feat: add documentation link to require() error message#7898
Merged
graphite-app[bot] merged 1 commit intomainfrom Jan 15, 2026
Merged
feat: add documentation link to require() error message#7898graphite-app[bot] merged 1 commit intomainfrom
graphite-app[bot] merged 1 commit intomainfrom
Conversation
✅ Deploy Preview for rolldown-rs canceled.
|
Copilot
AI
changed the title
[WIP] Add link to external modules in error message
Add documentation link to require() error message
Jan 15, 2026
Member
|
@copilot fix test failure |
Contributor
Author
hyf0
approved these changes
Jan 15, 2026
Member
Merge activity
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR enhances the error message for require() calls in environments that don't expose the require function by adding a documentation link to help users understand and resolve the issue.
Changes:
- Added a documentation link (https://rolldown.rs/in-depth/bundling-cjs#require-external-modules) to the error message in runtime-tail.js
- Updated test snapshots to reflect the new content hashes caused by the runtime code change
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| crates/rolldown/src/runtime/runtime-tail.js | Enhanced error message with documentation link for better user guidance |
| crates/rolldown/tests/snapshots/integration_rolldown__filename_with_hash.snap | Updated file hashes to reflect the runtime code modification |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- [x] Add documentation link to require() error message in runtime-tail.js - [x] Update test snapshots to reflect the runtime change <!-- START COPILOT CODING AGENT SUFFIX --> <!-- START COPILOT ORIGINAL PROMPT --> <details> <summary>Original prompt</summary> > Add a link to https://rolldown.rs/in-depth/bundling-cjs#require-external-modules in this error message: https://github.com/rolldown/rolldown/blob/d566268b93bc9e44c26bc929eab38c9bf840abb2/crates/rolldown/src/runtime/runtime-tail.js#L17 </details> <!-- START COPILOT CODING AGENT TIPS --> --- 💬 We'd love your input! Share your thoughts on Copilot coding agent in our [2 minute survey](https://gh.io/copilot-coding-agent-survey).
6791863 to
e26a334
Compare
This was referenced Jan 21, 2026
Merged
shulaoda
pushed a commit
that referenced
this pull request
Jan 22, 2026
## [1.0.0-rc.1] - 2026-01-22 ### 🚀 Features - debug_info: add facade chunk elimination reason (#7980) by @IWANABETHATGUY - support lazy barrel optimization (#7933) by @shulaoda - add `experimental.lazyBarrel` option (#7908) by @shulaoda - skip unused external modules from IIFE parameter list (#7978) by @sapphi-red - add custom panic hook for better crash reporting (#7752) by @shulaoda - treeshake: add `invalidImportSideEffects` option (#7958) by @shulaoda - merge allow-extension emitted chunks (#7940) by @IWANABETHATGUY - nativeMagicString generateMap (#7944) by @IWANABETHATGUY - Include meta.magicString in RenderChunkMeta (#7943) by @IWANABETHATGUY - debug_info: add debug info for eliminated facade chunks (#7946) by @IWANABETHATGUY - stablize `strictExecutionOrder` and move to `output.strictExecutionOrder` from `experimental.strictExecutionOrder` (#7901) by @sapphi-red - add documentation link to require() error message (#7898) by @Copilot - add `codeSplitting: boolean` and deprecate `inlineDynamicImports` (#7870) by @hyf0 - dev: change lazy module URL to `/@vite/lazy` from `/lazy` (#7884) by @sapphi-red ### 🐛 Bug Fixes - transform JS files containing `</script>` to escape template literals (#7987) by @IWANABETHATGUY - apply avoid-breaking-exported-api = false to clippy.toml and fix clippy errors (#7982) by @Boshen - pass `kind` from `this.resolve` (#7981) by @sapphi-red - rolldown_plugin_vite_resolve: ignore yarn resolution errors and fallback to other resolvers (#7968) by @sapphi-red - renamer: prevent renaming symbols when there no conflicts (#7936) by @Dunqing - correct minifyInterExports when emitted chunk got merged (#7941) by @IWANABETHATGUY - deduplicate entry points when module is both emitted and dynamically imported (#7885) by @IWANABETHATGUY - dev: add `@vite-ignore` to lazy compilation proxy module import (#7883) by @sapphi-red ### 🚜 Refactor - rust: enable clippy nursery lint group (#8002) by @Boshen - rust: fix inconsistent_struct_constructor clippy lint (#7999) by @Boshen - rust: fix needless_pass_by_ref_mut clippy lint (#7994) by @Boshen - rust: fix unnecessary_wraps clippy lint (#7993) by @Boshen - rust: fix enum_variant_names clippy lint (#7992) by @Boshen - fix single_match clippy lint (#7997) by @Boshen - rust: fix redundant_clone clippy lint (#7996) by @Boshen - rust: rename CJS to Cjs to follow upper_case_acronyms lint (#7991) by @Boshen - rust: remove unnecessary Box wrapper around Vec in MemberExprRef (#7990) by @Boshen - import_record: make resolved_module optional (#7907) by @shulaoda - remove unnecessary `.parse` (#7966) by @sapphi-red - remove unused `ImportRecordMeta::IsPlainImport` (#7948) by @shulaoda - proper set chunk meta (#7939) by @IWANABETHATGUY - module_loader: remove `try_spawn_with_cache` (#7920) by @shulaoda - link_stage: simplify `ImportStatus::NoMatch` to unit variant (#7909) by @shulaoda - improve global scope symbol reservation in chunk deconfliction (#7906) by @IWANABETHATGUY - simplify ast unwrapping in generate stage (#7900) by @IWANABETHATGUY - generate_stage: optimize cross-chunk imports computation (#7889) by @shulaoda - link_stage: move runtime require logic into match branch (#7892) by @shulaoda - link_stage: simplify runtime require reference conditions (#7891) by @shulaoda - link_stage: inline and simplify external dynamic import check (#7890) by @shulaoda - generate_stage: simplify external module import collection logic (#7887) by @shulaoda - avoid redundant module lookup in TLA computation (#7886) by @shulaoda - dev: `devEngine.compileEntry` does not return null (#7882) by @sapphi-red - dev: fix type errors for test HMR runtime (#7881) by @sapphi-red - dev: move `clientId` property to `DevRuntime` base class (#7880) by @sapphi-red - dev: generate client id in browser (#7878) by @hyf0 ### 📚 Documentation - apis: organize hook filters documentation and add composable filters section (#8003) by @sapphi-red - update `vitepress-plugin-group-icons` (#7947) by @yuyinws - add in-depth documentation for lazy barrel optimization (#7969) by @shulaoda - bump theme & update activeMatch for reference (#7963) by @mdong1909 - mark `build()` API as experimental (#7954) by @sapphi-red - enhance search functionality with improved scoring and filtering logic (#7935) by @hyf0 - add minor comments to multiple types (#7930) by @sapphi-red - refactor advanedChunks related content to adapt manual code splitting concept (#7925) by @hyf0 - apis: add content to Bundler API page (#7926) by @sapphi-red - apis: restructure plugin API related docs (#7924) by @sapphi-red - add plugin API docs (#7923) by @sapphi-red - apis: add docs to important APIs (#7913) by @sapphi-red - move the important APIs to the top of the sidebar (#7912) by @sapphi-red - apis: add more content to CLI documentation (#7911) by @sapphi-red - apis: generate CLI docs from --help output (#7910) by @sapphi-red - add fathom analytics (#7896) by @mdong1909 ### ⚡ Performance - use u32 for string indices in string_wizard and rolldown to reduce memory usage (#7989) by @IWANABETHATGUY - rust: remove all usages of `with_scope_tree_child_ids(true)` for `SemanticBuilder` (#7995) by @Dunqing - renamer: skip unnecessary nested scope symbol processing (#7899) by @Dunqing - module_loader: use ArcStr for importer_id to avoid string copy (#7922) by @shulaoda - module_loader: defer `ModuleTaskOwner` construction until needed (#7921) by @shulaoda - renamer: optimize symbol renaming by eliminating `rename_non_root_symbol` pass (#7867) by @Dunqing ### 🧪 Testing - add lazy barrel optimization test cases (#7967) by @shulaoda ### ⚙️ Miscellaneous Tasks - remove lazy barrel option (#8010) by @shulaoda - mark watch API as experimental (#8004) by @sapphi-red - deps: update dependency lodash-es to v4.17.23 [security] (#8001) by @renovate[bot] - git ignore zed local config (#7988) by @IWANABETHATGUY - setup publint for published packages (#7972) by @Copilot - enable `tagged_template_transform ` uncondionally (#7975) by @IWANABETHATGUY - deps: update oxc to v0.110.0 (#7964) by @renovate[bot] - deps: update oxc apps (#7962) by @renovate[bot] - ai: add upgrade-oxc Claude skill (#7957) by @Boshen - deps: update rollup submodule for tests to v4.55.2 (#7959) by @sapphi-red - deps: update test262 submodule for tests (#7960) by @sapphi-red - deps: update crate-ci/typos action to v1.42.1 (#7961) by @renovate[bot] - deps: update rust crates (#7951) by @renovate[bot] - deps: update npm packages (#7953) by @renovate[bot] - deps: update github-actions (#7952) by @renovate[bot] - deps: update npm packages (#7950) by @renovate[bot] - format magic-string test before write to disk (#7945) by @IWANABETHATGUY - deps: update dependency rolldown-plugin-dts to ^0.21.0 (#7915) by @renovate[bot] - deps: update dependency oxlint-tsgolint to v0.11.1 (#7914) by @renovate[bot] - deps: update dependency diff to v8.0.3 [security] (#7904) by @renovate[bot] - remove outdated TODO comment in `collect_depended_symbols` (#7888) by @shulaoda - deps: update oxc resolver to v11.16.3 (#7876) by @renovate[bot]
|
@copilot Will thrown error messages be included in the build output, and do they meaningfully affect bundle size? From a security standpoint, does this constitute information disclosure, such as exposing framework or internal details? |
fz6m
reviewed
Jan 23, 2026
| throw Error( | ||
| 'Calling `require` for "' + x + | ||
| '" in an environment that doesn\'t expose the `require` function.', | ||
| '" in an environment that doesn\'t expose the `require` function. See https://rolldown.rs/in-depth/bundling-cjs#require-external-modules for more details.', |
There was a problem hiding this comment.
@copilot If this is included in the production bundle, it could help attackers fingerprint the framework and exploit known vulnerabilities.
Member
|
The message is only included once and it's 89 bytes, so it is negligible. This can help fingerprint the framework, but there're many other places that can be used and further more, the license text would have to include the library name (like vue & react) anyway. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Original prompt
💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.