Unwanted serving of static files

Help
1

I have a basic api made using Express and Vercel Serverless Functions.
I deployed my project on vercel and got everything working perfect.

This is the vercel.json I used:

{
  "version": 2,
  "builds": [
    {
      "src": "api/batteries.js",
      "use": "@vercel/node"
    }
  ],
  "routes": [
    {
      "src": "/api/batteries",
      "dest": "api/batteries.js"
    }
  ]
}

Going through the Vercel docs, I found this:

We recommend against using this property. To customize Serverless Functions, please use the functions property instead.

We recommend using cleanUrls, trailingSlash, redirects, rewrites, and/or headers instead.

When i used the recommended Functions and Rewrites property instead of the legacy ones, files at the root of my project (test.js and pnpm-lock.yaml) started to being served as static assets.

This is the vercel.json configuration I’m having issues with:

{
  "functions": {
    "api/batteries.js": {
      "memory": 128,
      "maxDuration": 10
    }
  },
  "rewrites": [
    {
      "source": "/api/batteries",
      "destination": "/api/batteries.js"
    }
  ]
}

My project structure:

  • api/batteries.js
  • .gitignore
  • pnpm-lock.yaml
  • package.json
  • test.js
  • vercel.json

Is there any property I might have missed to explicitly exclude files from the build output?
As the builds property was handling it automatically for me:

When at least one builds item is specified, only the outputs of the build processes will be included in the resulting deployment as a security precaution. This is why we need to allowlist static files explicitly with @vercel/static .

Additional Info:

  • I can’t use .vercelignore as doing so will unwantedly increase the build time cuz the package manager will have to resolve all the deps every time build is triggered.
  • excludeFiles will obviously not work as it does not interfere with the build step or output. It will exclude the lockfile from the Serverless Function.
2

Hi, @kinjalkashyap!

I know you didn’t want to use .vercelignore but this is actually the recommended way to exclude files from deployment. The .vercelignore file doesn’t affect dependency resolution; it only tells Vercel what to ignore during deployment.

Alternatively, you could move your API files to a directory like api/ and adjust your vercel.json accordingly, Vercel will only deploy the contents of that directory.

Your vercel.json would look something like this:

{
  "functions": {
    "api/**/*.js": {
      "memory": 128,
      "maxDuration": 10
    }
  },
  "rewrites": [
    {
      "source": "/api/batteries",
      "destination": "/api/batteries"
    }
  ]
}

If you have static assets that you want to serve, place them in a public directory. Vercel will automatically deploy the contents of this directory.

Let us know how you get on!

3

Vercel will ignore these steps and the package manager will continue to resolve the dependencies because of the absence of the lockfile, on every build, which I don’t want to happen:

Detected `pnpm-lock.yaml` version 9 generated by pnpm@9.x
Lockfile is up to date, resolution step is skipped
Already up to date

This is already the current structure of my project:

The problem I am facing is, files (test.js and pnpm-lock.yaml) at the root directory is also being deployed even when it’s not in any public directory. I don’t want them to be deployed, but pnpm-lock.yaml file should not be excluded from the build process entirely.

Apparently, when I use the Builds and Routes property in vercel.json instead of Functions and Rewrites, this issue doesn’t occur.