WIP: Module Reloading Stratagies by ScriptedAlchemy · Pull Request #3809 · module-federation/core

ScriptedAlchemy · 2025-05-31T20:50:53Z

Description

Investigating better stratagies for hot reloading node servers when federated modules change.

Related Issue

Types of changes

Docs change / refactoring / dependency upgrade
Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)

Checklist

I have added tests to cover my changes.
All new and existing tests passed.
I have updated the documentation.

…error in final update

…om HMR helpers

changeset-bot · 2025-05-31T20:50:57Z

⚠️ No Changeset found

Latest commit: 28a003a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

netlify · 2025-05-31T20:51:13Z

✅ Deploy Preview for module-federation-docs ready!

Name	Link
🔨 Latest commit	`28a003a`
🔍 Latest deploy log	https://app.netlify.com/projects/module-federation-docs/deploys/68804bf69facbc0008268914
😎 Deploy Preview	https://deploy-preview-3809--module-federation-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

…ADME inaccuracies

ScriptedAlchemy · 2025-05-31T21:33:52Z

apps/vm-hotreload/webpack-custom-hmr/src/custom-hmr-helpers.js

+const vm = require('vm');
+
+// Webpack runtime code for in-memory HMR - only executed when webpack is available
+function injectInMemoryHMRRuntime(__webpack_require__) {


copy over the runtime module from HMR plugin - the plugin (in node targets) is designed to read filesystem only to check for updates. I replace some of the methods to allow in-memory patches, so that i could fetch() the update from a KV store or database etc and not need to manually write to disk.

ScriptedAlchemy · 2025-05-31T21:35:04Z

apps/vm-hotreload/webpack-custom-hmr/src/custom-hmr-helpers.js

+    /******/
+    /******/ // no external install chunk
+    /******/
+    /******/ function loadUpdateChunk(chunkId, updatedModulesList) {


node federation plugin already patches require.f.readFileVM but i never updated it to include the HMR stuff - in future this code could live in the node runtime plugin where other chunk loading stuff already exists.

…EADME inaccuracies

…ck-custom-debug

apps/vm-hotreload/webpack-custom-root/src/analytics.js

+    const event = {
+      id: `evt_${now}_${i}`,
+      type: EVENT_TYPES[Math.floor(Math.random() * EVENT_TYPES.length)],
+      userId: `user_${Math.floor(Math.random() * 100)}`,


To fix the issue, replace the use of Math.random() with a cryptographically secure random number generator. In Node.js, the crypto module provides a secure way to generate random values. Specifically, crypto.randomBytes can be used to generate random bytes, which can then be converted into a number or string as needed.

For the user ID generation, we can use crypto.randomBytes to generate a random number or string that is sufficiently unpredictable. This ensures that the user ID cannot be easily guessed or brute-forced.

apps/vm-hotreload/webpack-custom-root/src/analytics.js

+      id: `evt_${now}_${i}`,
+      type: EVENT_TYPES[Math.floor(Math.random() * EVENT_TYPES.length)],
+      userId: `user_${Math.floor(Math.random() * 100)}`,
+      sessionId: `session_${Math.floor(Math.random() * 20)}`,


To fix the issue, we need to replace the use of Math.random() with a cryptographically secure random number generator. In Node.js, the crypto module provides a secure method for generating random values. Specifically, we can use crypto.randomBytes to generate random bytes and convert them into a secure session ID.

The fix involves:

Importing the crypto module.

Replacing the insecure Math.random() logic with a secure random value generated using crypto.randomBytes.

Ensuring the session ID remains in the same format as before (e.g., prefixed with session_).

apps/vm-hotreload/full-demo/backend/server.js

+app.get('/admin', (req, res) => {
+  res.sendFile(path.join(__dirname, 'public', 'admin.html'));
+});


To address the issue, we will introduce rate limiting to the application using the express-rate-limit package. This package allows us to define a rate-limiting middleware that restricts the number of requests a client can make to the server within a specified time window. Specifically, we will:

Install the express-rate-limit package.

Configure a rate limiter with appropriate settings (e.g., a maximum of 100 requests per 15 minutes).

Apply the rate limiter middleware to the /admin route to limit access to the admin.html file.

This fix ensures that the /admin route is protected against excessive requests, reducing the risk of a DoS attack.

apps/vm-hotreload/full-demo/client/custom-hmr-helpers.js

apps/vm-hotreload/full-demo/client/src/index.js

Co-authored-by: Claude <noreply@anthropic.com>

2heal1 · 2025-09-05T02:47:04Z

This pr is inactive for a longtime, closed first . If wanna be merged , just reopen :D

