
Research
/Security News
Miasma Mini Shai-Hulud Hits ImmobiliareLabs npm Packages
Miasma Mini Shai-Hulud hits @immobiliarelabs Backstage plugins, targeting GitLab and LDAP auth packages on npm.
Rolldown paused Rust React Compiler integration after a 5MB binary size increase raised concerns about shipping React-specific code to all Vite users.

June 26, 2026
4 min read


Rolldown and Vite pulled a Rust-based React Compiler integration after maintainers decided the binary-size cost was too high for a feature that would ship to all users by default. Boshen, a maintainer involved in Rolldown and Oxc, said the increase could not be justified for the full Vite user base.
“We withdrew the Rust React Compiler integration from Rolldown and Vite because it increased the binary size from 28.7MB to 33.8MB, a 17% increase,” he wrote.
The work has been in discussion for over a year. In March 2025, the React team opened an Oxc issue about adding React Compiler support as an Oxc plugin. The goal was to let React apps drop Babel pipelines when they only needed Babel for React Compiler. That matters for Vite because its Rolldown integration is meant to move more of Vite’s build pipeline onto a Rust-based bundler.
In June, Boshen merged an Oxc PR integrating the Rust port of React Compiler. The PR showed the tradeoff clearly: the React Compiler path added measurable transform overhead and increased the Oxc napi transform addon from 3.51 MiB to 8.66 MiB, a 5.14 MiB increase.

A follow-up Rolldown PR wired that work into Rolldown behind a new transform.reactCompiler option. That PR was closed on June 9.
The decision drew pushback from both sides. Some argued the integration should not live in Vite or Rolldown core at all. React Compiler is useful for React projects, but Vite is used across frameworks, and critics saw the integration as framework-specific bloat in a tool that is supposed to stay framework-agnostic.
Several developers asked why React-specific compiler support should add weight to every install when it could ship through vite-plugin-react or another opt-in package instead.
Others thought the size concern was overblown. In that view, a roughly 5MB increase is a small price for a development dependency. Several commenters argued that the team could ship the integration first to make builds faster, and trim the size over time, rather than blocking it on the initial binary-size cost.
Evan You pushed back on that argument, saying it reflects “a clear disconnect between those who use React only vs. those who don’t use React at all.”
“Vite is framework agnostic, vendor agnostic, and we can’t go down that slippery slope,” You wrote. He asked what happens if Vite adds another 5MB for a Rust Vue compiler, then more for Svelte, Solid, and Astro. “One can argue React is the most popular so it deserves special treatment, but where should that line be drawn? Why NOT other frameworks?”
You also pointed to scale. Vite is downloaded 12 million times a week, and every uncached download consumes bandwidth and CI time. In a follow-up, he added that 5MB looks different when the whole tool is “20ish mb,” and said the team is willing to do the work to make it smaller.
The maintainer side is looking at a different cost. A default binary is paid for by every user, including projects that do not use React. Vite is not a React-only tool, and Rolldown is meant to serve more than one framework. From that perspective, even a few megabytes become harder to justify if the feature only benefits part of the user base.
The plugin answer sounds obvious, but compiler work complicates it. A JavaScript plugin can preserve opt-in behavior, but it may also reintroduce the overhead that a native Rust integration is trying to avoid.
Evan You argued that React Compiler exposes a performance tradeoff in Oxc. A Rust-based plugin is already much faster than Babel, he said, but still up to 50% slower than a direct Oxc integration because of data passing and AST cloning overhead.
Frontend build-tool rival Rspack shipped version 2.1 today with Rust React Compiler support as a headline feature, including benchmarks showing the Rust version running 7–13x faster than Babel. The release makes the tradeoff around native-addon size more immediate: Rust-backed tooling can deliver major build-time gains, but the ecosystem still needs practical ways to ship those gains without making installs significantly heavier.
The size discussion is already producing adjacent work. John-David Dalton, a participant in the debate, opened a new napi-rs proposal for an optional --compress flag that would ship native addons in compressed form. In his Vite 8.1.0 example, the native addon footprint drops from 25.74MB to 8.15MB on darwin-arm64, while runtime speed stays unchanged after the compressed addon is decompressed and cached.

React is not the only framework running into this shift. Angular has also teased Rust compiler work, another sign that native tooling is becoming less of a side experiment and more of a default direction for frontend frameworks.
The Oxc PR shows some of that complexity. Boshen traced part of the binary growth to the Rust port keeping the JavaScript plugin’s interface: it returned a JSON-serialized Babel AST, which Oxc then parsed back into Rust types in the same process. Removing that full-file JSON round trip cut transform time on a large test file from 14.95 ms to 10.83 ms and reduced the napi addon by another 759 KiB.
Longer term, You said the team wants to make raw AST transfer available to transform plugins, which could let Oxc plugins avoid the AST cloning overhead that makes the direct integration faster today.
Boshen is now experimenting with a smaller implementation. He said early Claude-assisted work shows up to a 2x performance improvement with only a 1.4MB binary size increase. The next step, in his words, is to “de-slopify” the code, get it into a maintainable state, and upstream some of the changes.
If that work holds up, React users could still get the direct Oxc implementation without making every Vite and Rolldown user carry the original 5MB increase.

Subscribe to our newsletter
Get notified when we publish new security blog posts!

Research
/Security News
Miasma Mini Shai-Hulud hits @immobiliarelabs Backstage plugins, targeting GitLab and LDAP auth packages on npm.

Security News
/Research
Mini Shai-Hulud expands into the Go ecosystem after hitting LeoPlatform npm packages and targeting GitHub Actions workflows.

Security News
The Fable shutdown shows how quickly model access can become a business continuity risk for AI-dependent engineering teams.