netlify-cli@26.2.0 still installs the @netlify/local-functions-proxy-linux-x64@1.1.1 platform binary when npm is invoked with --omit=optional.
Reproduction on Node 24.18.0 / npm 11.16.0:
npm i -g --omit=optional netlify-cli@26.2.0
find /usr/local/lib/node_modules/netlify-cli -path '*local-functions-proxy*' -print
The result includes:
/usr/local/lib/node_modules/netlify-cli/node_modules/@netlify/local-functions-proxy-linux-x64/bin/local-functions-proxy
The dependency chain is netlify-cli -> @netlify/local-functions-proxy@2.0.3 -> @netlify/local-functions-proxy-linux-x64@1.1.1. Security scanners flag the bundled Go binary, including fixable critical findings such as CVE-2023-24538, CVE-2023-24540, CVE-2024-24790, and CVE-2025-68121.
Removing the platform package after installation leaves netlify --version, netlify build --help, and netlify deploy --help working, but intentionally disables local functions and netlify dev.
Could the platform binaries be rebuilt against supported Go dependencies, and could --omit=optional be made to omit them as expected? HolyCode is temporarily removing every local-functions-proxy-* package from its image and documenting remote build/deploy support only.
netlify-cli@26.2.0still installs the@netlify/local-functions-proxy-linux-x64@1.1.1platform binary when npm is invoked with--omit=optional.Reproduction on Node 24.18.0 / npm 11.16.0:
npm i -g --omit=optional netlify-cli@26.2.0 find /usr/local/lib/node_modules/netlify-cli -path '*local-functions-proxy*' -printThe result includes:
The dependency chain is
netlify-cli -> @netlify/local-functions-proxy@2.0.3 -> @netlify/local-functions-proxy-linux-x64@1.1.1. Security scanners flag the bundled Go binary, including fixable critical findings such asCVE-2023-24538,CVE-2023-24540,CVE-2024-24790, andCVE-2025-68121.Removing the platform package after installation leaves
netlify --version,netlify build --help, andnetlify deploy --helpworking, but intentionally disables local functions andnetlify dev.Could the platform binaries be rebuilt against supported Go dependencies, and could
--omit=optionalbe made to omit them as expected? HolyCode is temporarily removing everylocal-functions-proxy-*package from its image and documenting remote build/deploy support only.