([#15407](#15407)) - Updated dependencies \[[`83e804013528fc54de31082960ae31f58339bd71`](83e8040), [`921314f958c4ec85adb09e020310a5becb7f866c`](921314f)]: - @vercel/python-analysis@0.9.0 ## @vercel/python-analysis@0.9.0 ### Minor Changes - [python] add support for module-based entrypoints for cron jobs ([#15393](#15393)) - For the django frontend, dynamically load settings.py instead of parsing it ([#15367](#15367)) ## @vercel/backends@0.0.42 ### Patch Changes - Updated dependencies \[[`83e804013528fc54de31082960ae31f58339bd71`](83e8040), [`921314f958c4ec85adb09e020310a5becb7f866c`](921314f)]: - @vercel/build-utils@13.7.0 ## @vercel/cervel@0.0.29 ### Patch Changes - Updated dependencies \[]: - @vercel/backends@0.0.42 ## @vercel/client@17.2.54 ### Patch Changes - Updated dependencies \[[`83e804013528fc54de31082960ae31f58339bd71`](83e8040), [`921314f958c4ec85adb09e020310a5becb7f866c`](921314f)]: - @vercel/build-utils@13.7.0 ## @vercel/config@0.0.38 ### Patch Changes - Fix type generation ([#15386](#15386)) ## @vercel/detect-agent@1.1.1 ### Patch Changes - Add Antigravity agent detection via `ANTIGRAVITY_AGENT` environment variable ([#15413](#15413)) - Detect Codex when `CODEX_CI` or `CODEX_THREAD_ID` is present. ([#15412](#15412)) ## @vercel/elysia@0.1.45 ### Patch Changes - Updated dependencies \[]: - @vercel/node@5.6.12 ## @vercel/express@0.1.54 ### Patch Changes - Updated dependencies \[]: - @vercel/node@5.6.12 - @vercel/cervel@0.0.29 ## @vercel/fastify@0.1.48 ### Patch Changes - Updated dependencies \[]: - @vercel/node@5.6.12 ## @vercel/gatsby-plugin-vercel-builder@2.0.144 ### Patch Changes - Updated dependencies \[[`83e804013528fc54de31082960ae31f58339bd71`](83e8040), [`921314f958c4ec85adb09e020310a5becb7f866c`](921314f)]: - @vercel/build-utils@13.7.0 ## @vercel/h3@0.1.54 ### Patch Changes - Updated dependencies \[]: - @vercel/node@5.6.12 ## @vercel/hono@0.2.48 ### Patch Changes - Updated dependencies \[]: - @vercel/node@5.6.12 ## @vercel/koa@0.1.28 ### Patch Changes - Updated dependencies \[]: - @vercel/node@5.6.12 ## @vercel/nestjs@0.2.49 ### Patch Changes - Updated dependencies \[]: - @vercel/node@5.6.12 ## @vercel/next@4.15.42 ### Patch Changes - Revert "[next] vary fallback allowQuery for partial fallback shells" ([#15418](#15418)) ## @vercel/node@5.6.12 ### Patch Changes - Updated dependencies \[[`83e804013528fc54de31082960ae31f58339bd71`](83e8040), [`921314f958c4ec85adb09e020310a5becb7f866c`](921314f)]: - @vercel/build-utils@13.7.0 ## @vercel/static-build@2.8.46 ### Patch Changes - Updated dependencies \[]: - @vercel/gatsby-plugin-vercel-builder@2.0.144 ## @vercel/python-runtime@0.6.0 ### Minor Changes - [python] add support for Python worker services with Django tasks ([#15396](#15396)) - [python] add support for module-based entrypoints for cron jobs ([#15393](#15393))  > [!NOTE] > Low Risk Change > > This PR is an automated Changesets release that only updates version numbers in package.json files, CHANGELOG.md files, and deletes changeset markdown files — no functional code changes. > > - Version bumps across ~30 packages (patch/minor) > - Changelog and changeset file updates only > - Single constant update: VERCEL_RUNTIME_VERSION = '0.6.0' > > <sup>Risk assessment for [commit d3cf7ea](https://github.com/vercel/vercel/commit/d3cf7ea8deab73a058f4228f0346317fcf3e3dbc).</sup>  Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

