codeant-ai-for-open-source[bot] commented on code in PR #45522:
URL: https://github.com/apache/superset/pull/45522#discussion_r4339079605
##########
superset-extensions-cli/src/superset_extensions_cli/templates/frontend/webpack.config.js.j2:
##########
@@ -61,6 +61,15 @@ module.exports = (env, argv) => {
singleton: true,
import: false,
},
+ // Declared here as well as by the host, because Module Federation
+ // only consumes the share scope for modules the remote itself
+ // declares as shared. Without this the extension bundles its own
+ // copy, whose SupersetClient is never configured -- so every call
+ // through it goes out without a CSRF token.
+ "@superset-ui/core": {
+ singleton: true,
+ import: false,
+ },
Review Comment:
Yes—the concern is valid. The share entry makes the host provide
`@superset-ui/core` at runtime, but it does not make the package available to
TypeScript while the generated extension builds.
The scaffold should declare it as a **peer dependency** to document that the
host supplies it, and as a **dev dependency** so local installs can resolve its
types and compile imports such as `SupersetClient`. Use a version range
compatible with the host’s supported version. Keep `import: false`: the
extension should consume the host’s shared copy, not bundle its own.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
