Uh oh!
There was an error while loading. Please reload this page.
[web] Disable Vite minification in @workflow/web to fix Socket "obfuscated code" alert - #1768
Merged
Conversation
Contributor
🦋 Changeset detectedLatest commit: fc3bdb6 The changes in this PR will be included in the next version bump. This PR includes changesets to release 17 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
karthikscale3
marked this pull request as ready for review
April 16, 2026 05:25
Contributor
📊 Benchmark Results
workflow with no steps💻 Local Development
▲ Production (Vercel)
workflow with 1 step💻 Local Development
▲ Production (Vercel)
workflow with 10 sequential steps💻 Local Development
▲ Production (Vercel)
workflow with 25 sequential steps💻 Local Development
▲ Production (Vercel)
workflow with 50 sequential steps💻 Local Development
▲ Production (Vercel)
Promise.all with 10 concurrent steps💻 Local Development
▲ Production (Vercel)
Promise.all with 25 concurrent steps💻 Local Development
▲ Production (Vercel)
Promise.all with 50 concurrent steps💻 Local Development
▲ Production (Vercel)
Promise.race with 10 concurrent steps💻 Local Development
▲ Production (Vercel)
Promise.race with 25 concurrent steps💻 Local Development
▲ Production (Vercel)
Promise.race with 50 concurrent steps💻 Local Development
▲ Production (Vercel)
workflow with 10 sequential data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
workflow with 25 sequential data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
workflow with 50 sequential data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
workflow with 10 concurrent data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
workflow with 25 concurrent data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
workflow with 50 concurrent data payload steps (10KB)💻 Local Development
▲ Production (Vercel)
Stream Benchmarks(includes TTFB metrics)workflow with stream💻 Local Development
▲ Production (Vercel)
stream pipeline with 5 transform steps (1MB)💻 Local Development
▲ Production (Vercel)
10 parallel streams (1MB each)💻 Local Development
▲ Production (Vercel)
fan-out fan-in 10 streams (1MB each)💻 Local Development
▲ Production (Vercel)
SummaryFastest Framework by WorldWinner determined by most benchmark wins
Fastest World by FrameworkWinner determined by most benchmark wins
Column Definitions
Worlds:
❌ Some benchmark jobs failed:
Check the workflow run for details. |
Contributor
🧪 E2E Test Results❌ Some tests failed Summary
❌ Failed Tests🌍 Community Worlds (98 failed)mongodb (15 failed):
redis (15 failed):
turso (68 failed):
Details by Category✅ ▲ Vercel Production
✅ 💻 Local Development
✅ 📦 Local Production
✅ 🐘 Local Postgres
✅ 🪟 Windows
❌ 🌍 Community Worlds
✅ 📋 Other
|
TooTallNate
approved these changes
Apr 16, 2026
TooTallNate
left a comment
Member
There was a problem hiding this comment.
Straightforward fix. minify: false in the Vite build config is the correct approach — it only affects the client bundle (SSR is already unminified by default). The trade-off (tarball ~1.6 to 2.1 MB, ~35% larger gzip) is negligible for a self-hosted observability tool, and it eliminates false-positive supply chain alerts for downstream consumers.
Comment in the config clearly explains the reasoning. Changeset correctly scoped to @workflow/web patch.
One housekeeping note: the branch has 82 merge commits from repeatedly merging main. Consider squash-merging to keep the history clean.
Uh oh!
There was an error while loading. Please reload this page.
ghost
pushed a commit
that referenced
this pull request
Apr 16, 2026
ghost
commented
Apr 16, 2026
Cherry-pick to |
VaguelySerious pushed a commit
that referenced
this pull request
Apr 16, 2026
![workflow-devkit-release-bot[bot]](https://github.laxmiang.work.gd/r/github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
minify: false) in@workflow/web's production build so the published npm package contains readable JavaScript instead of single-line minified mega-bundlesContext
Socket Security flags
@workflow/webas 91% likely obfuscated, triggering high-severity warnings on downstream PRs (e.g. purduehackers/wack-hacker#62). This is a false positive — the package ships standard Vite production bundles, but Socket's heuristics flag them because:Impact
After this change, client bundle max line lengths drop from 100K–200K chars to 1K–3K chars, and all variable names remain human-readable:
The npm tarball grows from ~1.6 MB to ~2.1 MB. Gzip sizes (what browsers actually download) increase ~35%, which is negligible for a self-hosted observability tool. The SSR server bundle was already unminified by default and is unchanged.
The remaining long lines (72K in the server build, 15K in mermaid) are embedded WASM base64 data and Unicode lookup tables from bundled dependencies — not something minification controls.