@openrewrite/recipes-nodejs 0.51.0 → 0.51.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openrewrite/recipes-nodejs",
-  "version": "0.51.0",
+  "version": "0.51.2",
   "license": "Moderne Proprietary",
   "description": "OpenRewrite recipes for Node.js library migrations.",
   "homepage": "https://github.com/moderneinc/rewrite-node",
@@ -25,7 +25,7 @@
     "ci:test": "jest"
   },
   "dependencies": {
-    "@openrewrite/rewrite": "^8.93.0-20260923-155039",
+    "@openrewrite/rewrite": "^8.92.18",
     "mutative": "^1.1.0",
     "semver": "^7.7.3"
   },

package/src/index.ts

@@ -24,15 +24,22 @@ import {ReplaceOutgoingMessageHeaders} from "./migrate/outgoing-message-headers"
 import {ReplaceTlsInternalModules} from "./migrate/tls-internal-modules";
 import {ReplaceStreamInternalModules} from "./migrate/stream-internal-modules";
 import {RemoveNetSetSimultaneousAccepts} from "./migrate/net-set-simultaneous-accepts";
+import {UpgradeNode20} from "./migrate/upgrade-node-20";
 import {UpgradeNode22} from "./migrate/upgrade-node-22";
 import {UpgradeNode24} from "./migrate/upgrade-node-24";
+import {UpgradeNode26} from "./migrate/upgrade-node-26";
 import {IncreaseNodeEngineVersion} from "./migrate/increase-node-engine-version";
 import {IncreaseNodeEngineVersionInGithubActions} from "./migrate/increase-node-engine-version-in-github-actions";
 import {FindCryptoCreateCipher} from "./migrate/find-crypto-create-cipher";
+import {FindCryptoDefaultEncoding} from "./migrate/find-crypto-default-encoding";
 import {FindPunycodeUsage} from "./migrate/find-punycode-usage";
 import {FindProcessAssert} from "./migrate/find-process-assert";
 import {FindTlsSecurePair} from "./migrate/find-tls-secure-pair";
 import {FindTimersActive} from "./migrate/find-timers-active";
+import {ReplaceServerResponseWriteHeader} from "./migrate/server-response-write-header";
+import {FindAeadDecipherivWithoutAuthTagLength} from "./migrate/find-aead-decipheriv-without-auth-tag-length";
+import {FindDuplexToWebType} from "./migrate/find-duplex-to-web-type";
+import {FindModuleRegister} from "./migrate/find-module-register";
 import {MigrateFsExtraToNodeFs} from "./migrate/fs-extra/migrate-fs-extra-to-node-fs";
 import {ReplaceFsExtraRemove} from "./migrate/fs-extra/replace-fs-extra-remove";
 import {ReplaceFsExtraMkdirs} from "./migrate/fs-extra/replace-fs-extra-mkdirs";
@@ -53,6 +60,7 @@ import {FindHpagentManualMigrations} from "./migrate/hpagent/find-hpagent-manual
 import {SwapHpagentDependency} from "./migrate/hpagent/swap-hpagent-dependency";
 import {MigrateSourceMapSupportToNative} from "./migrate/source-map-support/migrate-source-map-support-to-native";
 import {FindSourceMapSupportManualMigrations} from "./migrate/source-map-support/find-source-map-support-manual-migrations";
+import {EnableSourceMapsAtLaunch} from "./migrate/source-map-support/enable-source-maps-at-launch";
 import {ReplaceSourceMapSupportInstall} from "./migrate/source-map-support/replace-source-map-support-install";
 import {ReplaceSourceMapSupportRegisterInPackageJson} from "./migrate/source-map-support/replace-source-map-support-register-in-package-json";
 import {ReplaceSourceMapSupportRegisterInMochaConfig} from "./migrate/source-map-support/replace-source-map-support-register-in-mocha-config";
@@ -99,15 +107,22 @@ export async function activate(marketplace: RecipeMarketplace): Promise<void> {
     await marketplace.install(ReplaceTlsInternalModules, Migrate);
     await marketplace.install(ReplaceStreamInternalModules, Migrate);
     await marketplace.install(RemoveNetSetSimultaneousAccepts, Migrate);
+    await marketplace.install(UpgradeNode20, Migrate);
     await marketplace.install(UpgradeNode22, Migrate);
     await marketplace.install(UpgradeNode24, Migrate);
+    await marketplace.install(UpgradeNode26, Migrate);
     await marketplace.install(IncreaseNodeEngineVersion, Migrate);
     await marketplace.install(IncreaseNodeEngineVersionInGithubActions, Migrate);
     await marketplace.install(FindCryptoCreateCipher, Migrate);
+    await marketplace.install(FindCryptoDefaultEncoding, Migrate);
     await marketplace.install(FindPunycodeUsage, Migrate);
     await marketplace.install(FindProcessAssert, Migrate);
     await marketplace.install(FindTlsSecurePair, Migrate);
     await marketplace.install(FindTimersActive, Migrate);
+    await marketplace.install(ReplaceServerResponseWriteHeader, Migrate);
+    await marketplace.install(FindAeadDecipherivWithoutAuthTagLength, Migrate);
+    await marketplace.install(FindDuplexToWebType, Migrate);
+    await marketplace.install(FindModuleRegister, Migrate);
     await marketplace.install(MigrateFsExtraToNodeFs, FsExtra);
     await marketplace.install(ReplaceFsExtraRemove, FsExtra);
     await marketplace.install(ReplaceFsExtraMkdirs, FsExtra);
@@ -128,6 +143,7 @@ export async function activate(marketplace: RecipeMarketplace): Promise<void> {
     await marketplace.install(SwapHpagentDependency, Hpagent);
     await marketplace.install(MigrateSourceMapSupportToNative, SourceMapSupport);
     await marketplace.install(ReplaceSourceMapSupportInstall, SourceMapSupport);
+    await marketplace.install(EnableSourceMapsAtLaunch, SourceMapSupport);
     await marketplace.install(ReplaceSourceMapSupportRegisterInPackageJson, SourceMapSupport);
     await marketplace.install(ReplaceSourceMapSupportRegisterInMochaConfig, SourceMapSupport);
     await marketplace.install(FindSourceMapSupportManualMigrations, SourceMapSupport);

package/src/migrate/angular-animations/remove-angular-animations-providers.ts

@@ -11,7 +11,7 @@ import {JavaScriptVisitor, JS, maybeUnbind, walk} from "@openrewrite/rewrite/jav
 import {PlainText} from "@openrewrite/rewrite/text";
 import * as semver from "semver";
 import {bindingsOf, importModule, ModuleBindings} from "../module-bindings";
-import {anyBeneath, dirOf, isPackageJson, removeMembers} from "../remove-unused-dependency";
+import {anyBeneath, dirOf, isPackageJson, removeMembers} from "../package-json-support";
 
 const PROVIDER_MODULES = new Set(['@angular/platform-browser/animations', '@angular/platform-browser/animations/async']);
 const ANIMATIONS = '@angular/animations';

package/src/migrate/express-request-id/migrate-express-request-id-to-native.ts

@@ -12,13 +12,14 @@ export class MigrateExpressRequestIdToNative extends Recipe {
     readonly name = "org.openrewrite.node.migrate.express-request-id.migrate-express-request-id-to-native";
     readonly displayName = "Migrate `express-request-id` to an inline middleware";
     readonly description = "Replaces the `express-request-id` middleware with an equivalent inline middleware built on " +
-        "`randomUUID()` from `node:crypto`, then removes the dependency from each `package.json` that no longer needs it.";
+        "`randomUUID()` from `node:crypto`, then removes the dependency from each `package.json` that declares it, " +
+        "updating the lock file to match.";
     readonly tags = ["express-request-id"];
 
     async recipeList(): Promise<Recipe[]> {
         return [
             new ReplaceExpressRequestId(),
-            new RemoveUnusedExpressRequestIdDependency({accountForMigration: true}),
+            new RemoveUnusedExpressRequestIdDependency(),
         ];
     }
 }

package/src/migrate/express-request-id/remove-unused-express-request-id-dependency.ts

