chore(benchmarks): renovate, use ESM #2454

gabrielmfern · 2025-09-17T20:18:44Z

Summary by cubic

Switch benchmarks to native ESM and run them with tsx instead of precompiling. This simplifies running benchmarks and aligns configs across packages.

Refactors
- Enable ESM: set "type": "module" and update tsconfig (module: esnext, moduleResolution: bundler).
- Replace tsup + node with tsx; add/adjust scripts (0.0.17-vs-local, with-vs-without, flamegraph) and update README.
- Use top-level await in benchmark files; remove wrappers; ensure server cleanup and write results/print tables.

alwaysmeticulous · 2025-09-17T20:18:48Z

🤖 Meticulous was unable to start a test run because no sessions have been recorded yet. Click here to setup session recording.

_{Last updated for commit 654fc93. This comment will update as new commits are pushed.}

changeset-bot · 2025-09-17T20:18:48Z

⚠️ No Changeset found

Latest commit: 79fdf6a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

vercel · 2025-09-17T20:18:48Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
react-email	Ready	Preview	Comment	Oct 6, 2025 5:41pm
react-email-demo	Error			Oct 6, 2025 5:41pm

cubic-dev-ai

7 issues found across 10 files

Prompt for AI agents (all 7 issues)


Understand the root cause of the following 7 issues and fix them.


<file name="benchmarks/preview-server/package.json">

<violation number="1" location="benchmarks/preview-server/package.json:5">
Setting type: &quot;module&quot; makes this package ESM, but several scripts use __dirname, which is undefined in ESM. This risks runtime failures when running the benchmark scripts.</violation>
</file>

<file name="benchmarks/preview-server/src/local-vs-2.1.7-canary.2.ts">

<violation number="1" location="benchmarks/preview-server/src/local-vs-2.1.7-canary.2.ts:35">
Ensure server subprocesses are terminated via try/finally so they’re killed even if an await (fetch/run/writeFile) throws.</violation>
</file>

<file name="benchmarks/preview-server/src/local-vs-2.1.7-canary.2-on-startup.ts">

<violation number="1" location="benchmarks/preview-server/src/local-vs-2.1.7-canary.2-on-startup.ts:24">
Awaiting runServer without a timeout can hang indefinitely if the child process fails to emit the expected stdout.</violation>

<violation number="2" location="benchmarks/preview-server/src/local-vs-2.1.7-canary.2-on-startup.ts:24">
Subprocess may be left running if fetch throws; wrap server lifecycle in a try/finally so kill() always runs for cleanup.</violation>

<violation number="3" location="benchmarks/preview-server/src/local-vs-2.1.7-canary.2-on-startup.ts:26">
kill() is asynchronous; await the child process &#39;close&#39; event after sending the signal to ensure the server fully exits before the next iteration.</violation>

<violation number="4" location="benchmarks/preview-server/src/local-vs-2.1.7-canary.2-on-startup.ts:29">
Subprocess may be left running if fetch throws; wrap server lifecycle in a try/finally so kill() always runs for cleanup.</violation>
</file>

<file name="benchmarks/tailwind-component/README.md">

<violation number="1" location="benchmarks/tailwind-component/README.md:13">
README structure lists wrong extension; the file is .tsx, not .ts.</violation>
</file>

_{React with 👍 or 👎 to teach cubic. Mention @cubic-dev-ai to give feedback, ask questions, or re-run the review.}

cubic-dev-ai · 2025-09-17T20:31:49Z

benchmarks/preview-server/package.json

  "name": "@benchmarks/preview-server",
  "private": true,
  "version": "0.0.0",
+  "type": "module",


Setting type: "module" makes this package ESM, but several scripts use __dirname, which is undefined in ESM. This risks runtime failures when running the benchmark scripts.

Prompt for AI agents

Address the following comment on benchmarks/preview-server/package.json at line 5: <comment>Setting type: "module" makes this package ESM, but several scripts use __dirname, which is undefined in ESM. This risks runtime failures when running the benchmark scripts.</comment> <file context> @@ -2,6 +2,7 @@ "name": "@benchmarks/preview-server", "private": true, "version": "0.0.0", + "type": "module", "scripts": { "local-vs-2.1.7-canary.2": "tsx ./src/local-vs-2.1.7-canary.2.ts", </file context>

cubic-dev-ai · 2025-09-17T20:31:49Z

benchmarks/preview-server/src/local-vs-2.1.7-canary.2.ts

+await fetch(`${localServer.url}/preview/magic-links/notion-magic-link`);
+await fetch(`${canaryServer.url}/preview/magic-links/notion-magic-link`);
+
+await bench.run();


Ensure server subprocesses are terminated via try/finally so they’re killed even if an await (fetch/run/writeFile) throws.

