chore!: Build Snaps execution environments with Webpack #3322

Mrtenz · 2025-04-15T10:11:52Z

This updates the Snaps execution environments build to use Webpack instead of Browserify. The existing Browserify script was updated to build with Webpack. In the future we may be able to use Webpack from the CLI directly, but right now for compatibility with LavaMoat Node we need to use a custom script.

I've added a new script build:lavamoat:test which builds the execution environments for testing locally or in CI. The main difference with this script is that it uses tsconfig paths, which are now disabled for the production build. Doing so results in much better tree shaking, so a smaller bundle.

Breaking changes

The node-process and node-thread bundles are now exported as @metamask/snaps-execution-environments/node-process and @metamask/snaps-execution-environments/node-thread respectively.

socket-security · 2025-04-15T10:13:00Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality
@lavamoat/webpack@0.9.0-beta.0
@babel/generator@7.23.6 ⏵ 7.27.0		⁺¹
@babel/traverse@7.24.6 ⏵ 7.26.9	⁺¹	⁺¹
lavamoat@8.0.7 ⏵ 9.0.8	⁺¹
ts-loader@9.5.2
@metamask/post-message-stream@9.0.0 ⏵ 10.0.0	⁺¹

View full report

packages/snaps-execution-environments/lavamoat/build-system/policy-override.json

Mrtenz · 2025-04-15T12:40:50Z

packages/snaps-execution-environments/lavamoat/build-system/policy-override.json

+        "@swc/core>@swc/core-linux-x64-gnu": true
+      }
+    },
+    "html-webpack-plugin": {


All the additions in the policy override here are necessary because of how Webpack loads loaders. A future update to LavaMoat should make this obsolete.

codecov · 2025-04-15T12:41:58Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 98.03%. Comparing base (8120ab0) to head (e499c17).
Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3322      +/-   ##
==========================================
- Coverage   98.03%   98.03%   -0.01%     
==========================================
  Files         402      402              
  Lines       11109    11107       -2     
  Branches     1754     1754              
==========================================
- Hits        10891    10889       -2     
  Misses        218      218

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Mrtenz · 2025-04-17T10:55:08Z

packages/snaps-execution-environments/package.json

    "@metamask/json-rpc-engine": "^10.0.2",
    "@metamask/object-multiplex": "^2.1.0",
-    "@metamask/post-message-stream": "^9.0.0",
+    "@metamask/post-message-stream": "^10.0.0",


@metamask/post-message-stream only had a CJS version, and since it's using @metamask/utils, it caused Webpack to use the CJS version of @metamask/utils while an ESM version was available. After bumping this to 10.0.0, we can use the ESM version of both @metamask/post-message-stream and @metamask/utils, resulting in a smaller bundle.

socket-security · 2025-04-22T08:56:50Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

[email protected]
[email protected]

View full report

hmalik88

LGTM

…3357)" (#3359) This reverts commit 042d2fa. To avoid multiple major releases shortly after each other, we should group this closer with the merge of #3322.

Mrtenz · 2025-04-29T09:36:29Z

@SocketSecurity ignore npm/[email protected]

Network access ok.

@SocketSecurity ignore npm/[email protected]

This doesn't affect us.

FrederikBolding · 2025-05-02T08:32:49Z

packages/snaps-execution-environments/package.json

-    "build:lavamoat:policy": "yarn build:lavamoat --writeAutoPolicy && node scripts/build.js --writeAutoPolicy",
+    "build:lavamoat": "lavamoat --policy lavamoat/build-system/policy.json  --override lavamoat/build-system/policy-override.json ./scripts/build.js",
+    "build:lavamoat:policy": "yarn build:lavamoat --writeAutoPolicy && LAVAMOAT_GENERATE_POLICY=true node scripts/build.js",
+    "build:lavamoat:test": "NODE_ENV=test yarn build:lavamoat",


Not entirely sure how to feel about this, seems somewhat problematic that we aren't actually testing with prod builds in CI?

The only difference is using tsconfig paths for testing, but not for production.

Hmm, yeah I understand. Maybe worth the tradeoff

yarn.lock

.github/workflows/build-lint-test.yml

…ceptions

packages/snaps-execution-environments/src/index.ejs

packages/snaps-execution-environments/scripts/build.js

packages/snaps-execution-environments/webpack.config.js

FrederikBolding · 2025-05-02T08:59:13Z

packages/snaps-execution-environments/webpack.config.js

+    inlineBundle: true,
+
+    scuttleGlobalThis: true,
+    scuttleGlobalThisExceptions: ['JSON', 'ReactNativeWebView', 'String'],


We need to verify that this works in mobile

It does 🎉

FrederikBolding · 2025-05-02T09:01:41Z

packages/snaps-execution-environments/webpack.config.js

+              'Object',
+              'postMessage',
+              'Reflect',
+              'Set',


Set, Object and Reflect are new exceptions, do we know why?

Yes, these are introduced by LavaMoat boilerplate IIRC. These are safe to add, and we may be able to remove them with a future LavaMoat update.

packages/snaps-execution-environments/.browserslistrc

This is a redo of #3357, which was reverted in #3359 to avoid two breaking changes in a row. Now that #3322 is merged, we can do this again. The original PR description can be found below. --- This removes the web worker execution service and execution environment, as they were unused. We can revert this PR in the future to add them again, if needed. ## Breaking changes ### `@metamask/snaps-controllers` - Remove web worker execution service. ### `@metamask/snaps-execution-environments` - Remove web worker pool execution environment. - Remove web worker executor execution environment.