@@ -4,22 +4,14 @@
  * Moderne Proprietary. Only for use by Moderne customers under the terms of a commercial contract.
  */
 
-import {Recipe} from "@openrewrite/rewrite";
-import {RemoveUnusedDependency} from "../remove-unused-dependency";
-import {ReplaceExpressRequestId} from "./replace-express-request-id";
+import {RemoveDependencies} from "../remove-dependencies";
 
-export class RemoveUnusedExpressRequestIdDependency extends RemoveUnusedDependency {
+export class RemoveUnusedExpressRequestIdDependency extends RemoveDependencies {
     readonly name = "org.openrewrite.node.migrate.express-request-id.remove-unused-express-request-id-dependency";
-    readonly displayName = "Remove unused `express-request-id` dependency";
-    readonly description = "Removes `express-request-id` and `@types/express-request-id` from each `package.json` whose " +
-        "package no longer references it from any JavaScript or TypeScript source or tool configuration. `uuid` is kept, " +
-        "since the application may use it directly. Lock files are not regenerated; run the package manager's install afterwards.";
+    readonly displayName = "Remove the `express-request-id` dependency";
+    readonly description = "Removes `express-request-id` and `@types/express-request-id` from each `package.json` " +
+        "that declares them, and updates the lock file to match. `uuid` is kept, since the application may use it directly.";
     readonly tags = ["express-request-id"];
 
-    protected readonly module = 'express-request-id';
     protected readonly packages = ['express-request-id', '@types/express-request-id'];
-
-    protected migrationRecipes(): Recipe[] {
-        return [new ReplaceExpressRequestId()];
-    }
 }

package/src/migrate/find-aead-decipheriv-without-auth-tag-length.ts

@@ -0,0 +1,76 @@
+/*
+ * Copyright 2026 the original author or authors.
+ *
+ * Moderne Proprietary. Only for use by Moderne customers under the terms of a commercial contract.
+ */
+import {check, ExecutionContext, foundSearchResult, or, Recipe, TreeVisitor} from "@openrewrite/rewrite";
+import {JavaScriptVisitor, JS, MethodMatcher, usesMethod} from "@openrewrite/rewrite/javascript";
+import {J} from "@openrewrite/rewrite/java";
+
+export class FindAeadDecipherivWithoutAuthTagLength extends Recipe {
+    readonly name = "org.openrewrite.node.migrate.crypto.find-aead-decipheriv-without-auth-tag-length"
+    readonly displayName: string = "Find `crypto.createDecipheriv()` for AEAD ciphers without `authTagLength`";
+    readonly description: string = "Accepting shorter-than-default authentication tags for AEAD ciphers " +
+        "(`aes-*-gcm`, `aes-*-ccm`, `aes-*-ocb`, `chacha20-poly1305`) in `crypto.createDecipheriv()` is end-of-life in " +
+        "Node.js 26 (DEP0182). Pass an explicit `authTagLength` in the options so the tag length is validated at decipher " +
+        "construction instead of at `setAuthTag()` time.";
+    readonly tags: string[] = ["DEP0182"];
+
+    async editor(): Promise<TreeVisitor<any, ExecutionContext>> {
+        return check(or(
+            usesMethod("crypto createDecipheriv(..)"),
+            usesMethod("node:crypto createDecipheriv(..)"),
+        ), new class extends JavaScriptVisitor<ExecutionContext> {
+            matcher = new MethodMatcher("crypto createDecipheriv(..)");
+            nodeMatcher = new MethodMatcher("node:crypto createDecipheriv(..)");
+
+            private readonly aead = /^(aes-\d+-(gcm|ccm|ocb)|chacha20-poly1305)$/i;
+
+            private isAeadAlgorithm(expr: J): boolean {
+                if (expr.kind !== J.Kind.Literal) {
+                    return false;
+                }
+                const value = (expr as J.Literal).value;
+                return typeof value === "string" && this.aead.test(value);
+            }
+
+            private hasAuthTagLength(expr: J): boolean {
+                if (expr.kind !== J.Kind.NewClass || (expr as J.NewClass).class) {
+                    return false;
+                }
+                const obj = expr as J.NewClass;
+                const statements = obj.body?.statements ?? [];
+                for (const stmt of statements) {
+                    const element = stmt.element;
+                    if (element.kind !== JS.Kind.PropertyAssignment) {
+                        continue;
+                    }
+                    const name = (element as JS.PropertyAssignment).name.element;
+                    if (name.kind === J.Kind.Identifier && (name as J.Identifier).simpleName === "authTagLength") {
+                        return true;
+                    }
+                    if (name.kind === J.Kind.Literal && (name as J.Literal).value === "authTagLength") {
+                        return true;
+                    }
+                }
+                return false;
+            }
+
+            protected async visitMethodInvocation(m: J.MethodInvocation, p: ExecutionContext): Promise<J | undefined> {
+                const method = await super.visitMethodInvocation(m, p) as J.MethodInvocation;
+                if (!this.matcher.matches(method.methodType) && !this.nodeMatcher.matches(method.methodType)) {
+                    return method;
+                }
+                const args = method.arguments.elements;
+                if (args.length === 0 || !this.isAeadAlgorithm(args[0].element)) {
+                    return method;
+                }
+                if (args.length >= 4 && this.hasAuthTagLength(args[3].element)) {
+                    return method;
+                }
+                return foundSearchResult(method,
+                    "crypto.createDecipheriv() for AEAD ciphers without authTagLength is end-of-life (DEP0182). Pass authTagLength in options.");
+            }
+        });
+    }
+}

package/src/migrate/find-crypto-default-encoding.ts

@@ -0,0 +1,47 @@
+/*
+ * Copyright 2026 the original author or authors.
+ *
+ * Moderne Proprietary. Only for use by Moderne customers under the terms of a commercial contract.
+ */
+import {ExecutionContext, foundSearchResult, Recipe, TreeVisitor} from "@openrewrite/rewrite";
+import {JavaScriptVisitor} from "@openrewrite/rewrite/javascript";
+import {J, Type} from "@openrewrite/rewrite/java";
+
+const FQNS = new Set(["crypto", "node:crypto"]);
+
+export class FindCryptoDefaultEncoding extends Recipe {
+    readonly name = "org.openrewrite.node.migrate.find-crypto-default-encoding"
+    readonly displayName: string = "Find deprecated `crypto.DEFAULT_ENCODING` usage";
+    readonly description: string = "The `crypto.DEFAULT_ENCODING` property was deprecated in Node.js 10 (DEP0091) " +
+        "and removed in Node.js 20. Each API that accepted an encoding (hash, hmac, cipher, etc.) now requires " +
+        "the encoding to be passed explicitly. Occurrences must be reviewed and fixed by hand.";
+    readonly tags: string[] = ["DEP0091"];
+
+    async editor(): Promise<TreeVisitor<any, ExecutionContext>> {
+        return new class extends JavaScriptVisitor<ExecutionContext> {
+            private isCryptoReceiver(target: J | undefined): boolean {
+                if (!target || target.kind !== J.Kind.Identifier) {
+                    return false;
+                }
+                const type = (target as J.Identifier).type;
+                if (!type) {
+                    return (target as J.Identifier).simpleName === "crypto";
+                }
+                if (type.kind === Type.Kind.Class) {
+                    const fqn = (type as Type.Class).fullyQualifiedName;
+                    return FQNS.has(fqn);
+                }
+                return false;
+            }
+
+            protected async visitFieldAccess(fieldAccess: J.FieldAccess, p: ExecutionContext): Promise<J | undefined> {
+                const fa = await super.visitFieldAccess(fieldAccess, p) as J.FieldAccess;
+                if (fa.name.element.simpleName === "DEFAULT_ENCODING" && this.isCryptoReceiver(fa.target)) {
+                    return foundSearchResult(fa,
+                        "crypto.DEFAULT_ENCODING was removed in Node.js 20 (DEP0091). Pass the desired encoding explicitly to each crypto API instead.");
+                }
+                return fa;
+            }
+        };
+    }
+}

