Non-deterministic order of glob imports

[filips123]

🐛 bug report

When using glob imports, the order of imports in the bundle can differ each time the package is built.

🎛 Configuration (.babelrc, package.json, cli command)

See in the code sample below.

🤔 Expected Behavior

When the same source code is built multiple times, the result should be completely the same. This includes the order of imports, names of minified variables, and hashes in filenames.

😯 Current Behavior

The order in which files imported with glob import are included in the bundle can be different each time. This also causes the filename hashes to differ.

Here are two build results, produced after running yarn build from the same source (available below) multiple times:

• firefoxpwa-2.12.2-compiled-1.zip
• firefoxpwa-2.12.2-compiled-2.zip

There is a difference between the order of bundled JSON files in manage.6e285bee.js and manage.5d13f5f6.js. Specifically, the import ihRmT is on different positions. I've also seen other variations, but I haven't saved them.

Note that in this case, the first version here is the most common. I had to run yarn build around 5 times before the second version was generated. But in another attempt, variations were more common.

🔦 Context

I'm using Parcel to build a Firefox extension. Because of this non-deterministic builds, the extension failed the review, as Firefox policies require that all extensions are reproducible from source.

💻 Code Sample

The extension I'm trying to build is available on GitHub.

The exact line where I'm using glob imports is here. I also have a custom transformer here for locales, but I'm not sure if this if the reason for the issue.

The exact source that I used to build the above examples (same as in the repository, but with version set in a few files):

• firefoxpwa-2.12.2-source.zip

🌍 Your Environment

Software	Version(s)
Parcel	v2.12.0
Node	v20.15.0
npm/Yarn	Yarn v1.22.22
Operating System	Windows 11