Transitive dependencies of linked dependencies are bundled in SSR build

[haines]

Describe the bug

I have a pnpm monorepo containing packages app and shared. app depends on shared.

My expectation is that

• Vite will bundle shared in app's SSR build for HMR, because it is a linked dependency and therefore is not externalized.
• shared's dependencies in shared/node_modules remain external.

What actually happens is that Vite bundles shared's dependencies into app's SSR build as well as shared itself. This breaks our app because shared pulls in a CJS module (require-in-the-middle) which explodes if it is loaded in an ESM context (nodejs/require-in-the-middle#110).

Reproduction

https://github.com/haines/vite-ssr-externals-repro

Steps to reproduce

Clone the repo and run pnpm run repro (which is equivalent to running pnpm install followed by pnpm run build and pnpm run preview in the app).

The SSR bundle packages/app/dist/server/entry-server.js will include require-in-the-middle rather than importing it from packages/shared/node_modules. This will cause the server to blow up with

ReferenceError: require is not defined in ES module scope, you can use import instead
This file is being treated as an ES module because it has a '.js' file extension and 'vite-ssr-externals-repro/packages/app/package.json' contains "type": "module". To treat it as a CommonJS script, rename it to use the '.cjs' file extension.

System Info

System:
    OS: macOS 15.3
    CPU: (14) arm64 Apple M4 Pro
    Memory: 252.14 MB / 48.00 GB
    Shell: 3.7.1 - /opt/homebrew/bin/fish
  Binaries:
    Node: 22.13.1 - ~/.local/share/nvm/v22.13.1/bin/node
    pnpm: 10.3.0 - ~/.local/share/nvm/v22.13.1/bin/pnpm
  npmPackages:
    vite: ^6.0.1 => 6.1.0

Used Package Manager

pnpm

Logs

No response

Validations

• Follow our Code of Conduct
• Read the Contributing Guidelines.
• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Make sure this is a Vite issue and not a framework-specific issue. For example, if it's a Vue SFC related bug, it should likely be reported to vuejs/core instead.
• Check that this is a concrete bug. For Q&A open a GitHub Discussion or join our Discord Chat Server.
• The provided reproduction is a minimal reproducible example of the bug.

[botafi]

I have this issue when importing Sentry with Nuxt as it requires require-in-the-middle

[hi-ogawa]

This is somewhat expected since externalizing transitive dependency won't be necessary visible from the bundled application directory. You have to manually mark ssr.external and also install the transitive dependency as application dependency.

This is not the case for SSR dev, so this is technically dev/build inconsistency, but if dev is aligned with build, then it still need to require having externalized transitive dependency explicitly as application dependency. Last time I checked, that's basically what Next.js does and they have a warning for that case. Here is a reference if anyone is interested https://github.com/hi-ogawa/reproductions/tree/main/next-external-import.

 ⚠ ./node_modules/.pnpm/@vitejs+test-external-indirect@file+deps+external-indirect/node_modules/@vitejs/test-external-indirect
Package @node-rs/bcrypt can't be external
The request @node-rs/bcrypt matches serverExternalPackages (or the default list).
The request could not be resolved by Node.js from the project directory.
Packages that should be external need to be installed in the project directory, so they can be resolved from the output files.
Try to install it into the project directory by running npm install @node-rs/bcrypt from the project directory.

[hi-ogawa]

It looks like OP has addressed the issue on require-in-the-middle side nodejs/require-in-the-middle#111, so let me close this for now.