fix(packaging): exclude dev dependencies when the service dir is a symlink by RaphaelFakhri · Pull Request #14005 · serverless/serverless

RaphaelFakhri · 2026-10-21T08:35:58Z

excludeNodeDevDependencies strips the service directory from each npm ls --parseable path with item.replace(path.join(serviceDir, path.sep), ''). npm ls runs with the service directory as its working directory and prints real (symlink-resolved) paths. When serviceDir goes through a symlink, as with AWS CodeBuild sources, the prefix never matches. Every dev dependency then stays an absolute path, fails the package.json lookup, and is bundled into the artifact.

This change strips either the configured or the real service directory prefix, so the generated exclude globs are service-relative in both cases.

A new unit test packages a real project through a symlinked service directory and asserts that node_modules/dev-pkg/** is excluded and the production dependency is kept. The test fails on main (the exclude list contains only the user-defined pattern) and passes with this change.

Summary by CodeRabbit

Bug Fixes
- Improved dependency packaging for services accessed through symlinked directories.
- Development dependencies are now excluded correctly while production dependencies remain included, regardless of the service directory path used.

…mlink

github-actions · 2026-10-21T08:36:08Z

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

Mmarzex · 2026-10-21T08:36:14Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

coderabbitai · 2026-10-21T08:36:25Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 8ce5e10c-d055-4c99-b9be-1e921a303d30

📥 Commits

Reviewing files that changed from the base of the PR and between d5da2fd and 7f04df8.

📒 Files selected for processing: 2

packages/serverless/lib/plugins/package/lib/zip-service.js
packages/serverless/test/unit/lib/plugins/package/lib/zip-service.test.js

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

Dependency path normalization now recognizes both the configured service directory and its resolved real path. A unit test covers development dependency exclusion when the service directory is a symlink.

Changes: Dependency exclusion

Layer / File(s)	Summary
Normalize dependency paths `packages/serverless/lib/plugins/package/lib/zip-service.js`, `packages/serverless/test/unit/lib/plugins/package/lib/zip-service.test.js`	Path stripping now recognizes the configured service directory and its resolved real path. The test verifies that a development package is excluded and a production package remains included when the service directory is a symlink.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: czubocha

Merge Risk: ⚪ Minimal · up to 7f04d

Symlinked service directories are handled by the dependency exclusion path, with no identified issue blocking merge.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: excluding development dependencies when the service directory is a symlink.
Linked Issues check		Issue [`#13447`] requires `excludeNodeDevDependencies` to exclude development dependencies when `serviceDir` contains symlinks. The change resolves `serviceDir` with `fsp.realpath()`, checks both config…
Out of Scope Changes check		The pull request changes only dependency-path normalization in `zip-service.js` and adds the focused unit test for symlinked service directories. The changes support issue [`#13447`] and do not demonstr…

Full details: Linked Issues check

Explanation

Issue [#13447] requires excludeNodeDevDependencies to exclude development dependencies when serviceDir contains symlinks. The change resolves serviceDir with fsp.realpath(), checks both configured and real prefixes, and converts matching npm ls --parseable paths to service-relative paths. The added unit test uses a symlinked service directory and verifies that node_modules/dev-pkg/** is excluded while prod-pkg is not excluded.

Full details: Out of Scope Changes check

Explanation

The pull request changes only dependency-path normalization in zip-service.js and adds the focused unit test for symlinked service directories. The changes support issue [#13447] and do not demonstrate unrelated behavior changes.

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

RaphaelFakhri · 2026-10-21T12:45:08Z

I have read the CLA Document and I hereby sign the CLA

fix(packaging): exclude dev dependencies when the service dir is a sy…

7f04df8

…mlink

Navigation Menu

Repository navigation

fix(packaging): exclude dev dependencies when the service dir is a symlink - #14005

fix(packaging): exclude dev dependencies when the service dir is a symlink#14005
RaphaelFakhri wants to merge 1 commit into
serverless:mainfrom
RaphaelFakhri:fix/exclude-dev-deps-symlinked-service-dir

RaphaelFakhri commented Oct 21, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

github-actions Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

Mmarzex commented Oct 21, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 21, 2026 •

edited

Loading

Uh oh!

RaphaelFakhri commented Oct 21, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

RaphaelFakhri commented Oct 21, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

github-actions Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Mmarzex commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

coderabbitai Bot commented Oct 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

RaphaelFakhri commented Oct 21, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

RaphaelFakhri commented Oct 21, 2026 •

edited by coderabbitai Bot

Loading

github-actions Bot commented Oct 21, 2026 •

edited

Loading

Mmarzex commented Oct 21, 2026 •

edited

Loading

coderabbitai Bot commented Oct 21, 2026 •

edited

Loading