build: disable NODE_OPTIONS

Production binaries shall NOT take NODE_OPTIONS from end-users. Only the users (developers who use pkg to package their project) should have control over the flags via the "bake in" (--options) mechanism. Bug: vercel/pkg#954, vercel/pkg#989, vercel/pkg#1194, vercel/pkg#1517
vercel · May 1, 2022 · 52d32ed · 52d32ed
1 parent d840c26
commit 52d32ed
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/lib/build.ts b/lib/build.ts
@@ -55,6 +55,9 @@ function getConfigureArgs(major: number, targetPlatform: string): string[] {
     }
   }
 
+  // production binaries do NOT take NODE_OPTIONS from end-users
+  args.push('--without-node-options');
+
   // DTrace
   args.push('--without-dtrace');