refactor(dts-plugin): replace Koa dev server with native HTTP by ScriptedAlchemy · Pull Request #4419 · module-federation/core

ScriptedAlchemy · 2026-02-11T19:36:59Z

Summary

replace the Koa-based dts dev server with a native Node http server
keep remote type generation behavior equivalent while removing Koa-specific surface area
include related fixture/config updates already present on this branch

Changed Packages

@module-federation/dts-plugin

Changesets

.changeset/bright-squids-float.md (@module-federation/dts-plugin: patch)

Base

main

Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>

cursor · 2026-02-11T19:37:00Z

Cursor Agent can help with this pull request. Just @cursor in comments and I'll start working on changes in this branch.
_{Learn more about Cursor Agents}

netlify · 2026-02-11T19:37:04Z

✅ Deploy Preview for module-federation-docs ready!

Name	Link
🔨 Latest commit	`b254200`
🔍 Latest deploy log	https://app.netlify.com/projects/module-federation-docs/deploys/698d998c73145400086eb9f1
😎 Deploy Preview	https://deploy-preview-4419--module-federation-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

changeset-bot · 2026-02-11T19:37:05Z

🦋 Changeset detected

Latest commit: b254200

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 43 packages

Name	Type
@module-federation/dts-plugin	Patch
@module-federation/cli	Patch
@module-federation/enhanced	Patch
@module-federation/manifest	Patch
@module-federation/rspack	Patch
@module-federation/modern-js-v3	Patch
@module-federation/modern-js	Patch
@module-federation/nextjs-mf	Patch
@module-federation/node	Patch
@module-federation/rsbuild-plugin	Patch
@module-federation/rspress-plugin	Patch
@module-federation/storybook-addon	Patch
shared-tree-shaking-no-server-host	Patch
shared-tree-shaking-no-server-provider	Patch
shared-tree-shaking-with-server-host	Patch
shared-tree-shaking-with-server-provider	Patch
remote5	Patch
remote6	Patch
website-new	Patch
@module-federation/runtime	Patch
@module-federation/webpack-bundler-runtime	Patch
@module-federation/sdk	Patch
@module-federation/runtime-tools	Patch
@module-federation/managers	Patch
@module-federation/third-party-dts-extractor	Patch
@module-federation/devtools	Patch
@module-federation/bridge-react	Patch
@module-federation/bridge-vue3	Patch
@module-federation/bridge-shared	Patch
@module-federation/bridge-react-webpack-plugin	Patch
@module-federation/retry-plugin	Patch
@module-federation/data-prefetch	Patch
@module-federation/error-codes	Patch
@module-federation/inject-external-runtime-core-plugin	Patch
@module-federation/runtime-core	Patch
create-module-federation	Patch
@module-federation/treeshake-server	Patch
@module-federation/treeshake-frontend	Patch
@module-federation/metro	Patch
@module-federation/metro-plugin-rnef	Patch
@module-federation/metro-plugin-rnc-cli	Patch
@module-federation/esbuild	Patch
@module-federation/utilities	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

…lacement-2f9b Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>

github-actions · 2026-02-11T22:41:28Z

iOS Release APP for simulators

🔗 Download link.

Note: if the download link expires, please re-run the workflow to generate a new build.

Generated at 2026-02-12T09:30:24.073Z UTC

github-actions · 2026-02-11T22:49:33Z

Bundle Size Report

1 package(s) changed, 37 unchanged.

Package	Total dist	Delta	ESM gzip	Delta
`dts-plugin`	626.7 kB	+777 B (+0.1%)	23.4 kB	-15 B (-0.1%)

Total dist: 6.66 MB (+777 B (+0.0%))
Total ESM gzip: 137.6 kB (-15 B (-0.0%))

github-actions · 2026-02-12T00:28:21Z

Android Release APK for all devices

🔗 Download link.

Note: if the download link expires, please re-run the workflow to generate a new build.

Generated at 2026-02-12T09:22:35.728Z UTC

…lacement-2f9b Co-authored-by: Cursor <cursoragent@cursor.com>

…om/module-federation/core into cursor/koa-server-replacement-2f9b

…lacement-2f9b

…nimatch) ## Current Behavior 1. `@nx/webpack` and `@nx/next` depend on `copy-webpack-plugin@^10.2.4` which pulls `fast-glob` (supply-chain risk) and `serialize-javascript@^6.0.2` (GHSA-5c6j-r48x-rmvq, RCE). 2. `@nx/module-federation` depends on `@module-federation/enhanced@^0.21.2` (4 minor versions behind, transitively pulls vulnerable `koa@3.0.3`). 3. `@nx/node` scaffolds projects with `koa@^3.0.3` (CVE-2026-27959). ## Expected Behavior 1. copy-webpack-plugin bumped to `^14.0.0`: drops `fast-glob` for `tinyglobby`, bumps `serialize-javascript` to `^7.0.3`. Verified clean via `npm audit`. 2. `@module-federation/enhanced` and `@module-federation/sdk` bumped to `^2.0.1`. Includes `resolveShare` resolver return type fix for 2.x compatibility. 3. `koaVersion` in `@nx/node` bumped to `^3.1.2` so new projects get the patched version. Note: koa CVE in `@module-federation/dts-plugin` remains an upstream issue (module-federation/core#4419 merged but not yet released). Will be resolved when upstream publishes a new version. ## Related Issue(s) Fixes #34632 Fixes #34621 Fixes #34701

