Skip to content

feat(ui): add StackBlitzPreview and migrate examples directory from webpack.js.org - #248

Open
moshams272 wants to merge 2 commits into
webpack:mainfrom
moshams272:feat/stackblitz-preview-and-examples-migration
Open

feat(ui): add StackBlitzPreview and migrate examples directory from webpack.js.org#248
moshams272 wants to merge 2 commits into
webpack:mainfrom
moshams272:feat/stackblitz-preview-and-examples-migration

Conversation

@moshams272

@moshams272 moshams272 commented Aug 17, 2026

Copy link
Copy Markdown
Member

Summary

This PR replaces TODOs that related to StackBlitzPreview after adding it as component with the same design from webpack.js.org with our colors and migrates the examples directory from webpack.js.org

image

Summary by CodeRabbit

  • New Features

    • Added interactive StackBlitz previews to the Getting Started and Module Federation guides.
    • Added runnable Getting Started and Module Federation examples.
    • Added Module Federation demonstrations showing communication between two independently served apps.
  • Documentation

    • Added setup, build, and launch instructions for the new examples.
    • Added external preview links and enhanced guide content for hands-on exploration.

@vercel

vercel Bot commented Aug 17, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
webpack-doc-kit Ready Ready Preview Aug 17, 2026 9:02pm

Request Review

@github-actions github-actions Bot added documentation Improvements or additions to documentation theme tooling labels Aug 17, 2026
@moshams272 moshams272 changed the title feat(ui): add StackBlitzPreview and migrate examples directory from webpack.js feat(ui): add StackBlitzPreview and migrate examples directory from webpack.js.org Aug 17, 2026
@socket-security

socket-security Bot commented Aug 17, 2026

Copy link
Copy Markdown

@socket-security

socket-security Bot commented Aug 17, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn Critical
Critical CVE: Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/npm parse-url

CVE: GHSA-j9fq-vwqv-2fm2 Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url (CRITICAL)

Affected versions: < 8.1.0

Patched version: 8.1.0

From: ?npm/lerna@4.0.0npm/parse-url@6.0.5

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/parse-url@6.0.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Critical
Critical CVE: node-npm tar: Decompression/parse DoS via unlimited input

CVE: GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input (CRITICAL)

Affected versions: < 7.5.19

Patched version: 7.5.19

From: ?npm/lerna@4.0.0npm/tar@6.2.1

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/tar@6.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm json-schema is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?npm/lerna@4.0.0npm/json-schema@0.4.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/json-schema@0.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@moshams272
moshams272 force-pushed the feat/stackblitz-preview-and-examples-migration branch from e160d41 to 76b5a11 Compare August 17, 2026 21:01
@coderabbitai

coderabbitai Bot commented Aug 17, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 29f7f9fd-69a9-4d37-9791-d22ce8aae25a

📥 Commits

Reviewing files that changed from the base of the PR and between e160d41 and 76b5a11.

⛔ Files ignored due to path filters (1)
  • examples/getting-started/dist/index.html is excluded by !**/dist/**
📒 Files selected for processing (2)
  • examples/module-federation/app1/public/index.html
  • examples/module-federation/app2/public/index.html
🚧 Files skipped from review as they are similar to previous changes (2)
  • examples/module-federation/app1/public/index.html
  • examples/module-federation/app2/public/index.html

Included review availability: Your plan includes up to 3 reviews per rolling hour; 1 remains after this review.


Walkthrough

Added a Webpack getting-started example with Lodash and build scripts. Added a two-application Module Federation example with React, Webpack, Lerna, and runtime remote loading. Added StackBlitzPreview, its styles, doc-kit registration, and active previews on both guide pages. ESLint now ignores the examples/ directory.

Merge Risk: 🟡 Moderate · up to 76b5a

The migrated getting-started example may not render through its documented serve flow because the required HTML entry remains unresolved; merge should wait for this issue to be fixed or explicitly accepted.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the two main changes: adding StackBlitzPreview and migrating the examples directory.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🧹 Nitpick comments (2)
examples/module-federation/app1/src/App.js (1)

17-19: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Handle rejected remote loads with an Error Boundary.

The current fallback covers only the pending load. If remoteEntry.js or the exposed module fails, React.lazy sends the rejection to the nearest Error Boundary instead of this Suspense fallback. (react.dev)

If the application root does not already provide an Error Boundary, add one around RemoteApp so the preview shows a recoverable error.

eslint.config.mjs (1)

32-32: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Keep runnable examples covered by validation.

The examples/ directory now bypasses the repository's ESLint checks. If the ignore is required for imported example style, add a separate CI smoke check that installs and builds each preview example. Otherwise, narrow the ignore pattern. This prevents the documentation from advertising an example that cannot compile.


ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4d49e55d-1f1b-41da-bd83-221202eb10ab

📥 Commits

Reviewing files that changed from the base of the PR and between df0d506 and e160d41.

