Bug Report: Nitro SSR bundle leaks __require("react") for nested CJS deps

This repo is a reference for a Nitro bug report. The bug could not be reproduced in a minimal standalone project because it is sensitive to the full dependency tree — it was observed in a production TanStack Start application with a large number of dependencies.

Environment

Nitro	3.0.260610-beta
Vite	8.0.16
Preset	node-server
Framework	TanStack Start (React 19)
Node	22 (Alpine Docker)

Bug

When building a TanStack Start app with the node-server preset, some SSR chunks contain leaked __require("react") calls. These use createRequire(import.meta.url) at runtime which requires react to exist in node_modules — breaking Docker/serverless deployments where only .output/ is copied.

Trigger

The bug is triggered by packages that vendor use-sync-external-store as a nested CJS dependency (e.g. reactflow, recharts, @dnd-kit). The use-sync-external-store CJS shim calls require("react") inside a __commonJSMin wrapper. When the SSR bundle splits react into a separate _libs/ chunk, Rolldown fails to rewrite this nested require("react") to use the bundled copy — instead emitting it as a runtime __require("react").

Evidence from build output

_runtime.mjs sets up runtime require:

import { createRequire } from "node:module";
var __require = /* @__PURE__ */ createRequire(import.meta.url);

In _ssr/popupStateMapping-*.mjs, React is already imported from the bundled source at the top of the file:

// Line 2 — React IS available as a bundled module:
import { _ as require_react } from "../_libs/@anaralabs/lector+[...].mjs";

// Line 4 — __require is also imported for runtime resolution:
import { a as __require, t as __commonJSMin } from "./chunk-DlpNvrWU.mjs";

But deeper in the same file, the use-sync-external-store CJS shim (vendored inside @base-ui-components) uses the runtime require instead:

// Line 1358 — BUG: should be require_react(), not __require("react")
var require_use_sync_external_store_shim = __commonJSMin(((exports) => {
  var React = __require("react");
  // ...
}));

The bundled React is already imported in the same file, but the nested CJS wrapper doesn't use it.

Failure modes

1. Docker deployment with self-contained .output/:

Error: Cannot find module 'react'
Require stack:
- /app/server/_ssr/chunk-DlpNvrWU.mjs
    at Module._resolveFilename (node:internal/modules/cjs/loader:1207:15)

2. If react is provided at runtime (e.g. copied into node_modules):

A duplicate React instance is created — react-dom uses the bundled copy (with initialized dispatcher) while the CJS shim uses the separately required copy (null dispatcher):

TypeError: Cannot read properties of null (reading 'useSyncExternalStore')
    at exports.useSyncExternalStore (/app/server/_ssr/node_modules/react/cjs/react.production.js:533:33)
    at useStoreR19 (file:///app/server/_ssr/popupStateMapping-*.mjs:1486:46)

Why standalone Nitro doesn't reproduce it

With plain Nitro (no Vite SSR environment), React gets bundled inline within the same chunk as the CJS shims, so require("react") resolves correctly. The bug only manifests when Vite's SSR environment splits React into a separate _libs/react.mjs chunk, creating the cross-chunk resolution failure.

Workaround

Post-build script that rewrites __require("react") to the already-imported require_react():

// scripts/patch-react-require.mjs
import { readdir, readFile, writeFile } from 'node:fs/promises'
import { join } from 'node:path'

const ssrDir = join(import.meta.dirname, '..', '.output', 'server', '_ssr')
const files = await readdir(ssrDir)

for (const file of files) {
  if (!file.endsWith('.mjs')) continue
  const filePath = join(ssrDir, file)
  const content = await readFile(filePath, 'utf-8')
  if (!content.includes('__require("react")')) continue
  if (!content.includes('require_react')) continue

  const updated = content
    .replace(/__require\("react"\)/g, 'require_react()')
    .replace(/__require\("react-dom"\)/g, 'require_react_dom()')

  await writeFile(filePath, updated, 'utf-8')
}

Add to package.json:

{ "build": "vite build && node scripts/patch-react-require.mjs" }

Expected behavior

Rolldown should resolve require("react") inside __commonJSMin wrappers to the already-bundled React module (same as it does for top-level imports), ensuring .output/ is fully self-contained with no runtime dependency on node_modules.