Skip to content

fix(server-utils): Bundle the CommonJS dependencies of instrumented packages on Vite 8 - #25523

Merged
s1gr1d merged 2 commits into
developfrom
sigridhuemer/js-3951-sveltekit-3-sentry-118-build-time-instrumentation-breaks
Oct 20, 2026
Merged

s1gr1d merged 2 commits into
developfrom
sigridhuemer/js-3951-sveltekit-3-sentry-118-build-time-instrumentation-breaks

Conversation

@s1gr1d

@s1gr1d s1gr1d commented Oct 19, 2026 •

Copy link
Copy Markdown
Member

We put pg into ssr.noExternal and that bundles pg and changes its CJS imports. In the second bundling step, Rolldown in Vite 8 emits __require("pg-types") for the dependency imports of pg (see their migration guide mentioning esmExternalRequirePlugin - also check the linked rolldown docs). As __require comes from module.createRequire, the bundlers think it's a normal function variable, and not an import. Therefore, a sub-dependency like pg-types cannot get into the final bundle.

The plugin now bundles exactly these require() calls. The user's ssr.external entries and optional dependencies stay external. We didn't use esmExternalRequirePlugin, because it breaks function-exported CommonJS on Node < 23.

Stacked on #25359.

Fixes #25470


Same problem: __require() of an external package stays in bundled CommonJS

Workarounds and fixes in other tools

Existing Sentry issues

@linear-code

linear-code Bot commented Oct 19, 2026

Copy link
Copy Markdown

JS-3951

@s1gr1d
s1gr1d added this pull request to stack #25525 October 19, 2026 13:34
Base automatically changed from jp/react-router-orchestrion-core-default-import to develop October 19, 2026 16:07
@JPeer264
JPeer264 force-pushed the sigridhuemer/js-3951-sveltekit-3-sentry-118-build-time-instrumentation-breaks branch from 2286e1b to bfe4ef2 Compare October 19, 2026 16:07
@s1gr1d
s1gr1d force-pushed the sigridhuemer/js-3951-sveltekit-3-sentry-118-build-time-instrumentation-breaks branch from 48c2e2a to ae4166d Compare October 20, 2026 12:22
@s1gr1d
s1gr1d requested a review from timfish October 20, 2026 12:25
@s1gr1d

s1gr1d commented Oct 20, 2026

Copy link
Copy Markdown
Member Author

bugbot run

@s1gr1d
s1gr1d marked this pull request as ready for review October 20, 2026 12:25
@s1gr1d
s1gr1d requested a review from a team as a code owner October 20, 2026 12:25
@s1gr1d
s1gr1d requested review from isaacs and mydea and removed request for a team October 20, 2026 12:25

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit ae4166d. Configure here.

if (source !== SNIPPET_IMPORT_SPECIFIER) {
return resolveExternalRequire.call(this, source, importer, resolveOptions);
}
if (!resolveOptions?.ssr) {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Resolver cannot override Vite externalization

High Severity

The new resolveId handler is a default-order function, so Vite's core resolver can mark CommonJS sub-dependencies external before this plugin runs. After a successful resolution, later resolveId hooks are skipped, so those require() calls still become __require() and the deployed server fails with Cannot find module. The force-bundle path also bails when this.resolve returns null, so it cannot recover if the core resolver does not treat the specifier as external.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit ae4166d. Configure here.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The plugin runs with enforce: 'pre', so it's a false positive

@s1gr1d
s1gr1d force-pushed the sigridhuemer/js-3951-sveltekit-3-sentry-118-build-time-instrumentation-breaks branch from ae4166d to 5fbc75c Compare October 20, 2026 13:33
…ackages on Vite 8

Rolldown emits a require() of an external package in bundled CommonJS as
__require(), which a bundler that runs over the server output cannot follow.
On Rolldown, the orchestrion Vite plugin now also force-bundles the
dependencies that the CommonJS code of instrumented packages requires.

Fixes #25470
…nJS on Rolldown

Resolve each require() call from a package that orchestrion bundled instead of
walking package.json files. Only calls that Vite would make external are bundled,
and the user's ssr.external entries and optional dependencies stay external.
@s1gr1d
s1gr1d force-pushed the sigridhuemer/js-3951-sveltekit-3-sentry-118-build-time-instrumentation-breaks branch from 5fbc75c to 9d08cb4 Compare October 20, 2026 14:21
@s1gr1d
s1gr1d merged commit ebe8fdc into develop Oct 20, 2026
566 of 577 checks passed
@s1gr1d
s1gr1d deleted the sigridhuemer/js-3951-sveltekit-3-sentry-118-build-time-instrumentation-breaks branch October 20, 2026 15:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[SvelteKit 3] Sentry 11.8 build-time instrumentation breaks PostgreSQL bundling in Azure Functions

2 participants