feat(node): opt-in native ESM HTTP loader for bundler-free runtime by ScriptedAlchemy · Pull Request #4862 · module-federation/core

ScriptedAlchemy · 2026-07-02T04:24:12Z

Description

Adds an opt-in native ESM HTTP loader for @module-federation/node, enabling a bundler-free Module Federation runtime in Node. With node --import @module-federation/node/register, remote entries and their chunks are loaded through native module.register() loader hooks (real import() over http(s)) instead of fetch + vm.runInThisContext.

What changed:

New packages/node/src/loader-hooks/ module: module.register()-based HTTP loader hooks with an origin allowlist, a resolve/load protocol between the main thread and the hooks thread, and an entry loader for federation remote entries. Includes a fix to keep the allowlist ack MessagePort referenced during the round-trip so the process cannot exit mid-handshake.
New @module-federation/node/register entry (register.mjs / register.cjs + type declarations) so consumers can enable the loader with a single --import flag.
runtimePlugin.ts bridge: when the native loader is active, loadEntry delegates remote-entry loading to the loader hooks path; default behavior is unchanged when the loader is not registered.
Two example apps (apps/node-esm-host, apps/node-esm-remote) demonstrating a webpack-built ESM remote consumed by a bundler-free Node host over HTTP.
Design doc, research notes (packages/node/docs/), and a changeset (@module-federation/node minor).

Why: today the Node runtime executes remote code via fetch + vm.runInThisContext, which bypasses the native ESM module graph (no real import.meta, no native async chunk resolution, awkward interop). Native loader hooks let Node itself resolve and load federated ESM modules over HTTP.

Impact: fully opt-in. Nothing changes unless the process is started with the /register entry (or hooks are registered explicitly). Changeset included: @module-federation/node minor.

Validation:

@module-federation/node package build green; 71 jest tests passing (loader hooks, register entry, smoke tests).
Prettier/lint clean.
E2E: webpack-built ESM remote entry plus a nested async chunk loaded over http:// via node --import @module-federation/node/register, verified on Node 18.19 and Node 22.

Roadmap (phase 2): migrate from module.register() (hooks thread) to the synchronous in-thread module.registerHooks() API as it stabilizes, which removes the worker round-trip.

Related Issue

No linked issue; this implements the native ESM HTTP loader design discussed in packages/node/docs/native-http-loader-design.md.

Types of changes

Docs change / refactoring / dependency upgrade
Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)

Checklist

I have added tests to cover my changes.
All new and existing tests passed.
I have updated the documentation.

changeset-bot · 2026-07-02T04:24:16Z

🦋 Changeset detected

Latest commit: f613100

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 47 packages

Name	Type
@module-federation/node	Minor
@module-federation/modern-js-v3	Patch
@module-federation/modern-js	Patch
@module-federation/nextjs-mf	Patch
@module-federation/rsbuild-plugin	Patch
node-dynamic-remote-new-version	Patch
node-dynamic-remote	Patch
shared-tree-shaking-with-server-host	Patch
shared-tree-shaking-with-server-provider	Patch
@module-federation/playground	Patch
@module-federation/rspress-plugin	Patch
remote5	Patch
remote6	Patch
website-new	Patch
@module-federation/runtime	Patch
@module-federation/enhanced	Patch
@module-federation/rspack	Patch
@module-federation/webpack-bundler-runtime	Patch
@module-federation/sdk	Patch
@module-federation/runtime-tools	Patch
@module-federation/managers	Patch
@module-federation/manifest	Patch
@module-federation/dts-plugin	Patch
@module-federation/third-party-dts-extractor	Patch
@module-federation/devtools	Patch
@module-federation/bridge-react	Patch
@module-federation/bridge-vue3	Patch
@module-federation/bridge-shared	Patch
@module-federation/bridge-react-webpack-plugin	Patch
@module-federation/retry-plugin	Patch
@module-federation/error-codes	Patch
@module-federation/inject-external-runtime-core-plugin	Patch
@module-federation/runtime-core	Patch
create-module-federation	Patch
@module-federation/cli	Patch
@module-federation/treeshake-server	Patch
@module-federation/treeshake-frontend	Patch
@module-federation/metro	Patch
@module-federation/metro-plugin-rnef	Patch
@module-federation/metro-plugin-rock	Patch
@module-federation/metro-plugin-rnc-cli	Patch
@module-federation/esbuild	Patch
@module-federation/observability-plugin	Patch
@module-federation/storybook-addon	Patch
shared-tree-shaking-no-server-host	Patch
shared-tree-shaking-no-server-provider	Patch
@module-federation/utilities	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

