fix(server-utils): Bundle the CommonJS dependencies of instrumented packages on Vite 8

[s1gr1d]

We put pg into ssr.noExternal and that bundles pg and changes its CJS imports. In the second bundling step, Rolldown in Vite 8 emits __require("pg-types") for the dependency imports of pg (see their migration guide mentioning esmExternalRequirePlugin - also check the linked rolldown docs). As __require comes from module.createRequire, the bundlers think it's a normal function variable, and not an import. Therefore, a sub-dependency like pg-types cannot get into the final bundle.

The plugin now bundles exactly these require() calls. The user's ssr.external entries and optional dependencies stay external. We didn't use esmExternalRequirePlugin, because it breaks function-exported CommonJS on Node < 23.

Stacked on #25359.

Fixes #25470

---

Same problem: __require() of an external package stays in bundled CommonJS

• Cannot find module 'react' in Docker runner: use-sync-external-store/shim leaves __require('react') unresolved in SSR chunk nitrojs/nitro#4171
• Inlined CJS keeps a runtime require("react") when the package is not hoisted to the root node_modules rolldown/rolldown#10643
• [Bug]: Bundled CJS module's require("react") left as runtime __require even though react is already inlined elsewhere in the same build rolldown/rolldown#9407

Workarounds and fixes in other tools

• fix(build): add experimental flag to rewrite leaked runtime require of bundled deps (#4171) nitrojs/nitro#4365
• ssr.target: 'webworker' invokes esmExternalRequirePlugin() with an empty external, so bundled CJS require("<node builtin>") is left as a throwing __require stub vitejs/vite#22618
• fix(ssr): convert external require against built-in modules to import for ssr.target=webworker vitejs/vite#23759
• ssr.target: 'webworker' still defaults Rolldown SSR builds to platform: 'node', emitting createRequire(import.meta.url) that crashes on Workers vitejs/vite#21969

Existing Sentry issues

• @sentry/nuxt 11: CommonJS packages inlined for build-time instrumentation break in the Nitro bundle #24775
• @sentry/react-router 11: build-time instrumentation inlines CommonJS that default-imports @sentry/core; server crashes at startup #25339

[linear-code]

JS-3951

[s1gr1d]

bugbot run

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ae4166d. Configure here.}

[cursor]

Resolver cannot override Vite externalization

High Severity

The new resolveId handler is a default-order function, so Vite's core resolver can mark CommonJS sub-dependencies external before this plugin runs. After a successful resolution, later resolveId hooks are skipped, so those require() calls still become __require() and the deployed server fails with Cannot find module. The force-bundle path also bails when this.resolve returns null, so it cannot recover if the core resolver does not treat the specifier as external.

Additional Locations (1)

• packages/server-utils/src/orchestrion/bundler/externalRequire.ts#L50-L65

 

^{Reviewed by Cursor Bugbot for commit ae4166d. Configure here.}

[s1gr1d]

The plugin runs with enforce: 'pre', so it's a false positive