fix(start): skip errored Rspack modules during import protection by SyMind · Pull Request #7685 · TanStack/router

SyMind · 2026-06-24T07:26:27Z

Fixes a dev-mode recovery bug where invalid JS/TS code could produce a Rspack compiler-level error from import protection, leaving rsbuild dev unable to recover even after the user fixed the source code.

Changes:

Skip already-errored Rspack modules while building the import protection compilation graph.
Ensure the original syntax error is surfaced through the Rsbuild error overlay instead of a secondary Compilation.hooks.processAssets plugin error.
Add RSC Rsbuild e2e coverage that injects invalid route code and snapshots the client/server error overlay.

Summary by CodeRabbit

New Features
- Added a new rsbuild-based React Start end-to-end fixture with router setup, hydration root route, and an initial home route.
Bug Fixes
- Improved import-protection handling by skipping errored modules when building the compilation graph.
Tests
- Added an end-to-end test that injects a syntax error and verifies the dev error overlay output.
Chores
- Updated rsbuild core tooling versions across multiple examples and end-to-end setups.

coderabbitai · 2026-06-24T07:26:38Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

Bumps @rsbuild/core to ^2.1.0 across manifests, skips errored module connections during import graph construction, and adds an rsbuild React Start fixture with a Playwright error-overlay test.

Changes

rsbuild 2.1.0 upgrade, import-protection fix, and rsbuild E2E fixture

Layer / File(s)	Summary
Bump rsbuild dependencies `benchmarks/bundle-size/package.json`, `e2e//package.json`, `examples//package.json`, `packages/*/package.json`	Updates `@rsbuild/core` to `^2.1.0` across fixtures, examples, benchmarks, and packages; `e2e/vue-start/basic` also updates related Vue plugins.
Skip errored modules in import graph `packages/start-plugin-core/src/rsbuild/import-protection.ts`	`buildCompilationGraph` skips outgoing connections whose module has an error.
Add rsbuild React Start fixture `e2e/react-start/rsbuild/package.json`, `rsbuild.config.ts`, `server.js`, `src/*`, `tsconfig.json`, `.gitignore`, `.prettierignore`	Adds workspace metadata, build and server wiring, router setup, generated route types, routes, TypeScript configuration, and ignore rules.
Add error overlay Playwright coverage `e2e/react-start/rsbuild/playwright.config.ts`, `tests/error-overlay.spec.ts`	Starts the rsbuild dev server, injects a syntax error, parses the overlay, and compares normalized client and server snapshots.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related issues

TanStack/router-monorepo#1 — Covers the repository-wide @rsbuild/core dependency updates.
TanStack/router-security#75 — Covers the dependency-version updates across the affected manifests.

Suggested labels: package: start-plugin-core

Suggested reviewers: schiller-manuel

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main fix: skipping errored Rspack modules during import protection.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

# Conflicts: # benchmarks/bundle-size/package.json # e2e/react-router/rspack-basic-file-based/package.json # e2e/react-router/rspack-basic-virtual-named-export-config-file-based/package.json # e2e/react-start/basic/package.json # e2e/react-start/css-inline/package.json # e2e/react-start/custom-server-rsbuild/package.json # e2e/react-start/deferred-hydration/package.json # e2e/react-start/hmr/package.json # e2e/react-start/import-protection/package.json # e2e/react-start/rsc/package.json # e2e/react-start/server-functions/package.json # e2e/solid-router/rspack-basic-file-based/package.json # e2e/solid-router/rspack-basic-virtual-named-export-config-file-based/package.json # e2e/solid-start/basic/package.json # e2e/solid-start/deferred-hydration/package.json # e2e/vue-router/rspack-basic-file-based/package.json # e2e/vue-router/rspack-basic-virtual-named-export-config-file-based/package.json # e2e/vue-start/basic/package.json # examples/react/quickstart-rspack-file-based/package.json # examples/solid/quickstart-rspack-file-based/package.json # packages/react-start/package.json # packages/solid-start/package.json # packages/start-plugin-core/package.json # packages/vue-start/package.json # pnpm-lock.yaml

socket-security · 2026-06-24T07:39:06Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@rsbuild/core@2.1.1

