ESM issue upgrading from 2.0.16 into 2.0.17 / update-notifier

[elrumordelaluz]

• Versions: node@v16.14.2, darwin@21.5.0
• nodemon -v: 2.0.16
• Operating system/terminal environment (powershell, gitshell, etc): OSX 12.4 / fish
• Using Docker? What image: no
• Command you ran: nodemon --config nodemon.json src/index.js

Expected behaviour

Work as in v2.0.17

Actual behaviour

…/node_modules/nodemon/bin/nodemon.js:15
  require('update-notifier')({ pkg }).notify();
  ^

Error [ERR_REQUIRE_ESM]: require() of ES Module …/node_modules/update-notifier/index.js from …/node_modules/nodemon/bin/nodemon.js not supported.
Instead change the require of index.js in …/node_modules/nodemon/bin/nodemon.js to a dynamic import() which is available in all CommonJS modules.
    at Object.<anonymous> (…node_modules/nodemon/bin/nodemon.js:15:3) {
  code: 'ERR_REQUIRE_ESM'
}

Steps to reproduce

upgrade from v2.0.16 into v2.0.17

---

If applicable, please append the --dump flag on your command and include the output here ensuring to remove any sensitive/personal details or tokens.

[elrumordelaluz]

Seems to be related on the bump to a major version of update-notifier which was turned into a pure ESM

[remy]

I did do a rudimentary test of the update notifier locally and it did seem to run. I'm going to close the same issues raising on this topic and revert the change quickly - cheers for the heads up.

[remy]

Release going up now. I need to find time to drop that module entirely… 😮‍💨

[DanSuthWMW]

Downgrading to nodemon 2.0.14 fixed it for me in the interim.

[alexbrazier]

I would be in favour of dropping update-notifier entirely as it seems to come with quite a few dependencies and I'm not sure how many people actually use the feature. Happy to raise a PR to remove it if that is the consensus.

[Garamani]

I'm using the nodemon 2.0.7 and experiencing the same issue.

[remy]

@alexbrazier the thread is here on that very topic: #1961

I just don't have the time and no one else has proposed (or pushed) anything that aligns with what I want for this project.

2.0.18 is live now - which reverts back. Ideally the next release drops update-notifier entirely.

@Garamani you shouldn't see the same issue unless you've somehow managed to bump update-notifier to 6 (which, shouldn't happen at all - check your npm ls).

[Garamani]

@remy Thank you for your quick response.

nodemon: 2.0.7
update-notifier (package-lock.json): 4.1.0

I just pushed some codes to Heroku and this error happened.

This is the error:

/app/node_modules/nodemon/bin/nodemon.js:15
require('update-notifier')({ pkg }).notify();
Error [ERR_REQUIRE_ESM]: require() of ES Module /app/node_modules/update-notifier/index.js from /app/node_modules/nodemon/bin/nodemon.js not supported.
Instead change the require of index.js in /app/node_modules/nodemon/bin/nodemon.js to a dynamic import() which is available in all CommonJS modules.
at Object. (/app/node_modules/nodemon/bin/nodemon.js:15:3) {
code: 'ERR_REQUIRE_ESM'

I'm still investigating what else might be the source of this error.

[Garamani]

upgrading to nodemon: 2.0.18 fixed the issue.

[lorand-horvath]

@remy I've asked the developer to backport the vulnerability fix to got@9 sindresorhus/got#2067
Until now, backport was only done for v11 https://github.com/sindresorhus/got/releases/tag/v11.8.5
So it's plausible to think you'll have to remove update-notifier completely from nodemon deps.