Repository navigation
chore: merge web-infra-dev@v2.0.3 - #11
Merged
Merged
Conversation
…ta loss (web-infra-dev#13542) * chore: split rust bench * chore: fix pnpm install * chore: split build & task in top-level * chore: fix * chore: try again * fix(ci): use unique job IDs in bench workflows to avoid CodSpeed data loss CodSpeed uses GITHUB_JOB to build run_part_id for grouping uploads. Both bench-binding.yml and bench-rust.yml had their job ID set to "bench", causing identical run_part_id values under the same GITHUB_RUN_ID. This made CodSpeed treat them as the same run part, resulting in one overwriting the other (JS binding benchmarks skipped). --------- Co-authored-by: hardfist <yangjianzju@gmail.com>
* docs: update swc-loader examples to use detectSyntax * docs: align swc-loader example test patterns * docs: fix * docs: fix * docs: restore swc-loader wording in tech guides
…nfra-dev#13491) * fix(hash): include content hash in fullhash calculation * fix(hash): improve source type ordering in fullhash calculation Use numeric sort key instead of string comparison for source types, and include source_type in hash calculation for more stable ordering. Refs: web-infra-dev#12866 * fix(hash): limit full hash content mixing to css Co-Authored-By: Aiden * fix(hash): keep fullhash synced with css-only changes Include all chunk content source types in fullhash aggregation and extend hash case coverage to css-extract. Adjust lint-staged JS lint routing to avoid passing tests/rspack-test files to rslint project-scoped lint. Refs web-infra-dev#12866 Co-Authored-By: Aiden * test(stats): update snapshots for fullhash changes Align stats API/output snapshots with new hash behavior in fix/issue-12866. Co-Authored-By: Aiden * chore(hash): remove unrelated lint-staged changes * test(hash): format fullhash css-only config * refactor(hash): sort content hashes by SourceType
…dev#13668) * perf(javascript): reuse side effects evaluation state * perf(javascript): avoid cloning side effects state artifact * fix(javascript): remove needless borrow in side effects flag plugin * perf(javascript): share side effects evaluation states
…#13676) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…13683) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
* chore: add debugger * chore: parallel run wasm ci * chore: remove debugger * Revert "chore: remove debugger" This reverts commit 9cf41c2. * chore: max workers * Reapply "chore: remove debugger" This reverts commit 4b2b18a. * chore: wasi sdk * chore: remote custom wasi * chore: try increase increase memory * chore: try decrease memory * chore: limit memory to 2G * chore: adjust 2gb * chore: udpate comment * chore: update --------- Co-authored-by: CPunisher <1343316114@qq.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
…ra-dev#13679) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
* docs: document package.json imports resolution * docs: fix
…3663) * fix: support module external type in array externals When using array-style externals like `["module fs", "promises"]` with the "module" external type, two issues caused incorrect output: 1. In the non-concatenation-scope code path, the property access for the rest elements was missing. The generated code was `module.exports = __rspack_external_fs;` instead of `module.exports = __rspack_external_fs.promises;`. 2. In the concatenation-scope code path, when the request had additional specifiers, the safe-to-optimize branch would incorrectly use individual named imports instead of forcing a namespace import. This matches webpack's behavior of `if (moduleAndSpecifiers.length > 1) imported = true`. Tests are ported from webpack: - `library/module-external-array-request` (from webpack) - `library/module-array-external-request` (ESM library + array externals) - `library/module-array-external-request-concat` (ESM library + array externals + concatenation) - Extended `externals/async-externals` with `module-import` array case * test: add esmOutputCases snapshot for array-type module externals Adds a snapshot test under esmOutputCases/externals/array-request-module that exercises array-type module externals with property access in the modern-module library output path. * fix: revert force_namespace for UsedNamespace(false) case The UsedNamespace(false) branch means exports are completely unused, so we should keep the original side-effect-only import behavior regardless of whether the request has rest specifiers.
