Backport: Fix unstable_allowDynamic when used with pnpm (#73765)

> [!NOTE]
> This is a backport of #73732 for Next.js 14.

When using dependencies in Middleware that make use of dynamic code
evaluation, Next.js emits a build error because this is not supported in
the Edge runtime.

In rare cases, when the code can not be reached at runtime and can't be
removed by tree-shaking, users might opt in to using the
`unstable_allowDynamic` config.

When combined with pnpm, the provided glob patterns as documented at
https://nextjs.org/docs/messages/edge-dynamic-code-evaluation#possible-ways-to-fix-it
did not match correctly because of pnpm's use of the `.pnpm` directory.

To fix the pattern matching, we need to provide the `dot` option to
[picomatch](https://github.com/micromatch/picomatch), which enables
dotfile matching.

_Side note: Ideally we would detect dynamic code evaluation after tree
shaking, to reduce the number of cases where users need to revert to
using `unstable_allowDynamic`._

fixes #51401

Author: unstubbable

docs/02-app/02-api-reference/07-edge.mdx

@@ -155,7 +155,7 @@ export const config = {
     // allows a single file
     '/lib/utilities.js',
     // use a glob to allow anything in the function-bind 3rd party module
-    '/node_modules/function-bind/**',
+    '**/node_modules/function-bind/**',
   ],
 }
 ```

errors/edge-dynamic-code-evaluation.mdx

@@ -38,7 +38,7 @@ export const config = {
   runtime: 'edge', // for Edge API Routes only
   unstable_allowDynamic: [
     '/lib/utilities.js', // allows a single file
-    '/node_modules/function-bind/**', // use a glob to allow anything in the function-bind 3rd party module
+    '**/node_modules/function-bind/**', // use a glob to allow anything in the function-bind 3rd party module
   ],
 }
 ```

packages/next/src/build/analysis/get-page-static-info.ts

@@ -409,7 +409,7 @@ function getMiddlewareConfig(
       : [config.unstable_allowDynamic]
     for (const glob of result.unstable_allowDynamicGlobs ?? []) {
       try {
-        picomatch(glob)
+        picomatch(glob, { dot: true })
       } catch (err) {
         throw new Error(
           `${pageFilePath} exported 'config.unstable_allowDynamic' contains invalid pattern '${glob}': ${

packages/next/src/build/webpack/plugins/middleware-plugin.ts

@@ -291,7 +291,9 @@ function isDynamicCodeEvaluationAllowed(
 
   const name = fileName.replace(rootDir ?? '', '')
 
-  return picomatch(middlewareConfig?.unstable_allowDynamicGlobs ?? [])(name)
+  return picomatch(middlewareConfig?.unstable_allowDynamicGlobs ?? [], {
+    dot: true,
+  })(name)
 }
 
 function buildUnsupportedApiError({

test/integration/edge-runtime-configurable-guards/lib/index.js test/integration/edge-runtime-configurable-guards/node_modules/.pnpm/test/node_modules/lib/index.js

@@ -21,7 +21,13 @@ const context = {
   logs: { output: '', stdout: '', stderr: '' },
   api: new File(join(__dirname, '../pages/api/route.js')),
   middleware: new File(join(__dirname, '../middleware.js')),
-  lib: new File(join(__dirname, '../lib/index.js')),
+  lib: new File(
+    join(
+      __dirname,
+      // Simulated .pnpm node_modules path:
+      '../node_modules/.pnpm/test/node_modules/lib/index.js'
+    )
+  ),
 }
 const appOption = {
   env: { __NEXT_TEST_WITH_DEVTOOL: 1 },
@@ -74,7 +80,7 @@ describe('Edge runtime configurable guards', () => {
         }
         export const config = {
           runtime: 'edge',
-          unstable_allowDynamic: '/lib/**'
+          unstable_allowDynamic: '**/node_modules/lib/**'
         }
       `)
       await waitFor(500)
@@ -162,14 +168,14 @@ describe('Edge runtime configurable guards', () => {
       url: routeUrl,
       init() {
         context.api.write(`
-          import { hasDynamic } from '../../lib'
+          import { hasDynamic } from 'lib'
           export default async function handler(request) {
             await hasDynamic()
             return Response.json({ result: true })
           }
           export const config = {
             runtime: 'edge',
-            unstable_allowDynamic: '/lib/**'
+            unstable_allowDynamic: '**/node_modules/lib/**'
           }
         `)
         context.lib.write(`
@@ -178,22 +184,25 @@ describe('Edge runtime configurable guards', () => {
           }
         `)
       },
+      // TODO: Re-enable when Turbopack applies the middleware dynamic code
+      // evaluation transforms also to code in node_modules.
+      skip: Boolean(process.env.TURBOPACK),
     },
     {
       title: 'Middleware using lib',
       url: middlewareUrl,
       init() {
         context.middleware.write(`
           import { NextResponse } from 'next/server'
-          import { hasDynamic } from './lib'
+          import { hasDynamic } from 'lib'
 