pkg-pr-new · 2026-07-02T04:28:22Z

Open in StackBlitz

@module-federation/devtools

pnpm add https://pkg.pr.new/@module-federation/devtools@f613100

@module-federation/cli

pnpm add https://pkg.pr.new/@module-federation/cli@f613100

create-module-federation

pnpm add https://pkg.pr.new/create-module-federation@f613100

@module-federation/dts-plugin

pnpm add https://pkg.pr.new/@module-federation/dts-plugin@f613100

@module-federation/enhanced

pnpm add https://pkg.pr.new/@module-federation/enhanced@f613100

@module-federation/error-codes

pnpm add https://pkg.pr.new/@module-federation/error-codes@f613100

@module-federation/esbuild

pnpm add https://pkg.pr.new/@module-federation/esbuild@f613100

@module-federation/managers

pnpm add https://pkg.pr.new/@module-federation/managers@f613100

@module-federation/manifest

pnpm add https://pkg.pr.new/@module-federation/manifest@f613100

@module-federation/metro

pnpm add https://pkg.pr.new/@module-federation/metro@f613100

@module-federation/metro-plugin-rnc-cli

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rnc-cli@f613100

@module-federation/metro-plugin-rnef

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rnef@f613100

@module-federation/metro-plugin-rock

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rock@f613100

@module-federation/modern-js

pnpm add https://pkg.pr.new/@module-federation/modern-js@f613100

@module-federation/modern-js-v3

pnpm add https://pkg.pr.new/@module-federation/modern-js-v3@f613100

@module-federation/native-federation-tests

pnpm add https://pkg.pr.new/@module-federation/native-federation-tests@f613100

@module-federation/native-federation-typescript

pnpm add https://pkg.pr.new/@module-federation/native-federation-typescript@f613100

@module-federation/nextjs-mf

pnpm add https://pkg.pr.new/@module-federation/nextjs-mf@f613100

@module-federation/node

pnpm add https://pkg.pr.new/@module-federation/node@f613100

@module-federation/observability-plugin

pnpm add https://pkg.pr.new/@module-federation/observability-plugin@f613100

@module-federation/playground

pnpm add https://pkg.pr.new/@module-federation/playground@f613100

@module-federation/retry-plugin

pnpm add https://pkg.pr.new/@module-federation/retry-plugin@f613100

@module-federation/rsbuild-plugin

pnpm add https://pkg.pr.new/@module-federation/rsbuild-plugin@f613100

@module-federation/rspack

pnpm add https://pkg.pr.new/@module-federation/rspack@f613100

@module-federation/rspress-plugin

pnpm add https://pkg.pr.new/@module-federation/rspress-plugin@f613100

@module-federation/runtime

pnpm add https://pkg.pr.new/@module-federation/runtime@f613100

@module-federation/runtime-core

pnpm add https://pkg.pr.new/@module-federation/runtime-core@f613100

@module-federation/runtime-tools

pnpm add https://pkg.pr.new/@module-federation/runtime-tools@f613100

@module-federation/sdk

pnpm add https://pkg.pr.new/@module-federation/sdk@f613100

@module-federation/storybook-addon

pnpm add https://pkg.pr.new/@module-federation/storybook-addon@f613100

@module-federation/third-party-dts-extractor

pnpm add https://pkg.pr.new/@module-federation/third-party-dts-extractor@f613100

@module-federation/treeshake-frontend

pnpm add https://pkg.pr.new/@module-federation/treeshake-frontend@f613100

@module-federation/treeshake-server

pnpm add https://pkg.pr.new/@module-federation/treeshake-server@f613100

@module-federation/typescript

pnpm add https://pkg.pr.new/@module-federation/typescript@f613100

@module-federation/utilities

pnpm add https://pkg.pr.new/@module-federation/utilities@f613100

@module-federation/webpack-bundler-runtime

pnpm add https://pkg.pr.new/@module-federation/webpack-bundler-runtime@f613100

@module-federation/bridge-react

pnpm add https://pkg.pr.new/@module-federation/bridge-react@f613100

@module-federation/bridge-react-webpack-plugin

pnpm add https://pkg.pr.new/@module-federation/bridge-react-webpack-plugin@f613100