ScriptedAlchemy added 5 commits May 30, 2025 16:11

chore: vm hmr

ca4a04b

chore(utils): restore module-based and wrapper-based hot reload demos

b4ac211

test(utils): verify repeatable runs and robust file restoration

ba70959

fix(webpack-bundler-runtime): add module.hot.accept() and fix syntax …

3224c4a

…error in final update

fix(webpack-bundler-runtime): remove file restore functions from cust…

edeb2f1

…om HMR helpers

ScriptedAlchemy added 2 commits May 31, 2025 14:28

docs: clean up README.md function signatures and demo descriptions

7724e38

docs: clean up module-based demo - remove unused functions and fix RE…

afff948

…ADME inaccuracies

ScriptedAlchemy commented May 31, 2025

View reviewed changes

ScriptedAlchemy added 3 commits May 31, 2025 14:39

docs: clean up wrapper-based demo - remove unused functions and fix R…

b2d3e39

…EADME inaccuracies

chore: x

f5d8535

fix(runtime): align HMR module structure and enhance logging in webpa…

39c5589

…ck-custom-debug

github-advanced-security bot found potential problems Jun 1, 2025

View reviewed changes

ScriptedAlchemy added 3 commits June 1, 2025 14:07

chore: vm hmr

998e3a6

chore: lkw

850064f

docs: update HMR spec with compilation hash documentation

df0c77a

github-advanced-security bot found potential problems Jun 4, 2025

View reviewed changes

ScriptedAlchemy and others added 2 commits July 16, 2025 16:23

Merge branch 'main' into module-reloaders

82458ec

feat(node): Custom HMR Bundler Runtime & Client (#3849)

28a003a

Co-authored-by: Claude <noreply@anthropic.com>

2heal1 closed this Sep 5, 2025

@@ -2,2 +2,3 @@
             const Logger = require('./utils/logger');
+            const crypto = require('crypto');
             const DataManager = require('./utils/dataManager');
@@ -141,3 +142,3 @@
                   type: EVENT_TYPES[Math.floor(Math.random() * EVENT_TYPES.length)],
-                  userId: `user_${Math.floor(Math.random() * 100)}`,
+                  userId: `user_${crypto.randomBytes(4).toString('hex')}`,
                   sessionId: `session_${Math.floor(Math.random() * 20)}`,

@@ -3,2 +3,3 @@
             const DataManager = require('./utils/dataManager');
+            const crypto = require('crypto');
             const Metrics = require('./utils/metrics');
@@ -142,3 +143,3 @@
                   userId: `user_${Math.floor(Math.random() * 100)}`,
-                  sessionId: `session_${Math.floor(Math.random() * 20)}`,
+                  sessionId: `session_${crypto.randomBytes(4).toString('hex')}`,
                   timestamp: new Date(now - Math.random() * 86400000).toISOString(), // Last 24 hours

@@ -6,2 +6,3 @@
             const WebSocket = require('ws');
+            const rateLimit = require('express-rate-limit');
@@ -264,3 +265,7 @@
             // Serve admin interface
-            app.get('/admin', (req, res) => {
+            const adminLimiter = rateLimit({
+              windowMs: 15 * 60 * 1000, // 15 minutes
+              max: 100, // Limit each IP to 100 requests per windowMs
+            });
+            app.get('/admin', adminLimiter, (req, res) => {
               res.sendFile(path.join(__dirname, 'public', 'admin.html'));

@@ -13,3 +13,4 @@
                 "body-parser": "^1.20.2",
-                "ws": "^8.14.2"
+                "ws": "^8.14.2",
+                "express-rate-limit": "^8.0.1"
               },

Package	Version	Security advisories
express-rate-limit (npm)	8.0.1	None

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

WIP: Module Reloading Stratagies#3809

WIP: Module Reloading Stratagies#3809
ScriptedAlchemy wants to merge 15 commits intomainfrom
module-reloaders

ScriptedAlchemy commented May 31, 2025 •

edited

Loading

Uh oh!

changeset-bot bot commented May 31, 2025 •

edited

Loading

Uh oh!

netlify bot commented May 31, 2025 •

edited

Loading

Uh oh!

ScriptedAlchemy May 31, 2025

Uh oh!

ScriptedAlchemy May 31, 2025

Uh oh!

Check failure

Copilot Autofix

Check failure

Copilot Autofix

Check failure

Copilot Autofix

Uh oh!

Uh oh!

2heal1 commented Sep 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ScriptedAlchemy commented May 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related Issue

Types of changes

Checklist

Uh oh!

changeset-bot bot commented May 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

netlify bot commented May 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for module-federation-docs ready!

Uh oh!

ScriptedAlchemy May 31, 2025

Choose a reason for hiding this comment

Uh oh!

ScriptedAlchemy May 31, 2025

Choose a reason for hiding this comment

Uh oh!

Check failure

Uh oh!

Copilot Autofix

Check failure

Uh oh!

Copilot Autofix

Check failure

Uh oh!

Copilot Autofix

Uh oh!

Uh oh!

2heal1 commented Sep 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ScriptedAlchemy commented May 31, 2025 •

edited

Loading

changeset-bot bot commented May 31, 2025 •

edited

Loading

netlify bot commented May 31, 2025 •

edited

Loading