fix(build-tools): stop one WebSocket message from crashing the self-hosted API (6.5.0)

[adrians5j]

On a self-hosted API, any incoming WebSocket message of 32 bytes or more crashed the API process with TypeError: bufferUtil.unmask is not a function. The process exited, and the API stayed down until it was restarted.

Cause

The function bundle config (build-tools/bundling/function/createRsbuildConfig.js) set resolve.fallback: { bufferutil: false } to leave out ws's optional native bufferutil module. A false fallback makes rspack bundle an empty module in its place. ws loads bufferutil inside a try/catch and falls back to its own JavaScript only when the require throws. The empty module loads fine, so ws switched mask/unmask to bufferUtil.mask/bufferUtil.unmask, which are undefined. Client frames are always masked, and ws uses the native unmask for payloads of 32 bytes or more, so every message that size threw inside the socket's data handler. The ws server runs only in the self-hosted (standalone) API. On AWS, WebSockets go through API Gateway.

Fix

bufferutil is now left out with an IgnorePlugin entry, the same way the config already leaves out jsdom's optional canvas. An ignored module throws MODULE_NOT_FOUND when required, ws catches that, and it keeps its JavaScript implementation. The resolve.fallback entry is removed. bufferutil was the only module the bundle ignored this way.

Testing

• Before: with the self-hosted API running locally, a 94-byte message to the WebSocket endpoint closed the connection with 1006, and the API returned 503 from then on.
• After: the rebuilt bundle throws MODULE_NOT_FOUND for bufferutil, and the same message sent three times leaves the API answering 200. The admin's own WebSocket connection still connects and works.
• Not run on 6.5.0 locally. The change is identical to fix(build-tools): stop one WebSocket message from crashing the self-hosted API #5988 on next, where it was verified as described above.

Workspace: wby-next2 · 🧹 MERGE 6.5.0 => NEXT

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 761105e5-a384-43e8-afb0-fa2e00ec1c57

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}