…infra-dev#13677) * feat: enforce macro-generated implemented_hooks in debug builds * fix
…13680) * chore(deps): update dependency @rslint/core to v0.4.1 * fix --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: neverland <chenjiahan.jait@bytedance.com>
…in a worker (web-infra-dev#13687) * Add browser e2e worker test for @rspack/browser * chore: remove test-results * Remove @rspack/browser tests from e2e suite * chore: update lock * chore: format js * chore: fix e2e browser * chore: upgrade rsbuild * chore: remove resolve.alias
* docs: clarify externals configuration * docs: fix
* docs: clarify config option types * fix(config): correct stats filter signatures
* test: split benchmark case entrypoints * test: address benchmark case review comments
* feat(externals): add modern-module externals type * fix(externals): align rust modern-module externals default
* docs: update NestJS guide * docs: clarify NestJS production HMR entry * docs: tighten NestJS production HMR warning * docs: align NestJS build entry example * docs: correct NestJS HMR build mode wording * docs: address NestJS guide review feedback * docs: sync NestJS example build updates * docs: clarify NestJS HMR production build warning * docs: simplify NestJS HMR warning * docs: update NestJS dev plugin condition
* base64 encoding with base64 crate Use the base64 crate for standard and URL-safe base64 encoding instead of custom implementations. This improves maintainability and reduces potential bugs in the encoding logic. * fix(hash): fix hash salt not working * test(hash): add base64 hash tests * fix: use base64-simd for hash digests * test(hash): move hash tests to integration target
…ob (web-infra-dev#13953) * refactor(copy-plugin) + perf: unify glob implementation with fast-glob * refactor(core): replace custom directory traversal with walk_dir utility - Add new `walk_dir` utility function in glob_utils for reusable directory traversal - Replace custom recursive directory traversal in context_module_factory and glob_utils with walk_dir - Add fast-glob dependency to support the implementation - Simplify code by removing async_recursion dependency * fix: satisfy clippy * fix(core): restore glob edge cases in fast-glob helpers
* chore: bump swc from 65.0.1 to 65.0.4 * chore: codegen
…ra-dev#13863) * fix: drop inactive branch dependencies for inlined booleans * fix: guard dynamic import branch dependencies * test: fix inline branch fixture typo * test: assert inline branch dependency pruning
…dev#13968) * perf: optimize code splitter prepare * fix: recompute skipped connection state * perf: reduce depth assignment allocations * perf: avoid indexmap in code splitter prepare * perf: reduce code splitter prepare allocations * perf: avoid prepared connection slice allocation * perf: streamline prepared connection finalization * perf: preallocate dynamic import chunk naming * perf: streamline chunk group merging * perf: reduce depth preparation lookups * fix: address code splitter review feedback * perf: reduce code splitter preparation overhead * perf: streamline chunk group connection queue * perf: reduce outdated chunk group processing allocations
* chore(ci): print fd usage for browser e2e * fix(ci): raise nofile limit for browser e2e * chore(ci): remove browser e2e fd debug logs * fix(ci): avoid browser e2e watcher
* docs: add node app guide * Update website/docs/en/guide/tech/nestjs.mdx Co-authored-by: neverland <chenjiahan.jait@bytedance.com> * docs: recommend esm node externals * Update website/docs/zh/guide/tech/nestjs.mdx Co-authored-by: neverland <chenjiahan.jait@bytedance.com> * Update website/docs/zh/guide/tech/nestjs.mdx Co-authored-by: neverland <chenjiahan.jait@bytedance.com> * Update website/docs/en/guide/tech/nestjs.mdx Co-authored-by: neverland <chenjiahan.jait@bytedance.com> * docs: use auto swc syntax in node guide * docs: refine node swc rule * docs: clarify esm node output * docs: move node esm config to note * docs: clarify node esm guidance * docs: highlight esm output for node apps * docs: simplify node esm note * docs: simplify esm node output config --------- Co-authored-by: neverland <chenjiahan.jait@bytedance.com>
…fra-dev#13997) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
* chore(deps): tighten pnpm install safeguards * fix
…dev#14003) * refactor(core): remove unused exports final name metadata * test: update wasm hash snapshots * test: update stats api hash snapshot
…ublishing (web-infra-dev#14011) The previous publish flow wrote a static `_authToken` from the `NPM_TOKEN` secret into `~/.npmrc` before invoking `pnpm publish`. On pnpm < 11.0.7 a configured `_authToken` takes precedence over OIDC trusted publishing, so even though all `@rspack/*` packages have a trusted publisher binding configured on npmjs.com, releases were still authenticating with a long-lived token. The static-credential surface is exactly what enables the TanStack 2026-05-11-style attack: anything that runs in the `npm`/`npm-canary` environment can exfiltrate `process.env.NPM_TOKEN` and publish arbitrary versions. Deleting the `.npmrc` write makes OIDC the only auth path. `pnpm publish` now mints a per-run token via the workflow's `id-token: write` permission and authenticates against the trusted publisher binding configured on npmjs.com. Provenance (`--provenance` flag) is unaffected; it was already using OIDC for signing and is independent of publish auth. After merge, the `NPM_TOKEN` secret in the `npm` and `npm-canary` GitHub environments has no remaining consumer and should be removed from environment secrets to fully retire the credential.
…eb-infra-dev#14001) security(ci): pin actions/{download,upload}-artifact to immutable SHAs Replace floating tag references (download-artifact@v4.1.7, upload-artifact@v4) with commit SHAs plus version comments, closing the supply-chain vector exploited in the tj-actions/changed-files 2025 incident, where a tag rewrite by a compromised maintainer propagates to every downstream workflow that still resolves the tag at run time. - actions/download-artifact -> 65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7 - actions/upload-artifact -> ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 Both SHAs verified against upstream: gh api repos/actions/download-artifact/git/ref/tags/v4.1.7 gh api repos/actions/upload-artifact/git/ref/tags/v4.6.2 This is Phase 1 of a broader supply-chain hardening initiative motivated by the TanStack 2026-05-11 npm compromise; remaining phases (npm OIDC trusted publishing, optionalDependencies whitelist lint, ecosystem- benchmark PR isolation, etc.) land in follow-up PRs.
… with fast-glob" (web-infra-dev#14010) Revert "perf: reduce binary size by unifying glob implementation with fast-gl…" This reverts commit 8c45475.
rspack@0.100.3 rspack_allocator@0.100.3 rspack_binding_api@0.100.3 rspack_binding_build@0.100.3 rspack_binding_builder@0.100.3 rspack_binding_builder_macros@0.100.3 rspack_browserslist@0.100.3 rspack_cacheable@0.100.3 rspack_cacheable_macros@0.100.3 rspack_collections@0.100.3 rspack_core@0.100.3 rspack_error@0.100.3 rspack_fs@0.100.3 rspack_hash@0.100.3 rspack_hook@0.100.3 rspack_ids@0.100.3 rspack_javascript_compiler@0.100.3 rspack_loader_lightningcss@0.100.3 rspack_loader_preact_refresh@0.100.3 rspack_loader_react_refresh@0.100.3 rspack_loader_runner@0.100.3 rspack_loader_swc@0.100.3 rspack_loader_testing@0.100.3 rspack_location@0.100.3 rspack_macros@0.100.3 rspack_napi@0.100.3 rspack_napi_macros@0.100.3 rspack_parallel@0.100.3 rspack_paths@0.100.3 rspack_plugin_asset@0.100.3 rspack_plugin_banner@0.100.3 rspack_plugin_case_sensitive@0.100.3 rspack_plugin_circular_dependencies@0.100.3 rspack_plugin_copy@0.100.3 rspack_plugin_css@0.100.3 rspack_plugin_css_chunking@0.100.3 rspack_plugin_devtool@0.100.3 rspack_plugin_dll@0.100.3 rspack_plugin_dynamic_entry@0.100.3 rspack_plugin_ensure_chunk_conditions@0.100.3 rspack_plugin_entry@0.100.3 rspack_plugin_esm_library@0.100.3 rspack_plugin_externals@0.100.3 rspack_plugin_extract_css@0.100.3 rspack_plugin_hmr@0.100.3 rspack_plugin_html@0.100.3 rspack_plugin_ignore@0.100.3 rspack_plugin_javascript@0.100.3 rspack_plugin_json@0.100.3 rspack_plugin_lazy_compilation@0.100.3 rspack_plugin_library@0.100.3 rspack_plugin_lightning_css_minimizer@0.100.3 rspack_plugin_limit_chunk_count@0.100.3 rspack_plugin_merge_duplicate_chunks@0.100.3 rspack_plugin_mf@0.100.3 rspack_plugin_module_info_header@0.100.3 rspack_plugin_module_replacement@0.100.3 rspack_plugin_no_emit_on_errors@0.100.3 rspack_plugin_progress@0.100.3 rspack_plugin_real_content_hash@0.100.3 rspack_plugin_remove_duplicate_modules@0.100.3 rspack_plugin_remove_empty_chunks@0.100.3 rspack_plugin_rsc@0.100.3 rspack_plugin_rsdoctor@0.100.3 rspack_plugin_rslib@0.100.3 rspack_plugin_rstest@0.100.3 rspack_plugin_runtime@0.100.3 rspack_plugin_runtime_chunk@0.100.3 rspack_plugin_schemes@0.100.3 rspack_plugin_size_limits@0.100.3 rspack_plugin_split_chunks@0.100.3 rspack_plugin_sri@0.100.3 rspack_plugin_swc_js_minimizer@0.100.3 rspack_plugin_wasm@0.100.3 rspack_plugin_worker@0.100.3 rspack_regex@0.100.3 rspack_storage@0.100.3 rspack_swc_plugin_import@0.100.3 rspack_swc_plugin_ts_collector@0.100.3 rspack_tasks@0.100.3 rspack_tracing@0.100.3 rspack_tracing_perfetto@0.100.3 rspack_util@0.100.3 rspack_watcher@0.100.3 rspack_workspace@0.100.3 Generated by cargo-workspaces
Rsdoctor Bundle Diff AnalysisFound 6 projects in monorepo, 6 projects with changes. 📊 Quick Summary
📋 Detailed Reports (Click to expand)📁 popular-libsPath:
📁 react-10kPath:
📁 react-1kPath:
📁 react-5kPath:
📁 romePath:
📁 ui-componentsPath:
Generated by Rsdoctor GitHub Action |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
FEP is updating web to build with rspack v2.0.3. This merges in changes from the
v2.0.3tag in web-infra-dev/rspack. After this is merged, I'll cherry-pick the hash determinism fix onto a new branch (similar to v1.7.5-deterministic)Done via