unstale

npm / @module-federation/sdk

@module-federation/sdk

What changed in @module-federation/sdk 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-19.

2 breaking1 security5 new APIs and options1 behavior and defaults7 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.0 on npm

@module-federation/sdk 216 changes

Breaking changes 2

  • The node-fetch fallback and optional peer dependency were removed; native fetch is used where available, avoiding up to ~9MB of optional install weight.

    2.7.0release notes

  • The legacy Data Prefetch package and its related configuration, manifest fields, and runtime hooks were removed.

    2.4.0release notes

Security 1

  • Bundle loading adds SHA-256 hashes to manifests.

    2.5.0release notes

New APIs and options 5

  • Bundle loading gains optional cache layer integration.

    2.5.0release notes

  • Loader hooks can access resource context, and preload resource results are tracked.

    2.5.0release notes

  • Adds a callback that runs after each successful type generation in dev and prod modes, allowing follow-up work with generated files.

    2.3.0release notes

  • Adds outputDir so users can configure where @mf-types.zip and @mf-types.d.ts are emitted.

    2.2.0release notes

  • A standalone entrypoint exposes runtime-safe helpers for webpack require, share-scope globals, and ignored dynamic imports, independently of the SDK main index bundle.

    2.1.0release notes

Behavior and default changes 1

  • Builds can exclude unused remote consumption and shared capabilities, and omit Webpack container initialization when no exposes are configured.

    2.8.0release notes

Fixes and other changes 7

  • Chunk flushing uses manifest expose assets, including for aliased remotes, and derives legacy federated stats compatibility assets without an extra Webpack stats traversal.

    2.8.1release notes

  • Node built-in imports are now handled in the Node ESM remote loader.

    2.7.0release notes

  • Allows the default IP family option to auto-select when set to 0.

    2.5.1release notes

  • Fixes Windows manifest type URL resolution in dts-plugin consumeTypes.

    2.5.1release notes

  • The optional peer range now accepts node-fetch ^2.7.0 as well as ^3.3.2, resolving a version conflict with @module-federation/node.

    2.4.0release notes

  • Fixes capture of timeout network errors.

    2.3.0release notes

  • Enhances error handling for script loading and execution.

    2.2.0release notes