feat(es/loader): add opt-in Yarn PnP resolver (refs #3247)

[Mukunda Rao Katta (MukundaKatta)]

Summary

Refs #3247. Adds an opt-in Yarn Plug'n'Play resolver to swc_ecma_loader. Addresses the maintainer's blocker (running .pnp.cjs JS in a Rust host) by reading the JSON manifest variant .pnp.data.json, which Yarn emits when pnpEnableInlining: false is set.

Files changed

• crates/swc_ecma_loader/src/resolvers/pnp.rs (new, 539 lines incl. 6 unit tests)
• crates/swc_ecma_loader/src/resolvers/mod.rs — module gate
• crates/swc_ecma_loader/Cargo.toml — new opt-in pnp feature; only adds serde_json; tempfile as dev-dep
• Cargo.lock — auto-updated for tempfile dev-dep

Public API

• PnpResolver::new(path) and PnpResolver::discover(start_dir)
• resolve_bare(from, specifier)
• Full Resolve trait impl

Bare specifiers (incl. scoped) handled. Relative/absolute/node-builtin specifiers pass through (returns Ok(None)) so callers compose with NodeModulesResolver. Manifest cached in Arc.

Scope notes

Resolver intentionally stops at the package directory + subpath and lets the existing node resolver handle main/exports — avoids logic duplication. Maintainers may prefer a fuller package.json["exports"]/zip-fs walk; happy to extend if so.

Test plan

• cargo fmt -p swc_ecma_loader --check clean
• cargo clippy -p swc_ecma_loader --features pnp --all-targets -- -D warnings clean
• cargo test -p swc_ecma_loader --features pnp passes 6/6 (split_specifier, discover hit/miss, resolve_bare hit, relative/builtin pass-through, unknown-module pass-through)
• Default-feature build/test still green

[changeset-bot]

🦋 Changeset detected

Latest commit: 863aac4

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[CLAassistant]

All committers have signed the CLA.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	eslint-define-config@​1.24.1
	eslint@​8.57.0
	glob@​8.1.0
	dprint@​0.35.4
	jest@​29.7.0
	expect@​27.5.1
	npm-run-all@​4.1.5
	sourcemap-validator@​2.1.0
	react@​17.0.2
	husky@​7.0.4
	regenerator-runtime@​0.13.11
	reflect-metadata@​0.1.14
	@​types/​node@​20.12.12
	swc-plugin-coverage-instrument@​0.0.26
	js-beautify@​1.14.7
	ts-node@​10.9.1
	prop-types@​15.8.1
	source-map-support@​0.5.21
	tsx@​3.14.0
	semver@​7.6.2 ⏵ 7.5.4
	octokit@​3.2.1
	zx@​8.1.4
	yaml@​2.4.5
	webpack-dev-server@​3.11.3
	eslint-plugin-n@​16.6.2
	source-map@​0.7.4
	typescript@​5.5.4
	typescript@​5.3.3
	webpack-cli@​3.3.12
	terser@​5.17.6
	prettier@​2.8.8
	cspell@​5.21.2
	lint-staged@​12.5.0
See 2 more rows in the dashboard

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm js-beautify is 100.0% likely obfuscated Confidence: 1.00 Location: Package overview From: package.json → npm/js-beautify@1.14.7 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/js-beautify@1.14.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks
⏩ 220 skipped benchmarks¹

---

_{Comparing MukundaKatta:feat/yarn-pnp-resolver (863aac4) with main (3ed7243)}

Footnotes

1. 220 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[github-actions]

Binary Sizes

File	Size
swc.linux-x64-gnu.node	27M (27782984 bytes)

Commit: ece9042