Skip to content

chore: move the pnpm dual-package interop bug to marko-js/vite's feedback #262

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rturnq merged 1 commit into from
Aug 12, 2026
Merged

chore: move the pnpm dual-package interop bug to marko-js/vite's feedback #262

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 0 additions & 6 deletions agent-feedback/bugs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,6 @@

Out-of-scope defects noticed while working on something else. Format and rules: [README.md](README.md).

## `@marko/run` SSR build can bundle a dependency's private transitive CJS deps under pnpm and crash on ESM/CJS interop

`packages/run/src/vite/plugin.ts` › `config` (ssr.noExternal / resolve.conditions) | 2026-07-23 | impact:med | effort:med

Under pnpm, a bundled dependency's _private_ transitive CJS dep can be pulled into the SSR bundle and crash the built server at startup. Repro: the `micro-frame-fetch` fixture depends on `@micro-frame/marko`, which ships uncompiled `.marko` files, so the Marko plugin must pull it into the bundle. `@micro-frame/marko` imports `make-fetch-happen@12` → `cacache@17` → `lru-cache@7`. Because `make-fetch-happen` is _private_ to `@micro-frame/marko` under pnpm (`.pnpm/@micro-frame+marko@…/node_modules/make-fetch-happen`) it is not resolvable from the app root, so Vite cannot externalize it and bundles the whole chain. `resolve.conditions` lists `import` before `require`, so rolldown bundles `lru-cache@7`'s dual-published _ESM_ build (`index.mjs`, `export default LRUCache`) for cacache's CJS `require("lru-cache")`; the interop wrapper then evaluates `new __toCommonJS({ default: LRUCache })(…)` → `TypeError: … is not a constructor` and the server exits 1. On npm's flat `node_modules` the chain externalizes and Node loads lru-cache's CJS build, so it only fails under pnpm. This repo's suite is unblocked by declaring `make-fetch-happen` in the workspace-root `devDependencies` (making it root-resolvable so Vite externalizes it), but any pnpm consumer of `@marko/run` whose app pulls a `.marko`-shipping package with a private dual-published CJS transitive dep hits the same crash. Durable fix: externalize such nested transitive deps in the SSR build even under pnpm's layout, or prefer the `require` condition ahead of `import` for the Node SSR target so a bundled `require()` resolves the CJS build.

## Stop `mergeOptions` from mutating the shared `+middleware` options object — one route's body validator and limits leak into every later route

`packages/run/src/runtime/internal.ts` › `mergeOptions` | 2026-08-03 | impact:high | effort:med
Expand Down
Loading