
Security News
Critical Security Vulnerability in React Server Components
React disclosed a CVSS 10.0 RCE in React Server Components and is advising users to upgrade affected packages and frameworks to patched versions now.
@gathertown/circular-dependency-plugin
Advanced tools
Detect modules with circular dependencies when bundling with webpack.
Detect modules with circular dependencies when bundling with webpack.
Circular dependencies are often a necessity in complex software, the presence of a circular dependency doesn't always imply a bug, but in the case where you believe a bug exists, this module may help find it.
Adds support for a faster development workflow by providing options to reduce the number of times this plugin does its processing.
// webpack.config.js
module.exports = {
...
plugins: [
new CircularDependencyPlugin({
// enable developer mode
devMode: true,
// check only once every 2 minutes
checkInterval: 2 * 60 * 1000,
// Other configuration options
...
})
]
...
}
The latest major version of this plugin 5
// webpack.config.js
const CircularDependencyPlugin = require('@gathertown/circular-dependency-plugin')
module.exports = {
entry: "./src/index",
plugins: [
new CircularDependencyPlugin({
// exclude detection of files based on a RegExp
exclude: /a\.js|node_modules/,
// include specific files based on a RegExp
include: /dir/,
// add errors to webpack instead of warnings
failOnError: true,
// allow import cycles that include an asyncronous import,
// e.g. via import(/* webpackMode: "weak" */ './file.js')
allowAsyncCycles: false,
// set the current working directory for displaying module paths
cwd: process.cwd(),
})
]
}
// webpack.config.js
const CircularDependencyPlugin = require('circular-dependency-plugin')
module.exports = {
entry: "./src/index",
plugins: [
new CircularDependencyPlugin({
// `onStart` is called before the cycle detection starts
onStart({ compilation }) {
console.log('start detecting webpack modules cycles');
},
// `onDetected` is called for each module that is cyclical
onDetected({ module: webpackModuleRecord, paths, compilation }) {
// `paths` will be an Array of the relative module paths that make up the cycle
// `module` will be the module record generated by webpack that caused the cycle
compilation.errors.push(new Error(paths.join(' -> ')))
},
// `onEnd` is called before the cycle detection ends
onEnd({ compilation }) {
console.log('end detecting webpack modules cycles');
},
})
]
}
If you have some number of cycles and want to fail if any new ones are introduced, you can use the life cycle methods to count and fail when the count is exceeded. (Note if you care about detecting a cycle being replaced by another, this won't catch that.)
// webpack.config.js
const CircularDependencyPlugin = require('circular-dependency-plugin')
const MAX_CYCLES = 5;
let numCyclesDetected = 0;
module.exports = {
entry: "./src/index",
plugins: [
new CircularDependencyPlugin({
onStart({ compilation }) {
numCyclesDetected = 0;
},
onDetected({ module: webpackModuleRecord, paths, compilation }) {
numCyclesDetected++;
compilation.warnings.push(new Error(paths.join(' -> ')))
},
onEnd({ compilation }) {
if (numCyclesDetected > MAX_CYCLES) {
compilation.errors.push(new Error(
`Detected ${numCyclesDetected} cycles which exceeds configured limit of ${MAX_CYCLES}`
));
}
},
})
]
}
This module is maintained despite few changes being necessary, please open issues if you find any bugs relating to integration with webpack core.
FAQs
Detect modules with circular dependencies when bundling with webpack.
We found that @gathertown/circular-dependency-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
React disclosed a CVSS 10.0 RCE in React Server Components and is advising users to upgrade affected packages and frameworks to patched versions now.

Research
/Security News
We spotted a wave of auto-generated “elf-*” npm packages published every two minutes from new accounts, with simple malware variants and early takedowns underway.

Security News
TypeScript 6.0 will be the last JavaScript-based major release, as the project shifts to the TypeScript 7 native toolchain with major build speedups.