Skip to content

fix: Resolve require() incompatibility in ESM and UMD builds - #248

Merged
reeshika-h merged 4 commits into
developmentfrom
fix/DX-esm-umd-require-compat
Aug 5, 2026
Merged

fix: Resolve require() incompatibility in ESM and UMD builds#248
reeshika-h merged 4 commits into
developmentfrom
fix/DX-esm-umd-require-compat

Conversation

@cs-raj

@cs-raj cs-raj commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Native ESM (ReferenceError: require is not defined) — added typeof require === 'undefined' guard in createKeepAliveAgent(), falls back to false in ESM environments
  • Turbopack/webpack (expression is too dynamic) — replaced require(moduleName) variable arg with static string literals so bundlers can statically analyse the call
  • UMD webpack build (Can't resolve 'http') — added externals for http/https in config/webpack.config.js; UMD wrapper resolves them at runtime in Node, isNodeEnvironment guard prevents execution in browser

Test plan

  • npm run build — all four targets (cjs, esm, umd, types) compile clean
  • node test/esm-compat.mjs — native ESM agents fall back to false, no crash
  • npm test — existing and new Jest specs pass
  • Validate in a Next.js + Turbopack project to confirm customer-reported error is resolved

Related

Closes #246

🤖 Generated with Claude Code

Three environments broke when keep-alive agents were introduced using
require('http') and require('https'):

1. Native ESM (ReferenceError: require is not defined)
   - Added typeof require === 'undefined' guard in createKeepAliveAgent()
   - Falls back to false (pre-1.5.0 behaviour) in ESM environments

2. Turbopack/webpack (expression is too dynamic)
   - Replaced require(moduleName) variable arg with static string literals
   - require('http') / require('https') are statically analysable by bundlers

3. UMD webpack build (Can't resolve 'http')
   - Added externals for http and https in config/webpack.config.js
   - UMD wrapper resolves them at runtime in Node; isNodeEnvironment guard
     prevents execution in browser where they are not available

Tests added:
- test/esm-compat.mjs: native ESM integration test (run after build)
- test/contentstack-core.node-agent.spec.ts: Jest wrapper spawning esm-compat.mjs
- test/esm-exports.spec.ts: static analysis asserting no dynamic require(variable)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@cs-raj
cs-raj requested a review from a team as a code owner August 4, 2026 14:31
@snyk-io

snyk-io Bot commented Aug 4, 2026

Copy link
Copy Markdown

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues
Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@github-actions

github-actions Bot commented Aug 4, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

@github-actions

github-actions Bot commented Aug 5, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates @contentstack/core’s HTTP keep-alive agent setup to avoid require() failures in native ESM and to make bundlers (webpack/Turbopack) able to statically analyze require('http'|'https'), while also adjusting the UMD build to avoid resolving Node built-ins during bundling.

Changes:

  • Refactors keep-alive agent creation to use typeof require !== 'undefined' and static require('http') / require('https') calls.
  • Adds package-level browser mappings for http/https and webpack UMD externals for Node built-ins.
  • Adds/extends tests to validate ESM build safety and a native ESM regression check for issue #246.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
src/lib/contentstack-core.ts Guards keep-alive agent creation for native ESM and replaces dynamic require(moduleName) with static literals.
config/webpack.config.js Externalizes http/https for the UMD build to prevent bundler resolution of Node built-ins.
package.json Adds browser mappings for Node built-ins and bumps version.
package-lock.json Updates locked package version metadata.
test/esm-exports.spec.ts Adds assertions to ensure the built ESM output does not contain dynamic require(variable) calls.
test/esm-compat.mjs Adds a native ESM integration script validating no crash and agent fallback behavior.
test/contentstack-core.node-agent.spec.ts Adds a Jest test that runs the native ESM integration script as a child process.
.talismanrc Adds an ignore entry for the new ESM compat test script.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread config/webpack.config.js Outdated
Comment thread config/webpack.config.js Outdated
Comment thread .talismanrc
@github-actions

github-actions Bot commented Aug 5, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

… fix

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Aug 5, 2026

Copy link
Copy Markdown

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 0 0 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

✅ BUILD PASSED - All security checks passed

@OMpawar-21 OMpawar-21 left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@netrajpatel netrajpatel left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@reeshika-h
reeshika-h merged commit 8218dc4 into development Aug 5, 2026
9 checks passed
@reeshika-h
reeshika-h deleted the fix/DX-esm-umd-require-compat branch August 5, 2026 07:48
reeshika-h added a commit that referenced this pull request Aug 7, 2026
fix: Resolve require() incompatibility in ESM and UMD builds
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants