Start: import protection keeps a parsed AST per module in dev (hundreds of MB in large apps) #8614

Which project does this relate to?

Start

Describe the bug

In development, import protection keeps one parsed AST for every module it analyses, for as long as the dev server runs. The analysis of each module is cached on its transform result in a per-environment cache. That cached analysis holds the AST (ImportAnalysis.ast, earlier TransformResult.parsedAst). The AST is only needed while building the analysis and, rarely, to find the usage position of a violation, but it is retained for every module.

In our app (Solid Start) this was about 145 MB of live heap per dev server, and we run several servers at once. In the reproducer below, 1,500 generated modules (about 6 MB of source) leave 474 MB of live heap with import protection on and 158 MB with it off, after one page load and a forced GC.

Complete minimal reproducer

https://github.com/jav-ed/start-import-protection-memory-repro

Steps to reproduce the bug

1. git clone the repository and run npm install
2. Run npm run measure (it generates the modules, starts the dev server with import protection on and then off, loads / once and prints the live heap after a forced GC)
3. Compare the two numbers

Expected behavior

Import protection should not keep memory proportional to the size of every analysed module. With the AST dropped from the cached analysis (and parsed again only when a violation needs its usage position), the same reproducer leaves 173 MB, within 15 MB of having import protection off. I can inshallah share the patch, with a test, if that is useful.

Platform

• Router / Start Version: @tanstack/react-start 1.168.60, @tanstack/start-plugin-core 1.171.49
• OS: Linux x64
• Browser: not relevant (server memory)
• Bundler: vite
• Bundler Version: 7.3.6 (we see the same on 8.3.2)

Additional context

Node 26.7.0. The measurements and the reproducer were prepared with the help of Claude Code and verified by running them.