dead code from `instanceOf.ts` is not tree shaked for browser due `globalThis.process`

[dimaMachina]

after #3923 and #3501 dead code from instanceOf is no longer tree shaked for browsers

@IvanGoncharov wrote

Bundlers incorrectly replace (probably RegExp) process.env.NODE_ENV with "development" resulting in:

(_globalThis$process = globalThis.process) === null ||
_globalThis$process === void 0
  ? void 0
  : _globalThis$"development";

but this happens only when using globalThis.process.env.NODE_ENV

[vdineva]

Any update on this issue? This is a blocker for us to upgrade to newer versions of graphql and there's an advisory for the version we're currently on: GHSA-9pv7-vfvm-6vr7

[radesai21]

Can we get an update on this? This is a security warning caused by this GHSA-9pv7-vfvm-6vr7

[JoviDeCroock]

For now you can use something like rollup-plugin-replace or the equivalent in your own bundler to do the following

{
  `globalThis.process`: JSON.stringify(true),
  `globalThis.process.env.NODE_ENV`: JSON.stringify("production"),
}

after #4022 you'll be able to look it up in the docs, see the files changed you can pick and choose your bundler.

[JoviDeCroock]

Hey @dimaMachina #4022 is live in the latest 16.x.x line, does this solve your issue?