…nimatch) 1. `@nx/webpack` and `@nx/next` depend on `copy-webpack-plugin@^10.2.4` which pulls `fast-glob` (supply-chain risk) and `serialize-javascript@^6.0.2` (GHSA-5c6j-r48x-rmvq, RCE). 2. `@nx/module-federation` depends on `@module-federation/enhanced@^0.21.2` (4 minor versions behind, transitively pulls vulnerable `koa@3.0.3`). 3. `@nx/node` scaffolds projects with `koa@^3.0.3` (CVE-2026-27959). 1. copy-webpack-plugin bumped to `^14.0.0`: drops `fast-glob` for `tinyglobby`, bumps `serialize-javascript` to `^7.0.3`. Verified clean via `npm audit`. 2. `@module-federation/enhanced` and `@module-federation/sdk` bumped to `^2.0.1`. Includes `resolveShare` resolver return type fix for 2.x compatibility. 3. `koaVersion` in `@nx/node` bumped to `^3.1.2` so new projects get the patched version. Note: koa CVE in `@module-federation/dts-plugin` remains an upstream issue (module-federation/core#4419 merged but not yet released). Will be resolved when upstream publishes a new version. Fixes #34632 Fixes #34621 Fixes #34701

refactor(dts-plugin): replace koa server with http

0ec1685

Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>

cursoragent and others added 2 commits February 11, 2026 22:19

Merge remote-tracking branch 'origin/main' into cursor/koa-server-rep…

1ec3e3f

…lacement-2f9b Co-authored-by: Zack Jackson <ScriptedAlchemy@users.noreply.github.com>

chore: update lockfile

d59dd60

fix(module-federation): ensure rn gradle plugin for metro host

c056217

fix(module-federation): align metro example lodash versions

f013c3a

ScriptedAlchemy marked this pull request as ready for review February 12, 2026 02:32

ScriptedAlchemy and others added 2 commits February 11, 2026 18:36

Merge remote-tracking branch 'origin/main' into cursor-koa-server-rep…

b573aad

…lacement-2f9b Co-authored-by: Cursor <cursoragent@cursor.com>

chore(core): add changeset coverage for pr #4419

781b5e7

ScriptedAlchemy changed the title ~~Koa server replacement~~ fix(dts-plugin): replace koa server integration for type generation Feb 12, 2026

github-actions bot added the change: fix label Feb 12, 2026

cursoragent and others added 4 commits February 12, 2026 03:01

fix(enhanced): rebuild tree-shake fixtures

279f541

Merge branch 'cursor/koa-server-replacement-2f9b' of https://github.c…

13e7c76

…om/module-federation/core into cursor/koa-server-replacement-2f9b

refactor(dts-plugin): rename createKoaServer

31e05c9

chore(dts-plugin): replace automated changeset note

0919ba4

ScriptedAlchemy changed the title ~~fix(dts-plugin): replace koa server integration for type generation~~ refactor(dts-plugin): replace Koa dev server with native HTTP Feb 12, 2026

github-actions bot removed the change: fix label Feb 12, 2026

cursoragent added 3 commits February 12, 2026 08:27

Merge remote-tracking branch 'origin/main' into cursor/koa-server-rep…

32b609a

…lacement-2f9b

fix(module-federation): stabilize tree-shake fixtures

51fbcd1

fix(module-federation): reset reshake fixtures

b254200

ScriptedAlchemy merged commit 6235711 into main Feb 12, 2026
24 checks passed

ScriptedAlchemy deleted the cursor/koa-server-replacement-2f9b branch February 12, 2026 20:50

2heal1 mentioned this pull request Mar 3, 2026

koa@3.0.3 vulnerability (CVE-2026-27959) #4490

Open

5 tasks

2heal1 mentioned this pull request Mar 5, 2026

Release v2.1.0 #4500

Merged

MarcelBariakGrenzebach mentioned this pull request Mar 10, 2026

koa high severity vurneability not fixed yet - @angular-architects/module-federation versions: 21.2.1 / possible migration to @module-federation/enhanced@2.1.0? angular-architects/module-federation-plugin#1080

Closed

MarcelBariakGrenzebach mentioned this pull request Mar 18, 2026

@nx/module-federation@22.5.4 - security vurneability from @module-federation/enhanced": "^0.21.2" nrwl/nx#34903

Closed

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

refactor(dts-plugin): replace Koa dev server with native HTTP#4419

refactor(dts-plugin): replace Koa dev server with native HTTP#4419
ScriptedAlchemy merged 14 commits intomainfrom
cursor/koa-server-replacement-2f9b

ScriptedAlchemy commented Feb 11, 2026 •

edited

Loading

Uh oh!

cursor bot commented Feb 11, 2026

Uh oh!

netlify bot commented Feb 11, 2026 •

edited

Loading

Uh oh!

changeset-bot bot commented Feb 11, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 11, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 11, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 12, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ScriptedAlchemy commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changed Packages

Changesets

Base

Uh oh!

cursor bot commented Feb 11, 2026

Uh oh!

netlify bot commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for module-federation-docs ready!

Uh oh!

changeset-bot bot commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

github-actions bot commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

iOS Release APP for simulators

Uh oh!

github-actions bot commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bundle Size Report

Uh oh!

github-actions bot commented Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Android Release APK for all devices

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ScriptedAlchemy commented Feb 11, 2026 •

edited

Loading

netlify bot commented Feb 11, 2026 •

edited

Loading

changeset-bot bot commented Feb 11, 2026 •

edited

Loading

github-actions bot commented Feb 11, 2026 •

edited

Loading

github-actions bot commented Feb 11, 2026 •

edited

Loading

github-actions bot commented Feb 12, 2026 •

edited

Loading