Error after upgrading from 16.6 to 16.8.1 with globalThis.process.env.NODE_ENV #3978

DontRepeatYourself · 2023-10-12T06:37:52Z

Running a project with Vue3 / Quasar2 / Vite in development mode fails after update.

// node_modules/graphql/jsutils/instanceOf.mjs
globalThis.process && globalThis.process.env.NODE_ENV === 'production'

is compiled to

var instanceOf = globalThis.process && globalThis."development" === "production" ? function instanceOf2(value, constructor) { ... }

Changing

globalThis.process && globalThis.process.env.NODE_ENV === 'production'

to

globalThis.process && globalThis.process.env['NODE_ENV'] === 'production'

solves the problem for me.

The text was updated successfully, but these errors were encountered:

vdineva · 2023-10-12T13:37:20Z

Experiencing the same issue and this bug does not allow us to upgrade to the latest version and there's a security advisory for versions before 16.8.1: GHSA-9pv7-vfvm-6vr7

rafaelsorto · 2023-10-19T18:04:39Z

Having the same bug. It resolves to globalThis."development" === 'production' or production and it breaks the app.

MaLiN2223 · 2023-10-28T07:14:04Z

Got the same issue when using the ReactJS framework, keeping graphql on 16.6.0 seems to be the solution for us for now.

TdyP · 2023-12-04T09:45:25Z

Same issue here, with a Uncaught SyntaxError: missing name after . operator at runtime.
React project compiled with Vite.

Any plans for a fix?

Thanks

The newest versions of the package presented a bug as for this issue graphql/graphql-js#3978.

vdineva · 2024-01-04T17:33:53Z

Just checking on the status of this issue. Is there a plan to address it and publish a new version? It's been open for a while now

vdineva · 2024-02-12T15:21:15Z

For anyone experiencing issues with v16.8.1, a workaround is to define globalThis.process.env.NODE_ENV in your bundler.
For Webpack it's:

new DefinePlugin({
   "globalThis.process.env.NODE_ENV": JSON.stringify(process.env.NODE_ENV)
})

mobsean · 2024-02-13T15:01:26Z

see PR, this fixes the vue3, quasar, vite problem with graphql-js > 16.6

JoviDeCroock · 2024-02-14T14:32:20Z

Hey,

Would anyone mind posting a reproduction to this issue leveraging vite/webpack/.... Does upgrading resolve the issue?

mobsean · 2024-02-15T13:37:32Z

Hey,

Would anyone mind posting a reproduction to this issue leveraging vite/webpack/.... Does upgrading resolve the issue?

I checked your PR and fine with it. The problem in this issue is solved by this.

n05la3 · 2024-02-15T13:53:38Z

Hey,

Would anyone mind posting a reproduction to this issue leveraging vite/webpack/.... Does upgrading resolve the issue?

Tested with vite and it works fine.

JoviDeCroock · 2024-02-15T13:55:08Z

What did you test @n05la3 the PR or whether the issue is present 😅 we need versions/... actual reproductions or at the very least version numbers of where this issue shows itself

n05la3 · 2024-02-15T14:50:52Z

I misread the comment. I experienced this issue in a Quasar 2.14.3 project with Vite 5.0.0 when upgrading from 16.6.0 to 16.8.1. I had used a patch to bypass this issue. Earlier today, I tested the changes in the PR in my project and it works fine.

…raphql/graphql-js#3978

@n1ru4l

#4022) As surfaced in [Discord](https://discord.com/channels/625400653321076807/862957336082645006/1206980831915282532) this currently is a breaking change in the 16.x.x release line which is preventing folks from upgrading towards a security fix. This PR should result in a patch release on the 16 release line. This change was originally introduced to support CFW and browser environments which should still be supported with the `typeof` check CC @n1ru4l This also adds a check whether `.env` is present as in the DOM using `id="process"` defines that as a global which we don't want to access on accident. as shown in #4017 Bundles also target `process.env.NODE_ENV` specifically which fails when it replaces `globalThis.process.env.NODE_ENV` as this becomes `globalThis."production"` which is invalid syntax. Fixes #3978 Fixes #3918 Fixes #3928 Fixes #3758 Fixes #3934 This purposefully does not account for #3925 as we can't address this without breaking CF/plain browsers so the small byte-size increase will be expected for bundled browser environments. As a middle ground we did optimise the performance here. We can revisit this for v17. Most bundlers will be able to tree-shake this with a little help, in #4075 (comment) you can find a conclusion with a repo where we discuss a few. - Next.JS by default replaces [`process.env.NODE_ENV`](https://github.com/vercel/next.js/blob/b0ab0fe85fe8c93792051b058e060724ff373cc2/packages/next/webpack.config.js#L182) you can add `typeof process` linearly - Vite allows you to specify [`config.define`](https://vitejs.dev/config/shared-options.html#define) - ESBuild by default will replace `process.env.NODE_ENV` but does not support replacing `typeof process` - Rollup has a plugin for this https://www.npmjs.com/package/@rollup/plugin-replace Supersedes #4021 Supersedes #4019 Supersedes #3927 > This now also adds a documentation page on how to remove all of these

DontRepeatYourself · 2024-06-13T09:38:53Z

Fixed with 16.8.2

@n1ru4l

graphql#4022) As surfaced in [Discord](https://discord.com/channels/625400653321076807/862957336082645006/1206980831915282532) this currently is a breaking change in the 16.x.x release line which is preventing folks from upgrading towards a security fix. This PR should result in a patch release on the 16 release line. This change was originally introduced to support CFW and browser environments which should still be supported with the `typeof` check CC @n1ru4l This also adds a check whether `.env` is present as in the DOM using `id="process"` defines that as a global which we don't want to access on accident. as shown in graphql#4017 Bundles also target `process.env.NODE_ENV` specifically which fails when it replaces `globalThis.process.env.NODE_ENV` as this becomes `globalThis."production"` which is invalid syntax. Fixes graphql#3978 Fixes graphql#3918 Fixes graphql#3928 Fixes graphql#3758 Fixes graphql#3934 This purposefully does not account for graphql#3925 as we can't address this without breaking CF/plain browsers so the small byte-size increase will be expected for bundled browser environments. As a middle ground we did optimise the performance here. We can revisit this for v17. Most bundlers will be able to tree-shake this with a little help, in graphql#4075 (comment) you can find a conclusion with a repo where we discuss a few. - Next.JS by default replaces [`process.env.NODE_ENV`](https://github.com/vercel/next.js/blob/b0ab0fe85fe8c93792051b058e060724ff373cc2/packages/next/webpack.config.js#L182) you can add `typeof process` linearly - Vite allows you to specify [`config.define`](https://vitejs.dev/config/shared-options.html#define) - ESBuild by default will replace `process.env.NODE_ENV` but does not support replacing `typeof process` - Rollup has a plugin for this https://www.npmjs.com/package/@rollup/plugin-replace Supersedes graphql#4021 Supersedes graphql#4019 Supersedes graphql#3927 > This now also adds a documentation page on how to remove all of these

@n1ru4l

graphql#4022) As surfaced in [Discord](https://discord.com/channels/625400653321076807/862957336082645006/1206980831915282532) this currently is a breaking change in the 16.x.x release line which is preventing folks from upgrading towards a security fix. This PR should result in a patch release on the 16 release line. This change was originally introduced to support CFW and browser environments which should still be supported with the `typeof` check CC @n1ru4l This also adds a check whether `.env` is present as in the DOM using `id="process"` defines that as a global which we don't want to access on accident. as shown in graphql#4017 Bundles also target `process.env.NODE_ENV` specifically which fails when it replaces `globalThis.process.env.NODE_ENV` as this becomes `globalThis."production"` which is invalid syntax. Fixes graphql#3978 Fixes graphql#3918 Fixes graphql#3928 Fixes graphql#3758 Fixes graphql#3934 This purposefully does not account for graphql#3925 as we can't address this without breaking CF/plain browsers so the small byte-size increase will be expected for bundled browser environments. As a middle ground we did optimise the performance here. We can revisit this for v17. Most bundlers will be able to tree-shake this with a little help, in graphql#4075 (comment) you can find a conclusion with a repo where we discuss a few. - Next.JS by default replaces [`process.env.NODE_ENV`](https://github.com/vercel/next.js/blob/b0ab0fe85fe8c93792051b058e060724ff373cc2/packages/next/webpack.config.js#L182) you can add `typeof process` linearly - Vite allows you to specify [`config.define`](https://vitejs.dev/config/shared-options.html#define) - ESBuild by default will replace `process.env.NODE_ENV` but does not support replacing `typeof process` - Rollup has a plugin for this https://www.npmjs.com/package/@rollup/plugin-replace Supersedes graphql#4021 Supersedes graphql#4019 Supersedes graphql#3927 > This now also adds a documentation page on how to remove all of these

