Merge remote-tracking branch 'origin/main' into feat/node-native-http-loader-main

ScriptedAlchemy · ScriptedAlchemy · commit b89367ca0651 · 2026-07-02T07:15:19.000Z
# Conflicts:
#	pnpm-lock.yaml
diff --git a/.changeset/bright-pots-vanish.md b/.changeset/bright-pots-vanish.md
@@ -0,0 +1,5 @@
+---
+'@module-federation/retry-plugin': patch
+---
+
+fix: externalize @module-federation/runtime and runtime-core from DTS bundle to prevent type incompatibility in consumers
diff --git a/.changeset/drop-ansi-colors-dts-plugin.md b/.changeset/drop-ansi-colors-dts-plugin.md
@@ -0,0 +1,5 @@
+---
+'@module-federation/dts-plugin': patch
+---
+
+chore(dts-plugin): drop `ansi-colors` dependency in favor of inline ANSI escape for the single red error message.
diff --git a/.changeset/drop-lodash-get.md b/.changeset/drop-lodash-get.md
@@ -0,0 +1,5 @@
+---
+'@module-federation/typescript': patch
+---
+
+chore(typescript): drop `lodash.get` dependency in favor of optional chaining in `normalizeOptions`.
diff --git a/.changeset/replace-find-pkg-with-empathic.md b/.changeset/replace-find-pkg-with-empathic.md
@@ -0,0 +1,7 @@
+---
+'@module-federation/managers': patch
+'@module-federation/third-party-dts-extractor': patch
+'@module-federation/manifest': patch
+---
+
+chore: replace `find-pkg` with `empathic` (per [e18e replacements](https://e18e.dev/docs/replacements/find-pkg.html)). Removes unused `find-pkg` dependency from `@module-federation/manifest`.
diff --git a/.changeset/tricky-pants-rescue.md b/.changeset/tricky-pants-rescue.md
@@ -0,0 +1,5 @@
+---
+'@module-federation/treeshake-server': patch
+---
+
+Bump undici to 7.28.0 to resolve known vulnerabilities (CVE-2026-12151 and related advisories).
diff --git a/package.json b/package.json
@@ -174,7 +174,6 @@
     "express": "5.2.1",
     "fast-glob": "3.3.3",
     "glob": "^11.0.0",
-    "lodash.get": "4.4.2",
     "openai": "^6.27.0",
     "rambda": "11.1.0",
     "regenerator-runtime": "0.14.1",
@@ -226,7 +225,6 @@
     "@types/fs-extra": "9.0.13",
     "@types/jest": "29.5.13",
     "@types/lodash.clonedeepwith": "^4.5.9",
-    "@types/lodash.get": "4.4.9",
     "@types/minimatch": "^5.1.2",
     "@types/node": "20.19.5",
     "@types/node-fetch": "2.6.11",
diff --git a/packages/bridge/bridge-react-webpack-plugin/__tests__/mockRouterDir/router-v6/react-router-dom/package.json b/packages/bridge/bridge-react-webpack-plugin/__tests__/mockRouterDir/router-v6/react-router-dom/package.json
@@ -24,7 +24,7 @@
   "types": "./dist/index.d.ts",
   "dependencies": {
     "@remix-run/router": "1.23.2",
-    "react-router": "6.30.3"
+    "react-router": "6.30.4"
   },
   "devDependencies": {
     "react": "^18.3.1",
diff --git a/packages/chrome-devtools/package.json b/packages/chrome-devtools/package.json
@@ -65,7 +65,7 @@
     "ahooks": "3.7.10",
     "dagre": "0.8.5",
     "reactflow": "11.11.4",
-    "echarts": "6.0.0",
+    "echarts": "6.1.0",
     "lucide-react": "0.364.0",
     "echarts-for-react": "3.0.5",
     "i18next": "23.0.0",
diff --git a/packages/create-module-federation/package.json b/packages/create-module-federation/package.json
@@ -39,7 +39,7 @@
     "minimist": "1.2.8",
     "rslog": "1.2.3",
     "glob": "7.2.0",
-    "handlebars": "4.7.7"
+    "handlebars": "4.7.9"
   },
   "devDependencies": {
     "@types/glob": "7.2.0",
diff --git a/packages/dts-plugin/package.json b/packages/dts-plugin/package.json
@@ -70,7 +70,6 @@
     "@module-federation/sdk": "workspace:*",
     "@module-federation/third-party-dts-extractor": "workspace:*",
     "adm-zip": "0.5.10",
-    "ansi-colors": "4.1.3",
     "isomorphic-ws": "5.0.0",
     "undici": "7.28.0",
     "node-schedule": "2.1.1",
diff --git a/packages/dts-plugin/src/core/lib/utils.ts b/packages/dts-plugin/src/core/lib/utils.ts
@@ -1,7 +1,7 @@
 import fs from 'fs';
 import path from 'path';
+import { styleText } from 'node:util';
 import { moduleFederationPlugin, getProcessEnv } from '@module-federation/sdk';
-import ansiColors from 'ansi-colors';
 import { Agent } from 'undici';
 import { retrieveRemoteConfig } from '../configurations/remotePlugin';
 import { HostOptions } from '../interfaces/HostOptions';
@@ -63,7 +63,9 @@ export function retrieveTypesAssetsInfo(options: RemoteOptions) {
       apiFileName: path.basename(apiTypesPath),
     };
   } catch (err) {
-    console.error(ansiColors.red(`Unable to compile federated types, ${err}`));
+    console.error(
+      styleText('red', `Unable to compile federated types, ${err}`),
+    );
     return {
       apiTypesPath: '',
       zipTypesPath: '',
diff --git a/packages/managers/package.json b/packages/managers/package.json
@@ -26,7 +26,7 @@
   "types": "./dist/index.d.ts",
   "dependencies": {
     "@module-federation/sdk": "workspace:*",
-    "find-pkg": "2.0.0"
+    "empathic": "2.0.0"
   },
   "devDependencies": {
     "webpack": "5.104.1"
diff --git a/packages/managers/src/PKGJsonManager.ts b/packages/managers/src/PKGJsonManager.ts
@@ -1,6 +1,5 @@
 import path from 'path';
-// @ts-ignore this pkg miss types
-import finder from 'find-pkg';
+import { up as findPkgUp } from 'empathic/package';
 import fs from 'fs';
 import { MFModuleType, logger } from '@module-federation/sdk';
 