View full report

socket-security · 2026-06-24T07:39:07Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@emnapi/runtime` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → `npm/nitro@3.0.1-alpha.2` → `npm/@tanstack/eslint-config@0.4.0` → `npm/@rsbuild/plugin-vue@1.2.7` → `npm/nitro@3.0.260311-beta` → `npm/wrangler@4.75.0` → `npm/@cloudflare/vite-plugin@1.29.1` → `npm/@rsbuild/plugin-react@2.0.0` → `npm/@rsbuild/plugin-tailwindcss@2.0.3` → `npm/@rsbuild/core@2.1.1` → `npm/@tanstack/eslint-config@0.3.2` → `npm/@netlify/vite-plugin-tanstack-start@1.1.4` → `npm/@emnapi/runtime@1.11.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@emnapi/runtime@1.11.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@e2e/react-start/rsc-rsbuild/tests/error-overlay.spec.ts`:
- Around line 28-44: The DevServer startup path currently waits only on
waitUntilReady(), so a spawn failure from pnpm/rsbuild can hang until timeout
instead of failing immediately. In the DevServer.start method, add an error
listener to the spawned process and surface that error right away, ideally
before or alongside the waitUntilReady() flow, so startup failures are reported
immediately instead of being masked by the timeout.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 666b748c-f5f5-4855-9201-a1019bf10caf

📥 Commits

Reviewing files that changed from the base of the PR and between 80d098f and ab4f558.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (28)

benchmarks/bundle-size/package.json
e2e/react-router/rspack-basic-file-based/package.json
e2e/react-router/rspack-basic-virtual-named-export-config-file-based/package.json
e2e/react-start/basic/package.json
e2e/react-start/css-inline/package.json
e2e/react-start/custom-server-rsbuild/package.json
e2e/react-start/deferred-hydration/package.json
e2e/react-start/hmr/package.json
e2e/react-start/import-protection/package.json
e2e/react-start/rsc-rsbuild/package.json
e2e/react-start/rsc-rsbuild/tests/error-overlay.spec.ts
e2e/react-start/rsc/package.json
e2e/react-start/server-functions/package.json
e2e/solid-router/rspack-basic-file-based/package.json
e2e/solid-router/rspack-basic-virtual-named-export-config-file-based/package.json
e2e/solid-start/basic/package.json
e2e/solid-start/deferred-hydration/package.json
e2e/vue-router/rspack-basic-file-based/package.json
e2e/vue-router/rspack-basic-virtual-named-export-config-file-based/package.json
e2e/vue-start/basic/package.json
examples/react/quickstart-rspack-file-based/package.json
examples/solid/quickstart-rspack-file-based/package.json
packages/react-start/package.json
packages/router-plugin/package.json
packages/solid-start/package.json
packages/start-plugin-core/package.json
packages/start-plugin-core/src/rsbuild/import-protection.ts
packages/vue-start/package.json

SyMind · 2026-06-29T03:37:27Z

@codex review

nx-cloud · 2026-06-29T19:05:32Z

View your CI Pipeline Execution ↗ for commit bf247d6

Command	Status	Duration	Result
`nx affected --targets=test:eslint,test:unit,tes...`	❌ Failed	11m 46s	View ↗
`nx run-many --target=build --exclude=examples/*...`	✅ Succeeded	2m 9s	View ↗

