feat(rspack): redirect the native bundler runtime to a composed entry

[ScriptedAlchemy]

Part of RFC #5128 (alternate proposal to #5036).
Stack: 6 of 7. Base: #5140 (rfc5128/05-enhanced-composed). Next: #5142.
Landing order: #5135 → #5137 → #5139 → #5134 → #5140 → #5141 → #5142.
Companions on main: #5143 (disabled remote loadEntry), #5144 (enhanced duplicate serializer keys). #5126 (@rspack/core 2) is on main. PR 6 and 7 include it.

What changes

With experiments.composedRuntime set, @module-federation/rspack builds a composed federation bootstrap and points rspack's native Module Federation plugin at it. The build then imports only the runtime parts the plan needs, in ESM, instead of webpack-bundler-runtime/dist/index.cjs and the whole runtime. Rspack itself does not change. The composed build runs on @rspack/core 1.5.8, 1.7.9, and 2.1.10.

The wrapper plans from its own options, registers the bootstrap as a virtual module at node_modules/.federation/rspack/<name>.<hash>.mjs, and aliases the bundler runtime path rspack computes to it. A virtual module does not go stale under rspack's persistent cache, which a real file at a hashed path does. The hash covers the rendered source, including the build id and resolved paths. In composed mode the wrapper runs the managers graph check in finishModules. An externalized runtime package, or a federation module whose adapter is not in the bootstrap, is a build error.

The build keeps the full runtime, as today, in three cases. The flag is off, the @rspack/core has no experiments.VirtualModulesPlugin, or a user alias points at a runtime package. The build warns when the flag was set. An @rspack/core without compiler.rspack (0.7) also falls back instead of throwing, because the plugins come from compiler.webpack.

• The mode is decided in beforeRun and watchRun, once per compiler. selectMode may await function externals, and rspack reads resolve.alias and builtin plugins only when it creates its native compiler. The capability defines are applied after that decision for the same reason.
• Rspack's native runtime before 2.0.0-beta.1 calls federation.runtime.init, which the composed shim from refactor(webpack-bundler-runtime): compose the bundler runtime from adapters #5137 provides.
• The rstest plugin keeps the aliased bundler runtime path bundled with the flag on, because the virtual file does not exist on disk.
• The @module-federation/runtime$ alias is removed. Rspack's native plugin writes a @module-federation/runtime alias first, which already matches.

This branch includes #5126 (the move to @rspack/core 2, now on main) through an earlier merge of its branch. The repo's previous pin, @rspack/core 1.3.9, has no VirtualModulesPlugin. The root package.json, pnpm-lock.yaml, and app config changes in this diff come from #5126.

Verification

• A composed host and remote on @rspack/core 1.5.8 and 1.7.9 failed with TypeError: __webpack_require__.federation.runtime.init is not a function (11 passed, 2 failed) before the refactor(webpack-bundler-runtime): compose the bundler runtime from adapters #5137 shim reached this branch. They pass after it.
• A host and a remote built with @rspack/core run in Node. The spec asserts the remote module's value and one shared singleton (evaluations 1).
• The virtual composed module is in the graph, webpack-bundler-runtime/dist/index.cjs is not, and excluded capability modules are absent in remotes-only and exposes-only builds.
• A persistent cache sequence A, B, B, A, then A at a new version, picks the current bootstrap on every build. Mutations that drop the per-compiler memo or fix the hash each fail one spec.
• A watch rebuild stays composed with no warning. A MultiCompiler with two plans gets the right bootstrap in each.
• The build keeps the full runtime with a warning when VirtualModulesPlugin is missing, when a user alias points at the bundler runtime path, and when one points at a runtime package. Mutating either user-alias branch turns its spec red. Without the flag the build keeps the full runtime and no warning.
• A composed host with a plugin-applied ExternalsPlugin on ^@module-federation/runtime-core, and a composed build where a standalone ContainerReferencePlugin adds a remote module with no remotes adapter, both built with no error before (Received: []). They now fail with the managers messages.
• The async startup runtime keeps the consumes adapter. Without the fix the plan's consumes adapter is false.
• packages/rspack passes 22/22 at cfd395d69, with typecheck and lint clean. The rstest unit tests pass.
• The end-to-end gate at cfd395d69 passes with 0 failed and 0 skipped. --composed --bundler rspack runs 16 checks on each of @rspack/core 1.7.9 and 1.5.8. --composed --bundler both on 2.1.10 runs 32. Flag off against feat(enhanced): compose the runtime bootstrap behind experiments.composedRuntime #5140 at 232dbe30e plus chore(deps): move the repo to @rspack/core 2 #5126 runs 34, and the emitted files are byte-identical on webpack and rspack.
• Independent verification passed at cfd395d69. Its own composed host and remote loaded the remote and one singleton on 1.5.8, 1.7.9, and 2.1.10, with the virtual module and no index.cjs. The live head 84cee419c has the same patch over its parent.
• CI passes at 84cee419c with 19 checks.

