build: Update swc_core to v75.0.0

[Donny/강동윤 (kdy1)]

No description provided.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7be518d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​lightningcss@​1.0.0-alpha.71 ⏵ 1.0.0-alpha.72	+1
	cargo/​parcel_selectors@​0.28.2 ⏵ 0.28.3
	cargo/​swc_ecma_transforms_base@​46.0.0 ⏵ 47.0.0
	cargo/​swc_core@​74.0.0 ⏵ 75.0.0
	cargo/​anyhow@​1.0.103 ⏵ 1.0.104
	cargo/​serde@​1.0.228 ⏵ 1.0.229
	cargo/​serde_json@​1.0.150 ⏵ 1.0.151
	cargo/​swc_ecma_visit@​26.0.0 ⏵ 27.0.0
	cargo/​swc_ecma_minifier@​58.0.0 ⏵ 59.0.0
	cargo/​phf@​0.13.1
	cargo/​swc_ecma_ast@​26.0.0 ⏵ 27.0.0
	cargo/​swc_ecma_codegen@​29.0.0 ⏵ 30.0.0
	cargo/​swc_ecma_parser@​42.0.0 ⏵ 43.0.0
	cargo/​swc_ecma_transforms_testing@​50.0.0 ⏵ 51.0.0
	cargo/​swc_ecma_utils@​32.0.0 ⏵ 33.0.0
	cargo/​swc_plugin_proxy@​27.0.0 ⏵ 28.0.0
	cargo/​clap@​4.6.2 ⏵ 4.6.4
	cargo/​serde_repr@​0.1.20 ⏵ 0.1.21			+4
	cargo/​swc_ecma_transforms@​59.0.0 ⏵ 60.0.0
	cargo/​swc_ecma_transforms_react@​52.0.0 ⏵ 53.0.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: cargo zerocopy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/preset_env_base@8.0.1 → cargo/swc_atoms@10.0.0 → cargo/lightningcss@1.0.0-alpha.72 → cargo/swc_core@75.0.0 → cargo/swc_ecma_codegen@30.0.0 → cargo/swc_ecma_minifier@59.0.0 → cargo/swc_ecma_transforms_react@53.0.0 → cargo/swc_cached@2.0.0 → cargo/zerocopy@0.8.55 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/zerocopy@0.8.55. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[claude]

Review: build: Update swc_core to v75.0.0

Mechanical dependency-bump + release PR. I verified the consistency of the version graph programmatically rather than eyeballing it, and it checks out. No bugs found. Details below, plus a few non-blocking observations.

Verified ✅

• Workspace deps are coherent. swc_core 74→75 plus all 11 sibling crates (swc_ecma_ast 26→27, codegen 29→30, minifier 58→59, parser 42→43, transforms 59→60, transforms_base 46→47, transforms_react 52→53, transforms_testing 50→51, utils 32→33, visit 26→27) and swc_plugin_proxy 27→28 all moved together — no crate left on the old major.
• Cargo.lock is in sync. Checked all 35 workspace manifests: every name/version pair has a matching lock entry (0 mismatches). Only one swc_core node exists (75.0.0), so no stale v74 lingering transitively, and there are no duplicated swc_* crates in the graph (the only duplicates are unrelated third-party crates like hashbrown/syn/phf).
• Path-dependency version pins match reality. Cross-checked every { path = ..., version = ... } declaration against the target crate's actual version — 0 suspects. This is the class of thing that usually gets missed in a lockstep bump (e.g. packages/formatjs/transform/Cargo.toml:34 correctly moved the swc_icu_messageformat_parser pin to 34.0.0 alongside crates/swc_icu_messageformat_parser/Cargo.toml:9).
• All 18 publishable packages updated. 16 under packages/ + 2 under contrib/, each with package.json + CHANGELOG.md + README changelog section. The three without a README changelog diff (swc-confidential, mut-cjs-exports, graphql-codegen-client-preset) simply never had that section — nothing missing.
• Semver classification matches convention. ### Minor Changes for an swc_core major is what v72/v73/v74 did too (see packages/emotion/CHANGELOG.md), so this is consistent, not a slip.
• No hardcoded swc_core version anywhere else. Grepped docs/CI/JSON — the only references are historical changelog lines and renovate.json's group name. No compat table to update (contrib/mut-cjs-exports/README.md defers to swc.rs).

Observations (non-blocking)

1. swc_icu_messageformat_parser takes a breaking major for zero API change. 33.0.0 → 34.0.0, but that crate has no swc_core dependency at all — its deps are langtag, once_cell, regex, serde, serde_repr, widestring, with testing only in dev-deps. Downstream consumers of that published crate eat a semver-major for a no-op. swc_experimental_babel and swc_feature_flags legitimately need theirs (both depend on swc_core/swc_ecma_* in public API), so this is the one crate where the lockstep bump is pure churn. Worth considering excluding it from the group if anyone outside this repo depends on it.

2. Stale peer range in contrib/mut-cjs-exports/package.json:44. "@swc/core": "^1.10.0" — a wasm plugin compiled against swc_core v75 won't load in @swc/core 1.10.x; the user gets a runtime plugin-version-mismatch error instead of an install-time warning. Pre-existing, but each swc_core major widens the gap. Bumping the floor would turn a confusing runtime failure into an npm warning. (The other 17 packages declare no peer at all, which is a deliberate choice given the swc.rs compatibility docs — just noting the inconsistency.)

