Skip to content

fix(deps): stop relying on pnpm's NODE_PATH for undeclared packages - #6372

Open
Han5991 wants to merge 7 commits into
facebook:mainfrom
Han5991:chore/declare-shim-only-requires
Open

Han5991 wants to merge 7 commits into
facebook:mainfrom
Han5991:chore/declare-shim-only-requires

Conversation

@Han5991

@Han5991 Han5991 commented Sep 19, 2026

Copy link
Copy Markdown
Contributor

Maintainer impact

pnpm's command shims put node_modules/.pnpm/node_modules on NODE_PATH. That let these lookups resolve under vitest/next without being declared, and each fails outside a shim:

Intended invariant

A package resolves only what it declares (#5327).

Change

  • ./postcss passes the host's postcss a CSS string to parse, so it needs no postcss of its own.
  • ./vite resolves lightningcss and browserslist from @stylexjs/unplugin, which depends on both. Its test now checks for a prefix only that pass adds.
  • Declare the missing packages:
    • enhanced-resolve in build
    • autoprefixer in the sandbox
    • next in core, at the 16.3.0-preview.5 the test already ran against
  • The core tests now resolve their presets from core.
  • Remove the sandbox's unused lexical$ alias.
  • The lockfile adds no new package versions.

Evidence

  • Failure before the change: every lookup above fails without NODE_PATH. The old vite test stays green even when the pass is skipped.
  • Success after the change: build and core tests pass with vitest run without NODE_PATH. The new vite assertion fails on the old code.
  • Product/runtime behavior verified unchanged: the sandbox CSS output is byte-identical (7 files), and the sandbox and storybook builds pass.

Scope

  • No intended public API, product behavior, visual direction, or policy change. @astryxdesign/build has a changeset.
  • Product changes discovered during the work were removed or split.
  • Public text and artifacts contain no internal Meta context.

Testing

Ran locally: pnpm build, check:repo, lint, every CI typecheck gate, verify-exports, CLI smoke tests, docsite generate + test, storybook and sandbox builds, and vitest node + ui. The only failures were the macOS-only ones noted in #5327. The theme-layer cascade guard needs Playwright's browser, which is left to CI.

…DE_PATH

After facebook#5327 made node_modules strict, three CommonJS requires kept resolving
without a declaration: pnpm's command shims for vitest and next put
node_modules/.pnpm/node_modules on NODE_PATH, and require folds NODE_PATH in.
Run without it, each one fails with MODULE_NOT_FOUND.

- packages/build/src/index.js, the ./postcss entry, requires postcss, which
  the package has never declared (facebook#1447). It is now an optional peer: the
  PostCSS plugin guidelines keep postcss a peer so a plugin works on the
  host's AST, and the Babel, Vite and Next entries never load it.
- apps/sandbox/next.config.mjs resolves lexical to pin its ESM build (facebook#4380).
  lexical is a richtext dependency; the sandbox never declared it.
- packages/build/src/next.test.mjs drives enhanced-resolve (facebook#5932), which only
  arrives transitively through next.

All three resolve to versions the lockfile already carries, so it gains
importer entries and no new package versions.
resolveLexicalDist caught a failed lookup and returned null, and the webpack
hook then skipped the lexical$ alias. lab's bare lexical imports would then
resolve through lexical's `source` export to its raw TS, which this app's Babel
pipeline rejects (facebook#4380) -- an error about class fields, far from the missing
package that caused it.

lexical is now a declared devDependency, so a failed lookup means a broken
install rather than an optional package. Let it throw where the cause is.
@vercel

vercel Bot commented Sep 19, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
astryx Ready Ready Preview Sep 19, 2026 5:43am UTC

Request Review

@meta-cla meta-cla Bot added the CLA Signed This label is managed by the Meta Open Source bot. label Sep 19, 2026
@github-actions github-actions Bot added community Authored by a community contributor (not on the eng/design team) needs:code-review High-risk change (new package/component/API) — needs human code review before merge labels Sep 19, 2026
facebook#4380 pinned bare lexical imports issued from @astryxdesign modules to
lexical's built ESM: lab's RichTextEditor imported lexical, and withAstryx's
`source` condition sent it to lexical's raw TS. facebook#4678 moved the editor into
@astryxdesign/richtext, which the sandbox does not depend on, and left the
alias behind.

Nothing the sandbox compiles imports lexical, @lexical/* or richtext, and the
build output contains no lexical code with or without the alias. Remove it,
along with the lexical devDependency the earlier commit declared for it.
ButtonGroup.test.tsx and Selector.source-build.test.mjs hand Babel bare preset
names. Babel looks those up from the cwd -- the repo root, which declares none
of them -- so they resolved only through the node_modules/.pnpm/node_modules
entry pnpm's vitest shim puts on NODE_PATH. Without it, the first fails on
@babel/preset-typescript and the second on next.

Resolve each preset from the test's own package instead. core already declares
both Babel presets; it now declares next too, at the 16.3.0-preview.5 the test
was already running against, so the lockfile reuses the existing snapshot.
Addresses the review on facebook#6372.

