Uh oh!
There was an error while loading. Please reload this page.
[rust-compiler] Switch to hmac-sha256 and bump napi/similar - #36809
Merged
Conversation
Hi @Boshen! Thank you for your pull request and welcome to our community. Action RequiredIn order to merge any pull request (code, docs, etc.), we require contributors to sign our Contributor License Agreement, and we don't seem to have one on file for you. ProcessIn order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA. Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with If you have received this in error or have any questions, please contact us at cla@meta.com. Thanks! |
Thank you for signing our Contributor License Agreement. We can now accept your code for this (and any) Meta Open Source project. Thanks! |
Boshen added a commit
to oxc-project/forked-react-compiler
that referenced
this pull request
Jun 17, 2026
Apply react/react PR #36809 ("[rust-compiler] Bump dependencies and fix
cargo check") to the vendored tree via
patches/0001-backport-react-pr-36809-dep-bumps.patch:
- similar 2->3, sha2 0.10->0.11, hmac 0.12->0.13, napi/napi-derive 2->3
- drop the unused react_compiler_ssa -> react_compiler_lowering dep
- hmac 0.13 API fix in codegen_reactive_function.rs (KeyInit import +
manual hex formatting of the finalized MAC)
Skips the PR's cosmetic MEMO_CACHE_SENTINEL rustfmt hunk (its base carries
a `.into()` the currently-pinned upstream lacks; our line is already <100
cols). `cargo check --workspace` passes.
Temporary backport of an unmerged PR: remove the patch once #36809 merges
into react/react main (the next `just sync` will then make `git apply` fail
loudly, signalling removal).Switch the Fast Refresh source hash from RustCrypto's sha2 + hmac
(11 crates) to the single zero-dependency hmac-sha256 crate -- a net
reduction of 10 crates. HMAC-SHA256 is deterministic, so the emitted
hash is unchanged; a new unit test pins source_file_hash against Node's
createHmac('sha256', code).digest('hex').
Also bump napi/napi-derive 2 -> 3 and similar 2 -> 3 (dev-dependency),
and drop the unused react_compiler_lowering dependency from
react_compiler_ssa.Boshenforce-pushed
the
fix-rust-cargo-check
branch
from
June 17, 2026 12:58
4c2f42d to
5f91e06Comparepoteto
approved these changes
Jun 17, 2026
Uh oh!
There was an error while loading. Please reload this page.
github-actionsBot
pushed a commit
to thought7878/react
that referenced
this pull request
Jun 18, 2026
) ## Summary Dependency maintenance for the Rust compiler crates. ### Fast Refresh hash: sha2 + hmac → hmac-sha256 The Fast Refresh source hash (`enableResetCacheOnSourceFileChanges`) only needs an HMAC-SHA256 of the source text, matching the TS compiler's `createHmac('sha256', code).digest('hex')`. RustCrypto's `sha2` + `hmac` pulled in **11 crates** (`sha2`, `hmac`, `digest`, `block-buffer`, `typenum`, `crypto-common`, `hybrid-array`, `const-oid`, `cpufeatures`, `cmov`, `ctutils`) — generic-hashing / constant-time machinery that is irrelevant for a non-security content fingerprint. This replaces them with the single **zero-dependency** `hmac-sha256` crate: a net reduction of **10 crates**. HMAC-SHA256 is a standardized deterministic algorithm, so the emitted hash is unchanged. A new unit test `source_file_hash_matches_node_create_hmac` pins the result against Node's `createHmac('sha256', code).digest('hex')` for several inputs. ### Other bumps - `napi` / `napi-derive` 2 → 3 - `similar` 2 → 3 (dev-dependency) - Drop the unused `react_compiler_lowering` dependency from `react_compiler_ssa` `cargo check --workspace --all-targets` passes, including the napi 3 native crate. DiffTrain build for [560db51](react@560db51)
github-actionsBot
pushed a commit
to thought7878/react
that referenced
this pull request
Jun 18, 2026
) ## Summary Dependency maintenance for the Rust compiler crates. ### Fast Refresh hash: sha2 + hmac → hmac-sha256 The Fast Refresh source hash (`enableResetCacheOnSourceFileChanges`) only needs an HMAC-SHA256 of the source text, matching the TS compiler's `createHmac('sha256', code).digest('hex')`. RustCrypto's `sha2` + `hmac` pulled in **11 crates** (`sha2`, `hmac`, `digest`, `block-buffer`, `typenum`, `crypto-common`, `hybrid-array`, `const-oid`, `cpufeatures`, `cmov`, `ctutils`) — generic-hashing / constant-time machinery that is irrelevant for a non-security content fingerprint. This replaces them with the single **zero-dependency** `hmac-sha256` crate: a net reduction of **10 crates**. HMAC-SHA256 is a standardized deterministic algorithm, so the emitted hash is unchanged. A new unit test `source_file_hash_matches_node_create_hmac` pins the result against Node's `createHmac('sha256', code).digest('hex')` for several inputs. ### Other bumps - `napi` / `napi-derive` 2 → 3 - `similar` 2 → 3 (dev-dependency) - Drop the unused `react_compiler_lowering` dependency from `react_compiler_ssa` `cargo check --workspace --all-targets` passes, including the napi 3 native crate. DiffTrain build for [560db51](react@560db51)
github-actionsBot
pushed a commit
to srpatcha/react
that referenced
this pull request
Jun 18, 2026
) ## Summary Dependency maintenance for the Rust compiler crates. ### Fast Refresh hash: sha2 + hmac → hmac-sha256 The Fast Refresh source hash (`enableResetCacheOnSourceFileChanges`) only needs an HMAC-SHA256 of the source text, matching the TS compiler's `createHmac('sha256', code).digest('hex')`. RustCrypto's `sha2` + `hmac` pulled in **11 crates** (`sha2`, `hmac`, `digest`, `block-buffer`, `typenum`, `crypto-common`, `hybrid-array`, `const-oid`, `cpufeatures`, `cmov`, `ctutils`) — generic-hashing / constant-time machinery that is irrelevant for a non-security content fingerprint. This replaces them with the single **zero-dependency** `hmac-sha256` crate: a net reduction of **10 crates**. HMAC-SHA256 is a standardized deterministic algorithm, so the emitted hash is unchanged. A new unit test `source_file_hash_matches_node_create_hmac` pins the result against Node's `createHmac('sha256', code).digest('hex')` for several inputs. ### Other bumps - `napi` / `napi-derive` 2 → 3 - `similar` 2 → 3 (dev-dependency) - Drop the unused `react_compiler_lowering` dependency from `react_compiler_ssa` `cargo check --workspace --all-targets` passes, including the napi 3 native crate. DiffTrain build for [560db51](react@560db51)
github-actionsBot
pushed a commit
to srpatcha/react
that referenced
this pull request
Jun 18, 2026
) ## Summary Dependency maintenance for the Rust compiler crates. ### Fast Refresh hash: sha2 + hmac → hmac-sha256 The Fast Refresh source hash (`enableResetCacheOnSourceFileChanges`) only needs an HMAC-SHA256 of the source text, matching the TS compiler's `createHmac('sha256', code).digest('hex')`. RustCrypto's `sha2` + `hmac` pulled in **11 crates** (`sha2`, `hmac`, `digest`, `block-buffer`, `typenum`, `crypto-common`, `hybrid-array`, `const-oid`, `cpufeatures`, `cmov`, `ctutils`) — generic-hashing / constant-time machinery that is irrelevant for a non-security content fingerprint. This replaces them with the single **zero-dependency** `hmac-sha256` crate: a net reduction of **10 crates**. HMAC-SHA256 is a standardized deterministic algorithm, so the emitted hash is unchanged. A new unit test `source_file_hash_matches_node_create_hmac` pins the result against Node's `createHmac('sha256', code).digest('hex')` for several inputs. ### Other bumps - `napi` / `napi-derive` 2 → 3 - `similar` 2 → 3 (dev-dependency) - Drop the unused `react_compiler_lowering` dependency from `react_compiler_ssa` `cargo check --workspace --all-targets` passes, including the napi 3 native crate. DiffTrain build for [560db51](react@560db51)
