Unwanted serving of static files

I have a basic api made using Express and Vercel Serverless Functions. I deployed my project on vercel and got everything working perfect.

This is the vercel.json I used:

1{2  "version": 2,3  "builds": [4    {5      "src": "api/batteries.js",6      "use": "@vercel/node"7    }8  ],9  "routes": [10    {11      "src": "/api/batteries",12      "dest": "api/batteries.js"13    }14  ]15}

Going through the Vercel docs, I found this:

We recommend against using this property. To customize Serverless Functions, please use the functions property instead.

We recommend using cleanUrls, trailingSlash, redirects, rewrites, and/or headers instead.

When i used the recommended Functions and Rewrites property instead of the legacy ones, files at the root of my project (test.js and pnpm-lock.yaml) started to being served as static assets.

This is the vercel.json configuration I'm having issues with:

1{2  "functions": {3    "api/batteries.js": {4      "memory": 128,5      "maxDuration": 106    }7  },8  "rewrites": [9    {10      "source": "/api/batteries",11      "destination": "/api/batteries.js"12    }13  ]14}

My project structure:

api/batteries.js
.gitignore
pnpm-lock.yaml
package.json
test.js
vercel.json

Is there any property I might have missed to explicitly exclude files from the build output? As the builds property was handling it automatically for me:

When at least one builds item is specified, only the outputs of the build processes will be included in the resulting deployment as a security precaution. This is why we need to allowlist static files explicitly with @vercel/static .

Additional Info:

I can't use .vercelignore as doing so will unwantedly increase the build time cuz the package manager will have to resolve all the deps every time build is triggered.
excludeFiles will obviously not work as it does not interfere with the build step or output. It will exclude the lockfile from the Serverless Function.

Hi, !

I know you didn't want to use .vercelignore but this is actually the recommended way to exclude files from deployment. The .vercelignore file doesn't affect dependency resolution; it only tells Vercel what to ignore during deployment.

https://vercel.com/docs/deployments/vercel-ignore

Alternatively, you could move your API files to a directory like api/ and adjust your vercel.json accordingly, Vercel will only deploy the contents of that directory.

Your vercel.json would look something like this:

1{2  "functions": {3    "api/**/*.js": {4      "memory": 128,5      "maxDuration": 106    }7  },8  "rewrites": [9    {10      "source": "/api/batteries",11      "destination": "/api/batteries"12    }13  ]14}

If you have static assets that you want to serve, place them in a public directory. Vercel will automatically deploy the contents of this directory.

Let us know how you get on!

Vercel will ignore these steps and the package manager will continue to resolve the dependencies because of the absence of the lockfile, on every build, which I don't want to happen:

1Detected `pnpm-lock.yaml` version 9 generated by pnpm@9.x2Lockfile is up to date, resolution step is skipped3Already up to date

This is already the current structure of my project:

The problem I am facing is, files (test.js and pnpm-lock.yaml) at the root directory is also being deployed even when it's not in any public directory. I don't want them to be deployed, but pnpm-lock.yaml file should not be excluded from the build process entirely.

Apparently, when I use the Builds and Routes property in vercel.json instead of Functions and Rewrites, this issue doesn't occur.

any updates in this discussion?