Codestin Search App

logaretm · 2025-12-23T16:12:29Z

This PR adds several fixes and tests for various edge cases around module.createRequire.

Null Checks

When mixedModules: false and the file is ESM, knownBindings.require is undefined because it's only initialized for CommonJS or when mixedModules: true. The code was accessing knownBindings.require.shadowDepth without checking if require exists first.

Blocking variables named `require`

This came up by @timfish in this comment, we seem to actively block variables named require.

This is marked as "known unknown" but I thought we should make an exception if the variable was created by module.createRequire.

Named import tracking

Using:

import { createRequire } from 'node:module'

wasn't being detected, so I added a detection block to support it.

closes #543

Copilot

Pull request overview

This PR adds comprehensive test coverage and fixes for edge cases around module.createRequire in ESM contexts, particularly when mixedModules: false. The changes address three key issues: null pointer exceptions when accessing knownBindings.require, incorrect blocking of variables named require that are created via module.createRequire, and missing support for named imports of createRequire.

Added null safety checks for knownBindings.require which may be undefined in ESM with mixedModules: false
Modified setKnownBinding to allow variables named require if they're created by module.createRequire
Added support for detecting createRequire when imported as a named export

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
test/unit/module-create-require-no-mixed/test-opts.json	Configures test to run with mixedModules: false
test/unit/module-create-require-no-mixed/output.js	Expected output showing lib.node is traced with mixedModules: false
test/unit/module-create-require-no-mixed/lib.node	Dummy binary file for testing dependency tracing
test/unit/module-create-require-no-mixed/input.mjs	Test case using module.createRequire with namespace import
test/unit/module-create-require-named-require/test-opts.json	Configures test to run with mixedModules: false
test/unit/module-create-require-named-require/output.js	Expected output showing variable named 'require' from createRequire is properly traced
test/unit/module-create-require-named-require/lib.node	Dummy binary file for testing dependency tracing
test/unit/module-create-require-named-require/input.mjs	Test case where the createRequire result is named 'require'
test/unit/module-create-require-named-import/test-opts.json	Configures test to run with mixedModules: false
test/unit/module-create-require-named-import/output.js	Expected output showing named import of createRequire works correctly
test/unit/module-create-require-named-import/lib.node	Dummy binary file for testing dependency tracing
test/unit/module-create-require-named-import/input.mjs	Test case using named import syntax for createRequire
test/unit/module-create-require-block-other/test-opts.json	Configures test to run with mixedModules: false
test/unit/module-create-require-block-other/output.js	Expected output showing non-createRequire 'require' is not traced
test/unit/module-create-require-block-other/lib.node	Dummy binary file that should not be traced
test/unit/module-create-require-block-other/input.mjs	Test case verifying variables named 'require' that aren't from createRequire are blocked
test/unit.test.js	Updated test runner to use input.mjs and respect mixedModules setting from test-opts.json
src/analyze.ts	Adds CREATE_REQUIRE symbol, null safety checks, exception for BOUND_REQUIRE in setKnownBinding, and named import tracking for createRequire

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-23T16:16:35Z

src/analyze.ts

+          if (parent.type === 'VariableDeclarator') {
+            const requireName = parent.id.name;
+            setKnownBinding(requireName, { value: BOUND_REQUIRE });


The code accesses parent.id.name without first verifying that parent.id.type === 'Identifier'. In JavaScript, variable declarators can use destructuring patterns (e.g., const { x } = createRequire(...)), where parent.id would be an ObjectPattern or ArrayPattern instead of an Identifier. This could cause a runtime error or unexpected behavior.

The existing code at line 1047 shows the correct pattern: it checks parent.id.type === 'Identifier' before accessing parent.id.name. The same check should be added here for consistency and safety.

This seems like copilot found a bug

Oh that's a rare one, I should've given those comments a glance.