package/src/migrate/find-duplex-to-web-type.ts

@@ -0,0 +1,71 @@
+/*
+ * Copyright 2026 the original author or authors.
+ *
+ * Moderne Proprietary. Only for use by Moderne customers under the terms of a commercial contract.
+ */
+import {check, ExecutionContext, foundSearchResult, Recipe, TreeVisitor} from "@openrewrite/rewrite";
+import {JavaScriptVisitor, JS, usesType} from "@openrewrite/rewrite/javascript";
+import {J, Type} from "@openrewrite/rewrite/java";
+
+export class FindDuplexToWebType extends Recipe {
+    readonly name = "org.openrewrite.node.migrate.stream.find-duplex-to-web-type"
+    readonly displayName: string = "Find `Duplex.toWeb()` calls passing `options.type`";
+    readonly description: string = "Passing `options.type` to `stream.Duplex.toWeb()` is runtime-deprecated in Node.js 26 (DEP0201). " +
+        "The `type` field controls the readable-side ReadableStream chunk type; drop it from the options and set the type on the " +
+        "resulting `ReadableStream` instead.";
+    readonly tags: string[] = ["DEP0201"];
+
+    async editor(): Promise<TreeVisitor<any, ExecutionContext>> {
+        return check(usesType("Stream.Duplex"), new class extends JavaScriptVisitor<ExecutionContext> {
+
+            private isDuplexReceiver(select: J | undefined): boolean {
+                if (!select || select.kind !== J.Kind.Identifier) {
+                    return false;
+                }
+                const type = (select as J.Identifier).type;
+                if (type?.kind !== Type.Kind.Class) {
+                    return false;
+                }
+                return (type as Type.Class).fullyQualifiedName === "Stream.Duplex";
+            }
+
+            private hasTypeKey(expr: J): boolean {
+                if (expr.kind !== J.Kind.NewClass || (expr as J.NewClass).class) {
+                    return false;
+                }
+                const obj = expr as J.NewClass;
+                const statements = obj.body?.statements ?? [];
+                for (const stmt of statements) {
+                    const element = stmt.element;
+                    if (element.kind !== JS.Kind.PropertyAssignment) {
+                        continue;
+                    }
+                    const name = (element as JS.PropertyAssignment).name.element;
+                    if (name.kind === J.Kind.Identifier && (name as J.Identifier).simpleName === "type") {
+                        return true;
+                    }
+                    if (name.kind === J.Kind.Literal && (name as J.Literal).value === "type") {
+                        return true;
+                    }
+                }
+                return false;
+            }
+
+            protected async visitMethodInvocation(m: J.MethodInvocation, p: ExecutionContext): Promise<J | undefined> {
+                const method = await super.visitMethodInvocation(m, p) as J.MethodInvocation;
+                if (method.name.simpleName !== "toWeb" || !this.isDuplexReceiver(method.select?.element)) {
+                    return method;
+                }
+                const args = method.arguments.elements;
+                if (args.length < 2) {
+                    return method;
+                }
+                if (!this.hasTypeKey(args[1].element)) {
+                    return method;
+                }
+                return foundSearchResult(method,
+                    "Duplex.toWeb() options.type is runtime-deprecated (DEP0201). Drop it from the options and set the type on the resulting ReadableStream instead.");
+            }
+        });
+    }
+}