☁️ Nx Cloud last updated this comment at 2026-07-27 19:51:28 UTC

pkg-pr-new · 2026-06-29T19:10:54Z

More templates

@tanstack/arktype-adapter

npm i https://pkg.pr.new/@tanstack/arktype-adapter@7685

@tanstack/eslint-plugin-router

npm i https://pkg.pr.new/@tanstack/eslint-plugin-router@7685

@tanstack/eslint-plugin-start

npm i https://pkg.pr.new/@tanstack/eslint-plugin-start@7685

@tanstack/history

npm i https://pkg.pr.new/@tanstack/history@7685

@tanstack/nitro-v2-vite-plugin

npm i https://pkg.pr.new/@tanstack/nitro-v2-vite-plugin@7685

@tanstack/react-router

npm i https://pkg.pr.new/@tanstack/react-router@7685

@tanstack/react-router-devtools

npm i https://pkg.pr.new/@tanstack/react-router-devtools@7685

@tanstack/react-router-ssr-query

npm i https://pkg.pr.new/@tanstack/react-router-ssr-query@7685

@tanstack/react-start

npm i https://pkg.pr.new/@tanstack/react-start@7685

@tanstack/react-start-client

npm i https://pkg.pr.new/@tanstack/react-start-client@7685

@tanstack/react-start-rsc

npm i https://pkg.pr.new/@tanstack/react-start-rsc@7685

@tanstack/react-start-server

npm i https://pkg.pr.new/@tanstack/react-start-server@7685

@tanstack/router-cli

npm i https://pkg.pr.new/@tanstack/router-cli@7685

@tanstack/router-core

npm i https://pkg.pr.new/@tanstack/router-core@7685

@tanstack/router-devtools

npm i https://pkg.pr.new/@tanstack/router-devtools@7685

@tanstack/router-devtools-core

npm i https://pkg.pr.new/@tanstack/router-devtools-core@7685

@tanstack/router-generator

npm i https://pkg.pr.new/@tanstack/router-generator@7685

@tanstack/router-plugin

npm i https://pkg.pr.new/@tanstack/router-plugin@7685

@tanstack/router-ssr-query-core

npm i https://pkg.pr.new/@tanstack/router-ssr-query-core@7685

@tanstack/router-utils

npm i https://pkg.pr.new/@tanstack/router-utils@7685

@tanstack/router-vite-plugin

npm i https://pkg.pr.new/@tanstack/router-vite-plugin@7685

@tanstack/solid-router

npm i https://pkg.pr.new/@tanstack/solid-router@7685

@tanstack/solid-router-devtools

npm i https://pkg.pr.new/@tanstack/solid-router-devtools@7685

@tanstack/solid-router-ssr-query

npm i https://pkg.pr.new/@tanstack/solid-router-ssr-query@7685

@tanstack/solid-start

npm i https://pkg.pr.new/@tanstack/solid-start@7685

@tanstack/solid-start-client

npm i https://pkg.pr.new/@tanstack/solid-start-client@7685

@tanstack/solid-start-server

npm i https://pkg.pr.new/@tanstack/solid-start-server@7685

@tanstack/start-client-core

npm i https://pkg.pr.new/@tanstack/start-client-core@7685

@tanstack/start-fn-stubs

npm i https://pkg.pr.new/@tanstack/start-fn-stubs@7685

@tanstack/start-plugin-core

npm i https://pkg.pr.new/@tanstack/start-plugin-core@7685

@tanstack/start-server-core

npm i https://pkg.pr.new/@tanstack/start-server-core@7685

@tanstack/start-static-server-functions

npm i https://pkg.pr.new/@tanstack/start-static-server-functions@7685

@tanstack/start-storage-context

npm i https://pkg.pr.new/@tanstack/start-storage-context@7685

@tanstack/valibot-adapter

npm i https://pkg.pr.new/@tanstack/valibot-adapter@7685

@tanstack/virtual-file-routes

npm i https://pkg.pr.new/@tanstack/virtual-file-routes@7685

@tanstack/vue-router

npm i https://pkg.pr.new/@tanstack/vue-router@7685

@tanstack/vue-router-devtools

npm i https://pkg.pr.new/@tanstack/vue-router-devtools@7685

@tanstack/vue-router-ssr-query

npm i https://pkg.pr.new/@tanstack/vue-router-ssr-query@7685

@tanstack/vue-start

npm i https://pkg.pr.new/@tanstack/vue-start@7685

@tanstack/vue-start-client

npm i https://pkg.pr.new/@tanstack/vue-start-client@7685

