MODULE_NOT_FOUND - path-scurry & glob

[martoncsukas]

Since yesterday, rimraf is not working fine in our project - it fails with this error:

[INFO] - /home/vsts/work/1/s/view/node_modules/rimraf/dist/cjs/src/bin.js
[INFO]     at Function.Module._resolveFilename (internal/modules/cjs/loader.js:880:15)
[INFO]     at Function.Module._load (internal/modules/cjs/loader.js:725:27)
[INFO]     at Module.require (internal/modules/cjs/loader.js:952:19)
[INFO]     at require (internal/modules/cjs/helpers.js:88:18)
[INFO]     at Object.<anonymous> (/home/vsts/work/1/s/view/node_modules/path-scurry/dist/commonjs/index.js:28:21)
[INFO]     at Module._compile (internal/modules/cjs/loader.js:1063:30)
[INFO]     at Object.Module._extensions..js (internal/modules/cjs/loader.js:1092:10)
[INFO]     at Module.load (internal/modules/cjs/loader.js:928:32)
[INFO]     at Function.Module._load (internal/modules/cjs/loader.js:769:14)
[INFO]     at Module.require (internal/modules/cjs/loader.js:952:19) {
[INFO]   code: 'MODULE_NOT_FOUND',
[INFO]   requireStack: [
[INFO]     '/home/vsts/work/1/s/view/node_modules/path-scurry/dist/commonjs/index.js',
[INFO]     '/home/vsts/work/1/s/view/node_modules/rimraf/node_modules/glob/dist/commonjs/glob.js',
[INFO]     '/home/vsts/work/1/s/view/node_modules/rimraf/node_modules/glob/dist/commonjs/index.js',
[INFO]     '/home/vsts/work/1/s/view/node_modules/rimraf/dist/cjs/src/index.js',
[INFO]     '/home/vsts/work/1/s/view/node_modules/rimraf/dist/cjs/src/bin.js'
[INFO]   ]
[INFO] }
[INFO] npm ERR! code ELIFECYCLE
[INFO] npm ERR! errno 1
[INFO] npm ERR! view@0.1.0 build: `rimraf build && node scripts/build.js`
[INFO] npm ERR! Exit status 1
[INFO] npm ERR! 
[INFO] npm ERR! Failed at the view@0.1.0 build script.
[INFO] npm ERR! This is probably not a problem with npm. There is likely additional logging output above.

We use 5.0.1 version of rimraf, but I see that its transitive dependency glob is defined as "glob": "^10.3.7", and glob has been updated yesterday (since our builds are failing).

Since rimraf is only used in our building and testing phase, and no active code relies on it, I decided to temporarily downgrade it to 3.0.2, which is the latest major version that won't use "glob": "^10.×.×" but "glob": "^7.1.3", so it will bypass the faulty version and path-scurry. It currently has no active vulnerabilities either, so safe to downgrade.

[isaacs]

/home/vsts/work/1/s/view/node_modules/rimraf/dist/cjs/src/bin.js

Why is it looking for the bin there? That is not the latest release of rimraf. The bin has been esm since 5739c767 in v5.0.2

In Node 16, require('glob') and require('path-scurry') both work fine.

Can you provide more details, or better yet, a reproduction case?

[isaacs]

Example that works fine for me:

$ cat package.json
{
  "type": "module",
  "scripts": {
    "build": "rimraf build && node build.js"
  },
  "dependencies": {
    "rimraf": "5"
  }
}

$ cat build.js
import { mkdirSync, writeFileSync } from 'fs'

// just make some files
mkdirSync('build/a/b/c', { recursive: true })
const data = new Date().toISOString()
writeFileSync('build/a/b/c/d', data)
writeFileSync('build/a/b/d', data)
writeFileSync('build/a/d', data)

$ npm exec -c 'which rimraf'
/Users/isaacs/Developer/isaacs/rimraf/gh-306/node_modules/.bin/rimraf

$ npm ls rimraf
gh-306@ /Users/isaacs/Developer/isaacs/rimraf/gh-306
└── rimraf@5.0.6


$ npm run build

> build
> rimraf build && node build.js

$ cat build/a/b/c/d 
2024-05-10T21:52:42.885Z
$ npm run build

> build
> rimraf build && node build.js


$ cat build/a/b/c/d 
2024-05-10T21:52:53.974Z

Works in commonjs mode, as well:

$ cat package.json
{
  "scripts": {
    "build": "rimraf build && node build.js"
  },
  "dependencies": {
    "rimraf": "5"
  }
}

$ cat build.js
const { mkdirSync, writeFileSync } = require('fs')

// just make some files
mkdirSync('build/a/b/c', { recursive: true })
const data = new Date().toISOString()
writeFileSync('build/a/b/c/d', data)
writeFileSync('build/a/b/d', data)
writeFileSync('build/a/d', data)

$ npm run build

> build
> rimraf build && node build.js


$ cat build/a/b/c/d 
2024-05-10T21:54:44.773Z