dead code from instanceOf.ts is not tree shaked for browser due globalThis.process

[dimaMachina]

after #3923 and #3501 dead code from instanceOf is no longer tree shaked for browsers

@IvanGoncharov wrote

Bundlers incorrectly replace (probably RegExp) process.env.NODE_ENV with "development" resulting in:

(_globalThis$process = globalThis.process) === null ||
_globalThis$process === void 0
  ? void 0
  : _globalThis$"development";

but this happens only when using globalThis.process.env.NODE_ENV

[vdineva]

Any update on this issue? This is a blocker for us to upgrade to newer versions of graphql and there's an advisory for the version we're currently on: GHSA-9pv7-vfvm-6vr7

[radesai21]

Can we get an update on this? This is a security warning caused by this GHSA-9pv7-vfvm-6vr7

[JoviDeCroock]

For now you can use something like rollup-plugin-replace or the equivalent in your own bundler to do the following

{
  `globalThis.process`: JSON.stringify(true),
  `globalThis.process.env.NODE_ENV`: JSON.stringify("production"),
}

after #4022 most bundlers will be covered however it is possible you will need the following in some

{
  `typeof process`: JSON.stringify('object'),
  `process.env.NODE_ENV`: JSON.stringify("production"),
}

When a minifier sees these met conditions it will prune the unused branch for you.