⛔ Files ignored due to path filters (2)
  • examples/getting-started/dist/index.html is excluded by !**/dist/**
  • public/assets/open-in-stackblitz-button.svg is excluded by !**/*.svg
📒 Files selected for processing (25)
  • components/StackBlitzPreview/index.jsx
  • components/StackBlitzPreview/index.module.css
  • eslint.config.mjs
  • examples/getting-started/README.md
  • examples/getting-started/package.json
  • examples/getting-started/src/index.js
  • examples/getting-started/webpack.config.js
  • examples/module-federation/README.md
  • examples/module-federation/app1/package.json
  • examples/module-federation/app1/public/index.html
  • examples/module-federation/app1/src/App.js
  • examples/module-federation/app1/src/bootstrap.js
  • examples/module-federation/app1/src/index.js
  • examples/module-federation/app1/webpack.config.js
  • examples/module-federation/app2/package.json
  • examples/module-federation/app2/public/index.html
  • examples/module-federation/app2/src/App.js
  • examples/module-federation/app2/src/bootstrap.js
  • examples/module-federation/app2/src/index.js
  • examples/module-federation/app2/webpack.config.js
  • examples/module-federation/lerna.json
  • examples/module-federation/package.json
  • pages/guides/getting-started/concepts/module-federation.md
  • pages/guides/getting-started/index.md
  • scripts/html/doc-kit.config.mjs

Included review availability: Your plan includes up to 3 reviews per rolling hour; 2 remain after this review.

Comment on lines +3 to +8
module.exports = {
entry: './src/index.js',
output: {
filename: 'main.js',
path: path.resolve(__dirname, 'dist'),
},

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

Emit an HTML entry for the example.

This configuration emits only main.js. The start script serves dist, but the example contains no HTML document that loads main.js. Following the documented build-and-start flow therefore cannot render the application.

Add an index.html entry and include it in the build, or configure HtmlWebpackPlugin with an HTML template.

Comment on lines +2 to +5
window.app2Url = 'http://localhost:3002';

// Use dynamic import here to allow webpack to interface with module federation code
import('./bootstrap');

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/sh
set -eu

rg -n -C 4 'app2Url|3002|remoteEntry\.js' examples/module-federation

Repository: webpack/webpack-doc-kit

Length of output: 3504


🏁 Script executed:

#!/bin/sh
set -eu

printf '%s\n' '--- module-federation files ---'
git ls-files examples/module-federation

printf '%s\n' '--- relevant source and configuration ---'
sed -n '1,80p' examples/module-federation/app1/src/index.js
sed -n '1,100p' examples/module-federation/app1/webpack.config.js
sed -n '1,80p' examples/module-federation/app2/webpack.config.js
sed -n '1,80p' examples/module-federation/README.md

printf '%s\n' '--- hosting and preview configuration references ---'
rg -n -i 'stackblitz|webcontainer|codesandbox|preview|3001|3002|app2Url' \
  --glob '!node_modules' --glob '!dist' --glob '!build' .

Repository: webpack/webpack-doc-kit

Length of output: 6558


🌐 Web query:

StackBlitz WebContainers browser preview exposed service URL localhost port forwarding runtime domain

💡 Result:

In StackBlitz WebContainers, port forwarding is handled automatically by the runtime [1][2]. When a development server starts inside a WebContainer, it does not bind to the host machine's localhost; instead, the WebContainer runtime detects the port activity and exposes the service through a unique, browser-accessible preview URL [1][2]. Key mechanisms of this system include: 1. Automatic Port Forwarding: When a process inside the container opens a network port (e.g., an Express server on port 3000), the WebContainer runtime captures this event [3][2]. 2. URL Generation: The runtime generates a secure, unique URL in a format similar to https://{unique-id}.webcontainer-api.io [1][2]. These URLs are designed to be used within the browser, typically by injecting them into an iframe for previewing [1][2]. 3. WebContainer API Events: Developers can monitor these services using the WebContainer API's 'server-ready' event, which provides the port number and the corresponding preview URL [3][4]. 4. HostURL Resolution: For applications that need to reference internal services, the @webcontainer/env package provides a HostURL utility [5]. This utility resolves localhost references within the container to the appropriate WebContainer-specific hostname (e.g., http://blitz--1234.local.webcontainer.io), allowing code to function seamlessly regardless of whether it is running inside the container or on a standard local environment [5]. Because these URLs are proxied through StackBlitz infrastructure to ensure browser compatibility and security (including CORS support), they cannot typically be accessed from outside the browser environment where the container is running [2][6]. Accessing services from the parent window or between different iframes is typically handled via standard web messaging, such as window.postMessage [7].