3. Confidence rests entirely on CI, which was still pending when I looked. Two coverage gaps make that worth calling out for a major bump specifically:

• .github/workflows/CI.yml:82-83 excludes swc_plugin_styled_jsx, styled_jsx, swc_plugin_formatjs, and swc_formatjs_transform from the swc_ast_unknown check (matching their build scripts, which also omit the RUSTFLAGS — so this is intentional, not drift).
• @swc-contrib/plugin-graphql-codegen-client-preset has "test": "echo 'No tests'", so its v75 compatibility is only ever compile-checked, never executed. A manual smoke test on swc_core majors would be cheap insurance for that one.

4. Drive-by nit: packages/emotion/Cargo.toml:3 has a copy-pasted description from transform-imports — "SWC plugin for https://www.npmjs.com/package/babel-plugin-transform-imports". Pre-existing and cosmetic (publish = false), but easy to fix while you're in the file.

Performance / security

Nothing concerning. Transitive graph changes are small and upstream-driven: const-str-proc-macro 0.3.2 dropped, phf/phf_generator/phf_macros/phf_shared 0.13.1 and syn 3.0.3 added. That does leave three syn majors (1.0.109 / 2.0.119 / 3.0.3) and two phf lines in the tree — a mild cold-build cost, nothing actionable here. No new first-party code, so no new attack surface; Socket Security checks pass.

Verdict: looks good to merge once the integration tests and the swc_ast_unknown check go green. Since no .rs files were touched, a green Test - ubuntu-latest / Integration Test run is the real signal that v75 introduced no source-breaking API changes for these plugins.

[Donny/강동윤 (kdy1)]

Claude (@claude) Fix CI failures

[claude]

Claude finished Donny/강동윤 (@kdy1)'s task in 17m 49s —— View job

---

CI fixes pushed — 7be518d

• Identify failing CI jobs and read logs
• Reproduce locally
• Implement fix
• Verify (cargo test --all --no-fail-fast: 81/81 targets green, RUSTFLAGS=--cfg swc_ast_unknown cargo check, cargo fmt --check, cargo clippy)
• Commit & push

What was failing

Test - ubuntu-latest and Test - windows-latest both died in cargo test on styled_components. Because cargo test --all stops at the first failing target, CI only ever reported that one — running with --no-fail-fast locally surfaced two more failing targets that would have shown up on the next run anyway:

Crate	Tests	Cause
styled_components	1	swc_ecma_transforms_base v47 fixer change
swc_emotion	3	same fixer change
styled_jsx	2	lightningcss v1.0.0-alpha.72 minifier

Root cause: the annotation range of /*#__PURE__*/

v47's fixer parenthesizes a PURE-annotated callee/receiver so the annotation range survives a re-emit (swc-project/swc#12019, fixer.rs:415 + fixer.rs:653). The flag is stored by position, and both plugins annotated a call that starts at the same BytePos as its own nested styled(..) call, so the fixer resolved the ambiguity in favor of the inner call and wrapped it:

// styled-components (outer span = tagged template span = inner call's lo)
- const Test2 = /*#__PURE__*/ styled("div").withConfig({...})([``]);
+ const Test2 = /*#__PURE__*/ (styled("div")).withConfig({...})([``]);

// emotion
- const SpanContainer = /*#__PURE__*/ styled("span", {...})({...});
+ const SpanContainer = /*#__PURE__*/ (styled("span", {...}))({...});
- const ContainerWithOptions = /*#__PURE__*/ styled("div", {...})("color:hotpink;");
+ const ContainerWithOptions = (/*#__PURE__*/ styled("div", {...}))("color:hotpink;");

I did not accept these as the new snapshots, because the parens are not cosmetic — they narrow the annotation to the inner styled(...) factory call, which is trivially side-effect-free anyway. The component-creating outer call is exactly the one that needs to be pure, so blessing the snapshots would have silently cost styled-components/emotion users tree-shaking of every styled("tag") / styled(Component) component (the styled.div member forms were unaffected — their intermediate withConfig call has a dummy span, which is why only 4 of the ~93 fixtures moved).

Fix

Annotate a synthesized position (Span::dummy_with_cmt()) that no other node shares, so the annotation is unambiguously owned by the outer call. Emitted output is then byte-identical to swc_core v74 — no fixture snapshot changes in either plugin.

• packages/styled-components/transform/src/visitors/pure_annotation.rs — reuse the existing "dummy span → fresh comment position" path when a nested call/new/tagged template on the leftmost spine of the callee starts at the same position (new starts_with_call_at helper).
• packages/emotion/transform/src/lib.rs — new add_pure_comment_with_new_span, used at the two ambiguous sites (styled('div')({}) in fold_call_expr, styled('div') `` in fold_expr). The `BytePos(0)` guard is kept, so React-Compiler-synthesized calls with dummy spans still get no hint. The other 7 `add_pure_comment` sites annotate an ident or member callee, which the fixer never parenthesizes, so they're untouched.

Fixtures that genuinely needed updating

packages/styled-jsx/transform/tests/fixture/{transform-css,transform-css-global}/output.lightningcss.js — unrelated to swc_core: lightningcss alpha.71 → alpha.72 now minifies rgba(255,255,255,.8) to the equivalent 4-digit hex #fffc. Only the two .lightningcss.js snapshots changed; the non-lightningcss variants are identical.

Note on release

No changeset added — the branch already carries the RELEASING: Releasing 18 package(s) bump, and these fixes keep behavior at v74 parity rather than changing it, so they ride along under the existing "Update swc_core to v75.0.0" entries. Say the word if you'd rather they be called out separately.
• Branch kdy1/core

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ kdy1
❌ github-actions[bot]
_{You have signed the CLA already but the status is still pending? Let us recheck it.}