fix: unify Vite and Rsbuild runtime fetch policies

[dmchoi77]

Summary

Vite and Rsbuild remote server-entry and manifest fetch paths used different timeout, response-size, and cache behavior. This change applies one fetch policy so remote loading cannot hang indefinitely or consume unbounded response bodies.

This package delegates Federation build and container wiring to @module-federation/vite and @module-federation/rsbuild-plugin, but it owns adapter boundaries for CommonJS entry compatibility in the Rsbuild development environment and server-side manifest/CSS lookup. Those boundaries had diverged fetch-safety policies for the same remote.

Context

• @module-federation/vite/ssrEntryLoader provides timeout and response-size options for Vite ESM entries, but getRemoteStylesheets and Rsbuild CommonJS entries used separate fetch paths.
• @module-federation/rsbuild-plugin and @module-federation/enhanced own build/container/runtime wiring; they do not expose a stable public API for manifest CSS lookup or a shared response-body limit.
• The change therefore standardizes only the fetch boundary owned by this adapter, without replacing the upstream plugin or copying private helpers.
• Out of scope: replacing @module-federation/rsbuild-plugin's runtime, reimplementing the Vite SSR loader, or changing React SSR ErrorBoundary fallback behavior.

Changes

• Added a remote-fetch layer with 10-second and 10 MiB defaults. Passing 0 disables either limit, while HTTP status, Content-Length, streaming bodies, and JSON parse failures are handled consistently.
• Rsbuild CommonJS server entries now use the shared fetch layer, while Vite ESM server entries continue using the existing @module-federation/vite/ssrEntryLoader with the same fetch options. RemoteEntryError phases and original causes remain unchanged.
• Added fetchTimeoutMs and fetchMaxBytes to getRemoteStylesheets. Manifest requests now single-flight in-flight work, reuse only successful responses for the TTL, and evict failed requests from the cache.
• Kept @module-federation/rsbuild-plugin client/server Federation wiring and the custom CommonJS _compile path unchanged. Added the remote-fetch build artifact and updated release artifact coverage.
• Preserved RemoteEntryError phases/causes, manifest CSS URL resolution, the default 30-second manifest TTL, and fetchTimeoutMs: 0 opt-out behavior. The new getRemoteStylesheets fetch options keep existing callers' default behavior unchanged.
• Added timeout, response-size, malformed JSON, non-2xx, manifest-cache, and Vite/Rsbuild SSR regression coverage, plus a patch changeset.

Validation

• pnpm --filter @module-federation/tanstack typecheck: passed
• pnpm --filter @module-federation/tanstack build: passed
• node --test --test-concurrency=1 test/runtime.test.mjs: 18 passed
• node --test --test-concurrency=1 test/remote-fetch.test.mjs test/release-artifacts.test.mjs test/release-contracts.test.mjs: 32 passed

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/module-federation/tanstack/@module-federation/tanstack@8

commit: 4483e32