Skip to content

fix(perf): use modern tar and use node streaming utilities#130

Closed
ayuhito wants to merge 3 commits into
vercel:mainfrom
ayuhito:perf/modern-tar
Closed

fix(perf): use modern tar and use node streaming utilities#130
ayuhito wants to merge 3 commits into
vercel:mainfrom
ayuhito:perf/modern-tar

Conversation

@ayuhito
Copy link
Copy Markdown
Contributor

@ayuhito ayuhito commented Feb 22, 2026

This PR aims to reduce the bundle size and removes 13 dependencies for Node natives and modern-tar.

  • Replaces tar with modern-tar. I noticed just-bash using modern-tar, which prompted this PR.
  • Replaces promisepipe with node:stream/promises.
  • Replaces stream-to-pipe with node:stream/consumers.

For example, tar adds 3MB to the final unpacked package size which makes up for most of total bundle already (4MB).

image

Ref: https://npmgraph.js.org/?q=%40vercel%2Ffun#select=tar%407.5.7


I intended to split all separate changes into separate PRs, but since they are all so tiny I went with splitting them per commit which should also be reviewable. Apologies!

I think there are additional drop in improvements such as debug --> obug,node-fetch --> native, stat-mode --> native, but I'd rather not grow the scope of this PR any larger.

@socket-security
Copy link
Copy Markdown

socket-security Bot commented Feb 22, 2026

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addedmodern-tar@​0.7.510010010094100

View full report

@styfle styfle changed the title perf: use modern tar and use node streaming utilities fix(perf): use modern tar and use node streaming utilities Feb 23, 2026
Copy link
Copy Markdown
Member

@styfle styfle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lets separate into two PRs

  1. Remove promisepipe and stream-to-promise
  2. Replace tar with modern-tar

The first will be safe to merge but the second will require security audit.

@ayuhito
Copy link
Copy Markdown
Contributor Author

ayuhito commented Mar 5, 2026

Sorry for the delay! I'll go ahead and do that now 👍

@ayuhito ayuhito closed this Mar 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants