Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: resolve cjs deps as cjs instead of esm #362

Merged
merged 6 commits into from
Sep 18, 2023
Merged

fix: resolve cjs deps as cjs instead of esm #362

merged 6 commits into from
Sep 18, 2023

Conversation

cb1kenobi
Copy link
Contributor

@cb1kenobi cb1kenobi commented Sep 15, 2023 •
edited by styfle
Loading

When nft analyzes a file that has both a require() and an ESM export, the first call to acorn fails because of the export, so it treats the whole file as ESM, which is probably fine.

The problem is it treats the require() as an ESM import which is wrong. This will cause the resolve dependency entrypoint in the dependency to get the ESM export instead of the proper CJS export.

If the dependency is an import, add it to imports. If it's a require(), add it to deps and don't worry about whatever isESM.

orca-security-us[bot]
orca-security-us bot reviewed Sep 15, 2023
View reviewed changes
Copy link

@orca-security-us orca-security-us bot left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Orca Security Scan Summary

Status Check Issues by priority
Passed Passed Secrets high 0   medium 0   low 0   info 0 View in Orca

styfle
styfle requested changes Sep 15, 2023
View reviewed changes
Copy link
Member

@styfle styfle left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add a test. Ideally an integration test with @vercel/edge-config but also a simple unit test would be good.

styfle
styfle reviewed Sep 15, 2023
View reviewed changes
package.json Show resolved Hide resolved
styfle
styfle approved these changes Sep 16, 2023
View reviewed changes
Copy link
Member

@styfle styfle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good if tests pass, thanks!

styfle
styfle approved these changes Sep 18, 2023
View reviewed changes
Copy link
Member

@styfle styfle left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great, thanks!

@styfle styfle merged commit 1eba4d5 into main Sep 18, 2023
17 checks passed
@styfle styfle deleted the resolve-cjs-as-cjs-not-esm branch September 18, 2023 21:47
@github-actions
Copy link

🎉 This PR is included in version 0.24.1 🎉

The release is available on:

Your semantic-release bot 📦🚀

@cb1kenobi cb1kenobi mentioned this pull request Oct 2, 2023
Draft
cb1kenobi added a commit that referenced this pull request Oct 2, 2023
@cb1kenobi
Revert "fix: resolve cjs deps as cjs instead of esm (#362)"
881b0e3 
This reverts commit 1eba4d5.
styfle pushed a commit that referenced this pull request Oct 2, 2023
@cb1kenobi
fix: Revert "fix: resolve cjs deps as cjs instead of esm (#362)" (#365)
544e352 
This reverts commit 1eba4d5.

The fix in the original PR did solve the problem of tracing a dependency
being loaded from an ESM file via `require()`, but also caused a
regression where a simple `.mjs` file with ESM imports was failing. I
have a test (#364) for that.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@orca-security-us Orca Security (US) orca-security-us left review comments

@styfle styfle styfle approved these changes

@ijjk ijjk Awaiting requested review from ijjk ijjk is a code owner

Assignees
No one assigned
Labels
released
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@cb1kenobi @styfle