We discovered a highly dangerous new attack vector in the Rspack repository. An attacker may reply to an issue claiming that they encountered a similar problem and provide a “reproduction” project, such as this example:
However, the reproduction project itself may contain malicious code. This means that if you use an AI agent to fix the issue, the agent may clone the project from the issue and execute it. For example, if the attack payload is hidden in an install or postinstall script of one of the project’s dependencies, the environment could be compromised as soon as the agent runs the install command. 🤡
Looks like my PRs have landed for module federation rstest support. Once shipped. You’ll be able to unit test federated applications just like you would any other monolithic app. “Just works”
🦀 Rstest 0.11.0 released 🚀
Breaking changes toward 1.0, with more to come.
🧩 TestOptions → 2nd arg
🎭 Sync-only mock factories
🧹 Flatter pool config
🔀 shard is CLI-only
⚡ 3.34× faster V8 coverage
🕰️ Fake timers on Sinon 15
👀 0.12 will have some interesting stuff.
🦀 Rstest 0.11.0 released 🚀
Breaking changes toward 1.0, with more to come.
🧩 TestOptions → 2nd arg
🎭 Sync-only mock factories
🧹 Flatter pool config
🔀 shard is CLI-only
⚡ 3.34× faster V8 coverage
🕰️ Fake timers on Sinon 15
👀 0.12 will have some interesting stuff.
🦀 Rslint now has a JavaScript API
Use `@rslint/core` to lint files with the same engine behind the Rslint CLI.
Useful for editors, codemods, custom checks, and migration.
Make your Node.js CLI start faster:
Enable compile cache at startup. It uses on-disk V8 code cache for faster warm starts.
typescript.js benchmark: 130ms -> 80ms
Best for CLIs that load lots of code.
This is a very clever architecture. We use a similar approach in Rspack by running CPU-bound tasks directly on Tokio. We don’t even need a separate I/O runtime, because the priority in compiler workloads is maximizing CPU utilization, not minimizing I/O latency.
One of the reasons we chose Tokio over Rayon is that Rspack exposes a large number of JavaScript hooks. These hooks are asynchronous and are frequently interleaved with CPU-bound work, so keeping everything on the same runtime greatly simplifies the execution model.
The discussion in is excellent. I’d also love to see Tokio provide more Rayon-like APIs (such as par_iter) to make scheduling CPU-bound workloads more ergonomic.
Today's two supply chain incidents are likely connected:
1. `actions-cool/issues-helper` was compromised
2. AntV was compromised shortly after
I noticed AntV was using `actions-cool/issues-helper@main` in GitHub Actions.
Rspack was not affected because we pin Actions to commit ids via renovate's `pinGitHubActionDigests`.
Strongly recommend enabling it.