feat: reproducible manifest (#11542)

package.json

@@ -47,6 +47,7 @@
     "@types/estree": "^1.0.0",
     "@types/etag": "^1.8.1",
     "@types/fs-extra": "^9.0.13",
+    "@types/json-stable-stringify": "^1.0.34",
     "@types/less": "^3.0.3",
     "@types/micromatch": "^4.0.2",
     "@types/minimist": "^1.2.2",

packages/vite/LICENSE.md

@@ -1833,6 +1833,32 @@ Repository: git+https://github.com/isaacs/isexe.git
 
 ---------------------------------------
 
+## json-stable-stringify
+License: MIT
+By: James Halliday
+Repository: git://github.com/ljharb/json-stable-stringify.git
+
+> This software is released under the MIT license:
+> 
+> Permission is hereby granted, free of charge, to any person obtaining a copy of
+> this software and associated documentation files (the "Software"), to deal in
+> the Software without restriction, including without limitation the rights to
+> use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+> the Software, and to permit persons to whom the Software is furnished to do so,
+> subject to the following conditions:
+> 
+> The above copyright notice and this permission notice shall be included in all
+> copies or substantial portions of the Software.
+> 
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+> FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+> COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+> IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+> CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+---------------------------------------
+
 ## launch-editor
 License: MIT
 By: Evan You

packages/vite/package.json

@@ -97,6 +97,7 @@
     "etag": "^1.8.1",
     "fast-glob": "^3.2.12",
     "http-proxy": "^1.18.1",
+    "json-stable-stringify": "^1.0.2",
     "launch-editor-middleware": "^2.6.0",
     "magic-string": "^0.27.0",
     "micromatch": "^4.0.5",

packages/vite/rollup.config.ts

@@ -112,6 +112,10 @@ function createNodePlugins(
           pattern: /require(?=\((configFile|'ts-node')\))/g,
           replacement: `eval('require')`,
         },
+        'json-stable-stringify/index.js': {
+          pattern: /^var json = typeof JSON.+require\('jsonify'\);$/gm,
+          replacement: 'var json = JSON',
+        },
       }),
 
     commonjs({

packages/vite/src/node/plugins/manifest.ts

@@ -1,5 +1,6 @@
 import path from 'node:path'
 import type { OutputAsset, OutputChunk } from 'rollup'
+import jsonStableStringify from 'json-stable-stringify'
 import type { ResolvedConfig } from '..'
 import type { Plugin } from '../plugin'
 import { normalizePath } from '../utils'
@@ -158,7 +159,7 @@ export function manifestPlugin(config: ResolvedConfig): Plugin {
               ? config.build.manifest
               : 'manifest.json',
           type: 'asset',
-          source: JSON.stringify(manifest, null, 2),
+          source: jsonStableStringify(manifest, { space: 2 }),
         })
       }
     },

packages/vite/src/node/ssr/ssrManifestPlugin.ts

@@ -2,6 +2,7 @@ import { basename, dirname, join, relative } from 'node:path'
 import { parse as parseImports } from 'es-module-lexer'
 import type { ImportSpecifier } from 'es-module-lexer'
 import type { OutputChunk } from 'rollup'
+import jsonStableStringify from 'json-stable-stringify'
 import type { ResolvedConfig } from '..'
 import type { Plugin } from '../plugin'
 import { preloadMethod } from '../plugins/importAnalysisBuild'
@@ -81,7 +82,7 @@ export function ssrManifestPlugin(config: ResolvedConfig): Plugin {
             ? config.build.ssrManifest
             : 'ssr-manifest.json',
         type: 'asset',
-        source: JSON.stringify(ssrManifest, null, 2),
+        source: jsonStableStringify(ssrManifest, { space: 2 }),
       })
     },
   }