vercel bot deployed to Preview March 4, 2026 02:48 View deployment

vercel bot reviewed Mar 4, 2026

View reviewed changes

packages/python/src/start-dev-server.ts Outdated Show resolved Hide resolved

dnwpark approved these changes Mar 4, 2026

View reviewed changes

vercel bot deployed to Preview March 4, 2026 19:00 View deployment

msullivan force-pushed the django-dynamic branch from ac34039 to c5782e2 Compare March 4, 2026 19:01

vercel bot deployed to Preview March 4, 2026 19:04 View deployment

vercel bot deployed to Preview March 4, 2026 22:14 View deployment

vercel bot deployed to Preview March 4, 2026 22:44 View deployment

msullivan force-pushed the django-dynamic branch from 5e4ce0c to f5238c3 Compare March 5, 2026 00:26

vercel bot deployed to Preview March 5, 2026 00:30 View deployment

msullivan changed the title ~~[WIP] Use dynamic inspection to find django entry points~~ Use dynamic inspection to find django entry points Mar 5, 2026

msullivan marked this pull request as ready for review March 5, 2026 03:50

msullivan requested review from a team as code owners March 5, 2026 03:50

vercel bot deployed to Preview March 5, 2026 03:53 View deployment

gscho reviewed Mar 5, 2026

View reviewed changes

packages/python/src/django.ts Outdated Show resolved Hide resolved

msullivan and others added 10 commits March 5, 2026 10:27

WIP: return structured object from detectPythonEntrypoint

ebab39b

WIP: django framework hook reads settings module

0ba4881

WIP: django hook resolves entrypoint from settings module

b350ac4

Remove the static settings search stuff from the ts

5aaec2a

Update packages/python/src/start-dev-server.ts

db841bb

Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>

remove unused getStringConstant from python-analysis

042efa2

changeset

78a0cee

Extract Django settings script to standalone .py file

64f7092

Move the inline Python script from django.ts into vc_django_settings.py, matching the pattern used by vc_init_dev.py. Read it at module load time and pass via python -c to keep sys.path[0] as the project directory.

Move Python template scripts into templates/ directory

1e31dbd

Move vc_django_settings.py and vc_init_dev.py into a templates/ subdirectory for better organization.

msullivan force-pushed the django-dynamic branch from d45185a to 1e31dbd Compare March 5, 2026 18:27

vercel bot deployed to Preview March 5, 2026 18:35 View deployment

Fix package.json files to include templates/ directory

ee4af7b

The templates/ directory containing vc_django_settings.py and vc_init_dev.py was not included in the published package, causing ENOENT at import time in CI.

vercel bot deployed to Preview March 5, 2026 19:45 View deployment

tweak

ba3b8c2

msullivan force-pushed the django-dynamic branch from 17e745d to 9091033 Compare March 5, 2026 22:46

vercel bot deployed to Preview March 5, 2026 22:49 View deployment

Merge main into django-dynamic

d9570d0

Resolve conflicts keeping containsTopLevelCallable and getStringConstant from main while still removing parseDjangoSettingsModule (replaced by dynamic manage.py execution)

msullivan force-pushed the django-dynamic branch from 9091033 to d9570d0 Compare March 6, 2026 00:34

vercel bot deployed to Preview March 6, 2026 00:35 View deployment

Merge branch 'main' into django-dynamic

41ffba8

vercel bot deployed to Preview March 6, 2026 00:57 View deployment

ricardo-agz approved these changes Mar 6, 2026

View reviewed changes

msullivan merged commit 921314f into main Mar 6, 2026
256 of 258 checks passed

msullivan deleted the django-dynamic branch March 6, 2026 05:25

vercel-release-bot mentioned this pull request Mar 6, 2026

Version Packages #15395

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use dynamic inspection to find django entry points#15367

Use dynamic inspection to find django entry points#15367
msullivan merged 14 commits intomainfrom
django-dynamic

msullivan commented Mar 4, 2026 •

edited by vercel bot

Loading

Uh oh!

changeset-bot bot commented Mar 4, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 4, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions bot commented Mar 4, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

msullivan commented Mar 4, 2026 • edited by vercel bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

github-actions bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🧪 Unit Test Strategy

Results

Uh oh!

Uh oh!

github-actions bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📦 CLI Tarball Ready

Quick Test

Use in vercel.json

Python Runtime Wheel

Python Workers Wheel

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

msullivan commented Mar 4, 2026 •

edited by vercel bot

Loading

changeset-bot bot commented Mar 4, 2026 •

edited

Loading

github-actions bot commented Mar 4, 2026 •

edited

Loading

github-actions bot commented Mar 4, 2026 •

edited

Loading