Turbopack: Add TransientEnvMap to avoid persisting env vars in cache#90526
Turbopack: Add TransientEnvMap to avoid persisting env vars in cache#90526
Conversation
Introduces TransientEnvMap (serialization = "none") and changes ProcessEnv::read_all() to return it instead of EnvMap. This prevents environment variables (which may contain secrets) from being stored in the persistent disk cache. EnvMap (serializable) is kept for config-derived env maps such as next.config.js env and edge_env.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Failing test suitesCommit: 72255e1 | About building and testing Next.js
Expand output● nx-handling › should work for pages page ● nx-handling › should work for pages API ● nx-handling › should work with app page ● nx-handling › should work with app route
Expand output● layout sharing in non-static prefetches › full prefetches should omit layouts that were already prefetched with a full prefetch
Expand output● app dir - prefetching › should show layout eagerly when prefetched with loading one level down ● app dir - prefetching › should immediately render the loading state for a dynamic segment when fetched from higher up in the tree
Expand output● filesystem-caching with cache enabled › should cache or not cache loaders ● filesystem-caching with cache enabled › should allow to change files while stopped (RSC change) ● filesystem-caching with cache enabled › should allow to change files while stopped (RCC change) ● filesystem-caching with cache enabled › should allow to change files while stopped (Pages change) ● filesystem-caching with cache enabled › should allow to change files while stopped (rename app page) ● filesystem-caching with cache enabled › should allow to change files while stopped (next config change) ● filesystem-caching with cache enabled › should allow to change files while stopped (env var change) ● filesystem-caching with cache enabled › should allow to change files while stopped (RSC change, RCC change, Pages change, rename app page, next config change, env var change)
Expand output● filesystem-caching with cache enabled › should cache or not cache loaders ● filesystem-caching with cache enabled › should allow to change files while stopped (RSC change) ● filesystem-caching with cache enabled › should allow to change files while stopped (RCC change) ● filesystem-caching with cache enabled › should allow to change files while stopped (Pages change) ● filesystem-caching with cache enabled › should allow to change files while stopped (rename app page) ● filesystem-caching with cache enabled › should allow to change files while stopped (next config change) ● filesystem-caching with cache enabled › should allow to change files while stopped (env var change) ● filesystem-caching with cache enabled › should allow to change files while stopped (RSC change, RCC change, Pages change, rename app page, next config change, env var change) |
Merging this PR will not alter performance
Comparing Footnotes
|
Stats from current PR🔴 1 regression
📊 All Metrics📖 Metrics GlossaryDev Server Metrics:
Build Metrics:
Change Thresholds:
⚡ Dev Server
📦 Dev Server (Webpack) (Legacy)📦 Dev Server (Webpack)
⚡ Production Builds
📦 Production Builds (Webpack) (Legacy)📦 Production Builds (Webpack)
📦 Bundle SizesBundle Sizes⚡ TurbopackClient Main Bundles: **399 kB** → **399 kB** ✅ -8 B80 files with content-based hashes (individual files not comparable between builds) Server Middleware
Build DetailsBuild Manifests
📦 WebpackClient Main Bundles
Polyfills
Pages
Server Edge SSR
Middleware
Build DetailsBuild Manifests
Build Cache
🔄 Shared (bundler-independent)Runtimes
📎 Tarball URL |
common_node_env filters env vars to a small known set (NODE_*, UV_*, SSL_*) that are safe to cache, so it should return a persistable EnvMap.
What?
Introduces a new
TransientEnvMaptype and changesProcessEnv::read_all()to returnVc<TransientEnvMap>instead ofVc<EnvMap>.Why?
EnvMapuses default (auto) serialization, which means all process environment variables — including secrets like API keys and tokens — could be written to the persistent disk cache.TransientEnvMapusesserialization = "none", ensuring env vars are never persisted and must always be read fresh from the process environment on cache restore.How?
TransientEnvMapinturbo-tasks-env/src/lib.rs: a transparent wrapper aroundFxIndexMap<RcStr, RcStr>withserialization = "none"ProcessEnv::read_all()trait method return type fromVc<EnvMap>→Vc<TransientEnvMap>ProcessEnv::read_all()(EnvMap,CommandLineProcessEnv,CustomProcessEnv,FilterProcessEnv,DotenvProcessEnv,TryDotenvProcessEnv,EmbeddableProcessEnv)case_insensitive_read,to_uppercase_map,common_node_env) to work withTransientEnvMapEnvMap(serializable) is kept for config-derived env maps likenext.config.jsenv andedge_env