Skip to content

fix: bundle semver to prevent npx/bunx cache startup crashes #679

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
posthog wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

fix: bundle semver to prevent npx/bunx cache startup crashes #679

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 18 additions & 2 deletions tsdown.config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,24 @@ export default defineConfig({
NODE_ENV: process.env.WIZARD_BUILD_NODE_ENV || 'production',
},

// Keep npm dependencies external — they're installed at runtime.
skipNodeModulesBundle: true,
// Keep npm dependencies external — they're installed at runtime — with one
// exception: semver is bundled into the output.
//
// semver's entry file eagerly `require()`s its entire ./functions/* and
// ./ranges/* submodule tree at load. When a package runner (npx/bunx)
// extracts a corrupted/partial semver tarball into its cache (a known failure
// mode when antivirus or a concurrent run interrupts extraction), that eager
// require throws MODULE_NOT_FOUND (e.g. './ranges/intersects', './functions/sort')
// before any wizard code runs — an instant, unrecoverable startup crash.
// Bundling semver means a corrupted runtime install can no longer surface a
// missing-submodule crash. semver is dependency-free, so this is self-contained.
//
// Note: `deps.skipNodeModulesBundle` and `deps.alwaysBundle` are mutually
// exclusive in tsdown, so we rely on the default behavior (externalize
// production dependencies declared in package.json) and force-bundle semver.
deps: {
alwaysBundle: ['semver'],
},

sourcemap: true,
clean: true,
Expand Down
Loading