While adding webauthn support to a Next.js app, I kept getting the following error during build:
../../../node_modules/.pnpm/cbor-x@1.5.2/node_modules/cbor-x/decode.js
Dynamic Code Evaluation (e. g. 'eval', 'new Function', 'WebAssembly.compile') not allowed in Edge Runtime
Learn More: https://nextjs.org/docs/messages/edge-dynamic-code-evaluation
Import trace for requested module:
../../../node_modules/.pnpm/cbor-x@1.5.2/node_modules/cbor-x/decode.js
../../../node_modules/.pnpm/cbor-x@1.5.2/node_modules/cbor-x/encode.js
../../../node_modules/.pnpm/@simplewebauthn+server@9.0.0/node_modules/@simplewebauthn/server/esm/deps.js
../../../node_modules/.pnpm/@simplewebauthn+server@9.0.0/node_modules/@simplewebauthn/server/esm/registration/verifications/verifyAttestationAndroidKey.js
../../../node_modules/.pnpm/@simplewebauthn+server@9.0.0/node_modules/@simplewebauthn/server/esm/registration/verifyRegistrationResponse.js
../../../node_modules/.pnpm/@simplewebauthn+server@9.0.0/node_modules/@simplewebauthn/server/esm/index.js
Turns out cbor-x declares some dynamic functions that are not compatible with Vercel's edge compute and Cloudflare workers (info).
Thankfully, fixing it is fairly straighforward. cbor-x exports a version of itself without these eval statements via cbor-x/index-no-eval
I tested the change locally by changing the cbor import line in my node_modules to be
export * as cborx from 'cbor-x/index-no-eval';
and it fixed the issue.
The Deno import can continue pointing to the regular export since it supports eval.
PS: a few months ago I merge a PR here for something related - lack of support for streaming APIs in serverless environments. That has since changed, so importing from cbor-x/index instead of cbor-x/encode isn't an issue anymore.
While adding webauthn support to a Next.js app, I kept getting the following error during build:
Turns out
cbor-x
declares some dynamic functions that are not compatible with Vercel's edge compute and Cloudflare workers (info).Thankfully, fixing it is fairly straighforward.
cbor-x
exports a version of itself without these eval statements viacbor-x/index-no-eval
I tested the change locally by changing the cbor import line in my node_modules to be
export * as cborx from 'cbor-x/index-no-eval';
and it fixed the issue.The Deno import can continue pointing to the regular export since it supports eval.
PS: a few months ago I merge a PR here for something related - lack of support for streaming APIs in serverless environments. That has since changed, so importing from
cbor-x/index
instead ofcbor-x/encode
isn't an issue anymore.