fix(routing): keep npm API routes portable on Node - #3970
Conversation
API-route module hashing used Uint8Array.prototype.toHex(), which is unavailable in supported stock Node 22 and Node 24. Route all loader hashes through the existing hardened cross-runtime SHA-256 utility and extend the packed npm smoke to request a real API route. Constraint: The npm package supports stock Node 22+ without runtime flags. Rejected: Add a toHex shim or runtime flag | both hide a Deno-specific dependency instead of removing it. Confidence: high Scope-risk: narrow Directive: Keep published-runtime hashing on the shared computeHash boundary and retain the packed API-route smoke. Tested: Loader 63 steps; hash utility 24 steps; packed npm page and API route on Node 22.23.2 and 24.19.0. Not-tested: Registry-published RC artifact; CI performs that release-stage validation. Related: #3968
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reached
Next review available in: 7 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (4)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
📦 Client bundle boundary
A server module in a client graph aborts hydration in the browser. New leaks fail CI; known leaks are tracked in |
Outcome
Restores every API route in the published npm package on stock supported Node releases and prepares
0.1.1250-rcfor immediate validation.Closes #3968.
Root cause
The API module loader converted SHA-256 digests with
Uint8Array.prototype.toHex(). Deno exposes that method, but stock Node 22 and Node 24 do not. The shipped dnt artifact therefore started normally and failed only when an API route loaded.The user-wide regression entered in #3912 on 2026-08-21 when content hashes became the cache key for both direct and bundled routes. A narrower instance had already entered the isolated route-preparation path in #3285 on 2026-08-02.
CI stayed green because:
Deno., and the loader suite includes Deno-specific filesystem cases;/, but never requested an API route.Fix
computeHashutility.app/api/npm-smoke/route.tsand require exact200 {"ok":true}behavior.0.1.1250-rc.Verification
toHex is not a functionand HTTP 500.Release plan
Publish and probe the unique
0.1.1250-rcartifact first, then promote the same commit without code divergence to stable0.1.1250.