Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: remove globalThis check and align with what bundlers can accept #4022

Open
wants to merge 3 commits into
base: 16.x.x
Choose a base branch
from

Conversation

JoviDeCroock
Copy link

@JoviDeCroock JoviDeCroock commented Feb 14, 2024

As surfaced in Discord this currently is a breaking change in the 16.x.x release line which is preventing folks from upgrading towards a security fix. This PR should result in a patch release on the 16 release line.

This change was originally introduced to support CFW and browser environments which should still be supported with the typeof check CC @n1ru4l

This also adds a check whether .env is present as in the DOM using id="process" defines that as a global which we don't want to access on accident. as shown in #4017

Bundles also target process.env.NODE_ENV specifically which fails when it replaces globalThis.process.env.NODE_ENV as this becomes globalThis."production" which is invalid syntax.

Fixes #3978
Fixes #3918
Fixes #3758

This purposefully does not account for #3925 as we can't address this without breaking CF/plain browsers so the small byte-size increase will be expected for bundled browser environments. As a middle ground we did optimise the performance here. We can revisit this for v17

Supersedes #4021
Supersedes #4019
Supersedes #3927

Copy link
Member

@benjie benjie left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Copy link

Hi @JoviDeCroock, I'm @github-actions bot happy to help you with this PR 👋

Supported commands

Please post this commands in separate comments and only one per comment:

  • @github-actions run-benchmark - Run benchmark comparing base and merge commits for this PR
  • @github-actions publish-pr-on-npm - Build package from this PR and publish it on NPM

@JoviDeCroock JoviDeCroock force-pushed the fix-node-env-issue branch 2 times, most recently from daffdff to a8f5b4a Compare February 14, 2024 13:22
@JoviDeCroock
Copy link
Author

JoviDeCroock commented Feb 14, 2024

After talking to @phryneas there seems to be a lot of pushback from his side with regards to this change opting out of tree-shaking. I'll probably need more evidence that this breaks on different bundlers

@JoviDeCroock
Copy link
Author

CC @graphql/graphql-js-reviewers

Comment on lines 3 to 11
/* c8 ignore next 4 */
const isProduction =
// eslint-disable-next-line no-undef
typeof process !== 'undefined' &&
// eslint-disable-next-line no-undef
process.env &&
// eslint-disable-next-line no-undef
process.env.NODE_ENV === 'production';

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Another alternative that makes the branch default to production

Suggested change
/* c8 ignore next 4 */
const isProduction =
// eslint-disable-next-line no-undef
typeof process !== 'undefined' &&
// eslint-disable-next-line no-undef
process.env &&
// eslint-disable-next-line no-undef
process.env.NODE_ENV === 'production';
/* c8 ignore next 4 */
const isDev =
// eslint-disable-next-line no-undef
typeof process !== 'undefined' &&
// eslint-disable-next-line no-undef
process.env.NODE_ENV === 'development';

@@ -9,7 +18,7 @@ import { inspect } from './inspect';
export const instanceOf: (value: unknown, constructor: Constructor) => boolean =
/* c8 ignore next 6 */
// FIXME: https://github.com/graphql/graphql-js/issues/2317
globalThis.process && globalThis.process.env.NODE_ENV === 'production'
isProduction
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
isProduction
!isDevelopment

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants