Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: remove globalThis check and align with what bundlers can accept #4022

Open
wants to merge 4 commits into
base: 16.x.x
Choose a base branch
from

Conversation

JoviDeCroock
Copy link

@JoviDeCroock JoviDeCroock commented Feb 14, 2024

As surfaced in Discord this currently is a breaking change in the 16.x.x release line which is preventing folks from upgrading towards a security fix. This PR should result in a patch release on the 16 release line.

This change was originally introduced to support CFW and browser environments which should still be supported with the typeof check CC @n1ru4l

This also adds a check whether .env is present as in the DOM using id="process" defines that as a global which we don't want to access on accident. as shown in #4017

Bundles also target process.env.NODE_ENV specifically which fails when it replaces globalThis.process.env.NODE_ENV as this becomes globalThis."production" which is invalid syntax.

Fixes #3978
Fixes #3918
Fixes #3928
Fixes #3758
Fixes #3934

This purposefully does not account for #3925 as we can't address this without breaking CF/plain browsers so the small byte-size increase will be expected for bundled browser environments. As a middle ground we did optimise the performance here. We can revisit this for v17.

Most bundlers will be able to tree-shake this with a little help, in #4075 (comment) you can find a conclusion with a repo where we discuss a few.

Supersedes #4021
Supersedes #4019
Supersedes #3927

Copy link
Member

@benjie benjie left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Copy link

Hi @JoviDeCroock, I'm @github-actions bot happy to help you with this PR 👋

Supported commands

Please post this commands in separate comments and only one per comment:

  • @github-actions run-benchmark - Run benchmark comparing base and merge commits for this PR
  • @github-actions publish-pr-on-npm - Build package from this PR and publish it on NPM

@JoviDeCroock JoviDeCroock force-pushed the fix-node-env-issue branch 2 times, most recently from daffdff to a8f5b4a Compare February 14, 2024 13:22
@JoviDeCroock
Copy link
Author

JoviDeCroock commented Feb 14, 2024

After talking to @phryneas there seems to be a lot of pushback from his side with regards to this change opting out of tree-shaking. I'll probably need more evidence that this breaks on different bundlers

@JoviDeCroock
Copy link
Author

CC @graphql/graphql-js-reviewers

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants