fix(enhanced): resolve protocol requiredVersion from installed package

[tonoizer]

What changed

Auto requiredVersion for shared consumes no longer treats package-manager protocol dependency strings (catalog:, catalog:name, workspace:*, npm:…, patch:, file:, link:, portal:) as usable version ranges.

When the app package.json lists such a specifier, @module-federation/enhanced now falls back to the installed package’s .version and sets requiredVersion to ^<installed> (for example ^19.2.4). Plain semver ranges in package.json (^18.2.0, *) are unchanged, and git URL dependencies keep existing normalizeVersion behavior.

Why

Protocol strings are not semver. normalizeVersion previously turned them into '', and Consume treated that as “found,” so runtime matching failed or warned and users had to pin requiredVersion by hand.

Impact

Apps using pnpm/yarn/bun catalogs or workspace/npm aliases with Module Federation shared deps get a real caret range from the resolved install without manual requiredVersion.

Validation

• pnpm exec turbo run build --filter=@module-federation/enhanced...
• pnpm exec rstest for requiredVersion-protocol.test.ts, ConsumeSharedPlugin.createConsumeSharedModule.test.ts, all ConsumeSharedPlugin/ unit tests, and utils-filtering.test.ts
• Changeset: .changeset/fix-shared-required-version-protocols.md

Skipped full test:packages / ci:local (change is scoped to enhanced sharing utils + ConsumeSharedPlugin).

  

[github-actions]

Bundle Size Report

7 package(s) changed, 36 unchanged.

Package dist + ESM entry

Package	Total dist (raw)	Delta	ESM gzip	Delta
@module-federation/enhanced	819.6 kB	+2.4 kB (+0.3%)	672 B	no change
@module-federation/playground	28.91 MB	-697 B (-0.0%)	45.7 kB	no change

Bundle targets

Package	Web bundle (gzip)	Delta	Node bundle (gzip)	Delta
@module-federation/cli	2.3 kB	-5 B (-0.2%)	2.4 kB	-30 B (-1.2%)
@module-federation/core	1.0 kB	+3 B (+0.3%)	1.0 kB	-31 B (-2.9%)
@module-federation/devtools	30.3 kB	no change	30.3 kB	-23 B (-0.1%)
@module-federation/enhanced	2.7 kB	+5 B (+0.2%)	2.8 kB	-41 B (-1.4%)
@module-federation/metro-plugin-rnc-cli	416 B	no change	435 B	-24 B (-5.2%)
@module-federation/node	9.1 kB	+3 B (+0.0%)	9.2 kB	-27 B (-0.3%)

Consumer scenarios

Scenario	Web output (gzip)	Delta	Node output (gzip)	Delta	Gap (node-web)	Delta
Enhanced remoteEntry	22.3 kB	-19 B (-0.1%)	23.8 kB	-11 B (-0.0%)	+1.6 kB	+8 B

Total dist (raw): 36.16 MB (+1.7 kB (+0.0%))
Total ESM gzip: 111.4 kB (no change)
Total web bundle (gzip): 253.1 kB (+6 B (+0.0%))
Total node bundle (gzip): 255.3 kB (-176 B (-0.1%))
Tracked ./bundler entry gzip: 563 B (no change)
Tracked ./bundler web bundle (gzip): 4.9 kB (no change)
Tracked ./bundler node bundle (gzip): 4.9 kB (no change)

Bundle sizes are generated with rslib (Rspack). Package-root metrics preserve the historical report. Tracked subpath exports such as ./bundler are measured separately so ENV_TARGET-driven tree-shaking is visible. Bare imports are externalized to keep package-level sizes consistent, and assets are emitted as resources.