Skip to content

fix(runtime-core): guard targetShared.get before calling in loadShare#4655

Open
knappam wants to merge 3 commits intomodule-federation:mainfrom
knappam:fix/shared-get-guard
Open

fix(runtime-core): guard targetShared.get before calling in loadShare#4655
knappam wants to merge 3 commits intomodule-federation:mainfrom
knappam:fix/shared-get-guard

Conversation

@knappam
Copy link
Copy Markdown

@knappam knappam commented Apr 10, 2026

Description

When the host's share scope contains a dependency that a remote does not
declare, the share scope entry has no get() factory. SharedHandler.loadShare
calls targetShared.get!() without checking, crashing with
targetShared.get is not a function (or M.get is not a function in
minified builds).

This is particularly common in Metro MF on React Native/Android, where the
host app shares a dependency (e.g. moment) that a mini app remote does not
declare. During share scope negotiation the runtime encounters the entry
without a get factory and crashes.

The fix adds a typeof targetShared.get !== 'function' guard before both
call sites in SharedHandler.loadShare. If get is not a function, the
runtime returns an empty factory instead of crashing.

Confirmed on a real Android device:

  • Without fix: M.get is not a function (it is undefined) when loading the remote
  • With fix: remote loads successfully

Related Issue

Fixes #2497

Types of changes

  • Docs change / refactoring / dependency upgrade
  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)

Checklist

  • I have added tests to cover my changes.
  • All new and existing tests passed.
  • I have updated the documentation.

@netlify
Copy link
Copy Markdown

netlify Bot commented Apr 10, 2026

Deploy Preview for module-federation-docs ready!

Name Link
🔨 Latest commit ae100e9
🔍 Latest deploy log https://app.netlify.com/projects/module-federation-docs/deploys/69faacd3150b3700084577ad
😎 Deploy Preview https://deploy-preview-4655--module-federation-docs.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Apr 10, 2026

🦋 Changeset detected

Latest commit: ae100e9

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2e845ced2d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment on lines +192 to +194
if (typeof targetShared.get !== 'function') {
return (() => ({})) as unknown as () => T;
}
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Return no-match sentinel when shared factory is missing

When targetShared.get is absent, this branch now returns a dummy factory (() => ({})) instead of signaling that no usable shared module was found. That changes loadShare from a miss to a success and breaks callers that rely on the documented false sentinel for fallback behavior (for example packages/webpack-bundler-runtime/src/consumes.ts checks factory === false before using the local getter). In the malformed-share-scope scenario handled by this patch, consumers can now silently receive an empty module object rather than taking fallback logic, causing missing-export failures downstream.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a valid point, will update

When the host's share scope contains a dependency that a remote does not
declare, the share scope entry has no get() factory. The loadShare method
calls targetShared.get!() without checking, crashing with 'targetShared.get
is not a function'.

Add a typeof check before both call sites in SharedHandler.loadShare. If
get is not a function, return an empty factory instead of crashing.

Fixes module-federation#2497
@knappam knappam force-pushed the fix/shared-get-guard branch from 2e845ce to 1552989 Compare April 10, 2026 21:40
@2heal1 2heal1 requested a review from zackarychapple April 15, 2026 09:28
@2heal1
Copy link
Copy Markdown
Member

2heal1 commented Apr 15, 2026

@zackarychapple please help check metro part

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

@module-federation/enhanced: shareInfoRes.get is not a function while trying to load shared dependency

2 participants