I fixed it just now and added a couple of tests for it

test/unit/module-create-require-ignore-other/input.mjs

test/unit/module-create-require-named-import/input.mjs

test/unit/module-create-require-named-require/input.mjs

test/unit/module-create-require-no-mixed/input.mjs

test/unit/module-create-require-ignore-other/input.mjs

test/unit.test.js

Co-authored-by: Steven <[email protected]>

test/unit/module-create-require-block-other/input.mjs

styfle · 2026-01-01T19:56:06Z

test/unit/module-create-require-named-require/input.mjs

@@ -0,0 +1,6 @@
+import * as module from 'node:module';
+
+// Variable named 'require' - might conflict


This test doesn't seem to be actually testing anything different than the test above which uses

const req = createRequire(import.meta.url)

I think instead of import.meta.url all the tests should be using a subdirectory instead like

module.createRequire(new URL('/sub', import.meta.url));

That way we know the require() call is on the subdirectory and that we didn't accidentally resolve using the global require().

Does that make sense?

This test doesn't seem to be actually testing anything different than the test above....

I wanted ensure that it doesn't ignore variables named require if created by module.createRequire, more of a sanity check. I could delete the other test since this can test both behaviors at the same time. What do you think?

I think instead of import.meta.url all the tests should be using a subdirectory instead like

Makes sense, I just pushed that and updated the tests.

…lers

styfle · 2026-01-07T18:54:07Z

test/unit/module-create-require-destructure-namespace/input.js

+
+// Destructuring pattern - should not crash, but won't be traced
+// since we can't bind a single identifier to the createRequire result
+const { resolve } = module.createRequire(import.meta.url);


In a futre PR, this test should also call resolve() on a dependency to see if that still works

(preferably under the /sub directory)

styfle

Great work, thanks!

github-actions · 2026-01-07T19:01:48Z

🎉 This PR is included in version 1.2.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

logaretm added 6 commits December 23, 2025 17:46

tests: added tests to confirm the issue

f462177

fix: check for require existence before shadow checking

0c6077d

tests: added more tests for edge cases outlined in the issue

0c54437

fix: support named imports

5e8a661

fix: unblock require variables created by module.createRequire

5521014

test: check if we still block require vars

4eff15e

Copilot AI review requested due to automatic review settings December 23, 2025 16:12

logaretm requested review from a team, icyJoseph, ijjk and styfle as code owners December 23, 2025 16:12

Copilot started reviewing on behalf of logaretm December 23, 2025 16:12 View session

logaretm changed the title ~~tests: added tests to confirm the issue~~ fix: support module.createRequire when mixedModules: false Dec 23, 2025

Copilot AI reviewed Dec 23, 2025

View reviewed changes

styfle reviewed Dec 23, 2025

View reviewed changes

test/unit.test.js Outdated Show resolved Hide resolved

ref: use optional chaining

50828b5

Co-authored-by: Steven <[email protected]>

styfle reviewed Dec 23, 2025

View reviewed changes

test/unit/module-create-require-block-other/input.mjs Outdated Show resolved Hide resolved

fix: format

e161944

logaretm requested a review from styfle December 24, 2025 17:29

refactor: use ignored instead of blocked as terms

71fcc3a

styfle reviewed Jan 1, 2026

View reviewed changes

logaretm added 2 commits January 2, 2026 11:36

test: use sub dirs in tests

8c2f57d

fix: check parent.id.type before accessing name in createRequire hand…

c88f146

…lers

styfle reviewed Jan 7, 2026

View reviewed changes

styfle approved these changes Jan 7, 2026

View reviewed changes

styfle changed the title ~~fix: support module.createRequire when mixedModules: false~~ feat: support module.createRequire when mixedModules: false Jan 7, 2026

styfle enabled auto-merge (squash) January 7, 2026 18:57

styfle merged commit 67038d5 into vercel:main Jan 7, 2026
14 checks passed

github-actions bot added the released label Jan 7, 2026

		@@ -0,0 +1,6 @@
		import * as module from 'node:module';

		// Variable named 'require' - might conflict

Conversation

logaretm commented Dec 23, 2025

Null Checks

Blocking variables named require

Named import tracking

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Dec 23, 2025

Choose a reason for hiding this comment

Uh oh!

styfle Jan 7, 2026

Choose a reason for hiding this comment

Uh oh!

logaretm Jan 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

styfle Jan 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

logaretm Jan 2, 2026

Choose a reason for hiding this comment

Uh oh!

styfle Jan 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

styfle left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Jan 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Blocking variables named `require`

styfle Jan 1, 2026 •

edited

Loading

styfle Jan 7, 2026 •

edited

Loading