Unused CommonJS re-exports are concatenated into a call chain, breaking semicolon-free packages (regression in 5.110.3) #21955

Activity

1. albo72

   added the

   Bug

   issue type on Sep 4, 2026
2. coderabbitai

   added

   area: optimizationTree-shaking, splitChunks, concatenation, ids (lib/optimize, lib/ids)Tree-shaking, splitChunks, concatenation, ids (lib/optimize, lib/ids)

   area: runtimeEmitted runtime and chunk loading across targets (lib/runtime, lib/web, lib/node, lib/esm)Emitted runtime and chunk loading across targets (lib/runtime, lib/web, lib/node, lib/esm)

   regressionWorked in a previous release; pair with the Affected version fieldWorked in a previous release; pair with the Affected version field

   on Sep 4, 2026
3. blankse commented on Sep 4, 2026

   

   blankse

   on Sep 4, 2026

   More actions

   I hit the same regression independently and filed #21956 before seeing this one — closing mine as a duplicate. Adding what my investigation covers that this report does not, in case it helps narrow the fix.

   The trigger does not need a dropped re-export

   Here the bare parenthesized reference appears because unused module.exports assignments are eliminated. It also happens with nothing eliminated at all: two adjacent require() expression statements, where the first has no trailing semicolon, are enough.

   Four files, webpack and webpack-cli only, no third-party dependency:

   src/index.js — the import is what makes this module ESM and therefore the concatenation root:

   import X from "./x";
   
   window.X = X;
   
   require("./a")
   require("./b");

   src/x.js:

   export default function X() {
   	return 42;
   }

   src/a.js and src/b.js:

   window.a = true;

   window.b = true;

   webpack.config.js:

   const path = require("path");
   
   module.exports = {
   	mode: "production",
   	entry: path.resolve(__dirname, "src/index.js"),
   	output: {
   		path: path.resolve(__dirname, "dist"),
   		filename: "bundle.js"
   	}
   };

   node -e "global.window={}; require('./dist/bundle.js')" throws TypeError: o(...) is not a function on 5.110.3 and runs on 5.110.2.

   Unminified, the difference is only the parentheses:

   // 5.110.2                  // 5.110.3
   a_namespaceFn()             (a_namespaceFn())
   b_namespaceFn();            (b_namespaceFn());

   So the fix needs to hold for a plain CommonJsRequireDependency too, not only for the CommonJsExportRequireDependency path — no export elimination is involved above.

   It is the accessorCall && !asCall branch, not the binding.info.wrapped one

   ConcatenatedModule.js has the same parenthesizing expression twice. Neutralizing them one at a time in an installed 5.110.3 isolates it:

   patched	collapsed
   nothing	yes
   line 984, else if (binding.info.wrapped)	yes
   line 989, else if (accessorCall && !asCall)	no

   That is the branch #21876 added and the one quoted above, so both reports land on the same line.

   Two more data points from patching line 989 in place:

   variant	collapsed
   `(${reference})` → `${reference}`	no
   always `;(${reference})`	no

   Bisect, and terser is not involved

   Same reproduction, only the version changed:

   webpack	collapsed
   5.109.2	no
   5.110.0	no
   5.110.1	no
   5.110.2	no
   5.110.3	yes

   The collapse is already present in the unminified output. Crossing the versions confirms terser is not a factor:

   webpack	terser	collapsed
   5.110.3	5.51.2	yes
   5.110.3	5.49.0	yes
   5.109.2	5.51.2	no
   5.109.2	5.49.0	no

   For completeness: #21907 landed in the same release and removed the ConcatenationScope.registerReplacedRequire / isInsideReplacedRequire containment guard. It looks related in the source diff but is not the cause — reverting only the parenthesization is sufficient.

   Impact note

   In our case this took down a production site after a routine dependency bump. The two semicolon-free require() lines had been in the source for over two years and were harmless until this release, and there is no build error or warning.

   Reproduction, bisect and branch attribution were produced with Claude Code; every number above comes from an actual build in an isolated directory.
4. alexander-akait

   added 2 commits that reference this issue on Sep 4, 2026

   fix(concatenate-modules): guard a module reference against ASI

   ...

   This issue will close once commit 6205eea is merged into the 'main' branch.

   6205eea

   fix(concatenate-modules): guard a module reference against ASI

   ...

   This issue will close once commit 7988deb is merged into the 'main' branch.

   7988deb
5. alexander-akait

   closed this as completedin #21962on Sep 4, 2026
6. pull

   added a commit that references this issue on Sep 4, 2026

   fix(concatenate-modules): guard a module reference against ASI (webpa…

   ...

   This issue will close once commit c17742f is merged into the 'main' branch.

   c17742f