@module-federation/bridge-shared

pnpm add https://pkg.pr.new/@module-federation/bridge-shared@f613100

@module-federation/bridge-vue3

pnpm add https://pkg.pr.new/@module-federation/bridge-vue3@f613100

@module-federation/inject-external-runtime-core-plugin

pnpm add https://pkg.pr.new/@module-federation/inject-external-runtime-core-plugin@f613100

commit: f613100

Add Node module-customization hooks (module.register) that import ESM remote entries and their chunks directly over HTTP(S) with a per-origin allowlist, wired into the MF runtime loadEntry hook so loadRemote works in a plain Node process. Registered via @module-federation/node/register or registerNativeHttpLoader(); the default vm-based path is unchanged.

Add the four research documents (Node platform hooks status, runtime-core entry-loading audit, ESM chunk-loading options, prior art) and update the native HTTP loader design doc accordingly: module.registerHooks() becomes the primary API in the roadmap (module.register() is DEP0205-deprecated, runtime-deprecated in Node 26) with out-of-band prefetch + disk cache, the no-hooks f.j/externalInstallChunk chunk fallback, upstream runtime-core PR candidates (ssrRemoteEntry preference, RUNTIME_008 normalization), and the manifest-SRI + lockfile integrity roadmap.

Add apps/node-esm-remote (webpack ESM output: chunkFormat 'module', chunkLoading 'import', module-type remote entry with a nested async chunk, plus a tiny static server) and apps/node-esm-host, a bundler-free-loading host that runs with `node --import @module-federation/node/register` and loads the remote entry and its chunks over http through Node's native ESM loader via the node runtime plugin's loadEntry bridge.

…urface Security fixes from consolidated code review of the native HTTP ESM loader: - gate registration itself on the MF_NODE_NATIVE_LOADER kill switch so module.register() is never called when disabled - share one in-flight ack per origin in allowOrigin() so concurrent callers cannot resolve before the hooks thread applied the allowlist update - reject HTTP redirects in the hooks-thread fetch so an allowlisted origin cannot redirect module source to an un-allowlisted target - bound the hooks fetch (30s abort) and allowlist acks (10s rejection) so a broken port fails loudly instead of hanging the process Cleanup: reuse RemoteEntryExports from @module-federation/runtime/types, drop the always-true state.enabled flag, fold state.ts into protocol.ts, type the hooks with @types/node module hook types, stop re-exporting test-only helpers, resolve the CJS register hooksUrl via defaultHooksUrl(), share the log prefix constant, warn when smoke tests skip on missing dist, and fix a stale comment in the node-esm-host example.

netlify · 2026-07-02T04:47:55Z

✅ Deploy Preview for module-federation-docs ready!

Name	Link
🔨 Latest commit	`f613100`
🔍 Latest deploy log	https://app.netlify.com/projects/module-federation-docs/deploys/6a4b16f918db6d00085a4e4a
😎 Deploy Preview	https://deploy-preview-4862--module-federation-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

github-actions · 2026-07-02T05:33:51Z

Bundle Size Report

11 package(s) changed, 31 unchanged.

Package dist + ESM entry

Package	Total dist (raw)	Delta	ESM gzip	Delta
`@module-federation/cli`	26.3 kB	no change	786 B	no change
`@module-federation/core`	39.1 kB	no change	173 B	no change
`@module-federation/devtools`	665.5 kB	no change	4.0 kB	no change
`@module-federation/enhanced`	810.0 kB	no change	672 B	no change
`@module-federation/managers`	70.0 kB	no change	334 B	no change
`@module-federation/manifest`	136.1 kB	no change	182 B	no change
`@module-federation/metro-plugin-rnc-cli`	0 B	no change	314 B	no change
`@module-federation/node`	239.4 kB	+46.0 kB (+23.8%)	217 B	no change
`@module-federation/playground`	28.85 MB	+5.1 kB (+0.0%)	51.9 kB	no change
`@module-federation/storybook-addon`	79.2 kB	no change	100 B	no change
`@module-federation/utilities`	110.6 kB	no change	328 B	no change

Bundle targets

Package	Web bundle (gzip)	Delta	Node bundle (gzip)	Delta
`@module-federation/cli`	2.3 kB	-34 B (-1.4%)	2.3 kB	-34 B (-1.4%)
`@module-federation/core`	1.1 kB	-34 B (-3.0%)	1.0 kB	-32 B (-3.0%)
`@module-federation/devtools`	30.3 kB	-28 B (-0.1%)	30.3 kB	-28 B (-0.1%)
`@module-federation/enhanced`	2.6 kB	-46 B (-1.7%)	2.6 kB	-46 B (-1.7%)
`@module-federation/managers`	2.4 kB	-29 B (-1.2%)	2.4 kB	-29 B (-1.2%)
`@module-federation/manifest`	6.1 kB	-41 B (-0.7%)	6.1 kB	-41 B (-0.7%)
`@module-federation/metro-plugin-rnc-cli`	411 B	-27 B (-6.2%)	411 B	-27 B (-6.2%)
`@module-federation/node`	9.2 kB	-28 B (-0.3%)	9.2 kB	-28 B (-0.3%)
`@module-federation/playground`	48.0 kB	no change	48.0 kB	no change
`@module-federation/storybook-addon`	1.9 kB	-26 B (-1.3%)	1.7 kB	-25 B (-1.4%)
`@module-federation/utilities`	2.6 kB	-33 B (-1.2%)	2.6 kB	-33 B (-1.2%)

Consumer scenarios

Scenario	Web output (gzip)	Delta	Node output (gzip)	Delta	Gap (node-web)	Delta
Enhanced remoteEntry	21.4 kB	-21 B (-0.1%)	23.1 kB	-21 B (-0.1%)	+1.7 kB	0 B

Total dist (raw): 35.75 MB (+51.2 kB (+0.1%))
Total ESM gzip: 131.2 kB (no change)
Total web bundle (gzip): 255.4 kB (-326 B (-0.1%))
Total node bundle (gzip): 257.6 kB (-323 B (-0.1%))
Tracked ./bundler entry gzip: 556 B (no change)
Tracked ./bundler web bundle (gzip): 4.8 kB (no change)
Tracked ./bundler node bundle (gzip): 4.8 kB (no change)

Bundle sizes are generated with rslib (Rspack). Package-root metrics preserve the historical report. Tracked subpath exports such as ./bundler are measured separately so ENV_TARGET-driven tree-shaking is visible. Bare imports are externalized to keep package-level sizes consistent, and assets are emitted as resources.

…-loader-main # Conflicts: # pnpm-lock.yaml

…-loader # Conflicts: # pnpm-lock.yaml

github-actions Bot added the change: feat label Jul 2, 2026

ScriptedAlchemy added 4 commits July 2, 2026 04:28

fix(node): keep allowlist ack port referenced during round-trip

cdf228b

ScriptedAlchemy force-pushed the feat/node-native-http-loader branch from 35f6a7d to ce100b3 Compare July 2, 2026 04:32

ScriptedAlchemy changed the base branch from rstest-plugin to main July 2, 2026 04:32

ScriptedAlchemy and others added 2 commits July 2, 2026 07:15

Merge remote-tracking branch 'origin/main' into feat/node-native-http…

b89367c

…-loader-main # Conflicts: # pnpm-lock.yaml

Merge remote-tracking branch 'origin/main' into feat/node-native-http…

f613100

…-loader # Conflicts: # pnpm-lock.yaml

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat(node): opt-in native ESM HTTP loader for bundler-free runtime#4862

feat(node): opt-in native ESM HTTP loader for bundler-free runtime#4862
ScriptedAlchemy wants to merge 7 commits into
mainfrom
feat/node-native-http-loader

ScriptedAlchemy commented Jul 2, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Jul 2, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Jul 2, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Jul 2, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 2, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

ScriptedAlchemy commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related Issue

Types of changes

Checklist

Uh oh!

changeset-bot Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

pkg-pr-new Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for module-federation-docs ready!

Uh oh!

github-actions Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bundle Size Report

Package dist + ESM entry

Bundle targets

Consumer scenarios

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ScriptedAlchemy commented Jul 2, 2026 •

edited

Loading

changeset-bot Bot commented Jul 2, 2026 •

edited

Loading

pkg-pr-new Bot commented Jul 2, 2026 •

edited

Loading

netlify Bot commented Jul 2, 2026 •

edited

Loading

github-actions Bot commented Jul 2, 2026 •

edited

Loading