Browserify is not actively maintained and we should stop recommending it. With the removal of Browserify from #3322, we can now completely remove Browserify from the repo. `@metamask/snaps-browserify-plugin` should be deprecated on NPM after merging this.

After #3322, generating LavaMoat policies requires the build files to be present. Since the examples step requires build files as well, I've moved the build to a new job which is now a requirement for the other steps.

Mrtenz commented Apr 15, 2025

View reviewed changes

packages/snaps-execution-environments/lavamoat/build-system/policy-override.json Outdated Show resolved Hide resolved

Mrtenz commented Apr 15, 2025

View reviewed changes

Mrtenz force-pushed the mrtenz/snaps-execution-environments-webpack branch from e775b0c to 69b64c4 Compare April 16, 2025 20:29

Mrtenz commented Apr 17, 2025

View reviewed changes

Mrtenz mentioned this pull request Apr 17, 2025

chore(deps): bump @metamask/post-message-stream from 9.0.0 to 10.0.0 #3327

Closed

Mrtenz force-pushed the mrtenz/snaps-execution-environments-webpack branch from cf1b6a7 to 5bdeb37 Compare April 22, 2025 08:55

Mrtenz force-pushed the mrtenz/snaps-execution-environments-webpack branch from 5bdeb37 to 974b038 Compare April 22, 2025 09:02

Mrtenz marked this pull request as ready for review April 22, 2025 09:50

Mrtenz requested a review from a team as a code owner April 22, 2025 09:50

hmalik88 previously approved these changes Apr 23, 2025

View reviewed changes

Mrtenz dismissed hmalik88’s stale review via 5871aee April 24, 2025 10:32

Mrtenz force-pushed the mrtenz/snaps-execution-environments-webpack branch 2 times, most recently from 5871aee to 355864e Compare April 24, 2025 11:08

Mrtenz marked this pull request as draft April 24, 2025 12:00

This was referenced Apr 25, 2025

perf: Reduce unnecessary validation on responses #3350

Merged

revert: "chore!: Remove web worker execution service and environment (#3357)" #3359

Merged

Mrtenz force-pushed the mrtenz/snaps-execution-environments-webpack branch from 8f08a47 to 6908166 Compare April 28, 2025 14:21

Mrtenz force-pushed the mrtenz/snaps-execution-environments-webpack branch from bfae935 to 59b4b0f Compare April 29, 2025 10:45

Mrtenz marked this pull request as ready for review April 29, 2025 11:51

FrederikBolding reviewed May 2, 2025

View reviewed changes

yarn.lock Show resolved Hide resolved

FrederikBolding reviewed May 2, 2025

View reviewed changes

.github/workflows/build-lint-test.yml Show resolved Hide resolved

Mrtenz added 3 commits May 2, 2025 10:38

Build Snaps execution environments with Webpack

cf13591

Update CI

407c4bd

Add node-thread and node-process aliases for Jest

2712851

Mrtenz added 8 commits May 2, 2025 10:39

Enable scuttling

767db1f

Add more exceptions to scuttleGlobalThis config

9a16da6

Update scuttleGlobalThis config again

50bdb54

Add WebAssembly to scuttling exceptions

4d75747

Simplify build script

0fcf26e

Only enable scuttling for specific builds and allow build-specific ex…

4b78ffa

…ceptions

Fix coverage

baab881

Remove unused patches

57e6670

Mrtenz force-pushed the mrtenz/snaps-execution-environments-webpack branch from f14dff9 to 57e6670 Compare May 2, 2025 08:39

FrederikBolding reviewed May 2, 2025

View reviewed changes

packages/snaps-execution-environments/src/index.ejs Outdated Show resolved Hide resolved

Update iframe title

476c72c

FrederikBolding reviewed May 2, 2025

View reviewed changes

packages/snaps-execution-environments/scripts/build.js Show resolved Hide resolved

FrederikBolding reviewed May 2, 2025

View reviewed changes

packages/snaps-execution-environments/webpack.config.js Show resolved Hide resolved

FrederikBolding reviewed May 2, 2025

View reviewed changes

Add log message

fc74ba9

FrederikBolding reviewed May 2, 2025

View reviewed changes

packages/snaps-execution-environments/.browserslistrc Show resolved Hide resolved

Mrtenz added 2 commits May 2, 2025 11:17

Remove unnecessary policy override

f5c19bc

Remove @swc/core from policy

e499c17

FrederikBolding approved these changes May 2, 2025

View reviewed changes

Mrtenz added this pull request to the merge queue May 2, 2025

Merged via the queue into main with commit 1d36a99 May 2, 2025
119 checks passed

Mrtenz deleted the mrtenz/snaps-execution-environments-webpack branch May 2, 2025 11:04

Mrtenz mentioned this pull request May 2, 2025

chore!: Remove web worker execution service and environment #3371

Merged

Mrtenz mentioned this pull request May 2, 2025

chore: Remove Browserify plugin #3372

Merged

Mrtenz mentioned this pull request May 6, 2025

ci: Build packages in update workflow #3380

Merged

chore!: Build Snaps execution environments with Webpack #3322

chore!: Build Snaps execution environments with Webpack #3322

Uh oh!

Conversation

Mrtenz commented Apr 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Breaking changes

Uh oh!

socket-security bot commented Apr 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Apr 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

socket-security bot commented Apr 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

hmalik88 left a comment

Choose a reason for hiding this comment

Uh oh!

Mrtenz commented Apr 29, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Mrtenz commented Apr 15, 2025 •

edited

Loading

socket-security bot commented Apr 15, 2025 •

edited

Loading

codecov bot commented Apr 15, 2025 •

edited

Loading

socket-security bot commented Apr 22, 2025 •

edited

Loading