5.17.1 breaks NPM workspaces support as part of webpack build

[vputsenko]

Hi,

Our project stopped to build when we upgraded webpack version to 5.94 due to GHSA-4vvj-4cpr-p986

We have a mono repo with NPM workspaces where we have internal libs and services built using these libs. Libs are installed as dependent packages into services using names taken from lib's package.json "name" parameter. Same with importing files from these libs. For instance: we have lib which has name "@ns/lib1" and some service which has lb1 installed as dependency

	"dependencies": {
		"@ns/lib1": "^1.0.0",

this service's source code also imports lib files using "import { someFunction } from "@ns/lib1/moduleX" ...
I believe it is a well known approach ...

After some investigation we found that problem is located in "enhanced-resolved" package, so fix was to add some kind of "pinning" into our root package.json

	"overrides": {
		"webpack": {
			"enhanced-resolve": "5.17.0"
		}
	},

However it can not be a long term solution, so it would be nice to have this fixed.

Thank you.

[alexander-akait]

Please create reproducible test repo, what is error? With wich code?

[vputsenko]

Ok.. Here is sample repo WPRepro.zip

1. unarchive
2. run "npm install"
3. run "npm run repro" // at this point everything is ok
4. go to root package.json and remove "overrides" section
5. run "npm install"
6. run "npm run repro" // ooops...

[alexander-akait]

That's expected due - #400, you have

"exports": {
		".": "./dist/src/index.js",
		"./*": [
			"./dist/src/*/index.js",
			"./dist/src/*.js"
		]
	},

so using @xy/core/settings/bootstrap will use @xy/core/settings/bootstrap/index.js (the first), but you don't have this file, don't use arrays in such case, you code will not work with other bundlers and node.js/bun/deno/etc

My recommendation:

"exports": {
  ".": "./dist/src/index.js",
  "./*": "./dist/src/*.js"
},

feel free to feedback

[vputsenko]

Thanks for the response. Please add this as breaking change to 5.17.1 release notes.

[alexander-akait]

It is in the changelog

fix: exports and imports array target resolving

It is under a bugfix because of it is a just a fix, before we have the wrong behaviour

[vputsenko]

such comment doesn't trigger me as user of lib to change something, but i got answers. thank you.