@@ -24,7 +23,11 @@ export class PKGJsonManager {
       return pkg;
     } catch (_err) {
       try {
-        const pkg = finder.sync(root);
+        const pkgPath = findPkgUp({ cwd: root });
+        if (!pkgPath) {
+          return {};
+        }
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
         this._pkg = pkg;
         return pkg;
       } catch (err) {
diff --git a/packages/managers/src/SharedManager.ts b/packages/managers/src/SharedManager.ts
@@ -1,5 +1,4 @@
-// @ts-ignore this pkg miss types
-import findPkg from 'find-pkg';
+import { up as findPkgUp } from 'empathic/package';
 import path from 'path';
 import fs from 'fs';
 import {
@@ -70,7 +69,9 @@ class SharedManager extends BasicPluginOptionsManager<moduleFederationPlugin.Mod
         }
       }
       pkgPath = pkgPath || require.resolve(depName, { paths: [this.root] });
-      const pkgJsonPath = findPkg.sync(pkgPath);
+      const pkgJsonPath = findPkgUp({
+        cwd: path.dirname(pkgPath),
+      }) as string;
       return {
         pkg: JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8')),
         path: '',
diff --git a/packages/manifest/package.json b/packages/manifest/package.json
@@ -29,8 +29,7 @@
   "dependencies": {
     "@module-federation/sdk": "workspace:*",
     "@module-federation/dts-plugin": "workspace:*",
-    "@module-federation/managers": "workspace:*",
-    "find-pkg": "2.0.0"
+    "@module-federation/managers": "workspace:*"
   },
   "exports": {
     ".": {
diff --git a/packages/retry-plugin/package.json b/packages/retry-plugin/package.json
@@ -32,6 +32,9 @@
       ]
     }
   },
+  "peerDependencies": {
+    "@module-federation/runtime": "*"
+  },
   "devDependencies": {
     "@module-federation/runtime": "workspace:*"
   },
diff --git a/packages/retry-plugin/tsdown.config.ts b/packages/retry-plugin/tsdown.config.ts
@@ -9,7 +9,11 @@ const baseConfig = {
   tsconfig: 'tsconfig.json',
   clean: true,
   entry,
-  external: ['@module-federation/sdk'],
+  external: [
+    '@module-federation/sdk',
+    '@module-federation/runtime',
+    '@module-federation/runtime-core',
+  ],
 };
 