Deviations from the RFC

• The rspack graph check does not report runtime packages resolved outside the family or loaded as both .cjs and .js. Rspack's resolve data has no descriptionFileRoot, so the summary carries no package roots. The adapter, external, and bootstrap-count checks run as the RFC specifies.
• resolveRspackRuntimeAlias stays exported and deprecated, because @module-federation/rspack/plugin re-exports it and a minor cannot remove it.

Overlaps with open PRs

This branch contains the #5144 fix through #5140 and #5126 through a merge of its branch. This PR carries no code from other open PRs. The PRs below change files this PR also changes. This PR does not include their changes.

• fix(rspack,manifest): load dts-plugin lazily when dts is disabled #5132 and feat(rspack): support eager exposes #5023 also change packages/rspack/src/ModuleFederationPlugin.ts. feat(rspack): support eager exposes #5023 touches resolveRspackRuntimeAlias. Neither changes the composed path.
• fix(managers,rspack,enhanced): resolve canonical share keys for relative imports (#5042) #5065 and feat(enhanced): coordinate runtime family selection #5094 (the RFC: Keep runtime families together and select capabilities through packages #5036 stack) also change packages/rspack/src/ModuleFederationPlugin.ts.
• feat(ssr): coordinate remote cache invalidation and Modern updates #5044 also changes the rspack.config.js of the three manifest-demo rspack providers.
• feat(managers): resolve runtime families atomically #5093, feat(modern): add weather SSR demo and dispose rebuilt application instances #5088, feat(lynx): add production Module Federation support #4907, and feat(bridge): add application-level SSR for React and Vue #4869 also change the root package.json.

[changeset-bot]

🦋 Changeset detected

Latest commit: 84cee41

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 48 packages

Name	Type
@module-federation/rspack	Minor
@module-federation/rstest	Minor
@module-federation/enhanced	Minor
@module-federation/modern-js-v3	Minor
@module-federation/modern-js	Minor
@module-federation/nextjs-mf	Patch
@module-federation/node	Patch
@module-federation/rsbuild-plugin	Minor
@module-federation/rspress-plugin	Minor
@module-federation/storybook-addon	Patch
shared-tree-shaking-no-server-host	Patch
shared-tree-shaking-no-server-provider	Patch
shared-tree-shaking-with-server-host	Patch
shared-tree-shaking-with-server-provider	Patch
node-dynamic-remote-new-version	Patch
node-dynamic-remote	Patch
@module-federation/playground	Patch
remote5	Patch
remote6	Patch
website-new	Patch
@module-federation/devtools	Minor
@module-federation/cli	Minor
create-module-federation	Minor
@module-federation/dts-plugin	Minor
@module-federation/error-codes	Minor
@module-federation/managers	Minor
@module-federation/manifest	Minor
@module-federation/metro	Minor
@module-federation/metro-plugin-rnc-cli	Minor
@module-federation/metro-plugin-rnef	Minor
@module-federation/metro-plugin-rock	Minor
@module-federation/retry-plugin	Minor
@module-federation/runtime-core	Minor
@module-federation/runtime-tools	Minor
@module-federation/runtime	Minor
@module-federation/sdk	Minor
@module-federation/third-party-dts-extractor	Minor
@module-federation/treeshake-frontend	Minor
@module-federation/treeshake-server	Minor
@module-federation/webpack-bundler-runtime	Minor
@module-federation/bridge-react-webpack-plugin	Minor
@module-federation/bridge-react	Minor
@module-federation/bridge-shared	Minor
@module-federation/bridge-vue3	Minor
@module-federation/inject-external-runtime-core-plugin	Minor
@module-federation/esbuild	Patch
@module-federation/observability-plugin	Patch
@module-federation/utilities	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-25T14:22:22.383688Z	2dddaa6	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[pkg-pr-new]