Prompt for AI agents

Address the following comment on benchmarks/preview-server/src/local-vs-2.1.7-canary.2.ts at line 35: <comment>Ensure server subprocesses are terminated via try/finally so they’re killed even if an await (fetch/run/writeFile) throws.</comment> <file context> @@ -15,32 +15,30 @@ const pathToLocalCliScript = path.resolve( +await fetch(`${localServer.url}/preview/magic-links/notion-magic-link`); +await fetch(`${canaryServer.url}/preview/magic-links/notion-magic-link`); + +await bench.run(); + +localServer.subprocess.kill(); </file context>

cubic-dev-ai · 2025-09-17T20:31:49Z

benchmarks/preview-server/src/local-vs-2.1.7-canary.2-on-startup.ts

-    });
+bench
+  .add('startup on local', async () => {
+    const server = await runServer(pathToLocalCliScript);


Awaiting runServer without a timeout can hang indefinitely if the child process fails to emit the expected stdout.

Prompt for AI agents

Address the following comment on benchmarks/preview-server/src/local-vs-2.1.7-canary.2-on-startup.ts at line 24: <comment>Awaiting runServer without a timeout can hang indefinitely if the child process fails to emit the expected stdout.</comment> <file context> @@ -15,28 +15,26 @@ const pathToLocalCliScript = path.resolve( - }); +bench + .add('startup on local', async () => { + const server = await runServer(pathToLocalCliScript); + await fetch(`${server.url}/preview/magic-links/notion-magic-link`); + server.subprocess.kill(); </file context>

cubic-dev-ai · 2025-09-17T20:31:50Z

benchmarks/preview-server/src/local-vs-2.1.7-canary.2-on-startup.ts

+  .add('startup on local', async () => {
+    const server = await runServer(pathToLocalCliScript);
+    await fetch(`${server.url}/preview/magic-links/notion-magic-link`);
+    server.subprocess.kill();


kill() is asynchronous; await the child process 'close' event after sending the signal to ensure the server fully exits before the next iteration.

Prompt for AI agents

Address the following comment on benchmarks/preview-server/src/local-vs-2.1.7-canary.2-on-startup.ts at line 26: <comment>kill() is asynchronous; await the child process 'close' event after sending the signal to ensure the server fully exits before the next iteration.</comment> <file context> @@ -15,28 +15,26 @@ const pathToLocalCliScript = path.resolve( + .add('startup on local', async () => { + const server = await runServer(pathToLocalCliScript); + await fetch(`${server.url}/preview/magic-links/notion-magic-link`); + server.subprocess.kill(); + }) + .add('startup on 2.1.7-canary.2', async () => { </file context>

cubic-dev-ai · 2025-09-17T20:31:50Z

benchmarks/preview-server/src/local-vs-2.1.7-canary.2-on-startup.ts

+    server.subprocess.kill();
+  })
+  .add('startup on 2.1.7-canary.2', async () => {
+    const server = await runServer(pathToCanaryCliScript);


Subprocess may be left running if fetch throws; wrap server lifecycle in a try/finally so kill() always runs for cleanup.

Prompt for AI agents

Address the following comment on benchmarks/preview-server/src/local-vs-2.1.7-canary.2-on-startup.ts at line 29: <comment>Subprocess may be left running if fetch throws; wrap server lifecycle in a try/finally so kill() always runs for cleanup.</comment> <file context> @@ -15,28 +15,26 @@ const pathToLocalCliScript = path.resolve( + server.subprocess.kill(); + }) + .add('startup on 2.1.7-canary.2', async () => { + const server = await runServer(pathToCanaryCliScript); + await fetch(`${server.url}/preview/magic-links/notion-magic-link`); + server.subprocess.kill(); </file context>

cubic-dev-ai · 2025-09-17T20:31:50Z

benchmarks/preview-server/src/local-vs-2.1.7-canary.2-on-startup.ts

-    });
+bench
+  .add('startup on local', async () => {
+    const server = await runServer(pathToLocalCliScript);


Subprocess may be left running if fetch throws; wrap server lifecycle in a try/finally so kill() always runs for cleanup.

Prompt for AI agents

Address the following comment on benchmarks/preview-server/src/local-vs-2.1.7-canary.2-on-startup.ts at line 24: <comment>Subprocess may be left running if fetch throws; wrap server lifecycle in a try/finally so kill() always runs for cleanup.</comment> <file context> @@ -15,28 +15,26 @@ const pathToLocalCliScript = path.resolve( - }); +bench + .add('startup on local', async () => { + const server = await runServer(pathToLocalCliScript); + await fetch(`${server.url}/preview/magic-links/notion-magic-link`); + server.subprocess.kill(); </file context>

benchmarks/tailwind-component/README.md

socket-security · 2025-10-06T17:20:26Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@types/nodemailer@6.4.20
	@plunk/node@3.0.3
	postmark@3.11.0
	mailersend@2.6.0
	next@15.5.4
	@react-email/components@0.0.36
	@sendgrid/mail@7.7.0
	typescript@4.9.5
	nodemailer@6.10.1
	react-dom@19.2.0
	@aws-sdk/client-ses@3.901.0
	resend@4.8.0

View full report

socket-security · 2025-10-06T17:20:28Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Block		`[email protected]` has Telemetry. Note: Can be disabled by setting the environment variable NEXT_TELEMETRY_DISABLED=1 . See https://nextjs.org/telemetry for more information From: examples/resend/package.json → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is telemetry? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		`[email protected]` has Install scripts. Install script: install Source: `node install/check.js` From: `?` → `npm/[email protected]` → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is an install script? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

gabrielmfern added 3 commits September 17, 2025 17:09

update README

1f85de1

use ESM for the tailwind-component benchmark

fcb2a50

update to using ESM, and moduleResolution 'bundler'

0bed263

gabrielmfern self-assigned this Sep 17, 2025

gabrielmfern requested a review from a team as a code owner September 17, 2025 20:18

gabrielmfern requested review from joaopcm and removed request for a team September 17, 2025 20:18

vercel bot deployed to Preview – react-email-demo September 17, 2025 20:18 View deployment

gabrielmfern requested review from a team and pedro-stramantinoli and removed request for joaopcm September 17, 2025 20:22

cubic-dev-ai bot reviewed Sep 17, 2025

View reviewed changes

gabrielmfern added 3 commits September 17, 2025 17:35

use import.meta.dirname inplace of __dirname

c73996b

update file extensions in README

398bbb2

use warmupIterations intead of fetching manually

654fc93

vercel bot deployed to Preview – react-email September 17, 2025 20:42 View deployment

vercel bot deployed to Preview – react-email-demo September 17, 2025 20:42 View deployment

remove unsused function

a4f17cc

gabrielmfern marked this pull request as draft September 17, 2025 20:50

try avoinding race conditions of sub processes not being closed

79fdf6a

vercel bot had a problem deploying to Preview – react-email-demo October 6, 2025 17:41 Failure

vercel bot deployed to Preview – react-email October 6, 2025 17:41 View deployment

gabrielmfern force-pushed the canary branch 3 times, most recently from 8128be7 to 19de23f Compare October 17, 2025 20:28

chore(benchmarks): renovate, use ESM #2454

Are you sure you want to change the base?

chore(benchmarks): renovate, use ESM #2454

Uh oh!

Conversation

gabrielmfern commented Sep 17, 2025 • edited by cubic-dev-ai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Uh oh!

alwaysmeticulous bot commented Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot bot commented Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

vercel bot commented Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

socket-security bot commented Oct 6, 2025

Uh oh!

socket-security bot commented Oct 6, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

gabrielmfern commented Sep 17, 2025 •

edited by cubic-dev-ai bot

Loading

alwaysmeticulous bot commented Sep 17, 2025 •

edited

Loading

changeset-bot bot commented Sep 17, 2025 •

edited

Loading

vercel bot commented Sep 17, 2025 •

edited

Loading

cubic-dev-ai bot Sep 17, 2025 •

edited

Loading

cubic-dev-ai bot Sep 17, 2025 •

edited

Loading

cubic-dev-ai bot Sep 17, 2025 •

edited

Loading

cubic-dev-ai bot Sep 17, 2025 •

edited

Loading

cubic-dev-ai bot Sep 17, 2025 •

edited

Loading

cubic-dev-ai bot Sep 17, 2025 •

edited

Loading