Recognize legacy @now/node type aliases

Extends the Vercel serverless handler detection to also match the
deprecated Zeit-era @now/node package with NowRequest/NowResponse
types. Per-review feedback from asgerf, these aliases still appear
in real-world code.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: murderteeth

javascript/ql/lib/semmle/javascript/frameworks/VercelNode.qll

@@ -32,8 +32,8 @@ module VercelNode {
       this = any(Module m).getAnExportedValue("default").getAFunctionValue() and
       req = this.getParameter(0) and
       res = this.getParameter(1) and
-      req.hasUnderlyingType("@vercel/node", "VercelRequest") and
-      res.hasUnderlyingType("@vercel/node", "VercelResponse")
+      req.hasUnderlyingType(["@vercel/node", "@now/node"], ["NowRequest", "VercelRequest"]) and
+      res.hasUnderlyingType(["@vercel/node", "@now/node"], ["NowResponse", "VercelResponse"])
     }
 
     /** Gets the parameter that contains the request object. */

javascript/ql/test/library-tests/frameworks/vercel/src/now.ts

@@ -0,0 +1,7 @@
+import type { NowRequest, NowResponse } from "@now/node";
+
+// Legacy Zeit-era aliases. The model should treat these identically to
+// the modern @vercel/node NowRequest -> VercelRequest, NowResponse -> VercelResponse.
+export default function handler(req: NowRequest, res: NowResponse) {
+  res.send(req.query.name);
+}

javascript/ql/test/library-tests/frameworks/vercel/tests.expected

@@ -1,15 +1,19 @@
 test_RouteHandler
+| src/now.ts:5:16:7:1 | functio ... ame);\\n} |
 | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
 test_RequestSource
+| src/now.ts:5:33:5:35 | req | src/now.ts:5:16:7:1 | functio ... ame);\\n} |
 | src/vercel.ts:9:33:9:35 | req | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
 test_ResponseSource
+| src/now.ts:5:50:5:52 | res | src/now.ts:5:16:7:1 | functio ... ame);\\n} |
 | src/vercel.ts:9:53:9:55 | res | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
 | src/vercel.ts:23:3:23:17 | res.status(200) | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
 test_HeaderDefinition
 | src/vercel.ts:19:3:19:44 | res.set ... /html") | content-type | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
 test_RedirectInvocation
 | src/vercel.ts:26:3:26:39 | res.red ... string) | src/vercel.ts:26:16:26:38 | req.que ...  string | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
 test_RequestInputAccess
+| src/now.ts:6:12:6:20 | req.query | parameter | src/now.ts:5:16:7:1 | functio ... ame);\\n} |
 | src/vercel.ts:11:13:11:21 | req.query | parameter | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
 | src/vercel.ts:12:13:12:20 | req.body | body | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
 | src/vercel.ts:13:13:13:23 | req.cookies | cookie | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
@@ -18,5 +22,6 @@ test_RequestInputAccess
 | src/vercel.ts:16:15:16:33 | req.headers.referer | header | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
 | src/vercel.ts:26:16:26:24 | req.query | parameter | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
 test_ResponseSendArgument
+| src/now.ts:6:12:6:25 | req.query.name | src/now.ts:5:16:7:1 | functio ... ame);\\n} |
 | src/vercel.ts:22:12:22:12 | q | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |
 | src/vercel.ts:23:24:23:24 | b | src/vercel.ts:9:16:27:1 | functio ... ing);\\n} |