Open in StackBlitz

@module-federation/devtools

pnpm add https://pkg.pr.new/@module-federation/devtools@84cee41

@module-federation/cli

pnpm add https://pkg.pr.new/@module-federation/cli@84cee41

create-module-federation

pnpm add https://pkg.pr.new/create-module-federation@84cee41

@module-federation/dts-plugin

pnpm add https://pkg.pr.new/@module-federation/dts-plugin@84cee41

@module-federation/enhanced

pnpm add https://pkg.pr.new/@module-federation/enhanced@84cee41

@module-federation/error-codes

pnpm add https://pkg.pr.new/@module-federation/error-codes@84cee41

@module-federation/esbuild

pnpm add https://pkg.pr.new/@module-federation/esbuild@84cee41

@module-federation/managers

pnpm add https://pkg.pr.new/@module-federation/managers@84cee41

@module-federation/manifest

pnpm add https://pkg.pr.new/@module-federation/manifest@84cee41

@module-federation/metro

pnpm add https://pkg.pr.new/@module-federation/metro@84cee41

@module-federation/metro-plugin-rnc-cli

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rnc-cli@84cee41

@module-federation/metro-plugin-rnef

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rnef@84cee41

@module-federation/metro-plugin-rock

pnpm add https://pkg.pr.new/@module-federation/metro-plugin-rock@84cee41

@module-federation/modern-js

pnpm add https://pkg.pr.new/@module-federation/modern-js@84cee41

@module-federation/modern-js-v3

pnpm add https://pkg.pr.new/@module-federation/modern-js-v3@84cee41

@module-federation/native-federation-tests

pnpm add https://pkg.pr.new/@module-federation/native-federation-tests@84cee41

@module-federation/native-federation-typescript

pnpm add https://pkg.pr.new/@module-federation/native-federation-typescript@84cee41

@module-federation/nextjs-mf

pnpm add https://pkg.pr.new/@module-federation/nextjs-mf@84cee41

@module-federation/node

pnpm add https://pkg.pr.new/@module-federation/node@84cee41

@module-federation/observability-plugin

pnpm add https://pkg.pr.new/@module-federation/observability-plugin@84cee41

@module-federation/playground

pnpm add https://pkg.pr.new/@module-federation/playground@84cee41

@module-federation/retry-plugin

pnpm add https://pkg.pr.new/@module-federation/retry-plugin@84cee41

@module-federation/rsbuild-plugin

pnpm add https://pkg.pr.new/@module-federation/rsbuild-plugin@84cee41

@module-federation/rspack

pnpm add https://pkg.pr.new/@module-federation/rspack@84cee41

@module-federation/rspress-plugin

pnpm add https://pkg.pr.new/@module-federation/rspress-plugin@84cee41

@module-federation/rstest

pnpm add https://pkg.pr.new/@module-federation/rstest@84cee41

@module-federation/runtime

pnpm add https://pkg.pr.new/@module-federation/runtime@84cee41

@module-federation/runtime-core

pnpm add https://pkg.pr.new/@module-federation/runtime-core@84cee41

@module-federation/runtime-tools

pnpm add https://pkg.pr.new/@module-federation/runtime-tools@84cee41

@module-federation/sdk

pnpm add https://pkg.pr.new/@module-federation/sdk@84cee41

@module-federation/storybook-addon

pnpm add https://pkg.pr.new/@module-federation/storybook-addon@84cee41

@module-federation/third-party-dts-extractor

pnpm add https://pkg.pr.new/@module-federation/third-party-dts-extractor@84cee41

@module-federation/treeshake-frontend

pnpm add https://pkg.pr.new/@module-federation/treeshake-frontend@84cee41

@module-federation/treeshake-server

pnpm add https://pkg.pr.new/@module-federation/treeshake-server@84cee41

@module-federation/typescript

pnpm add https://pkg.pr.new/@module-federation/typescript@84cee41

@module-federation/utilities

pnpm add https://pkg.pr.new/@module-federation/utilities@84cee41

@module-federation/webpack-bundler-runtime

pnpm add https://pkg.pr.new/@module-federation/webpack-bundler-runtime@84cee41

@module-federation/bridge-react

pnpm add https://pkg.pr.new/@module-federation/bridge-react@84cee41

@module-federation/bridge-react-webpack-plugin

pnpm add https://pkg.pr.new/@module-federation/bridge-react-webpack-plugin@84cee41

@module-federation/bridge-shared

pnpm add https://pkg.pr.new/@module-federation/bridge-shared@84cee41

@module-federation/bridge-vue3

pnpm add https://pkg.pr.new/@module-federation/bridge-vue3@84cee41

@module-federation/inject-external-runtime-core-plugin

pnpm add https://pkg.pr.new/@module-federation/inject-external-runtime-core-plugin@84cee41

commit: 84cee41

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2dddaa6de7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Implement the composed-runtime wiring

When a consumer enables experiments.composedRuntime, this commit only upgrades @rspack/core and never changes the Rspack plugin implementation. ModuleFederationPlugin.apply() still unconditionally passes the original options to the native plugin and aliases @module-federation/runtime$ through resolveRspackRuntimeAlias() (packages/rspack/src/ModuleFederationPlugin.ts, lines 235-253), with no composition planning or virtual-module branch, so the new flag has no effect and output continues using the existing runtime entry.

Useful? React with 👍 / 👎.