perf: don't bundle node:crypto in the browser bundle
#782
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…rypto` in the browser bundle
github-actions
bot
added
t-tooling
Copilot finished reviewing on behalf of
barjin
November 12, 2025 13:09
There was a problem hiding this comment.
Pull Request Overview
This PR optimizes the browser bundle by replacing Node.js crypto implementations with native WebCrypto API equivalents from @apify/utilities, reducing bundle size by ~2.4x. The key changes involve switching from synchronous crypto signature functions to asynchronous WebCrypto-based implementations and marking the Node.js crypto module as external in the browser bundler configuration.
- Updated signature generation functions to use async WebCrypto API implementations
- Added browser-based tests to verify cryptographic operations work correctly in secure contexts
- Upgraded
@apify/utilitiesfrom 2.18.0 to 2.23.0 to access the new async crypto functions
Reviewed Changes
Copilot reviewed 7 out of 8 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| src/resource_clients/key_value_store.ts | Switched to async signature functions (createHmacSignatureAsync, createStorageContentSignatureAsync) with proper await usage |
| src/resource_clients/dataset.ts | Updated to use createStorageContentSignatureAsync with await |
| test/key_value_stores.test.js | Added browser tests for getRecordPublicUrl() and createKeysPublicUrl() to verify WebCrypto implementation works in browsers |
| test/datasets.test.js | Added browser tests for createItemsPublicUrl() to verify WebCrypto implementation works in browsers |
| test/_helper.js | Enhanced getInjectedPage() to navigate to URLs ensuring secure context required for Web Crypto API |
| rsbuild.config.ts | Marked crypto as external to prevent bundling Node.js crypto module in browser builds |
| package.json | Upgraded @apify/utilities dependency to version 2.23.0 |
| package-lock.json | Updated lock file to reflect new @apify/utilities version (2.23.0) |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
barjin
added a commit
to apify/apify-shared-js
that referenced
this pull request
Nov 18, 2025
…ed environments (#573) Worker-based environments (e.g. `jest` tests) do not have access to `globalThis.require()` (while calling `require()` instead works). Deeper investigation shows that `tsup` doesn't transpile this in a dangerous way, so we can use this here. Unblocks apify/apify-client-js#782 (tested) Unblocks failing tests in #570
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 7 out of 8 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
B4nan
approved these changes
Nov 18, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uses new implementations of
createStorageContentSignatureandcreateHmacSignaturefrom@apify/utilities.Those native WebCrypto API instead of importing the
node:cryptopackage, so we can markcryptoas external in the browser bundler and cut the bundle size ~2.4 times (both plain and compressed).master)perf/use-native-crypto)Note:
SubtleCryptoAPI in browsers is only available in Secure Contexts. This should be fairly safe (as anyhttps://-served page is one, as well aslocalhost).Related to #753