[fireairforce]

UMD builds with externals: { react: 'React' } work through Webpack's CommonJS and browser-global branches. The utoopack adapter currently forwards 'React' unchanged, which makes Pack read only globalThis.React. Consumers that inject dependencies through require receive an undefined dependency.

Convert ordinary external strings to { root: name, commonjs: name }, preserving the configured request value for both branches. Apply this consistently to object mappings, a single external name, and top-level arrays. Explicitly typed values, existing objects, script conversion and whitespace-containing values retain their existing conversion paths. The Webpack build path and dependency versions are unchanged.

Validation:

• 25 config/runtime tests pass. The new runtime suite builds the same fixture with real Webpack and Pack and checks CommonJS, loader-style function injection, browser globals, dependency identity and shared mutable state. Before the fix, Pack's two injected-dependency cases fail while the other four cases pass.
• The three existing Webpack/Pack externals build fixtures pass.
• pnpm build, Prettier and git diff --check pass.
• A consumer build using candidate Father with its duplicate per-project externals override removed produces byte-identical JS/CSS to the previously validated override-based build; its real UMD loader still exposes the same 314 exports.

Compatibility boundary:
Plain-string externals change observable behavior in CommonJS hosts. A host that only defines the dependency on globalThis and cannot resolve its configured name through require could previously load the utoopack bundle; after this fix it fails while trying to load the CommonJS external. This boundary was verified with real old-string and new-object Pack builds. A correctly injected CommonJS dependency changes from failing to working; pure browser-global loading works in both cases. The change follows Webpack UMD semantics, but existing consumers relying on the previous global-only CommonJS behavior need migration. It must not be presented as a zero-impact change.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T07:26:32.255041Z	26950a6	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.