When using v0.dev to generate and commit code for a Next.js project that includes Supabase Edge Functions utilizing Deno’s npm: import syntax (e.g., npm:square), v0.dev incorrectly adds these npm: prefixed dependencies to the main project’s package.json file. This leads to pnpm install failures during Vercel builds due to ERR_PNPM_OUTDATED_LOCKFILE and 404 Not Found errors, requiring manual intervention outside of v0.dev.
- Detailed Description:
Our project structure involves a Next.js application (managed by pnpm) and a Supabase Edge Function (written in TypeScript/Deno).
The Supabase Edge Function correctly imports an npm module using Deno’s specific syntax:
import { SquareClient } from “npm:square@22.0.0”
The Problematic Behavior:
When v0.dev is used to generate or modify code and then commit directly to GitHub, it appears to scan the entire project for dependencies. In doing so, it incorrectly identifies the Deno npm: import and adds it as a regular dependency entry in the root package.json of the Next.js project.
Example of package.json after v0.dev’s commit:
“dependencies”: {
// … other valid Next.js dependencies
“npm:square”: “22.0.0”, // <— This line is incorrectly added by v0.dev
// …
}
This npm: prefix is not valid syntax for dependencies within a standard Node.js package.json file. Consequently, when Vercel attempts to build the project using pnpm install --frozen-lockfile, it encounters two errors:
- ERR_PNPM_OUTDATED_LOCKFILE: Because v0.dev adds the dependency to package.json but does not regenerate and commit a corresponding pnpm-lock.yaml that includes this (invalid) entry.
- GET https://registry.npmjs.org/npm%3Asquare: Not Found - 404: Because pnpm attempts to find a package literally named “npm:square” in the npm registry, which does not exist.
This forces developers to manually intervene in a separate environment (like GitHub Codespaces) to:
- Remove the invalid “npm:square”: “22.0.0” line from package.json.
- Delete pnpm-lock.yaml and node_modules.
- Run pnpm install to regenerate a clean pnpm-lock.yaml.
- Commit and push these changes to GitHub.
This manual step is required every time v0.dev makes a new commit that triggers this behavior, disrupting the CI/CD pipeline and user workflow.
-
Steps to Reproduce:
-
Start a new Next.js project in v0.dev (or open an existing one).
-
Create a Supabase Edge Function file (e.g., supabase/functions/my-function/index.ts or create-square-payment/index.ts) within the project structure.
-
In the Edge Function file, add a Deno npm: import, e.g.:
import { SomeClient } from “npm:some-npm-package@latest” (or specifically npm:square@22.0.0). -
Make a small change in v0.dev that triggers a commit to GitHub (e.g., modify a component, then use v0.dev’s “Deploy” or “Commit” feature).
-
Observe the package.json file in the GitHub repository after the v0.dev commit – the npm: prefixed dependency will likely be incorrectly added to its dependencies section.
-
Attempt to deploy this commit via Vercel.
-
The Vercel build will fail with ERR_PNPM_OUTDATED_LOCKFILE and a 404 Not Found error for the npm: prefixed package.
-
Expected Behavior:
v0.dev should:
- Ignore Deno npm: imports when processing the main Next.js project’s package.json for dependency management. These are specific to the Deno runtime and should not be treated as Node.js dependencies.
- Alternatively, if it must process them, it should do so in a way that is compatible with Node.js package managers (e.g., by converting them to standard npm package names if the package is truly used by the Node.js part of the app, which is unlikely for an Edge Function SDK).
- Ensure that any changes it makes to package.json are always accompanied by a correctly regenerated and committed pnpm-lock.yaml (or package-lock.json/yarn.lock) to maintain synchronization and prevent OUTDATED_LOCKFILE errors.
- Actual Behavior:
v0.dev adds npm: prefixed dependencies from Edge Functions to the root package.json in an invalid format, and does not synchronize the pnpm-lock.yaml, causing Vercel builds to fail.
- Impact:
- Breaks CI/CD pipelines (Vercel builds fail).
- Requires frequent, manual intervention (editing package.json, deleting lockfile, running pnpm install, committing) outside of v0.dev, negating the convenience of v0.dev’s direct commit feature.
- Causes confusion and frustration for developers.
Thank you for your time and consideration in addressing this limitation.