@tanstack/vue-start-server

npm i https://pkg.pr.new/@tanstack/vue-start-server@7685

@tanstack/zod-adapter

npm i https://pkg.pr.new/@tanstack/zod-adapter@7685

commit: bf247d6

codspeed-hq · 2026-06-29T19:20:35Z

Merging this PR will degrade performance by 5.49%

⚠️

Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 3 improved benchmarks
❌ 3 regressed benchmarks
✅ 174 untouched benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Mode	Benchmark	`BASE`	`HEAD`	Efficiency
❌	Memory	`mem server serialization-payload (react)`	3.4 MB	5.2 MB	-33.27%
❌	Memory	`mem server request-churn (react)`	492.1 KB	538.2 KB	-8.57%
❌	Simulation	`client-async-pipeline navigation loop (react)`	49.9 ms	51.7 ms	-3.62%
⚡	Memory	`mem server error-paths unmatched (react)`	297.6 KB	264.9 KB	+12.33%
⚡	Memory	`mem server error-paths not-found (react)`	277.4 KB	267 KB	+3.9%
⚡	Memory	`mem server server-fn-churn (react)`	281.8 KB	271.4 KB	+3.81%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

_{Comparing SyMind:fix-tanstack-router-dev (bf247d6) with main (179d9b9)}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@e2e/react-start/rsbuild/server.js`:
- Around line 32-49: The start() helper currently only handles the child process
“exit” path, so a failed srvx launch from spawn() can surface as an uncaught
“error” event instead of a controlled failure. Update start() to attach an
“error” handler on the spawned child and terminate the process deterministically
with a clear startup failure when srvx cannot be launched, alongside the
existing exit handling in child.on('exit').

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 6f2cab84-c020-40b7-a57d-4ab8abbce359

📥 Commits

Reviewing files that changed from the base of the PR and between 66fc253 and 5a606c5.

⛔ Files ignored due to path filters (1)

pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (12)

e2e/react-start/rsbuild/.gitignore
e2e/react-start/rsbuild/.prettierignore
e2e/react-start/rsbuild/package.json
e2e/react-start/rsbuild/playwright.config.ts
e2e/react-start/rsbuild/rsbuild.config.ts
e2e/react-start/rsbuild/server.js
e2e/react-start/rsbuild/src/routeTree.gen.ts
e2e/react-start/rsbuild/src/router.tsx
e2e/react-start/rsbuild/src/routes/__root.tsx
e2e/react-start/rsbuild/src/routes/index.tsx
e2e/react-start/rsbuild/tests/error-overlay.spec.ts
e2e/react-start/rsbuild/tsconfig.json

💤 Files with no reviewable changes (1)

e2e/react-start/rsbuild/tests/error-overlay.spec.ts

✅ Files skipped from review due to trivial changes (4)

e2e/react-start/rsbuild/.prettierignore
e2e/react-start/rsbuild/.gitignore
e2e/react-start/rsbuild/playwright.config.ts
e2e/react-start/rsbuild/src/routeTree.gen.ts

# Conflicts: # e2e/react-router/rspack-basic-file-based/package.json # e2e/react-router/rspack-basic-virtual-named-export-config-file-based/package.json # e2e/react-start/basic/package.json # e2e/react-start/css-inline/package.json # e2e/react-start/custom-server-rsbuild/package.json # e2e/react-start/hmr/package.json # e2e/react-start/import-protection/package.json # e2e/react-start/rsc-rsbuild/package.json # e2e/react-start/rsc/package.json # e2e/react-start/server-functions/package.json # e2e/solid-router/rspack-basic-file-based/package.json # e2e/solid-router/rspack-basic-virtual-named-export-config-file-based/package.json # e2e/solid-start/basic/package.json # e2e/vue-router/rspack-basic-file-based/package.json # e2e/vue-router/rspack-basic-virtual-named-export-config-file-based/package.json # e2e/vue-start/basic/package.json # pnpm-lock.yaml

