chore: vendor micromatch under @jest/micromatch

[wtgtybhertgeghgtwtg]

Summary

Proposal for temporary measure as discussed in #8032 (use a rollup'd version of micromatch@3 until micromatch@4 becomes available to avoid require's). Probably needs a license note somewhere.

Test plan

Everything should work as it did.

[wtgtybhertgeghgtwtg]

Browser build is failing because it can't find net. It works if I add net: 'empty' to scripts/browserBuild.js, but I don't know if you want to do that just for this.

[jeysal]

Thanks for doing this, I'll profile the performance of this when I have some time this week so we can better decide if it's worth it.

[jeysal]

jasmine2() total times in ms (very consistent within a few ms):
bundled (#8046): 750
micromatch3 (master): 1410
micromatch2 (#8032): 920

So the bundled micromatch 3 is even better than micromatch 2. We really seem to have a problem with loading many small modules, which could also come from our custom require impl / module registry, given that a normal Node require('micromatch') does not surface such extreme differences.
Anyone have ideas what the issues with our require performance could be? Would be cool to optimize that a little, either way we should probably keep bundling code that is loaded in the runtime at the back of our minds as a possible performance optimization.

[DylanVann]

Way out of scope of fixing this regression, but it sounds like Jest may benefit from bundling in general. This article on performance of bundled vs. unbundled code is interesting: https://zeit.co/blog/ncc#faster-bootup

[wtgtybhertgeghgtwtg]

I'm against bundling dependencies for a good number of reasons. The only reason I put forward vendoring micromatch is because the require time problem has been an issue for almost a year and the alternatives are not any better.

[cozmy]

Hi! Any ideas when this will be merged?

[SimenB]

The browser build is broken in this PR which needs to be fixed first.

That said, I'm more in favor of waiting for micromatch@4 to come out.

[wtgtybhertgeghgtwtg]

It can be fixed by adding net: 'empty' to scripts/browserBuild.js, I'd just like some direction on whether or not I should do that.
I don't like the idea of bundling dependcies, but it's better than using a version with a CVE.

[SimenB]

I'm more afraid about it being a breaking change to use v2 (more specifically, going from 2 to 3/4 later is breaking) than the CVE. If CVEs stops people's build pipelines with no way to ignore specific dependencies (in this case, it's a development time one), they should fix their pipeline.

That said, downgrading is, unless everybody strongly disagrees with me, not an option

[wtgtybhertgeghgtwtg]

Tests failing linting because of license check. I'm not sure how that'd work; I don't think vendored stuff is supposed to have a Facebook license.

[jeysal]

@wtgtybhertgeghgtwtg check out https://github.com/facebook/jest/blob/50300ab1252e1e02de9a456f2edc60b2fac3bc8f/scripts/checkCopyrightHeaders.js#L98

[jeysal]

@SimenB sooooo would you be fine with using this temporarily? In case micromatch 4 really does come out soon (and performs well) we don't really lose anything (this might not even be in a Jest release if it's really soon) but if it ends up taking longer we'll help people esp. with small projects a lot.

[scotthovestadt]

@jeysal Can you provide instructions on how to benchmark it? I want to look into the root cause of the slowness & see if changes I made haven't already improved it.

[jeysal]

We just had a call about this, a quick summary for documentation purposes:

• I used https://github.com/cozmy/jest-performance from Very poor performance on basic tests #7963, linked jest-cli into it and profiled a single --inspect-brk Jest run
• The numbers for "jasmine2() total times in ms" are taken from the jasmine2 bar in the flame chart
• The initialization time of just micromatch/braces that can be found searching for /braces/index in the bottom-up/top-down profiler views might also be interesting (screenshots in WIP fix performance regression #8032)

[wtgtybhertgeghgtwtg]

Looks like micromatch@4 is out.

[jeysal]

And it's probably really really tiny, compare v2, v3, v4

[github-actions]

This pull request has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.
Please note this issue tracker is not a help forum. We recommend using StackOverflow or our discord channel for questions.