@n1ru4l

#4022) As surfaced in [Discord](https://discord.com/channels/625400653321076807/862957336082645006/1206980831915282532) this currently is a breaking change in the 16.x.x release line which is preventing folks from upgrading towards a security fix. This PR should result in a patch release on the 16 release line. This change was originally introduced to support CFW and browser environments which should still be supported with the `typeof` check CC @n1ru4l This also adds a check whether `.env` is present as in the DOM using `id="process"` defines that as a global which we don't want to access on accident. as shown in #4017 Bundles also target `process.env.NODE_ENV` specifically which fails when it replaces `globalThis.process.env.NODE_ENV` as this becomes `globalThis."production"` which is invalid syntax. Fixes #3978 Fixes #3918 Fixes #3928 Fixes #3758 Fixes #3934 This purposefully does not account for #3925 as we can't address this without breaking CF/plain browsers so the small byte-size increase will be expected for bundled browser environments. As a middle ground we did optimise the performance here. We can revisit this for v17. Most bundlers will be able to tree-shake this with a little help, in #4075 (comment) you can find a conclusion with a repo where we discuss a few. - Next.JS by default replaces [`process.env.NODE_ENV`](https://github.com/vercel/next.js/blob/b0ab0fe85fe8c93792051b058e060724ff373cc2/packages/next/webpack.config.js#L182) you can add `typeof process` linearly - Vite allows you to specify [`config.define`](https://vitejs.dev/config/shared-options.html#define) - ESBuild by default will replace `process.env.NODE_ENV` but does not support replacing `typeof process` - Rollup has a plugin for this https://www.npmjs.com/package/@rollup/plugin-replace Supersedes #4021 Supersedes #4019 Supersedes #3927 > This now also adds a documentation page on how to remove all of these

petunmar mentioned this issue Nov 14, 2023

Not work with 3.2.25 vuejs/apollo#1517

Open

arthuravianna added a commit to prototyp3-dev/cartesi-client that referenced this issue Dec 18, 2023

fix: override graphql package version

c9c33dd

The newest versions of the package presented a bug as for this issue graphql/graphql-js#3978.

yusufkandemir mentioned this issue Jan 12, 2024

Update Roadmap quasarframework/quasar#16747

Closed

This was referenced Feb 13, 2024

fix#3978 #4020

Closed

fix#3978 #4021

Closed

JoviDeCroock mentioned this issue Feb 14, 2024

fix: remove globalThis check and align with what bundlers can accept #4022

Merged

DysektAI added a commit to DysektAI/TarkovTracker that referenced this issue Apr 15, 2024

Graphql package is currently broken 16.6.0 fixes the current problem g…

5639690

…raphql/graphql-js#3978

DontRepeatYourself closed this as completed Jun 13, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Error after upgrading from 16.6 to 16.8.1 with globalThis.process.env.NODE_ENV #3978

Error after upgrading from 16.6 to 16.8.1 with globalThis.process.env.NODE_ENV #3978

DontRepeatYourself commented Oct 12, 2023 •

edited

Loading

vdineva commented Oct 12, 2023 •

edited

Loading

rafaelsorto commented Oct 19, 2023

MaLiN2223 commented Oct 28, 2023 •

edited

Loading

TdyP commented Dec 4, 2023 •

edited

Loading

vdineva commented Jan 4, 2024

vdineva commented Feb 12, 2024

mobsean commented Feb 13, 2024

JoviDeCroock commented Feb 14, 2024

mobsean commented Feb 15, 2024

n05la3 commented Feb 15, 2024

JoviDeCroock commented Feb 15, 2024

n05la3 commented Feb 15, 2024 •

edited

Loading

DontRepeatYourself commented Jun 13, 2024

Error after upgrading from 16.6 to 16.8.1 with globalThis.process.env.NODE_ENV #3978

Error after upgrading from 16.6 to 16.8.1 with globalThis.process.env.NODE_ENV #3978

Comments

DontRepeatYourself commented Oct 12, 2023 • edited Loading

vdineva commented Oct 12, 2023 • edited Loading

rafaelsorto commented Oct 19, 2023

MaLiN2223 commented Oct 28, 2023 • edited Loading

TdyP commented Dec 4, 2023 • edited Loading

vdineva commented Jan 4, 2024

vdineva commented Feb 12, 2024

mobsean commented Feb 13, 2024

JoviDeCroock commented Feb 14, 2024

mobsean commented Feb 15, 2024

n05la3 commented Feb 15, 2024

JoviDeCroock commented Feb 15, 2024

n05la3 commented Feb 15, 2024 • edited Loading

DontRepeatYourself commented Jun 13, 2024

DontRepeatYourself commented Oct 12, 2023 •

edited

Loading

vdineva commented Oct 12, 2023 •

edited

Loading

MaLiN2223 commented Oct 28, 2023 •

edited

Loading

TdyP commented Dec 4, 2023 •

edited

Loading

n05la3 commented Feb 15, 2024 •

edited

Loading