pkg does not respect exports entrypoints defined in package.json

[mikeseese]

What version of pkg are you using?

5.8.0

What version of Node.js are you using?

18.13.0

What operating system are you using?

Windows 11

What CPU architecture are you using?

x86_x64

What Node versions, OSs and CPU architectures are you building for?

node18-linux-x64

Describe the Bug

If you are using a CJS project that has require("axios") where you're using axios@1.x (1.3.4 at the time of reporting this is latest), the axios package.json defines exports that would resolve to ./dist/node/axios.cjs. Note, per the NodeJS docs, exports is used when both exports and main are defined.

To explain how the require("axios") => require("axios/dist/node/axios.cjs") works further, require("axios") has a relative path of ., so it then looks at the "." section, then it's not a types lookup or a browser environment, so it then goes to the "default" section, and since we're using require, it goes to the "require" section which is defined as ./dist/node/axios.cjs.

When I look at my pkg --debug output, it shows it's just resolving to axios/index.js:

> [debug] Content of D:\project\node_modules\@open-match\api\node_modules\axios\package.json is added to queue. It was required from D:\project\node_modules\@open-match\api\lib\models\serviceOptions.js
> [debug] Bytecode of D:\project\node_modules\@open-match\api\node_modules\axios\index.js is added to queue. It was required from D:\project\node_modules\@open-match\api\lib\models\serviceOptions.js

The above is using @open-match/api@1.0.6 where import axiosStatic from "axios" gets compiled by tsc to const axios_1 = __importDefault(require("axios"));

Expected Behavior

pkg should respect the rules defined by "exports" in package.json as defined in the NodeJS docs since that's how require statements are interpreted.

To Reproduce

1. Install axios: npm install axios
2. Require axios: const axios = requie("axios");
3. Run pkg --debug
4. See that the axios.cjs file is never added to the queue

[robertsLando]

PR?

[mikeseese]

I'm currently deciphering to figure out how to implement a fix; I'll update if I end up not having time to make a PR.

[robertsLando]

This could be a good starting point: https://github.com/vercel/pkg/wiki/Developers

[mikeseese]

If I'm understanding how the walker/follower works, I believe the issue is because the resolve dependency to follow resolutions doesn't support exports yet. It seems like this is going to become more of an issue as some maintainers are apparently dropping "main" altogether (since NodeJS essentially says it's been deprecated for awhile). Apparently the issue is affecting jest users as well.

[robertsLando]

#1291

[mikeseese]

I'm aware of #1291. This is unrelated to ESMs; as I stated in my issue description, this for a CJS project with a CJS dependency. While browserify/resolve#222 has Support ESM resolution as the title, the issue is 2.5 years old that also includes Support exports field in package.json. Per the NodeJS docs (also linked above in my description), the "exports" field is not limited to ESM projects and CJS projects can, and do, use it.

[mikeseese]

Regardless, until resolve supports "exports", this issue cannot be fixed unless pkg wants to implement their own solution like rollup did. I definitely don't have the time to implement something like that.

In the meantime, a hacky pkg.scripts to include the dependency's file will work

[piranna]

I'm facing the same issue.

[andreasdamm]

Would switching to https://www.npmjs.com/package/enhanced-resolve be viable?

[lifegit]

yes, I'm facing the same issue.

[github-actions]

This issue is stale because it has been open 90 days with no activity. Remove the stale label or comment or this will be closed in 5 days. To ignore this issue entirely you can add the no-stale label

[luoxzhg]

refresh

[github-actions]

This issue is stale because it has been open 90 days with no activity. Remove the stale label or comment or this will be closed in 5 days. To ignore this issue entirely you can add the no-stale label

[mikeseese]

This issue is still relevant.

[MaxMusing]

This is causing issues for us with openai@4 which relies on exports.