fix(nextjs): allow nextjs prerelease/preview versions to be deployed

[annajowang]

By passing { includePrerelease: true } to semver.satisfies, preview/prerelease builds like 16.3.0-preview will pass the vulnerability check. Real vulnerable canary versions will remain blocked.

Fixes #661
Fixes b/529799040

[wiz-9635d3485b]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	-
Software Management Findings	-
Total	-

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

[gemini-code-assist]

Code Review

This pull request wraps the build scripts for both the Angular and Next.js adapters with an 'isMain' check, updates Next.js version checking to support prerelease versions, adds a 'yaml' dependency, and introduces a new package verification script. Feedback highlights a critical issue where the 'isMain' utility will fail when executed via symlinks (common in 'node_modules/.bin/') because of path mismatches; resolving symlinks using 'fs.realpathSync' is recommended to fix this.

[gemini-code-assist]

The isMain utility function (imported from ../utils.js) currently checks process.argv[1] === fileURLToPath(meta.url). However, when this adapter is installed and executed via a symlink (which is the standard behavior for binaries in node_modules/.bin/), process.argv[1] will contain the symlink path, while import.meta.url resolves to the real path. This causes the comparison to evaluate to false, preventing the build command from executing.\n\nTo fix this, update the isMain implementation in packages/@apphosting/adapter-angular/src/utils.ts to resolve symlinks using fs.realpathSync (or fsExtra.realpathSync) before comparing:\n\ntypescript\nexport const isMain = (meta: ImportMeta) => {\n if (!meta) return false;\n if (!process.argv[1]) return false;\n try {\n return fsExtra.realpathSync(process.argv[1]) === fileURLToPath(meta.url);\n } catch {\n return false;\n }\n};\n

[gemini-code-assist]

The isMain utility function (imported from ../utils.js) currently checks process.argv[1] === fileURLToPath(meta.url). However, when this adapter is installed and executed via a symlink (which is the standard behavior for binaries in node_modules/.bin/), process.argv[1] will contain the symlink path, while import.meta.url resolves to the real path. This causes the comparison to evaluate to false, preventing the build command from executing.\n\nTo fix this, update the isMain implementation in packages/@apphosting/adapter-nextjs/src/utils.ts to resolve symlinks using fs.realpathSync (or fsExtra.realpathSync) before comparing:\n\ntypescript\nexport const isMain = (meta: ImportMeta): boolean => {\n if (!meta) return false;\n if (!process.argv[1]) return false;\n try {\n return fsExtra.realpathSync(process.argv[1]) === fileURLToPath(meta.url);\n } catch {\n return false;\n }\n};\n

[annajowang]

/gemini

[annajowang]

@gemini-code-assist review

[gemini-code-assist]

Code Review

This pull request updates the Next.js version validation to include prerelease versions when checking against safe versions, adding a test case for a preview version. However, the reviewer noted that enabling { includePrerelease: true } introduces a critical security bypass by allowing vulnerable canary/prerelease versions to bypass the deployment block. The reviewer provided a safer alternative to handle prerelease versions and suggested adding test cases to ensure vulnerable canary versions are correctly blocked.