github-actionsBot
pushed a commit
to code/lib-react
that referenced
this pull request
Jun 21, 2026
) ## Summary Dependency maintenance for the Rust compiler crates. ### Fast Refresh hash: sha2 + hmac → hmac-sha256 The Fast Refresh source hash (`enableResetCacheOnSourceFileChanges`) only needs an HMAC-SHA256 of the source text, matching the TS compiler's `createHmac('sha256', code).digest('hex')`. RustCrypto's `sha2` + `hmac` pulled in **11 crates** (`sha2`, `hmac`, `digest`, `block-buffer`, `typenum`, `crypto-common`, `hybrid-array`, `const-oid`, `cpufeatures`, `cmov`, `ctutils`) — generic-hashing / constant-time machinery that is irrelevant for a non-security content fingerprint. This replaces them with the single **zero-dependency** `hmac-sha256` crate: a net reduction of **10 crates**. HMAC-SHA256 is a standardized deterministic algorithm, so the emitted hash is unchanged. A new unit test `source_file_hash_matches_node_create_hmac` pins the result against Node's `createHmac('sha256', code).digest('hex')` for several inputs. ### Other bumps - `napi` / `napi-derive` 2 → 3 - `similar` 2 → 3 (dev-dependency) - Drop the unused `react_compiler_lowering` dependency from `react_compiler_ssa` `cargo check --workspace --all-targets` passes, including the napi 3 native crate. DiffTrain build for [560db51](react@560db51)
github-actionsBot
pushed a commit
to code/lib-react
that referenced
this pull request
Jun 21, 2026
) ## Summary Dependency maintenance for the Rust compiler crates. ### Fast Refresh hash: sha2 + hmac → hmac-sha256 The Fast Refresh source hash (`enableResetCacheOnSourceFileChanges`) only needs an HMAC-SHA256 of the source text, matching the TS compiler's `createHmac('sha256', code).digest('hex')`. RustCrypto's `sha2` + `hmac` pulled in **11 crates** (`sha2`, `hmac`, `digest`, `block-buffer`, `typenum`, `crypto-common`, `hybrid-array`, `const-oid`, `cpufeatures`, `cmov`, `ctutils`) — generic-hashing / constant-time machinery that is irrelevant for a non-security content fingerprint. This replaces them with the single **zero-dependency** `hmac-sha256` crate: a net reduction of **10 crates**. HMAC-SHA256 is a standardized deterministic algorithm, so the emitted hash is unchanged. A new unit test `source_file_hash_matches_node_create_hmac` pins the result against Node's `createHmac('sha256', code).digest('hex')` for several inputs. ### Other bumps - `napi` / `napi-derive` 2 → 3 - `similar` 2 → 3 (dev-dependency) - Drop the unused `react_compiler_lowering` dependency from `react_compiler_ssa` `cargo check --workspace --all-targets` passes, including the napi 3 native crate. DiffTrain build for [560db51](react@560db51)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Dependency maintenance for the Rust compiler crates.
Fast Refresh hash: sha2 + hmac → hmac-sha256
The Fast Refresh source hash (
enableResetCacheOnSourceFileChanges) only needs an HMAC-SHA256 of the source text, matching the TS compiler'screateHmac('sha256', code).digest('hex'). RustCrypto'ssha2+hmacpulled in 11 crates (sha2,hmac,digest,block-buffer,typenum,crypto-common,hybrid-array,const-oid,cpufeatures,cmov,ctutils) — generic-hashing / constant-time machinery that is irrelevant for a non-security content fingerprint. This replaces them with the single zero-dependencyhmac-sha256crate: a net reduction of 10 crates.HMAC-SHA256 is a standardized deterministic algorithm, so the emitted hash is unchanged. A new unit test
source_file_hash_matches_node_create_hmacpins the result against Node'screateHmac('sha256', code).digest('hex')for several inputs.Other bumps
napi/napi-derive2 → 3similar2 → 3 (dev-dependency)react_compiler_loweringdependency fromreact_compiler_ssacargo check --workspace --all-targetspasses, including the napi 3 native crate.