…-dev # Conflicts: # pnpm-lock.yaml

SyMind · 2026-07-27T06:40:20Z

@schiller-manuel I received user feedback about the following issue they encountered during development. Could you please merge this PR when you have time?

nx-cloud

Nx Cloud has identified a possible root cause for your failed CI:

We identified that this failure is unrelated to the PR's changes. The test crashes before execution due to a stale build artifact in e2e/e2e-utils/dist/esm/index.js, where a named export toRuntimePath no longer exists in the compiled output. Rebuilding the e2e-utils package should resolve this environment state issue.

No code changes were suggested for this issue.

You can trigger a rerun by pushing an empty commit:

git commit --allow-empty -m "chore: trigger rerun"
git push

View detailed reasoning on Nx Cloud ↗

_{🎓 Learn more about Self-Healing CI on nx.dev}

SyMind added 2 commits June 24, 2026 10:32

chore: update rsbuild

6bb64e8

fix(start): skip errored Rspack modules during import protection

a4b9917

upgrade rsbuild core

ab4f558

SyMind marked this pull request as ready for review June 29, 2026 02:56

coderabbitai Bot reviewed Jun 29, 2026

View reviewed changes

Comment thread e2e/react-start/rsbuild/tests/error-overlay.spec.ts

test(start): fail fast on rsbuild dev server startup errors

66fc253

Nsttt approved these changes Jun 29, 2026

View reviewed changes

This comment was marked as outdated.

Sign in to view

chore: move test case

5a606c5

coderabbitai Bot reviewed Jun 30, 2026

View reviewed changes

Comment thread e2e/react-start/rsbuild/server.js

SyMind and others added 7 commits July 1, 2026 12:55

chore: update test case

6fcb200

ci: apply automated fixes

f3a5c57

ci: apply automated fixes (attempt 2/3)

8a2546c

merge origin main

6f3d887

Merge remote-tracking branch 'upstream/main' into fix-tanstack-router…

a4d9d09

…-dev # Conflicts: # pnpm-lock.yaml

Merge remote-tracking branch 'upstream/main' into fix-tanstack-router…

bf247d6

…-dev # Conflicts: # pnpm-lock.yaml

nx-cloud Bot reviewed Jul 27, 2026

View reviewed changes

schiller-manuel merged commit f04ddc6 into TanStack:main Jul 29, 2026
23 of 27 checks passed

coderabbitai Bot mentioned this pull request Jul 30, 2026

chore(ci): improve Nx sandbox cache declarations #7833

Open

Uh oh!

Uh oh!

Conversation

SyMind commented Jun 24, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

socket-security Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

SyMind commented Jun 29, 2026

Uh oh!

nx-cloud Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codspeed-hq Bot commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will degrade performance by 5.49%

Performance Changes

Uh oh!

This comment was marked as outdated.

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

SyMind commented Jul 27, 2026

Uh oh!

nx-cloud Bot left a comment

Choose a reason for hiding this comment

Nx Cloud has identified a possible root cause for your failed CI:

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

SyMind commented Jun 24, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 24, 2026 •

edited

Loading

socket-security Bot commented Jun 24, 2026 •

edited

Loading

socket-security Bot commented Jun 24, 2026 •

edited

Loading

nx-cloud Bot commented Jun 29, 2026 •

edited

Loading

pkg-pr-new Bot commented Jun 29, 2026 •

edited

Loading

codspeed-hq Bot commented Jun 29, 2026 •

edited

Loading