[Detail Bug] @browserless/function crashes in production due to missing runtime dependencies (acorn/acorn-walk)

# Detail Bug Report https://app.detail.dev/org_06887db3-bf54-40ab-976d-46c66ab2b840/bugs/bug_e41f7b37-c102-45b0-80a3-9a851a508758 # Summary - **Context**: The `template.js` file is the core module of `@browserless/function` that analyzes user-provided code to detect if it uses the Puppeteer page API, using AST parsing to determine whether to inject browser connection logic. - **Bug**: The file requires `acorn` and `acorn-walk` at the module level, but these packages are listed as `devDependencies` instead of `dependencies` in `package.json`. - **Actual vs. expected**: The packages should be listed under `dependencies` so they are installed in production environments, but they are only in `devDependencies` which means they won't be installed when users install `@browserless/function`. - **Impact**: Any production installation of `@browserless/function` will crash at runtime when `template.js` is loaded, making the package completely unusable. # Code with Bug In `packages/function/src/template.js`: ```javascript const walk = require('acorn-walk') // <-- BUG 🔴 Required at runtime but not declared as a dependency const acorn = require('acorn') // <-- BUG 🔴 Required at runtime but not declared as a dependency ``` In `packages/function/package.json`: ```json "devDependencies": { "@browserless/test": "^10.11.1", "acorn": "~8.16.0", // <-- BUG 🔴 Runtime dependency incorrectly listed as devDependency "acorn-walk": "~8.3.5", // <-- BUG 🔴 Runtime dependency incorrectly listed as devDependency "ava": "5", "lodash": "latest" } ``` # Explanation `packages/function/src/template.js` loads `acorn` and `acorn-walk` at module initialization. Because `packages/function/package.json` lists them only under `devDependencies`, they are not guaranteed to be installed for consumers in production installs, leading to `Cannot find module 'acorn-walk'`/`'acorn'` at runtime. The issue has been masked by a transitive dependency: the declared dependency `isolated-function` currently depends on `acorn`/`acorn-walk`, so Node may resolve them from `isolated-function`'s `node_modules`. This is an accidental, fragile coupling; if `isolated-function` changes its dependencies, `@browserless/function` will break. ## Codebase Inconsistency The published package confirms the mismatch: ```bash $ npm view @browserless/function dependencies { '@browserless/errors': '^10.11.1', 'isolated-function': '~0.1.49', 'require-one-of': '~1.0.24' } ``` `acorn` and `acorn-walk` are absent from the package’s declared dependencies despite being required at runtime. # Recommended Fix Move `acorn` and `acorn-walk` from `devDependencies` to `dependencies` in `packages/function/package.json` so they are installed for consumers. # History This bug was introduced in commit d45585fe. The commit added a performance optimization to parse user code with AST analysis (using acorn/acorn-walk) to detect whether the `page` object is used, avoiding unnecessary Puppeteer setup when not needed. When adding the new `template.js` file with these runtime dependencies, the acorn packages were mistakenly added to `devDependencies` instead of `dependencies` in package.json.