fix: reject cache files truncated after stat by OskarEichler · Pull Request #21893 · webpack/webpack

OskarEichler · 2026-08-31T21:12:42Z

Summary

If a cache file shrank after stat, positional reads could repeatedly return zero bytes while the original size still indicated remaining data. The reader now treats zero bytes before the expected end as truncation and rejects instead of looping indefinitely.

What kind of change does this PR introduce?

fix

Did you add tests for your changes?

Yes. A bounded fake filesystem simulates truncation after metadata lookup and verifies an EOF error after two reads. The focused unit suite passes 13 tests, and all lint, generated-output, type, format, spelling, changeset, and diff checks pass.

Does this PR introduce a breaking change?

No. Corrupt cache input now fails promptly instead of hanging.

If relevant, did you update the documentation?

A patch changeset documents truncated-cache rejection. No public documentation change is required.

Use of AI

Significant AI assistance was used to audit cache I/O and draft the fix and regression test. I reviewed the final diff and verification results.

Summary by CodeRabbit

Bug Fixes
- Improved handling of truncated cache files.
- Cache reads now fail promptly with an “Unexpected end of file” error instead of continuing with incomplete data or hanging.
Tests
- Added coverage for cache files whose reported size exceeds their actual contents.

changeset-bot · 2026-08-31T21:12:48Z

🦋 Changeset detected

Latest commit: dc8317f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
webpack	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-08-31T21:13:58Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: d04437f7-c93f-4cd3-96aa-81bccf7e5939

📥 Commits

Reviewing files that changed from the base of the PR and between 5352fd8 and dc8317f.

📒 Files selected for processing (3)

.changeset/020-truncated-cache-file.md
lib/serialization/FileMiddleware.js
test/FileMiddleware.unittest.js

Included review availability: Your plan provides up to 10 included reviews per hour; 4 remain after this review.

📝 Walkthrough

Walkthrough

The cache deserializer now rejects files that end before their reported size. A unit test simulates truncation and verifies the error and read count. A patch changeset records the fix.

Changes

Cache file integrity

Layer / File(s)	Summary
Reject incomplete cache reads `lib/serialization/FileMiddleware.js`	When a read returns zero bytes while data remains, the descriptor closes and deserialization rejects with `Unexpected end of file`.
Validate truncated cache handling `test/FileMiddleware.unittest.js`, `.changeset/020-truncated-cache-file.md`	The test simulates a truncated cache file and verifies the rejection after two reads. The changeset declares a patch release for `webpack`.

Suggested reviewers: alexander-akait, bjohansebas

Merge Risk: ⚪ Minimal · up to dc831

Truncated cache files are now rejected promptly instead of potentially hanging the reader. The change is localized and merge-ready after normal checks and review; no actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 3 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title uses the valid Conventional Commit form `fix: subject` and accurately describes the cache-file truncation fix. The branch prefix is not provided, so the required type-to-branch-prefix match …	Provide the branch name or confirm that its prefix is `fix`. If the branch prefix differs, update the title type to match it.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title uses the valid Conventional Commit form fix: subject and accurately describes the cache-file truncation fix. The branch prefix is not provided, so the required type-to-branch-prefix match cannot be verified.

Fix all pre-merge checks with AI

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

codecov · 2026-09-01T11:51:41Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.09%. Comparing base (5352fd8) to head (dc8317f).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #21893   +/-   ##
=======================================
  Coverage   95.09%   95.09%           
=======================================
  Files         702      702           
  Lines       90702    90707    +5     
  Branches    27376    27378    +2     
=======================================
+ Hits        86249    86255    +6     
+ Misses       4453     4452    -1

Flag	Coverage Δ
css-parsing	`24.77% <ø> (ø)`
html5lib	`29.88% <ø> (ø)`
integration	`88.62% <20.00%> (-0.01%)`	⬇️
syntax-equivalence	`79.75% <ø> (ø)`
test262	`44.53% <ø> (-0.01%)`	⬇️
unit	`56.60% <100.00%> (+0.05%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

codspeed · 2026-09-01T12:43:21Z

Merging this PR will improve performance by ×2.1

⚡ 1 improved benchmark
✅ 327 untouched benchmarks

Performance Changes

	Mode	Benchmark	`BASE`	`HEAD`	Efficiency
⚡	Memory	`benchmark "asset-modules-source", scenario '{"name":"mode-development-rebuild","mode":"development","watch":true}'`	1,373.9 KB	651.1 KB	×2.1

Tip

Curious why performance improved? Comment @codspeedbot explain why performance improved on this PR, or directly use the CodSpeed MCP with your agent.

_{Comparing OskarEichler:fix/truncated-cache-file (dc8317f) with main (5352fd8)}

fix: reject truncated cache files

dc8317f

github-actions Bot added the area: cache Persistent and memory caching, serialization (lib/cache, lib/serialization) label Aug 31, 2026

alexander-akait mentioned this pull request Sep 1, 2026

fix: handle audited correctness edge cases #21901

Merged

alexander-akait closed this in #21901 Sep 1, 2026

Navigation Menu

Uh oh!

Uh oh!

fix: reject cache files truncated after stat - #21893

fix: reject cache files truncated after stat#21893
OskarEichler wants to merge 1 commit into
webpack:mainfrom
OskarEichler:fix/truncated-cache-file

OskarEichler commented Aug 31, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

changeset-bot Bot commented Aug 31, 2026

Uh oh!

coderabbitai Bot commented Aug 31, 2026 •

edited

Loading

Walkthrough

Changes

❌ Failed checks (1 inconclusive)

Uh oh!

codecov Bot commented Sep 1, 2026 •

edited

Loading

Uh oh!

codspeed Bot commented Sep 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

OskarEichler commented Aug 31, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

changeset-bot Bot commented Aug 31, 2026

🦋 Changeset detected

Uh oh!

coderabbitai Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 inconclusive)

Uh oh!

codecov Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

codspeed Bot commented Sep 1, 2026

Merging this PR will improve performance by ×2.1

Performance Changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

OskarEichler commented Aug 31, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 31, 2026 •

edited

Loading

codecov Bot commented Sep 1, 2026 •

edited

Loading