- ./postcss required postcss only to parse its generated CSS. It now passes
  replaceWith() a string, which the host's own postcss parses, so both the
  require and the optional peer the earlier commit declared go away.
- ./vite required lightningcss and browserslist from its own location, where
  neither is declared, and its try/catch turned the miss into a silently
  skipped pass. It now resolves both from @stylexjs/unplugin, which depends on
  them and whose output that pass reproduces. The test guarding the pass looked
  for any -webkit- prefix, which an authored one always satisfied. It now
  checks a prefix only the pass adds, and fails on the old code without
  NODE_PATH.
- apps/sandbox declares autoprefixer. build's postcss() config adds it, and
  Next resolves it from the app.
Addresses the review on facebook#6372.

- ./postcss required postcss only to parse its generated CSS. It now passes
  replaceWith() a string, which the host's own postcss parses, so both the
  require and the optional peer the earlier commit declared go away.
- ./vite required lightningcss and browserslist from its own location, where
  neither is declared, and its try/catch turned the miss into a silently
  skipped pass. It now resolves both from @stylexjs/unplugin, which depends on
  them and whose output that pass reproduces. The test guarding the pass looked
  for any -webkit- prefix, which an authored one always satisfied. It now
  checks a prefix only the pass adds, and fails on the old code without
  NODE_PATH.
- apps/sandbox declares autoprefixer. build's postcss() config adds it, and
  Next resolves it from the app.
@Han5991 Han5991 changed the title chore(deps): declare the three requires that resolved only through NODE_PATH fix(deps): stop relying on pnpm's NODE_PATH for undeclared packages Sep 19, 2026
@Han5991
Han5991 marked this pull request as ready for review September 19, 2026 05:54
github-actions Bot added a commit that referenced this pull request Sep 19, 2026
@github-actions

Copy link
Copy Markdown
Contributor

PR Analysis Report

📚 Storybook Preview

View Storybook for this PR
GitHub Pages may take up to a minute to hydrate after deploy.

🧪 Sandbox Preview

View Sandbox for this PR
GitHub Pages may take up to a minute to hydrate after deploy.

No new or modified components detected.

Bundle Size Summary

Package Size (ESM) Size (CJS) Gzipped
@astryxdesign/core N/A 4.8KB 1.2KB

Accessibility Audit

Status: 36 accessibility violation(s) found — 2 critical, 34 serious.

Button pattern - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 1/18 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
ChatComposer - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 1/18 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
ChatComposerInput - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 1/14 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
ChatReasoning - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 4/5 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
ChatToolCalls - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 10/11 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
Checkbox pattern - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 2/33 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
CheckboxList - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 4/17 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
ClickableCard - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 1/5 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
CodeEditor - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 3/7 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
CodeEditorPerf - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 2/2 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
CodeEditorTheme - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 13/14 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
CodeTheme - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 14/16 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
DateRangeInput - 1 issue(s)
  • 🔴 critical: Ensure an element's role supports its ARIA attributes
    • Rule: aria-allowed-attr · Affects 1/21 stories · Learn more
    • WCAG: 4.1.2 (Level A)
FileInput - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 3/15 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
GridMasonry - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 1/3 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
Heading - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 1/16 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
Icon - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 1/18 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
LogStream - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 2/3 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
MediaTheme Auto - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 1/5 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
PowerSearch - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 2/26 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
ProgressBar - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 2/18 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
Radio group pattern - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 3/26 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
RadioList - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 3/13 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
RichTextEditor - 2 issue(s)
  • 🟠 serious: Ensure every ARIA input field has an accessible name
    • Rule: aria-input-field-name · Affects 2/18 stories · Learn more
    • WCAG: 4.1.2 (Level A)
  • 🔴 critical: Ensure every form element has a label
    • Rule: label · Affects 1/18 stories · Learn more
    • WCAG: 4.1.2 (Level A)
SelectableCard - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 1/4 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
Stepper - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 1/30 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
TableGroupedRows - 1 issue(s)
  • 🟠 serious: Ensure ARIA attributes are used as described in the specification of the element's role
    • Rule: aria-conditional-attr · Affects 3/3 stories · Learn more
    • WCAG: 4.1.2 (Level A)
TableTree - 1 issue(s)
  • 🟠 serious: Ensure ARIA attributes are used as described in the specification of the element's role
    • Rule: aria-conditional-attr · Affects 8/9 stories · Learn more
    • WCAG: 4.1.2 (Level A)
Text - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 1/23 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
Theme - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 1/5 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
PopArt - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 3/6 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
Thumbnail - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 1/12 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
Timestamp - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 1/20 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
Token - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 2/10 stories · Learn more
    • WCAG: 1.4.3 (Level AA)
Tokenizer - 1 issue(s)
  • 🟠 serious: Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds
    • Rule: color-contrast · Affects 2/24 stories · Learn more
    • WCAG: 1.4.3 (Level AA)

Generated by PR Enrichment workflow | Storybook | Sandbox | View full report

@astracat-bot

astracat-bot Bot commented Sep 20, 2026

Copy link
Copy Markdown

AI review status for this pull request.

Review status Updated
Waiting for review (for maintainers only) Sep 20, 2026, 3:43 PM UTC

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CLA Signed This label is managed by the Meta Open Source bot. community Authored by a community contributor (not on the eng/design team) needs:code-review High-risk change (new package/component/API) — needs human code review before merge

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant