shakapacker 9.3.0.beta.6 → 9.3.0

data/package/configExporter/configFile.ts

@@ -3,9 +3,9 @@ import { resolve, relative, isAbsolute } from "path"
 import { load as loadYaml, FAILSAFE_SCHEMA } from "js-yaml"
 import {
   BundlerConfigFile,
-  BuildConfig,
   ResolvedBuildConfig,
-  ExportOptions
+  ExportOptions,
+  DEFAULT_CONFIG_FILE
 } from "./types"
 
 /**
@@ -18,12 +18,12 @@ export class ConfigFileLoader {
   private configFilePath: string
 
   /**
-   * @param configFilePath - Path to config file (defaults to config/shakapacker-builds.yml in cwd)
+   * @param configFilePath - Path to config file (defaults to DEFAULT_CONFIG_FILE in cwd)
    * @throws Error if path is outside project directory
    */
   constructor(configFilePath?: string) {
     this.configFilePath =
-      configFilePath || resolve(process.cwd(), "config/shakapacker-builds.yml")
+      configFilePath || resolve(process.cwd(), DEFAULT_CONFIG_FILE)
     this.validateConfigPath()
   }
 
@@ -46,7 +46,7 @@ export class ConfigFileLoader {
         // If file doesn't exist yet, just use the resolved path
         realPath = absPath
       }
-    } catch (error) {
+    } catch {
       // If we can't resolve the path, use the original
       realPath = absPath
     }
@@ -92,16 +92,18 @@ export class ConfigFileLoader {
         json: true
       }) as BundlerConfigFile
 
-      this.validate(parsed)
+      ConfigFileLoader.validate(parsed)
       return parsed
-    } catch (error: any) {
+    } catch (error: unknown) {
+      const errorMessage =
+        error instanceof Error ? error.message : String(error)
       throw new Error(
-        `Failed to load config file ${this.configFilePath}: ${error.message}`
+        `Failed to load config file ${this.configFilePath}: ${errorMessage}`
       )
     }
   }
 
-  private validate(config: BundlerConfigFile): void {
+  private static validate(config: BundlerConfigFile): void {
     if (!config.builds || typeof config.builds !== "object") {
       throw new Error("Config file must contain a 'builds' object")
     }
@@ -193,7 +195,7 @@ export class ConfigFileLoader {
     }
 
     // Resolve bundler with precedence
-    const bundler = this.resolveBundler(
+    const bundler = ConfigFileLoader.resolveBundler(
       options.bundler,
       build.bundler,
       config.default_bundler,
@@ -207,7 +209,9 @@ export class ConfigFileLoader {
     )
 
     // Convert bundler_env to CLI args
-    const bundlerEnvArgs = this.convertBundlerEnvToArgs(build.bundler_env || {})
+    const bundlerEnvArgs = ConfigFileLoader.convertBundlerEnvToArgs(
+      build.bundler_env || {}
+    )
 
     // Resolve and validate outputs
     const outputs = build.outputs || []
@@ -264,7 +268,7 @@ export class ConfigFileLoader {
     }
   }
 
-  private resolveBundler(
+  private static resolveBundler(
     cliFlag?: "webpack" | "rspack",
     buildBundler?: "webpack" | "rspack",
     defaultBundler?: "webpack" | "rspack",
@@ -293,9 +297,9 @@ export class ConfigFileLoader {
     // Replace ${VAR:-default} with VAR value or default
     expanded = expanded.replace(
       /\$\{([^}:]+):-([^}]*)\}/g,
-      (_, varName, defaultValue) => {
+      (_: string, varName: string, defaultValue: string) => {
         // Validate env var name to prevent regex injection
-        if (!this.isValidEnvVarName(varName)) {
+        if (!ConfigFileLoader.isValidEnvVarName(varName)) {
           console.warn(
             `[Config Exporter] Warning: Invalid environment variable name: ${varName}`
           )
@@ -306,16 +310,19 @@ export class ConfigFileLoader {
     )
 
     // Replace ${VAR} with VAR value
-    expanded = expanded.replace(/\$\{([^}:]+)\}/g, (_, varName) => {
-      // Validate env var name to prevent regex injection
-      if (!this.isValidEnvVarName(varName)) {
-        console.warn(
-          `[Config Exporter] Warning: Invalid environment variable name: ${varName}`
-        )
-        return `\${${varName}}`
+    expanded = expanded.replace(
+      /\$\{([^}:]+)\}/g,
+      (_: string, varName: string) => {
+        // Validate env var name to prevent regex injection
+        if (!ConfigFileLoader.isValidEnvVarName(varName)) {
+          console.warn(
+            `[Config Exporter] Warning: Invalid environment variable name: ${varName}`
+          )
+          return `\${${varName}}`
+        }
+        return process.env[varName] || ""
       }
-      return process.env[varName] || ""
-    })
+    )
 
     return expanded
   }
@@ -326,11 +333,11 @@ export class ConfigFileLoader {
    * @param name - The variable name to validate
    * @returns true if valid, false otherwise
    */
-  private isValidEnvVarName(name: string): boolean {
+  private static isValidEnvVarName(name: string): boolean {
     return /^[A-Z_][A-Z0-9_]*$/i.test(name)
   }
 
-  private convertBundlerEnvToArgs(
+  private static convertBundlerEnvToArgs(
     bundlerEnv: Record<string, string | boolean>
   ): string[] {
     const args: string[] = []
@@ -357,7 +364,7 @@ export class ConfigFileLoader {
    */
   listBuilds(): void {
     const config = this.load()
-    const builds = config.builds
+    const { builds } = config
 
     console.log(`\nAvailable builds in ${this.configFilePath}:\n`)
 

data/package/configExporter/fileWriter.ts

@@ -56,12 +56,12 @@ export class FileWriter {
    * @example
    * // Built-in types
    * generateFilename("webpack", "development", "client", "yaml")
-   * // => "webpack-development-client.yaml"
+   * // => "webpack-development-client.yml"
    *
    * @example
    * // Custom output names
    * generateFilename("webpack", "development", "client-modern", "yaml", "dev-hmr")
-   * // => "webpack-dev-hmr-client-modern.yaml"
+   * // => "webpack-dev-hmr-client-modern.yml"
    */
   static generateFilename(
     bundler: string,
@@ -72,7 +72,7 @@ export class FileWriter {
   ): string {
     let ext: string
     if (format === "yaml") {
-      ext = "yaml"
+      ext = "yml"
     } else if (format === "json") {
       ext = "json"
     } else {

data/package/configExporter/types.ts

@@ -1,3 +1,67 @@
+/**
+ * Environment variable names that can be set by build configurations.
+ * These are the only environment variables that build configs are allowed to set.
+ * This whitelist prevents malicious configs from modifying critical system variables.
+ */
+export const BUILD_ENV_VARS = [
+  "NODE_ENV",
+  "RAILS_ENV",
+  "NODE_OPTIONS",
+  "BABEL_ENV",
+  "WEBPACK_SERVE",
+  "CLIENT_BUNDLE_ONLY",
+  "SERVER_BUNDLE_ONLY"
+] as const
+
+/**
+ * Environment variables that must never be set by build configurations.
+ * Setting these could compromise system security or cause unexpected behavior.
+ */
+export const DANGEROUS_ENV_VARS = [
+  "PATH",
+  "HOME",
+  "LD_PRELOAD",
+  "LD_LIBRARY_PATH",
+  "DYLD_LIBRARY_PATH",
+  "DYLD_INSERT_LIBRARIES"
+] as const
+
+/**
+ * Type predicate to check if a string is in the BUILD_ENV_VARS whitelist
+ *
+ * Note: The type assertion is necessary because TypeScript's type system cannot
+ * infer that .includes() on a readonly const array will properly narrow the type.
+ * The assertion is safe because we're only widening the type for the includes() check.
+ */
+export function isBuildEnvVar(
+  key: string
+): key is (typeof BUILD_ENV_VARS)[number] {
+  return (BUILD_ENV_VARS as readonly string[]).includes(key)
+}
+
+/**
+ * Type predicate to check if a string is in the DANGEROUS_ENV_VARS blacklist
+ *
+ * Note: The type assertion is necessary because TypeScript's type system cannot
+ * infer that .includes() on a readonly const array will properly narrow the type.
+ * The assertion is safe because we're only widening the type for the includes() check.
+ */
+export function isDangerousEnvVar(
+  key: string
+): key is (typeof DANGEROUS_ENV_VARS)[number] {
+  return (DANGEROUS_ENV_VARS as readonly string[]).includes(key)
+}
+
+/**
+ * Default directory for config exports when using --doctor or file output modes.
+ */
+export const DEFAULT_EXPORT_DIR = "shakapacker-config-exports"
+
+/**
+ * Default config file path for bundler build configurations.
+ */
+export const DEFAULT_CONFIG_FILE = "config/shakapacker-builds.yml"
+
 export interface ExportOptions {
   doctor?: boolean
   saveDir?: string

data/package/configExporter/yamlSerializer.ts

@@ -1,6 +1,6 @@
+import { relative, isAbsolute } from "path"
 import { ConfigMetadata } from "./types"
 import { getDocForKey } from "./configDocs"
-import { relative, isAbsolute } from "path"
 
 /**
  * Serializes webpack/rspack config to YAML format with optional inline documentation.
@@ -8,6 +8,7 @@ import { relative, isAbsolute } from "path"
  */
 export class YamlSerializer {
   private annotate: boolean
+
   private appRoot: string
 
   constructor(options: { annotate: boolean; appRoot: string }) {
@@ -18,11 +19,11 @@ export class YamlSerializer {
   /**
    * Serialize a config object to YAML string with metadata header
    */
-  serialize(config: any, metadata: ConfigMetadata): string {
+  serialize(config: unknown, metadata: ConfigMetadata): string {
     const output: string[] = []
 
     // Add metadata header
-    output.push(this.createHeader(metadata))
+    output.push(YamlSerializer.createHeader(metadata))
     output.push("")
 
     // Serialize the config
@@ -31,9 +32,9 @@ export class YamlSerializer {
     return output.join("\n")
   }
 
-  private createHeader(metadata: ConfigMetadata): string {
+  private static createHeader(metadata: ConfigMetadata): string {
     const lines: string[] = []
-    lines.push("# " + "=".repeat(77))
+    lines.push(`# ${"=".repeat(77)}`)
     lines.push("# Webpack/Rspack Configuration Export")
     lines.push(`# Generated: ${metadata.exportedAt}`)
     lines.push(`# Environment: ${metadata.environment}`)
@@ -42,11 +43,15 @@ export class YamlSerializer {
     if (metadata.configCount > 1) {
       lines.push(`# Total Configs: ${metadata.configCount}`)
     }
-    lines.push("# " + "=".repeat(77))
+    lines.push(`# ${"=".repeat(77)}`)
     return lines.join("\n")
   }
 
-  private serializeValue(value: any, indent: number, keyPath: string): string {
+  private serializeValue(
+    value: unknown,
+    indent: number,
+    keyPath: string
+  ): string {
     if (value === null || value === undefined) {
       return "null"
     }
@@ -64,11 +69,28 @@ export class YamlSerializer {
     }
 
     if (typeof value === "function") {
-      return this.serializeFunction(value)
+      return this.serializeFunction(
+        value as (...args: unknown[]) => unknown,
+        indent
+      )
     }
 
     if (value instanceof RegExp) {
-      return this.serializeString(value.toString())
+      // Extract pattern without surrounding slashes: "/pattern/flags" -> "pattern"
+      // Include flags as inline comment when present for semantic clarity
+      const regexStr = value.toString()
+      const lastSlash = regexStr.lastIndexOf("/")
+      const pattern = regexStr.slice(1, lastSlash)
+      const flags = regexStr.slice(lastSlash + 1)
+
+      const serializedPattern = this.serializeString(pattern, indent)
+
+      // Add flags as inline comment if present (e.g., "pattern" # flags: gi)
+      if (flags) {
+        return `${serializedPattern} # flags: ${flags}`
+      }
+
+      return serializedPattern
     }
 
     if (Array.isArray(value)) {
@@ -76,10 +98,20 @@ export class YamlSerializer {
     }
 
     if (typeof value === "object") {
-      return this.serializeObject(value, indent, keyPath)
+      return this.serializeObject(
+        value as Record<string, unknown>,
+        indent,
+        keyPath
+      )
     }
 
-    return String(value)
+    // Handle remaining types explicitly
+    if (typeof value === "symbol") return value.toString()
+    if (typeof value === "bigint") return value.toString()
+
+    // All remaining types are primitives (string, number, boolean, null, undefined)
+    // that String() handles safely - cast to exclude objects since we've already handled them
+    return String(value as string | number | boolean | null | undefined)
   }
 
   private serializeString(str: string, indent: number = 0): string {
@@ -90,15 +122,28 @@ export class YamlSerializer {
     if (cleaned.includes("\n")) {
       const lines = cleaned.split("\n")
       const lineIndent = " ".repeat(indent + 2)
-      return "|\n" + lines.map((line) => lineIndent + line).join("\n")
+      return `|\n${lines.map((line) => lineIndent + line).join("\n")}`
     }
 
-    // Escape strings that need quoting
+    // Escape strings that need quoting in YAML
+    // YAML has many special characters that can cause parsing errors:
+    // : # ' " (basic delimiters)
+    // [ ] { } (flow collections)
+    // * & ! @ ` (special constructs: aliases, anchors, tags)
     if (
       cleaned.includes(":") ||
       cleaned.includes("#") ||
       cleaned.includes("'") ||
       cleaned.includes('"') ||
+      cleaned.includes("[") ||
+      cleaned.includes("]") ||
+      cleaned.includes("{") ||
+      cleaned.includes("}") ||
+      cleaned.includes("*") ||
+      cleaned.includes("&") ||
+      cleaned.includes("!") ||
+      cleaned.includes("@") ||
+      cleaned.includes("`") ||
       cleaned.startsWith(" ") ||
       cleaned.endsWith(" ")
     ) {
@@ -109,7 +154,10 @@ export class YamlSerializer {
     return cleaned
   }
 
-  private serializeFunction(fn: Function): string {
+  private serializeFunction(
+    fn: (...args: unknown[]) => unknown,
+    indent: number = 0
+  ): string {
     // Get function source code
     const source = fn.toString()
 
@@ -122,21 +170,24 @@ export class YamlSerializer {
     const displayLines = truncated ? lines.slice(0, maxLines) : lines
 
     // Clean up indentation while preserving structure
-    const minIndent = Math.min(
-      ...displayLines
-        .filter((l) => l.trim().length > 0)
-        .map((l) => l.match(/^\s*/)?.[0].length || 0)
-    )
+    const indentLevels = displayLines
+      .filter((l) => l.trim().length > 0)
+      .map((l) => l.match(/^\s*/)?.[0].length || 0)
+    const minIndent = indentLevels.length > 0 ? Math.min(...indentLevels) : 0
 
     const formatted =
       displayLines.map((line) => line.substring(minIndent)).join("\n") +
       (truncated ? "\n..." : "")
 
-    // Use serializeString to properly handle multiline
-    return this.serializeString(formatted)
+    // Use serializeString to properly handle multiline with correct indentation
+    return this.serializeString(formatted, indent)
   }
 
-  private serializeArray(arr: any[], indent: number, keyPath: string): string {
+  private serializeArray(
+    arr: unknown[],
+    indent: number,
+    keyPath: string
+  ): string {
     if (arr.length === 0) {
       return "[]"
     }
@@ -147,6 +198,22 @@ export class YamlSerializer {
 
     arr.forEach((item, index) => {
       const itemPath = `${keyPath}[${index}]`
+
+      // Check if this is a plugin object and add its name as a comment
+      const pluginName = YamlSerializer.getConstructorName(item)
+      const isPlugin = pluginName && /(^|\.)plugins\[\d+\]/.test(itemPath)
+      const isEmpty =
+        typeof item === "object" &&
+        item !== null &&
+        !Array.isArray(item) &&
+        Object.keys(item).length === 0
+
+      // For non-empty plugins, add comment before the plugin
+      // For empty plugins, the name will be shown inline
+      if (isPlugin && !isEmpty) {
+        lines.push(`${itemIndent}# ${pluginName}`)
+      }
+
       const serialized = this.serializeValue(item, indent + 4, itemPath)
 
       // Add documentation for array items if available
@@ -164,11 +231,11 @@ export class YamlSerializer {
           .split("\n")
           .filter((line: string) => line.trim().length > 0)
         // Compute minimum leading whitespace to preserve relative indentation
-        const minIndent = Math.min(
-          ...nonEmptyLines.map(
-            (line: string) => line.match(/^\s*/)?.[0].length || 0
-          )
+        const indentLevels = nonEmptyLines.map(
+          (line: string) => line.match(/^\s*/)?.[0].length || 0
         )
+        const minIndent =
+          indentLevels.length > 0 ? Math.min(...indentLevels) : 0
         nonEmptyLines.forEach((line: string) => {
           // Remove only the common indent, preserving relative indentation
           lines.push(contentIndent + line.substring(minIndent))
@@ -180,11 +247,11 @@ export class YamlSerializer {
           .split("\n")
           .filter((line: string) => line.trim().length > 0)
         // Compute minimum leading whitespace to preserve relative indentation
-        const minIndent = Math.min(
-          ...nonEmptyLines.map(
-            (line: string) => line.match(/^\s*/)?.[0].length || 0
-          )
+        const indentLevels = nonEmptyLines.map(
+          (line: string) => line.match(/^\s*/)?.[0].length || 0
         )
+        const minIndent =
+          indentLevels.length > 0 ? Math.min(...indentLevels) : 0
         nonEmptyLines.forEach((line: string) => {
           // Remove only the common indent, preserving relative indentation
           lines.push(contentIndent + line.substring(minIndent))
@@ -195,12 +262,22 @@ export class YamlSerializer {
       }
     })
 
-    return "\n" + lines.join("\n")
+    return `\n${lines.join("\n")}`
   }
 
-  private serializeObject(obj: any, indent: number, keyPath: string): string {
-    const keys = Object.keys(obj)
+  private serializeObject(
+    obj: Record<string, unknown>,
+    indent: number,
+    keyPath: string
+  ): string {
+    const keys = Object.keys(obj).sort()
+    const constructorName = YamlSerializer.getConstructorName(obj)
+
+    // For empty objects, show constructor name if available
     if (keys.length === 0) {
+      if (constructorName) {
+        return `{} # ${constructorName}`
+      }
       return "{}"
     }
 
@@ -226,6 +303,12 @@ export class YamlSerializer {
         for (const line of value.split("\n")) {
           lines.push(`${valueIndent}${line}`)
         }
+      } else if (value instanceof RegExp || typeof value === "function") {
+        // Handle RegExp and functions explicitly before the generic object check
+        // to prevent them from being treated as empty objects (RegExp/functions
+        // have no enumerable keys but should serialize as their string representation)
+        const serialized = this.serializeValue(value, indent + 2, fullKeyPath)
+        lines.push(`${keyIndent}${key}: ${serialized}`)
       } else if (
         typeof value === "object" &&
         value !== null &&
@@ -236,7 +319,7 @@ export class YamlSerializer {
         } else {
           lines.push(`${keyIndent}${key}:`)
           const nestedLines = this.serializeObject(
-            value,
+            value as Record<string, unknown>,
             indent + 2,
             fullKeyPath
           )
@@ -260,7 +343,6 @@ export class YamlSerializer {
   }
 
   private makePathRelative(str: string): string {
-    if (typeof str !== "string") return str
     if (!isAbsolute(str)) return str
 
     // Convert absolute paths to relative paths using path.relative
@@ -275,6 +357,35 @@ export class YamlSerializer {
       return str
     }
 
-    return "./" + rel
+    return `./${rel}`
+  }
+
+  /**
+   * Extracts the constructor name from an object
+   * Returns null for plain objects (Object constructor) or objects without prototypes
+   */
+  private static getConstructorName(obj: unknown): string | null {
+    if (!obj || typeof obj !== "object") return null
+    if (Array.isArray(obj)) return null
+
+    // Use Object.getPrototypeOf for safer access to constructor
+    // This handles Object.create(null) and unusual prototypes correctly
+    try {
+      const proto = Object.getPrototypeOf(obj) as {
+        constructor?: { name?: string }
+      } | null
+      if (!proto || proto === Object.prototype) return null
+
+      const { constructor } = proto
+      if (!constructor || typeof constructor !== "function") return null
+
+      const constructorName = constructor.name
+      if (!constructorName || constructorName === "Object") return null
+
+      return constructorName
+    } catch {
+      // Handle frozen objects or other edge cases
+      return null
+    }
   }
 }

data/package/dev_server.ts

@@ -1,7 +1,8 @@
 // These are the raw shakapacker dev server config settings from the YML file with ENV overrides applied.
+import { DevServerConfig } from "./types"
+
 const { isBoolean } = require("./utils/helpers")
 const config = require("./config")
-import { DevServerConfig } from "./types"
 
 const envFetch = (key: string): string | boolean | undefined => {
   const value = process.env[key]

data/package/env.ts

@@ -1,5 +1,6 @@
 import { load } from "js-yaml"
 import { readFileSync } from "fs"
+
 const defaultConfigPath = require("./utils/defaultConfigPath")
 const configPath = require("./utils/configPath")
 const { isFileNotFoundError } = require("./utils/errorHelpers")
@@ -76,7 +77,6 @@ const validatedRailsEnv =
   initialRailsEnv && initialRailsEnv.match(regex) ? initialRailsEnv : DEFAULT
 
 if (initialRailsEnv && validatedRailsEnv !== initialRailsEnv) {
-  /* eslint no-console:0 */
   console.warn(
     `[SHAKAPACKER WARNING] Environment '${initialRailsEnv}' not found in the configuration.\n` +
       `Using '${DEFAULT}' configuration as a fallback.`

data/package/environments/base.ts

@@ -1,12 +1,12 @@
 /* eslint global-require: 0 */
 /* eslint import/no-dynamic-require: 0 */
 
+import { Dirent } from "fs"
+import type { Configuration, Entry } from "webpack"
+
 const { basename, dirname, join, relative, resolve } = require("path")
 const { existsSync, readdirSync } = require("fs")
-import { Dirent } from "fs"
 const extname = require("path-complete-extname")
-// @ts-ignore: webpack is an optional peer dependency (using type-only import)
-import type { Configuration, Entry } from "webpack"
 const config = require("../config")
 const { isProduction } = require("../env")
 
@@ -73,7 +73,7 @@ const getEntryObject = (): Entry => {
     const previousPaths = entries[name]
     if (previousPaths) {
       const pathArray = Array.isArray(previousPaths)
-        ? (previousPaths as string[])
+        ? previousPaths
         : [previousPaths as string]
       pathArray.push(assetPath)
       entries[name] = pathArray

data/package/environments/development.ts

@@ -3,12 +3,6 @@
  * @module environments/development
  */
 
-const { merge } = require("webpack-merge")
-const config = require("../config")
-const baseConfig = require("./base")
-const webpackDevServerConfig = require("../webpackDevServerConfig")
-const { runningWebpackDevServer } = require("../env")
-const { moduleExists } = require("../utils/helpers")
 import type {
   WebpackConfigWithDevServer,
   RspackConfigWithDevServer,
@@ -16,6 +10,13 @@ import type {
   ReactRefreshRspackPlugin
 } from "./types"
 
+const { merge } = require("webpack-merge")
+const config = require("../config")
+const baseConfig = require("./base")
+const webpackDevServerConfig = require("../webpackDevServerConfig")
+const { runningWebpackDevServer } = require("../env")
+const { moduleExists } = require("../utils/helpers")
+
 /**
  * Base development configuration shared between webpack and rspack
  */