From 9ca15ce2749608a999910326545cbd5337320bfa Mon Sep 17 00:00:00 2001
From: HosnainRafi <8.2991389e+07+HosnainRafi@users.noreply.github.com>
Date: Sun, 16 Aug 2026 23:58:24 +0000
Subject: [PATCH] fix(deps): move local-functions-proxy to optionalDependencies
 for --omit=optional support

The @netlify/local-functions-proxy package (and its platform-specific
sub-packages) were in regular dependencies, which meant npm installs
them even with --omit=optional. This caused security scanners to flag
bundled Go binary vulnerabilities (CVE-2023-24538, CVE-2023-24540,
CVE-2024-24790, CVE-2025-68121).

Changes:
1. Moved @netlify/local-functions-proxy from dependencies to
   optionalDependencies in package.json.
2. Changed the import in src/lib/functions/local-proxy.ts from a static
   import to a dynamic import with error handling, so that when the
   package is not installed (e.g., with --omit=optional), the CLI
   still works but local functions proxy is unavailable.

Fixes #8342
---
 package.json                     |  4 +++-
 src/lib/functions/local-proxy.ts | 23 ++++++++++++++++-------
 2 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/package.json b/package.json
index 4413062e5c0..b31fbbe7aee 100644
--- a/package.json
+++ b/package.json
@@ -65,7 +65,6 @@
     "@netlify/edge-functions-bootstrap": "^3.2.0",
     "@netlify/headers-parser": "^10.1.1",
     "@netlify/images": "^1.3.12",
-    "@netlify/local-functions-proxy": "^2.0.3",
     "@netlify/redirect-parser": "^16.1.0",
     "@netlify/zip-it-and-ship-it": "^15.3.3",
     "@octokit/rest": "^22.0.0",
@@ -215,6 +214,9 @@
     "verdaccio": "^6.3.2",
     "vitest": "^3.2.4"
   },
+  "optionalDependencies": {
+    "@netlify/local-functions-proxy": "^2.0.3"
+  },
   "engines": {
     "node": ">=22.13.0"
   },
diff --git a/src/lib/functions/local-proxy.ts b/src/lib/functions/local-proxy.ts
index c3e55d019d5..f3b470da47c 100644
--- a/src/lib/functions/local-proxy.ts
+++ b/src/lib/functions/local-proxy.ts
@@ -1,8 +1,20 @@
 import { stdout } from 'process'
+import execa from '../../utils/execa.js'
 
-import { getBinaryPath as getFunctionsProxyPath } from '@netlify/local-functions-proxy'
+let getFunctionsProxyPath: (() => Promise<string | null>) | null = null
 
-import execa from '../../utils/execa.js'
+async function loadFunctionsProxy() {
+  if (getFunctionsProxyPath === null) {
+    try {
+      const mod = await import('@netlify/local-functions-proxy')
+      getFunctionsProxyPath = mod.getBinaryPath
+    } catch {
+      // Package not installed (e.g., when using --omit=optional)
+      getFunctionsProxyPath = () => Promise.resolve(null)
+    }
+  }
+  return getFunctionsProxyPath
+}
 
 export const runFunctionsProxy = async ({
   binaryPath,
@@ -19,7 +31,8 @@ export const runFunctionsProxy = async ({
   name: string
   timeout: number
 }) => {
-  const functionsProxyPath = await getFunctionsProxyPath()
+  const getBinaryPath = await loadFunctionsProxy()
+  const functionsProxyPath = await getBinaryPath()
   const requestData = {
     resource: '',
     ...event,
@@ -33,11 +46,9 @@ export const runFunctionsProxy = async ({
       requestTimeEpoch: 0,
     },
   }
-
   if (functionsProxyPath === null) {
     throw new Error('Host machine does not support local functions proxy server')
   }
-
   const parameters = [
     '--event',
     JSON.stringify(requestData),
@@ -51,8 +62,6 @@ export const runFunctionsProxy = async ({
     `${timeout.toString()}s`,
   ]
   const proxyProcess = execa(functionsProxyPath, parameters)
-
   proxyProcess.stderr?.pipe(stdout)
-
   return proxyProcess
 }