[somiljain2006]

All Submissions:

• Have you followed the guidelines stated in the CONTRIBUTING.md file?
• Have you checked to ensure there aren't any other open Pull Requests for the desired change?

Type of change

Please delete options that are not relevant.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality not to work as expected)
• This change requires a documentation update

New Feature Submission:

• Does your submission pass the tests?
• Have you linted your code locally before submission?

Changes To Core Features:

• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your core changes, as applicable?
• Have you successfully run tests with your changes locally?

closes #7860

Server-provided JavaScript (rx.call_script code, rx.call_function functions and their result callbacks) no longer runs through a direct eval in utils/state.js. A direct eval stops the minifier from mangling the chunk that holds it; with frontend_lazy_bundled_libraries on, this shrinks the shared chunk by about 88 KB (11 KB gzipped).

• One runScript helper compiles a Function-constructor evaluator on first use, so a CSP without unsafe-eval still loads apps that never send scripts. Its body passes the code to eval, which sees only the Function's parameters and the globals, and runs it as a strict script, so statement lists keep their completion value.
• Scripts see every export of utils/state.js (ReflexEvent, refs, queueEvents, pyMod, ...), the late-bound addEvents, the socket, navigate and params of the event, the session token, and the globals. Names the module does not export (its imports, such as eventLoop) are no longer in scope.
• evalReactComponent uses a native import() of the data URI instead of eval("import(...)").
• Tests: packages/reflex-frontend/tests/run_script.test.js pins completion values, strict mode, scope, late-bound addEvents across event-loop remounts, and lazy compilation. test_state_js_template.py checks that every runScript call site declares the addEvents alias first.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; the latest change fixes the release note without changing runtime behavior.

Summary

The PR gives server-provided JavaScript an explicit set of available names, allowing smaller frontend bundles while preserving script results and event callbacks.

• Server-provided scripts run with an explicit set of names.
• Dynamic components load through native imports.

somiljain2006 accepted the inline dependency-name duplication because it matches the surrounding style and is small. No new issues found.

_{Reviews (9) · Last reviewed commit: "Describe the actual script scope in the ..." · Reviewed by Greptile}

[cubic-dev-ai]

All reported issues were addressed across 6 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>

[codspeed]

Merging this PR will regress 2 benchmarks

1 warning

⚠️ 18 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

⚡ 2 improved benchmarks
❌ 2 regressed benchmarks
✅ 147 untouched benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	test_state_update_wire_serialization[model_1000]	25.2 ms	26.6 ms	-5.28%
❌	test_process_event_burst_independent_tokens[1]	2.7 ms	2.8 ms	-4.26%
⚡	test_state_collection_assignment[1000]	12.1 ms	10.7 ms	+12.66%
⚡	test_state_collection_assignment[100000]	1.1 s	1 s	+5.27%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing somiljain2006:Eval (425e405) with main (b5aff10)}

[cubic-dev-ai]

All reported issues were addressed across 6 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

View guided diff | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 9 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>

[FarhanAliRaza]

I pushed three commits on top of your branch. Here is what each one changes and why.

Your version (up to 6759608). It replaced the direct eval in state.js with two Function-constructor evaluators:

• evaluateInExplicitEnvironment tries the code as an expression first. If that is a SyntaxError, it falls back to executeScriptInExplicitEnvironment, which uses a strict eval in a lazily built Function.
• Both get a fixed set of six names (addEvents, ReflexEvent, applyEventActions, refs, socket, token) from createExecutionContext, which has typeof guards.
• evalReactComponent uses a native import().

The approach fixes #7860. The direct eval is gone, so the minifier can mangle the shared chunk.

c868dde: pass every state.js export to scripts.

• Problem: a fixed name list breaks real callbacks. A Var operation inside a callback compiles to a helper that compiled pages import from state.js, such as pyMod, isTrue or pyStrLength. With six names, those throw ReferenceError, and the result never reaches the backend.
• Change: state.js imports itself (import * as stateExports from "$/utils/state"), and the scripts receive all of its exports. The list now follows the real export set, so a new helper cannot drift out of it. The typeof guards went away, because those names are always defined in the module. The two vm test harnesses link the self-import.

0c2cc28: replace the two evaluators with one runScript helper.

• A strict eval of the code inside the Function body already returns the completion value for an expression and for a statement list. The expression-first attempt and its SyntaxError fallback added a second code path but no behavior. One evaluator covers callbacks, _call_script and _call_function.
• The evaluator is still built on first use. A CSP without unsafe-eval rejects the Function constructor, so apps that never send scripts must still load.
• It also passes navigate and params again. On main, the direct eval saw them, and apps written against it can use them. So the scope is every export plus addEvents, socket, navigate, params and token.
• Tests: dynamic_execution.test.js (633 lines) became run_script.test.js (122 lines). Its eight cases pin these behaviors: completion value, every export visible, the four per-call names, strict mode and isolation, lazy compilation, the event-loop remount, and a string _call_function. The node-snippet tests in test_state_js_template.py went too. The remaining test checks that each runScript call site declares the addEvents alias first.
• The feature fragment became a performance fragment, because the user-visible effect is the smaller shared chunk.
• Result: the PR diff against main went from about +909 to about +220/−78. The minified chunk size is the same as with your version.

425e405: correct the news fragment. The fragment said scripts see "only addEvents, ReflexEvent, applyEventActions and the globals". After c868dde that was wrong. It now says that scripts see every export plus the per-call names, and that only names the module does not export (its imports) are out of scope.

I also updated the PR description to match the current code.