endojs / endo

Endo is a distributed secure JavaScript sandbox, based on SES
Apache License 2.0
804 stars 71 forks source link

Import attribute portability #2110

Open kriskowal opened 6 months ago

kriskowal commented 6 months ago

What is the Problem Being Solved?

Recent versions of JavaScript added support for import attributes. These were previously marked with assert and have since been replaced with with.

import descriptor from './package.json' with { type: 'json' }

Node.js cannot import JSON format in particular without the type attribute. Version 18 uses the assert keyword. When the dust settles on this syntax, for code to be portable between Node.js and Endo bundles, we will need to recognize import attributes and thread import attributes through the compartment import hooks.

Description of the Design

TBD

Security Considerations

NA

Scaling Considerations

NA

Test Plan

TBD

Compatibility Considerations

Very little JavaScript takes advantage of import attributes, but we expect the body of ESM in the wild to grow rapidly. Import attributes are also likely the beachhead for WASM integration.

Currently, Endo can import JSON without import attributes, but this creates a portability hazard since such programs are not mutually compatible with Node.js.

Upgrade Considerations

NA