presets(vercel): resolve function runtime from package.json engines

[everton-dgn]

🔗 Linked issue

Resolves #4767

❓ Type of change

• 📖 Documentation (updates to the documentation, readme, or JSdoc annotations)
• 🐞 Bug fix (a non-breaking change that fixes an issue)
• 👌 Enhancement (improving an existing functionality like performance)
• ✨ New feature (a non-breaking change that adds functionality)
• 🧹 Chore (updates to the build process or auxiliary tools and libraries)
• ⚠️ Breaking change (fix or feature that would cause existing functionality to change)

📚 Description

Building with bun --bun wrote bun1.x to .vc-config.json even when package.json had engines.node, because resolveVercelRuntime never read package.json. It now checks vercel.functions.runtime, then engines in package.json, then bunVersion in vercel.json, then the runtime running the build. The two middle steps follow the precedence of Vercel's getNodeVersion (vercel/vercel#16685), including Bun only with bunVersion when both engines are set. When engines.node overrides engines.bun or bunVersion, it warns, as Vercel does.

engines.node picks the newest supported Node.js version whose N.x intersects the range, with semver intersects like Vercel, so >=24.20.0 <25 and >=22.0.0 give nodejs24.x and >=20 <24 gives nodejs22.x. semver was already a devDependency. It is loaded with import() only when engines.node is set (17 kB, 5 kB gzip).

Where it differs from Vercel: a range with no supported match (20.x, 18.x, >=26, lts/*) logs a warning and uses the build's Node.js major instead of failing the build. That holds when building with Bun too, since engines.node asks for Node.

Node 20 is dropped from SUPPORTED_NODE_VERSIONS, like #3572 did for 18, and the runtime type now suggests nodejs22.x and nodejs24.x. Vercel discontinued 20 on 2026-10-01 and the page linked above the list only shows 22.x and 24.x. Keeping it would make engines.node: "20.x" emit nodejs20.x. A build running on Node 20 now maps to nodejs22.x. I can move this to its own PR if you prefer.

Output changes only for projects that declare engines, build with Bun, or build on Node 20; #4767 lists each case. I left "Breaking change" unticked for that reason, but I'm fine with either label.

The provider docs and the runtime JSDoc now describe this order.

Tested with:

• test/unit/vercel-runtime.test.ts (new): 20 cases, 13 of them fail on main. Besides the resolver, it runs the preset's build:before hook through createNitro and checks the runtime written to .vc-config.json and the bun export condition.
• A minimal app with engines.node: ">=24.20.0 <25" built with bun --bun: bun1.x with 3.0.260903-beta, nodejs24.x with this branch.
• pnpm lint, pnpm typecheck, pnpm test:rollup and pnpm test:rolldown, plus the CI variant of the rollup job with scripts/vite7.ts. I ran the tests with TZ=UTC and a TMPDIR outside /var, because on my macOS machine fmtDate and two dev-error-stack tests fail on main too (local timezone and the /var symlink).

📝 Checklist

• I have linked an issue or discussion.
• I have updated the documentation accordingly.

[vercel]

@everton-dgn is attempting to deploy a commit to the Nitro Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: d6174b50-e65d-470c-b2c8-c9db0adf19a0

📥 Commits

Reviewing files that changed from the base of the PR and between 88ffce7 and 62852ad.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4387e03c-46e5-48ee-a087-8d479fb0a2ed

📥 Commits

Reviewing files that changed from the base of the PR and between cef5305 and 7c74fb3.

📒 Files selected for processing (4)

• docs/2.deploy/20.providers/vercel.md
• src/presets/vercel/types.ts
• src/presets/vercel/utils.ts
• test/unit/vercel-runtime.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

Vercel runtime resolution now uses package engines alongside explicit Nitro configuration, Vercel configuration, and the build runtime. Supported Node.js versions are 22 and 24. Tests and documentation cover runtime selection and generated function configuration.

Changes: Vercel Runtime Detection

Layer / File(s)	Summary
Resolve and publish the Vercel runtime src/presets/vercel/types.ts, src/presets/vercel/utils.ts, test/unit/vercel-runtime.test.ts, docs/2.deploy/20.providers/vercel.md	Runtime resolution reads package.json engines and applies the documented Node.js and Bun selection rules. Supported Node.js versions are 22 and 24. Tests cover runtime selection and generated configuration, and the documentation describes the precedence and fallback behavior.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 7c74f

No merge-blocking runtime-selection issue was identified; the change is ready to merge after normal checks.

Security architecture risk: 🔵 Low · up to 7c74f

Runtime selection remains under build-time project configuration rather than request input, and explicit overrides retain precedence. The main residual risk is deployment compatibility: an unsupported engine range warns and selects another supported Node major instead of stopping the build. Published-package and live-deployment behavior were not verified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The directly affected scope is a Vercel project's server function and generated functions inheriting its base configuration. Exercising the new selection path requires influence over build-time project configuration or the build environment; the inspected flow does not derive runtime authority from incoming requests.

Trust Boundaries and Controls

• observed — The explicit Nitro runtime override still short-circuits detection. Package engine values affect semver selection but do not construct module import paths. Arbitrary explicit runtime strings remain a preexisting build-configuration capability, rather than a new request-accessible bypass.

Resilience and Maintainability Implications

• observed — Conflicting Bun settings and unmatched Node ranges produce warnings. The shared runtime value links build export conditions to generated function metadata, limiting independent selection drift in the normal build path. Fallback remains permissive, so package engine constraints are configuration preferences rather than a fail-closed runtime policy.

Pre-merge checks: 4 · 1

Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 3 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks (4 passed)

Check name	Status	Explanation
Title check		The title uses the Conventional Commits structure type(scope): description and accurately describes the Vercel runtime resolution change.
Description check		The description directly explains the Vercel runtime precedence, engine handling, Node version changes, documentation updates, and test coverage.
Linked Issues check		Issue #4767 requires Vercel runtime resolution from package.json engines. resolveVercelRuntime now preserves explicit runtime precedence, reads engines.node and engines.bun, applies `bunVersio…
Out of Scope Changes check		The changed files stay within issue #4767. The resolver change fixes the Vercel preset behavior. The unit tests validate the resolver and generated function configuration. The documentation and JSDoc …

Full details: Docstring Coverage

Explanation

Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 3 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/nitro@4768

commit: 88ffce7