Citations:


🏁 Script executed:

#!/bin/sh
set -eu

python3 - <<'PY'
from pathlib import Path
import re

app1 = Path("examples/module-federation/app1/src/index.js").read_text()
app1_config = Path("examples/module-federation/app1/webpack.config.js").read_text()
app2_config = Path("examples/module-federation/app2/webpack.config.js").read_text()

url = re.search(r"window\.app2Url\s*=\s*['\"]([^'\"]+)", app1).group(1)
remote = re.search(r"app2:\s*['\"]app2@\[app2Url\]([^'\"]+)", app1_config).group(1)
app2_port = re.search(r"\bport:\s*(\d+)", app2_config).group(1)
filename = re.search(r"filename:\s*['\"]([^'\"]+)", app2_config).group(1)

constructed = url.rstrip("/") + remote
print(f"app2Url={url}")
print(f"remotePath={remote}")
print(f"app2Port={app2_port}")
print(f"remoteFilename={filename}")
print(f"constructedRemote={constructed}")
print(f"matchesConfiguredPort={url.endswith(':' + app2_port)}")
print(f"matchesRemoteFilename=({remote.rsplit('/', 1)[-1]} == {filename})")
PY

Repository: webpack/webpack-doc-kit

Length of output: 401


🌐 Web query:

site:developer.stackblitz.com WebContainers server-ready event url localhost ports browser preview

💡 Result:

In WebContainers, there is no direct "server-ready" event that provides a static URL for localhost ports, because the preview URL is determined dynamically by the runtime environment [1]. Key points regarding WebContainers, server ports, and browser previews: 1. Dynamic Preview URL: In a WebContainers environment, you cannot predict the preview URL ahead of time [1]. If you are using the StackBlitz JavaScript SDK to control a virtual machine, the property vm.preview.origin will return null until a web server is actually running [1]. You should use the method vm.preview.getUrl to retrieve the active preview URL once the server has started [1]. 2. Browser Preview Behavior: When a project starts a web server (e.g., via npm start), WebContainers automatically exposes the server to a browser preview [2][3]. If the preview fails to connect or appears unresponsive, the recommended troubleshooting step is to check the terminal for an active dev server process [2]. If you accidentally close the preview panel, you can reopen it by clicking the Ports in Use icon (represented by a plug) in the editor's left-hand navigation bar [2][3]. 3. Localhost Handling: WebContainers do not map servers to standard localhost ports on your machine [1][4]. Instead, they use dynamic subdomains (e.g., xyz.local.webcontainer.io) [2][4]. Because these environments rely on specific browser features like SharedArrayBuffer and cross-origin isolation, you may encounter connectivity issues in certain browsers if proper cookie or popup permissions are not configured [4][5]. If a preview fails to connect in a split-screen view, opening it in a separate browser window is often a recommended workaround [5]. 4. Configuration: You can control how scripts run on load using the startScript URL parameter (e.g.,?startScript=dev) [6][7], which helps ensure your server starts automatically when the project environment is initialized [6].

Citations:


Use the exposed app2 URL in StackBlitz. window.app2Url always constructs http://localhost:3002/remoteEntry.js, but WebContainers expose ports through dynamic preview URLs. Keep the localhost URL as the local-development fallback.

Source: MCP tools

@ovflowd

ovflowd commented Aug 18, 2026

Copy link
Copy Markdown
Member

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security Vulnerability Quality Maintenance License
Added lerna@​4.0.0 99 100 70 87 100
Added @​babel/​preset-react@​7.29.7 100 100 71 92 100
Added external-remotes-plugin@​1.0.0 100 100 80 75 100
Added @​babel/​core@​7.29.7 97 100 79 90 100
Added lodash@​4.18.1 100 100 87 82 100
Added babel-loader@​8.4.1 99 100 100 85 100
Added webpack-dev-server@​4.15.2 97 85 100 92 100
Added serve@​12.0.1 99 100 96 87 100
Added html-webpack-plugin@​5.6.8 99 100 100 92 100
Added webpack-cli@​4.10.0 98 100 100 93 100
View full report

Trying to understand why Socket believes we use lerna as a dependency?

@avivkeller

Copy link
Copy Markdown
Member

@ovflowd socket probably thinks that all the dependencies from the examples are added, but they aren't

@ovflowd

ovflowd commented Aug 18, 2026

Copy link
Copy Markdown
Member

@ovflowd socket probably thinks that all the dependencies from the examples are added, but they aren't

That adds quite the noise :/

@moshams272

Copy link
Copy Markdown
Member Author

@ovflowd socket probably thinks that all the dependencies from the examples are added, but they aren't

Yeah, I just investgated it and found that in examples/module-federation/package.json it uses lerna as a dependency.

@moshams272

Copy link
Copy Markdown
Member Author

That adds quite the noise :/

Before pushing this PR, I actually thought about why we should add examples dir in our repo. The webpack/webpack repo has examples dir in the root, but I added it here in the same way the webpack/webpack.js.org does and said to myself, "Let's push this PR and see what maintainers like to do."

So, WDUT?!

@avivkeller

Copy link
Copy Markdown
Member

I'm not sure if we need examples in this repo, or at all, nothing reads then, right?

@moshams272

Copy link
Copy Markdown
Member Author

I'm not sure if we need examples in this repo, or at all, nothing reads then, right?

Just the StackBlitzPreview use them to clone the examples dir, we can remove them from here and just change the link:

 const url = `https://stackblitz.com/github/webpack/webpack-doc-kit/tree/main/examples/${example}`;

to webpack/webpack and check if they have in their examples dir what we need so it's ok if they've not I will open PR copying them.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation theme tooling

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants