@module-federation/vite 1.18.1 → 1.19.0

package/lib/{pluginDts-CGDIZCsD.js → pluginDts-Cd2opGcZ.js}

@@ -102,6 +102,7 @@ let packageDetectionCwd;
 function getDependencyCacheKey(cwd, dependencyName) {
 	return `${cwd}:${dependencyName}`;
 }
+const installedPackageJsonCache = /* @__PURE__ */ new Map();
 function setPackageDetectionCwd(cwd) {
 	packageDetectionCwd = cwd;
 }
@@ -398,6 +399,13 @@ const sharedCacheHelperCode = `const __mfGetSharedCacheDescriptor = (pkg, single
 function getInstalledPackageJson(pkg, opts) {
 	const cwd = opts?.cwd || getPackageDetectionCwd();
 	const packageName = opts?.packageName || getPackageName(pkg);
+	const cacheKey = `${cwd}\0${pkg}\0${packageName}\0${opts?.fromResolvedEntry ?? ""}`;
+	if (installedPackageJsonCache.has(cacheKey)) return installedPackageJsonCache.get(cacheKey);
+	const result = resolveInstalledPackageJson(pkg, cwd, packageName, opts);
+	installedPackageJsonCache.set(cacheKey, result);
+	return result;
+}
+function resolveInstalledPackageJson(pkg, cwd, packageName, opts) {
 	const tryReadPackageJson = (packageJsonPath) => {
 		if (!existsSync(packageJsonPath)) return void 0;
 		try {

package/lib/{ssrEntryLoader-DgsCQOqq.js → ssrEntryLoader-CuZVKlRm.js}

@@ -1,5 +1,6 @@
 //#region src/utils/fetchWithTimeout.ts
 const DEFAULT_SSR_FETCH_TIMEOUT_MS = 1e4;
+const DEFAULT_SSR_FETCH_MAX_BYTES = 10 * 1024 * 1024;
 function getFetchUrl(input) {
 	const raw = typeof input === "string" || input instanceof URL ? String(input) : input.url;
 	return new URL(raw);
@@ -10,6 +11,11 @@ function getSecureFetchUrl(input) {
 	if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopback)) throw new TypeError(`Refusing to fetch SSR resource over an insecure connection: ${url}`);
 	return url;
 }
+function isAbortLikeError(error) {
+	if (!error || typeof error !== "object") return false;
+	const name = error.name;
+	return name === "AbortError" || name === "TimeoutError";
+}
 /** Fetch with a bounded wait. Set timeoutMs to 0 to disable the timeout. */
 async function fetchWithTimeout(input, init = {}, timeoutMs = DEFAULT_SSR_FETCH_TIMEOUT_MS) {
 	const inputUrl = getSecureFetchUrl(input);
@@ -29,11 +35,67 @@ async function fetchWithTimeout(input, init = {}, timeoutMs = DEFAULT_SSR_FETCH_
 	try {
 		return await request(inputUrl);
 	} catch (error) {
-		if (inputUrl.hostname !== "localhost") throw error;
+		if (inputUrl.hostname !== "localhost" || isAbortLikeError(error)) throw error;
 		inputUrl.hostname = "[::1]";
 		return request(inputUrl);
 	}
 }
+var SsrFetchBodyTooLargeError = class extends Error {
+	url;
+	maxBytes;
+	declaredBytes;
+	constructor(url, maxBytes, declaredBytes) {
+		super(declaredBytes != null ? `SSR response from ${url} declared ${declaredBytes} bytes which exceeds the ${maxBytes}-byte limit` : `SSR response from ${url} exceeded the ${maxBytes}-byte limit`);
+		this.name = "SsrFetchBodyTooLargeError";
+		this.url = url;
+		this.maxBytes = maxBytes;
+		this.declaredBytes = declaredBytes;
+	}
+};
+function isSsrFetchBodyTooLargeError(error) {
+	return error instanceof SsrFetchBodyTooLargeError;
+}
+/**
+* Read a response body as text, rejecting when it exceeds `maxBytes`.
+* Set `maxBytes` to 0 (or a non-finite value) to disable the limit.
+*/
+async function readResponseTextBounded(res, maxBytes = DEFAULT_SSR_FETCH_MAX_BYTES, url = res.url || "unknown") {
+	if (!Number.isFinite(maxBytes) || maxBytes <= 0) return res.text();
+	const contentLengthHeader = res.headers?.get?.("content-length") ?? null;
+	if (contentLengthHeader != null) {
+		const declaredBytes = Number(contentLengthHeader);
+		if (Number.isFinite(declaredBytes) && declaredBytes > maxBytes) {
+			try {
+				await res.body?.cancel();
+			} catch {}
+			throw new SsrFetchBodyTooLargeError(url, maxBytes, declaredBytes);
+		}
+	}
+	if (!res.body) return res.text();
+	const reader = res.body.getReader();
+	const chunks = [];
+	let total = 0;
+	while (true) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		if (!value) continue;
+		total += value.byteLength;
+		if (total > maxBytes) {
+			try {
+				await reader.cancel();
+			} catch {}
+			throw new SsrFetchBodyTooLargeError(url, maxBytes);
+		}
+		chunks.push(value);
+	}
+	const merged = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		merged.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return new TextDecoder().decode(merged);
+}
 //#endregion
 //#region src/utils/ssrEntryLoader.ts
 /**
@@ -93,8 +155,8 @@ async function getModuleRunnerModule() {
 * This is Vite 8+ only — older versions don't expose `vite/module-runner` or
 * the `/__mf_runner__` proxy endpoint.
 */
-async function getOrCreateRunner(remoteOrigin, fetchTimeoutMs) {
-	const cacheKey = `${fetchTimeoutMs}::${remoteOrigin}`;
+async function getOrCreateRunner(remoteOrigin, fetchTimeoutMs, fetchMaxBytes) {
+	const cacheKey = `${fetchTimeoutMs}::${fetchMaxBytes}::${remoteOrigin}`;
 	if (runnerCache.has(cacheKey)) return runnerCache.get(cacheKey);
 	const promise = (async () => {
 		const viteRunner = await getModuleRunnerModule();
@@ -105,11 +167,12 @@ async function getOrCreateRunner(remoteOrigin, fetchTimeoutMs) {
 			return new ModuleRunner({
 				hmr: false,
 				transport: { async invoke(payload) {
-					return await (await fetchWithTimeout(runnerEndpoint, {
+					const text = await readResponseTextBounded(await fetchWithTimeout(runnerEndpoint, {
 						method: "POST",
 						headers: { "Content-Type": "application/json" },
 						body: JSON.stringify(payload)
-					}, fetchTimeoutMs)).json();
+					}, fetchTimeoutMs), fetchMaxBytes, runnerEndpoint);
+					return JSON.parse(text);
 				} }
 			}, new ESModulesEvaluator());
 		} catch {
@@ -146,8 +209,8 @@ function computeManifestVersionKey(manifest) {
 }
 const ssrEntryCache = /* @__PURE__ */ new Map();
 const manifestFetchCache = /* @__PURE__ */ new Map();
-function makeUrlCacheKey(url, fetchTimeoutMs) {
-	return `${fetchTimeoutMs}::${url}`;
+function makeUrlCacheKey(url, fetchTimeoutMs, fetchMaxBytes) {
+	return `${fetchTimeoutMs}::${fetchMaxBytes}::${url}`;
 }
 var SsrEntryHttpError = class extends Error {
 	constructor(url, status, statusText, bodyPreview) {
@@ -165,22 +228,26 @@ function getBodyPreview(body) {
 function isSsrEntryHttpError(error) {
 	return error instanceof SsrEntryHttpError;
 }
-async function fetchManifest(manifestUrl, fetchTimeoutMs) {
+async function fetchManifest(manifestUrl, fetchTimeoutMs, fetchMaxBytes) {
 	try {
 		const res = await fetchWithTimeout(manifestUrl, {}, fetchTimeoutMs);
 		if (!res.ok) return null;
-		return await res.json();
-	} catch {
+		const text = await readResponseTextBounded(res, fetchMaxBytes, manifestUrl);
+		return JSON.parse(text);
+	} catch (error) {
+		if (isSsrFetchBodyTooLargeError(error)) throw error;
 		return null;
 	}
 }
-async function fetchManifestCached(manifestUrl, fetchTimeoutMs) {
-	const cacheKey = makeUrlCacheKey(manifestUrl, fetchTimeoutMs);
+async function fetchManifestCached(manifestUrl, fetchTimeoutMs, fetchMaxBytes) {
+	const cacheKey = makeUrlCacheKey(manifestUrl, fetchTimeoutMs, fetchMaxBytes);
 	if (!manifestFetchCache.has(cacheKey)) {
-		const promise = fetchManifest(manifestUrl, fetchTimeoutMs);
+		const promise = fetchManifest(manifestUrl, fetchTimeoutMs, fetchMaxBytes);
 		manifestFetchCache.set(cacheKey, promise);
 		promise.then((manifest) => {
 			if (!manifest && manifestFetchCache.get(cacheKey) === promise) manifestFetchCache.delete(cacheKey);
+		}, () => {
+			if (manifestFetchCache.get(cacheKey) === promise) manifestFetchCache.delete(cacheKey);
 		});
 	}
 	return manifestFetchCache.get(cacheKey);
@@ -239,9 +306,9 @@ function resolveAssetBaseUrl(entryUrl, manifest, manifestUrl) {
 	if (!isManifestEntry(entryUrl)) return entryUrl;
 	return new URL("remoteEntry.js", manifestUrl.replace(/\/[^/]+$/, "/")).href;
 }
-async function buildEntryContext(entryUrl, fetchTimeoutMs) {
+async function buildEntryContext(entryUrl, fetchTimeoutMs, fetchMaxBytes) {
 	const manifestUrl = getManifestUrl(entryUrl);
-	const manifest = await fetchManifestCached(manifestUrl, fetchTimeoutMs);
+	const manifest = await fetchManifestCached(manifestUrl, fetchTimeoutMs, fetchMaxBytes);
 	const assetBaseUrl = resolveAssetBaseUrl(entryUrl, manifest, manifestUrl);
 	return {
 		entryUrl,
@@ -279,7 +346,7 @@ async function resolveFirstReachableCandidate(candidates, fetchTimeoutMs) {
 	}
 	return null;
 }
-async function resolveSSREntryImpl(remoteEntryUrl, fetchTimeoutMs) {
+async function resolveSSREntryImpl(remoteEntryUrl, fetchTimeoutMs, fetchMaxBytes) {
 	if (isSsrEntry(remoteEntryUrl)) return {
 		url: remoteEntryUrl,
 		type: "module",
@@ -294,33 +361,35 @@ async function resolveSSREntryImpl(remoteEntryUrl, fetchTimeoutMs) {
 		}, fetchTimeoutMs);
 		if (fromServerBuild) return fromServerBuild;
 	}
-	const ctx = await buildEntryContext(remoteEntryUrl, fetchTimeoutMs);
+	const ctx = await buildEntryContext(remoteEntryUrl, fetchTimeoutMs, fetchMaxBytes);
 	if (ctx.manifest) {
 		const fromManifest = resolveSSREntryUrl(ctx.manifest, ctx.manifestUrl);
 		if (fromManifest) return fromManifest;
 	}
 	return resolveFirstReachableCandidate(buildSsrEntryCandidates(ctx, { skipServerBuild: !isManifestEntry(remoteEntryUrl) }), fetchTimeoutMs);
 }
-function setSsrEntryCache(remoteEntryUrl, fetchTimeoutMs) {
-	const cacheKey = makeUrlCacheKey(remoteEntryUrl, fetchTimeoutMs);
+function setSsrEntryCache(remoteEntryUrl, fetchTimeoutMs, fetchMaxBytes) {
+	const cacheKey = makeUrlCacheKey(remoteEntryUrl, fetchTimeoutMs, fetchMaxBytes);
 	const record = {
-		promise: resolveSSREntryImpl(remoteEntryUrl, fetchTimeoutMs),
+		promise: resolveSSREntryImpl(remoteEntryUrl, fetchTimeoutMs, fetchMaxBytes),
 		resolvedAt: Date.now()
 	};
 	ssrEntryCache.set(cacheKey, record);
 	record.promise.then((entry) => {
 		if (!entry && ssrEntryCache.get(cacheKey) === record) ssrEntryCache.delete(cacheKey);
+	}, () => {
+		if (ssrEntryCache.get(cacheKey) === record) ssrEntryCache.delete(cacheKey);
 	});
 	return record;
 }
-async function getSSREntry(remoteEntryUrl, maxAgeMs, fetchTimeoutMs) {
-	const cacheKey = makeUrlCacheKey(remoteEntryUrl, fetchTimeoutMs);
+async function getSSREntry(remoteEntryUrl, maxAgeMs, fetchTimeoutMs, fetchMaxBytes) {
+	const cacheKey = makeUrlCacheKey(remoteEntryUrl, fetchTimeoutMs, fetchMaxBytes);
 	const cached = ssrEntryCache.get(cacheKey);
-	if (!cached) return setSsrEntryCache(remoteEntryUrl, fetchTimeoutMs).promise;
+	if (!cached) return setSsrEntryCache(remoteEntryUrl, fetchTimeoutMs, fetchMaxBytes).promise;
 	if (!(typeof maxAgeMs === "number" && maxAgeMs >= 0 && Date.now() - cached.resolvedAt >= maxAgeMs)) return cached.promise;
 	const previous = await cached.promise.catch(() => null);
-	manifestFetchCache.delete(makeUrlCacheKey(getManifestUrl(remoteEntryUrl), fetchTimeoutMs));
-	const record = setSsrEntryCache(remoteEntryUrl, fetchTimeoutMs);
+	manifestFetchCache.delete(makeUrlCacheKey(getManifestUrl(remoteEntryUrl), fetchTimeoutMs, fetchMaxBytes));
+	const record = setSsrEntryCache(remoteEntryUrl, fetchTimeoutMs, fetchMaxBytes);
 	const next = await record.promise.catch(() => null);
 	if (previous && next && previous.versionKey !== next.versionKey) dropRemoteCaches(remoteEntryUrl);
 	return record.promise;
@@ -337,7 +406,7 @@ function dropRemoteCaches(remoteEntryUrl) {
 	} catch {
 		return;
 	}
-	for (const [key] of tempFileCache) if (JSON.parse(key)[2].startsWith(origin)) {
+	for (const [key] of tempFileCache) if (JSON.parse(key).find((part) => typeof part === "string" && /^https?:\/\//.test(part))?.startsWith(origin)) {
 		tempFileCache.delete(key);
 		tempFilePathCache.delete(key);
 	}
@@ -429,9 +498,10 @@ function isVitePreloadHelperSpecifier(specifier) {
 * a remote redeploy (new manifest → new key) produces new files and bypasses
 * Node's ESM module cache instead of serving the stale build.
 */
-async function fetchEsmToTempFile(url, tmpDir, visited, pending, sharedPkgMap, versionKey = UNVERSIONED, fetchTimeoutMs = DEFAULT_SSR_FETCH_TIMEOUT_MS, contextKey = "default") {
+async function fetchEsmToTempFile(url, tmpDir, visited, pending, sharedPkgMap, versionKey = UNVERSIONED, fetchTimeoutMs = DEFAULT_SSR_FETCH_TIMEOUT_MS, contextKey = "default", fetchMaxBytes = DEFAULT_SSR_FETCH_MAX_BYTES) {
 	const cacheKey = JSON.stringify([
 		fetchTimeoutMs,
+		fetchMaxBytes,
 		versionKey,
 		url,
 		contextKey
@@ -440,7 +510,8 @@ async function fetchEsmToTempFile(url, tmpDir, visited, pending, sharedPkgMap, v
 	const cached = tempFileCache.get(cacheKey);
 	if (cached) {
 		pending.add(cached);
-		const tmpFile = await tempFilePathCache.get(cacheKey);
+		const reserved = tempFilePathCache.get(cacheKey);
+		const tmpFile = reserved ? await reserved : await cached;
 		visited.set(url, tmpFile);
 		return tmpFile;
 	}
@@ -454,7 +525,7 @@ async function fetchEsmToTempFile(url, tmpDir, visited, pending, sharedPkgMap, v
 		const tmpFile = await tmpFilePromise;
 		visited.set(url, tmpFile);
 		const res = await fetchWithTimeout(url, {}, fetchTimeoutMs);
-		let code = await res.text();
+		let code = await readResponseTextBounded(res, fetchMaxBytes, url);
 		if (!res.ok) throw new SsrEntryHttpError(url, res.status, res.statusText, getBodyPreview(code));
 		const base = url.replace(/\/[^/]*$/, "/");
 		const relImports = [];
@@ -463,7 +534,7 @@ async function fetchEsmToTempFile(url, tmpDir, visited, pending, sharedPkgMap, v
 		while ((m = relRegex.exec(code)) !== null) if ((m[1].startsWith("./") || m[1].startsWith("../")) && !isVitePreloadHelperSpecifier(m[1])) relImports.push(new URL(m[1], base).href);
 		const subMap = /* @__PURE__ */ new Map();
 		await Promise.all([...new Set(relImports)].filter((u) => u.startsWith("http://") || u.startsWith("https://")).map(async (u) => {
-			const tmpPath = await fetchEsmToTempFile(u, tmpDir, visited, pending, sharedPkgMap, versionKey, fetchTimeoutMs, contextKey);
+			const tmpPath = await fetchEsmToTempFile(u, tmpDir, visited, pending, sharedPkgMap, versionKey, fetchTimeoutMs, contextKey, fetchMaxBytes);
 			subMap.set(u, `file://${tmpPath}`);
 		}));
 		code = transformSsrCode(code, base, sharedPkgMap);
@@ -480,9 +551,9 @@ async function fetchEsmToTempFile(url, tmpDir, visited, pending, sharedPkgMap, v
 	});
 	return promise;
 }
-async function fetchEsmGraphToTempFile(url, tmpDir, sharedPkgMap, versionKey = UNVERSIONED, fetchTimeoutMs = DEFAULT_SSR_FETCH_TIMEOUT_MS, contextKey = "default") {
+async function fetchEsmGraphToTempFile(url, tmpDir, sharedPkgMap, versionKey = UNVERSIONED, fetchTimeoutMs = DEFAULT_SSR_FETCH_TIMEOUT_MS, contextKey = "default", fetchMaxBytes = DEFAULT_SSR_FETCH_MAX_BYTES) {
 	const pending = /* @__PURE__ */ new Set();
-	const rootFile = await fetchEsmToTempFile(url, tmpDir, /* @__PURE__ */ new Map(), pending, sharedPkgMap, versionKey, fetchTimeoutMs, contextKey);
+	const rootFile = await fetchEsmToTempFile(url, tmpDir, /* @__PURE__ */ new Map(), pending, sharedPkgMap, versionKey, fetchTimeoutMs, contextKey, fetchMaxBytes);
 	await Promise.all(pending);
 	return rootFile;
 }
@@ -494,7 +565,7 @@ async function importTempModule(filePath, versionKey) {
 }
 let warnedVmUnavailable = false;
 async function tryVmStrategy(ssrEntry, options) {
-	const { loadViaVmStrategy, isVmStrategyAvailable } = await import("./ssrVmStrategy-ChF8MB7l.js");
+	const { loadViaVmStrategy, isVmStrategyAvailable } = await import("./ssrVmStrategy-Dpw20xiw.js");
 	if (!await isVmStrategyAvailable()) {
 		if (!warnedVmUnavailable) {
 			warnedVmUnavailable = true;
@@ -507,6 +578,7 @@ async function tryVmStrategy(ssrEntry, options) {
 		shareScopeName: options.shareScopeName,
 		versionKey: ssrEntry.versionKey,
 		fetchTimeoutMs: options.fetchTimeoutMs,
+		fetchMaxBytes: options.fetchMaxBytes,
 		cacheContext: options.cacheContext,
 		federationInstance: options.federationInstance
 	});
@@ -525,14 +597,15 @@ async function loadSSRRemoteEntry(ssrEntry, options) {
 		const urlObj = new URL(url);
 		if (urlObj.pathname.includes("/__mf_ssr__/")) {
 			const remoteOrigin = urlObj.origin;
-			const runner = await getOrCreateRunner(remoteOrigin, options.fetchTimeoutMs);
+			const runner = await getOrCreateRunner(remoteOrigin, options.fetchTimeoutMs, options.fetchMaxBytes);
 			if (!runner) {
 				if (process.env.NODE_ENV !== "production") return null;
 			} else try {
 				const mod = await runner.import(urlObj.pathname);
 				if (mod && typeof mod === "object" && "init" in mod) return mod;
 				if (process.env.NODE_ENV !== "production") return null;
-			} catch {
+			} catch (error) {
+				if (isSsrFetchBodyTooLargeError(error)) throw error;
 				if (process.env.NODE_ENV !== "production") return null;
 			}
 		}
@@ -540,16 +613,16 @@ async function loadSSRRemoteEntry(ssrEntry, options) {
 			const fromVm = await tryVmStrategy(ssrEntry, options);
 			if (fromVm) return fromVm;
 		} catch (error) {
-			if (isSsrEntryHttpError(error)) throw error;
+			if (isSsrEntryHttpError(error) || isSsrFetchBodyTooLargeError(error)) throw error;
 		}
 		const { mkdirSync } = await _fs();
 		const cacheDir = await getSSRCacheDir();
 		mkdirSync(cacheDir, { recursive: true });
 		const sharedPkgMap = new Map(Object.entries(resolvedShared));
 		try {
-			return await importTempModule(await fetchEsmGraphToTempFile(url, cacheDir, sharedPkgMap, versionKey, options.fetchTimeoutMs, getSsrTransformContextKey(resolvedShared, options.shareScopeName)), versionKey);
+			return await importTempModule(await fetchEsmGraphToTempFile(url, cacheDir, sharedPkgMap, versionKey, options.fetchTimeoutMs, getSsrTransformContextKey(resolvedShared, options.shareScopeName), options.fetchMaxBytes), versionKey);
 		} catch (error) {
-			if (isSsrEntryHttpError(error)) throw error;
+			if (isSsrEntryHttpError(error) || isSsrFetchBodyTooLargeError(error)) throw error;
 			return null;
 		}
 	}
@@ -569,6 +642,7 @@ function ssrEntryLoaderPlugin(options = {}) {
 		shareScopeName: options.shareScopeName ?? "default",
 		maxAgeMs: options.maxAgeMs,
 		fetchTimeoutMs: options.fetchTimeoutMs ?? 1e4,
+		fetchMaxBytes: options.fetchMaxBytes ?? 10485760,
 		cacheContext: {}
 	};
 	return {
@@ -580,7 +654,7 @@ function ssrEntryLoaderPlugin(options = {}) {
 				cacheContext: origin,
 				federationInstance: origin
 			} : resolved;
-			const ssrEntry = await getSSREntry(remoteInfo.entry, loadOptions.maxAgeMs, loadOptions.fetchTimeoutMs);
+			const ssrEntry = await getSSREntry(remoteInfo.entry, loadOptions.maxAgeMs, loadOptions.fetchTimeoutMs, loadOptions.fetchMaxBytes);
 			if (!ssrEntry) return;
 			const mod = await loadSSRRemoteEntry(ssrEntry, loadOptions);
 			if (!mod) return;
@@ -589,4 +663,4 @@ function ssrEntryLoaderPlugin(options = {}) {
 	};
 }
 //#endregion
-export { DEFAULT_SSR_FETCH_TIMEOUT_MS as a, ssrEntryLoaderPlugin as i, neutralizeBrowserPreloadHelpers as n, fetchWithTimeout as o, revalidate as r, SsrEntryHttpError as t };
+export { DEFAULT_SSR_FETCH_MAX_BYTES as a, readResponseTextBounded as c, ssrEntryLoaderPlugin as i, neutralizeBrowserPreloadHelpers as n, DEFAULT_SSR_FETCH_TIMEOUT_MS as o, revalidate as r, fetchWithTimeout as s, SsrEntryHttpError as t };

package/lib/{ssrVmStrategy-ChF8MB7l.js → ssrVmStrategy-Dpw20xiw.js}

@@ -1,4 +1,4 @@
-import { n as neutralizeBrowserPreloadHelpers, o as fetchWithTimeout, t as SsrEntryHttpError } from "./ssrEntryLoader-DgsCQOqq.js";
+import { c as readResponseTextBounded, n as neutralizeBrowserPreloadHelpers, s as fetchWithTimeout, t as SsrEntryHttpError } from "./ssrEntryLoader-CuZVKlRm.js";
 //#region src/utils/ssrVmStrategy.ts
 /**
 * vm.SourceTextModule strategy for loading remote SSR entries.
@@ -104,9 +104,9 @@ function getVmCacheContextKey(options) {
 function getBodyPreview(body) {
 	return body.slice(0, 240).replace(/\s+/g, " ").trim();
 }
-async function fetchModuleSource(url, fetchTimeoutMs) {
+async function fetchModuleSource(url, fetchTimeoutMs, fetchMaxBytes) {
 	const res = await fetchWithTimeout(url, {}, fetchTimeoutMs);
-	const text = await res.text();
+	const text = await readResponseTextBounded(res, fetchMaxBytes ?? 10485760, url);
 	if (!res.ok) throw new SsrEntryHttpError(url, res.status, res.statusText, getBodyPreview(text));
 	return neutralizeBrowserPreloadHelpers(text);
 }
@@ -123,11 +123,12 @@ function getHttpModule(vm, url, options) {
 	const cacheKey = JSON.stringify([
 		getVmCacheContextKey(options),
 		options.fetchTimeoutMs ?? 1e4,
+		options.fetchMaxBytes ?? 10485760,
 		options.versionKey,
 		url
 	]);
 	if (!httpModuleCache.has(cacheKey)) httpModuleCache.set(cacheKey, (async () => {
-		const code = await fetchModuleSource(url, options.fetchTimeoutMs);
+		const code = await fetchModuleSource(url, options.fetchTimeoutMs, options.fetchMaxBytes);
 		return new vm.SourceTextModule(code, {
 			identifier: url,
 			initializeImportMeta(meta) {

package/lib/utils/ssrEntryLoader.d.ts

@@ -105,6 +105,11 @@ interface SsrEntryLoaderOptions {
    * 10 seconds. Set to `0` to disable the timeout.
    */
   fetchTimeoutMs?: number;
+  /**
+   * Maximum response body size in bytes for each SSR network request. Defaults
+   * to 10 MiB. Set to `0` to disable the limit.
+   */
+  fetchMaxBytes?: number;
 }
 declare function ssrEntryLoaderPlugin(options?: SsrEntryLoaderOptions): {
   name: string;

package/lib/utils/ssrEntryLoader.js

@@ -1,2 +1,2 @@
-import { i as ssrEntryLoaderPlugin, n as neutralizeBrowserPreloadHelpers, r as revalidate, t as SsrEntryHttpError } from "../ssrEntryLoader-DgsCQOqq.js";
+import { i as ssrEntryLoaderPlugin, n as neutralizeBrowserPreloadHelpers, r as revalidate, t as SsrEntryHttpError } from "../ssrEntryLoader-CuZVKlRm.js";
 export { SsrEntryHttpError, ssrEntryLoaderPlugin as default, neutralizeBrowserPreloadHelpers, revalidate };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@module-federation/vite",
-  "version": "1.18.1",
+  "version": "1.19.0",
   "description": "Vite plugin for Module Federation",
   "type": "module",
   "main": "./lib/index.js",
@@ -86,4 +86,4 @@
     "vite": "8.1.0",
     "vitest": "4.0.18"
   }
-}
+}