next.js

df88058f - Turbopack: switch from base40 to base38 hash encoding (remove ~ and . from charset) (#91832)

Turbopack: switch from base40 to base38 hash encoding (remove ~ and . from charset) (#91832) ### What? Switch Turbopack's hash encoding charset from base40 (`0-9 a-z _ - ~ .`) to base38 (`0-9 a-z _ -`), removing the `~` and `.` characters. Pure rename/charset change — no structural changes. ### Why? The `~` and `.` characters in base40-encoded filenames are blocked by standard Nginx hardening rules (`block_common_exploits.conf`) and enterprise WAF configurations, causing **403 Forbidden errors** when applications are deployed behind security-hardened infrastructure. Examples of problematic filenames: - `turbopack-0c3o1svijj_~~.js` — `~~` flagged as directory traversal / injection - `0...f7~att2_2.js` — `...` flagged as path traversal attempt - `0q~2copru0zy0.css` — `~` filtered by some WAF rulesets Previous hex-only filenames (e.g. `turbopack-01ca012029ca2e66.js`) had no such issues. Fixes https://github.com/vercel/next.js/issues/91678 ### How? **Charset change** (`turbo-tasks-hash/src/base38.rs`, renamed from `base40.rs`): - Alphabet reduced from 40 to 38 characters: `0123456789abcdefghijklmnopqrstuvwxyz_-` - All constants and functions renamed: `BASE40_*` → `BASE38_*`, `encode_base40` → `encode_base38` - Hash lengths unchanged: 13 chars for 64-bit, 25 chars for 128-bit (`38^13 > 2^64`, `38^25 > 2^128`) - Content hash length stays at 13 (68.2 bits vs 69.2 bits with base40 — negligible) **`HashAlgorithm` enum variants** (`turbo-tasks-hash/src/lib.rs`): - `Xxh3Hash64Base40` → `Xxh3Hash64Base38` - `Xxh3Hash128Base40` → `Xxh3Hash128Base38` **Bit computation comment** (`turbopack-core/src/ident.rs`): - Updated `7 base38 chars ≈ 37 bits` → `≈ 36 bits` (log2(38) × 7 = 36.7) **Test regex patterns** (15 test files): - Updated `[0-9a-z_.~-]` → `[0-9a-z_-]` to match the new charset --------- Co-authored-by: Tobias Koppers <sokra@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com>