Skip to content

fix(bridge): harden SSR V1 identity and lifecycle boundaries#4

Merged
cursor[bot] merged 1 commit into
cursor/bridge-app-ssr-e63bfrom
cursor/bridge-ssr-v1-fixes-3573
Jul 18, 2026
Merged

fix(bridge): harden SSR V1 identity and lifecycle boundaries#4
cursor[bot] merged 1 commit into
cursor/bridge-app-ssr-e63bfrom
cursor/bridge-ssr-v1-fixes-3573

Conversation

@tonoizer

@tonoizer tonoizer commented Jul 18, 2026

Copy link
Copy Markdown
Owner

Description

Hardens Bridge SSR V1 on top of #4869 without changing the architecture.

These commits were also fast-forwarded onto cursor/bridge-app-ssr-e63b, so #4869 already includes them.

Fixes

  1. Composite hydration identity — registry keys are moduleName + instanceId
  2. Empty SSR islands hydrate — markers/identity decide hydration, not child presence
  3. React mount-DOM cleanup — destroy previous provider root when the mount node changes
  4. Vue abort/failed destroy — soft-cancel aborted mounts; destroy even when isRendered is false
  5. Missing registry is an error for identity-only client references
  6. Abort checks after remote loader() / ssr.prepare()
  7. Safer state JSON — reject __proto__ / prototype / constructor; document trusted remote HTML
  8. consume() without this

Validation

  • pnpm exec turbo run build test --filter=@module-federation/bridge-shared --filter=@module-federation/bridge-react --filter=@module-federation/bridge-vue3 --force (passed)

Skipped full Bridge SSR / router E2E; package-focused regression coverage matched this change set.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)

Checklist

  • I have added tests to cover my changes.
  • All new and existing tests passed.
  • I have updated the documentation.
Open in Web Open in Cursor 

Key the hydration registry by moduleName+instanceId, hydrate empty islands
from markers, destroy React roots when mount DOM identity changes, require a
registry for client references, and soft-cancel aborted Vue mounts so failed
renders cannot leak remotes.
@cursor
cursor Bot merged commit bfa4fb5 into cursor/bridge-app-ssr-e63b Jul 18, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants