ESM issue upgrading from 2.0.16 into 2.0.17 / update-notifier

elrumordelaluz commented 2 years ago

Versions: node@v16.14.2, darwin@21.5.0
nodemon -v: 2.0.16
Operating system/terminal environment (powershell, gitshell, etc): OSX 12.4 / fish
Using Docker? What image: no
Command you ran: nodemon --config nodemon.json src/index.js

Expected behaviour

Work as in v2.0.17

Actual behaviour

…/node_modules/nodemon/bin/nodemon.js:15
  require('update-notifier')({ pkg }).notify();
  ^

Error [ERR_REQUIRE_ESM]: require() of ES Module …/node_modules/update-notifier/index.js from …/node_modules/nodemon/bin/nodemon.js not supported.
Instead change the require of index.js in …/node_modules/nodemon/bin/nodemon.js to a dynamic import() which is available in all CommonJS modules.
    at Object.<anonymous> (…node_modules/nodemon/bin/nodemon.js:15:3) {
  code: 'ERR_REQUIRE_ESM'
}

Steps to reproduce

upgrade from v2.0.16 into v2.0.17

If applicable, please append the --dump flag on your command and include the output here ensuring to remove any sensitive/personal details or tokens.

elrumordelaluz commented 2 years ago

Seems to be related on the bump to a major version of update-notifier which was turned into a pure ESM

remy commented 2 years ago

I did do a rudimentary test of the update notifier locally and it did seem to run. I'm going to close the same issues raising on this topic and revert the change quickly - cheers for the heads up.

remy commented 2 years ago

Release going up now. I need to find time to drop that module entirely… 😮‍💨

DanSuthWMW commented 2 years ago

Downgrading to nodemon 2.0.14 fixed it for me in the interim.

alexbrazier commented 2 years ago

I would be in favour of dropping update-notifier entirely as it seems to come with quite a few dependencies and I'm not sure how many people actually use the feature. Happy to raise a PR to remove it if that is the consensus.

Garamani commented 2 years ago

I'm using the nodemon 2.0.7 and experiencing the same issue.

remy commented 2 years ago

@alexbrazier the thread is here on that very topic: https://github.com/remy/nodemon/issues/1961

I just don't have the time and no one else has proposed (or pushed) anything that aligns with what I want for this project.

2.0.18 is live now - which reverts back. Ideally the next release drops update-notifier entirely.

@Garamani you shouldn't see the same issue unless you've somehow managed to bump update-notifier to 6 (which, shouldn't happen at all - check your npm ls).

Garamani commented 2 years ago

@remy Thank you for your quick response.

nodemon: 2.0.7 update-notifier (package-lock.json): 4.1.0

I just pushed some codes to Heroku and this error happened.

This is the error:

/app/node_modules/nodemon/bin/nodemon.js:15 require('update-notifier')({ pkg }).notify(); Error [ERR_REQUIRE_ESM]: require() of ES Module /app/node_modules/update-notifier/index.js from /app/node_modules/nodemon/bin/nodemon.js not supported. Instead change the require of index.js in /app/node_modules/nodemon/bin/nodemon.js to a dynamic import() which is available in all CommonJS modules. at Object. (/app/node_modules/nodemon/bin/nodemon.js:15:3) { code: 'ERR_REQUIRE_ESM'

I'm still investigating what else might be the source of this error.

Garamani commented 2 years ago

upgrading to nodemon: 2.0.18 fixed the issue.

lorand-horvath commented 2 years ago

@remy I've asked the developer to backport the vulnerability fix to got@9 https://github.com/sindresorhus/got/issues/2067 Until now, backport was only done for v11 https://github.com/sindresorhus/got/releases/tag/v11.8.5 So it's plausible to think you'll have to remove update-notifier completely from nodemon deps.

remy / nodemon