 export default defineConfig([
diff --git a/packages/third-party-dts-extractor/package.json b/packages/third-party-dts-extractor/package.json
@@ -32,7 +32,7 @@
   "author": "hanric <hanric.zhang@gmail.com>",
   "license": "MIT",
   "dependencies": {
-    "find-pkg": "2.0.0",
+    "empathic": "2.0.0",
     "resolve": "1.22.8"
   },
   "devDependencies": {
diff --git a/packages/third-party-dts-extractor/src/ThirdPartyExtractor.ts b/packages/third-party-dts-extractor/src/ThirdPartyExtractor.ts
@@ -1,4 +1,4 @@
-import findPkg from 'find-pkg';
+import { up as findPkgUp } from 'empathic/package';
 import { copyFile, lstat, mkdir, readdir } from 'fs/promises';
 import { existsSync, readFileSync } from 'fs';
 import path from 'path';
@@ -97,11 +97,13 @@ class ThirdPartyExtractor {
         return dir;
       } else {
         const typedPkgName = getTypedName(pkg.name);
-        const typedPkgJsonPath = findPkg.sync(
-          resolve.sync(`${typedPkgName}/package.json`, {
-            basedir: this.context,
-          }),
-        ) as string;
+        const typedPkgJsonPath = findPkgUp({
+          cwd: path.dirname(
+            resolve.sync(`${typedPkgName}/package.json`, {
+              basedir: this.context,
+            }),
+          ),
+        }) as string;
         const typedDir = path.dirname(typedPkgJsonPath);
         readFileSync(typedPkgJsonPath, 'utf-8');
         this.addPkgs(typedPkgName, typedDir);
diff --git a/packages/treeshake-server/package.json b/packages/treeshake-server/package.json
@@ -32,15 +32,15 @@
   "author": "",
   "license": "ISC",
   "dependencies": {
-    "@hono/node-server": "1.19.10",
+    "@hono/node-server": "1.19.13",
     "@hono/zod-validator": "0.7.4",
     "dotenv": "16.4.5",
     "hono": "4.12.25",
     "json-stable-stringify": "1.3.0",
     "nanoid": "5.1.6",
     "p-limit": "7.2.0",
     "pino": "10.1.0",
-    "undici": "6.23.0",
+    "undici": "7.28.0",
     "zod": "4.1.12"
   },
   "devDependencies": {
diff --git a/packages/typescript/package.json b/packages/typescript/package.json
@@ -44,7 +44,6 @@
   },
   "dependencies": {
     "axios": "1.16.1",
-    "lodash.get": "4.4.2",
     "node-fetch": "2.7.0",
     "tapable": "2.3.0"
   },
diff --git a/packages/typescript/src/lib/normalizeOptions.ts b/packages/typescript/src/lib/normalizeOptions.ts
@@ -1,6 +1,5 @@
 import ts from 'typescript';
 import { Compiler } from 'webpack';
-import get from 'lodash.get';
 import path from 'path';
 
 import type { FederatedTypesPluginOptions, TypeServeOptions } from '../types';
@@ -80,9 +79,14 @@ export const normalizeOptions = (
 
   const federationFileName = (federationConfig.filename ??
     'remoteEntry.js') as string;
+  const devServer = (
+    webpackCompilerOptions as {
+      devServer?: { static?: { directory?: string } };
+    }
+  ).devServer;
   const distPath =
-    get(webpackCompilerOptions, 'devServer.static.directory') ||
-    get(webpackCompilerOptions, 'output.path') ||
+    devServer?.static?.directory ||
+    webpackCompilerOptions.output?.path ||
     'dist';
 
   const typesPath = federationFileName.substring(
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml

-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +'@module-federation/retry-plugin': patch
 +---
++
 +fix: externalize @module-federation/runtime and runtime-core from DTS bundle to prevent type incompatibility in consumers