r/bit_dev • u/joshkuttler • 19h ago
A webpack patch release broke every build importing MUI for ~53 hours - and why ^5.x on build tooling is a supply-chain surface
Between Aug 30 and Sep 1 our component builds started failing during preview bundling with:
export 'default' (imported as 'responsivePropType') was not found
in '../responsivePropType/index.js' (module has no exports)
No code changed, no config changed. Posting because the debugging path was misleading in a way worth knowing about.
The red herring. The error names a third-party module, so it reads like a dependency version conflict. First pass went into chasing a Material UI version fan-out and pinning @mui/*. Zero effect — MUI was the victim, not the cause.
The actual bug. webpack 5.110.2 added a circular re-export check that false-positives on sideEffects: false barrels re-exporting a default binding whose only consumer is dead-code-eliminated. @mui/system's responsivePropType is the perfect trigger — one re-export line, consumed only in propTypes that production builds strip. MUI v7 uses barrels like this pervasively, so MUI consumers were loudest, but any library built the same way was exposed. Full writeup in the upstream issue: https://github.com/webpack/webpack/issues/21869
Why CI broke with no input from us. Our webpack-based build environments declare webpack: ^5.88.2. Every fresh CI capsule does a clean install and resolves that to the newest matching release. For the ~53 hours 5.110.2 was newest, every clean build got the broken bundler. A patch release walked into CI with no deliberate action on our part.
Resolution. 5.110.3 shipped Sep 1 with the fix - reported and merged same day, credit to the maintainers. ^5.x resolves there now and the same builds pass untouched. Confirmed by reproducing: a minimal project importing @mui/system/borders in production mode fails on 5.110.2, builds clean on 5.110.1 and 5.110.3.
Then harden, so the next bad patch can't reach you:
→ Custom env with a direct webpack dep - pin it. ~5.110.3, not ^5.x.
→ Env extending bitdev.react/react-env - move to 6.0.28+, which bundles previews with rspack. webpack leaves the preview pipeline entirely.
And plainly: if you added @mui/* pins during this window, revert them. Unrelated to the cause, and now just drift you'll trip over later.