           // populated with tests
           export default async function () {
             await hasDynamic()
             return NextResponse.next()
           }
           export const config = {
-            unstable_allowDynamic: '/lib/**'
+            unstable_allowDynamic: '**/node_modules/lib/**'
           }
         `)
         context.lib.write(`
@@ -202,15 +211,19 @@ describe('Edge runtime configurable guards', () => {
           }
         `)
       },
+      // TODO: Re-enable when Turbopack applies the middleware dynamic code
+      // evaluation transforms also to code in node_modules.
+      skip: Boolean(process.env.TURBOPACK),
     },
-  ])('$title with allowed, used dynamic code', ({ init, url }) => {
+  ])('$title with allowed, used dynamic code', ({ init, url, skip }) => {
     beforeEach(() => init())
-
-    it('still warns in dev at runtime', async () => {
+    ;(skip ? it.skip : it)('still warns in dev at runtime', async () => {
       context.app = await launchApp(context.appDir, context.appPort, appOption)
       const res = await fetchViaHTTP(context.appPort, url)
       await waitFor(500)
+      // eslint-disable-next-line jest/no-standalone-expect
       expect(res.status).toBe(200)
+      // eslint-disable-next-line jest/no-standalone-expect
       expect(context.logs.output).toContain(
         `Dynamic Code Evaluation (e. g. 'eval', 'new Function') not allowed in Edge Runtime`
       )
@@ -260,14 +273,14 @@ describe('Edge runtime configurable guards', () => {
       url: routeUrl,
       init() {
         context.api.write(`
-          import { hasUnusedDynamic } from '../../lib'
+          import { hasUnusedDynamic } from 'lib'
           export default async function handler(request) {
             await hasUnusedDynamic()
             return Response.json({ result: true })
           }
           export const config = {
             runtime: 'edge',
-            unstable_allowDynamic: '/lib/**'
+            unstable_allowDynamic: '**/node_modules/lib/**'
           }
         `)
         context.lib.write(`
@@ -285,14 +298,14 @@ describe('Edge runtime configurable guards', () => {
       init() {
         context.middleware.write(`
           import { NextResponse } from 'next/server'
-          import { hasUnusedDynamic } from './lib'
+          import { hasUnusedDynamic } from 'lib'
           // populated with tests
           export default async function () {
             await hasUnusedDynamic()
             return NextResponse.next()
           }
           export const config = {
-            unstable_allowDynamic: '/lib/**'
+            unstable_allowDynamic: '**/node_modules/lib/**'
           }
         `)
         context.lib.write(`
@@ -340,7 +353,7 @@ describe('Edge runtime configurable guards', () => {
       url: routeUrl,
       init() {
         context.api.write(`
-          import { hasDynamic } from '../../lib'
+          import { hasDynamic } from 'lib'
           export default async function handler(request) {
             await hasDynamic()
             return Response.json({ result: true })
@@ -356,14 +369,17 @@ describe('Edge runtime configurable guards', () => {
           }
         `)
       },
+      // TODO: Re-enable when Turbopack applies the edge runtime transforms also
+      // to code in node_modules.
+      skip: Boolean(process.env.TURBOPACK),
     },
     {
       title: 'Middleware using lib',
       url: middlewareUrl,
       init() {
         context.middleware.write(`
           import { NextResponse } from 'next/server'
-          import { hasDynamic } from './lib'
+          import { hasDynamic } from 'lib'
           export default async function () {
             await hasDynamic()
             return NextResponse.next()
@@ -378,20 +394,24 @@ describe('Edge runtime configurable guards', () => {
           }
         `)
       },
+      // TODO: Re-enable when Turbopack applies the middleware dynamic code
+      // evaluation transforms also to code in node_modules.
+      skip: Boolean(process.env.TURBOPACK),
     },
-  ])('$title with unallowed, used dynamic code', ({ init, url }) => {
+  ])('$title with unallowed, used dynamic code', ({ init, url, skip }) => {
     beforeEach(() => init())
-
-    it('warns in dev at runtime', async () => {
+    ;(skip ? it.skip : it)('warns in dev at runtime', async () => {
       context.app = await launchApp(context.appDir, context.appPort, appOption)
       const res = await fetchViaHTTP(context.appPort, url)
       await waitFor(500)
+      // eslint-disable-next-line jest/no-standalone-expect
       expect(res.status).toBe(200)
+      // eslint-disable-next-line jest/no-standalone-expect
       expect(context.logs.output).toContain(
         `Dynamic Code Evaluation (e. g. 'eval', 'new Function') not allowed in Edge Runtime`
       )
     })
-    ;(process.env.TURBOPACK_DEV ? describe.skip : describe)(
+    ;(skip || process.env.TURBOPACK_DEV ? describe.skip : describe)(
       'production mode',
       () => {
         it('fails to build because of dynamic code evaluation', async () => {
@@ -429,7 +449,7 @@ describe('Edge runtime configurable guards', () => {
       init() {
         context.middleware.write(`
           import { NextResponse } from 'next/server'
-          import { returnTrue } from './lib'
+          import { returnTrue } from 'lib'
           export default async function () {
             (() => {}) instanceof Function
             return NextResponse.next()