package/src/migrate/find-module-register.ts

@@ -0,0 +1,36 @@
+/*
+ * Copyright 2026 the original author or authors.
+ *
+ * Moderne Proprietary. Only for use by Moderne customers under the terms of a commercial contract.
+ */
+import {check, ExecutionContext, foundSearchResult, or, Recipe, TreeVisitor} from "@openrewrite/rewrite";
+import {JavaScriptVisitor, MethodMatcher, usesMethod} from "@openrewrite/rewrite/javascript";
+import {J} from "@openrewrite/rewrite/java";
+
+export class FindModuleRegister extends Recipe {
+    readonly name = "org.openrewrite.node.migrate.find-module-register"
+    readonly displayName: string = "Find `module.register()` usage";
+    readonly description: string = "`module.register()` for loading ESM loader hooks is runtime-deprecated in Node.js 26 (DEP0205). " +
+        "Use the `--import` CLI flag with a loader module instead.";
+    readonly tags: string[] = ["DEP0205"];
+
+    async editor(): Promise<TreeVisitor<any, ExecutionContext>> {
+        return check(or(
+            usesMethod("module register(..)"),
+            usesMethod("node:module register(..)"),
+        ), new class extends JavaScriptVisitor<ExecutionContext> {
+            moduleRegisterMatcher = new MethodMatcher("module register(..)");
+            nodeModuleRegisterMatcher = new MethodMatcher("node:module register(..)");
+
+            protected async visitMethodInvocation(m: J.MethodInvocation, p: ExecutionContext): Promise<J | undefined> {
+                const method = await super.visitMethodInvocation(m, p) as J.MethodInvocation;
+                if (this.moduleRegisterMatcher.matches(method.methodType) ||
+                    this.nodeModuleRegisterMatcher.matches(method.methodType)) {
+                    return foundSearchResult(method,
+                        "module.register() is runtime-deprecated (DEP0205). Use the --import CLI flag with a loader module instead.");
+                }
+                return method;
+            }
+        });
+    }
+}

package/src/migrate/find-process-assert.ts

@@ -14,7 +14,7 @@ export class FindProcessAssert extends Recipe {
     readonly tags: string[] = ["DEP0100"];
 
     async editor(): Promise<TreeVisitor<any, ExecutionContext>> {
-        return check(usesType("global.NodeJS.Process"), new class extends JavaScriptVisitor<ExecutionContext> {
+        return check(usesType("NodeJS.Process"), new class extends JavaScriptVisitor<ExecutionContext> {
             protected async visitMethodInvocation(m: J.MethodInvocation, p: ExecutionContext): Promise<J | undefined> {
                 const method = await super.visitMethodInvocation(m, p) as J.MethodInvocation;
                 if (method.name.simpleName !== "assert" || !method.select) {
@@ -25,7 +25,7 @@ export class FindProcessAssert extends Recipe {
                 if (select.kind === J.Kind.Identifier) {
                     const id = select as J.Identifier;
                     if (id.simpleName === "process" && id.type?.kind === Type.Kind.Class &&
-                        (id.type as Type.Class).fullyQualifiedName === "global.NodeJS.Process") {
+                        (id.type as Type.Class).fullyQualifiedName === "NodeJS.Process") {
                         return foundSearchResult(method,
                             "process.assert() is deprecated (DEP0100). Use the assert module instead.");
                     }

package/src/migrate/fs-extra/migrate-fs-extra-to-node-fs.ts

@@ -20,7 +20,9 @@ export class MigrateFsExtraToNodeFs extends Recipe {
         "existing destination, or work across devices. Calls without a faithful native equivalent " +
         "(`ensureSymlink`, `ensureLink`, ...) are left in place and listed in the `FsExtraManualMigrationSteps` " +
         "data table. " +
-        "`fs-extra` and `@types/fs-extra` are removed from each `package.json` whose sources no longer use it. " +
+        "`fs-extra` and `@types/fs-extra` are removed from each `package.json` that declares them, with the lock file " +
+        "updated to match. They are removed even where a call listed in the data table still uses fs-extra, so " +
+        "migrate those before building. " +
         "Tests that mock or spy on fs-extra itself (`vi.mock('fs-extra')`, `vi.spyOn(fs, 'outputFile')`, ...) keep " +
         "watching a module the migrated code no longer calls, so they fail until they mock `node:fs` / " +
         "`node:fs/promises` instead. Every such site is listed in the data table; migrate them together with the " +
@@ -31,7 +33,7 @@ export class MigrateFsExtraToNodeFs extends Recipe {
         return [
             ...fsExtraRewriteRecipes(),
             new FindFsExtraManualMigrations(),
-            new RemoveUnusedFsExtraDependency({accountForMigration: true}),
+            new RemoveUnusedFsExtraDependency(),
         ];
     }
 }

package/src/migrate/fs-extra/remove-unused-fs-extra-dependency.ts

@@ -4,24 +4,14 @@
  * Moderne Proprietary. Only for use by Moderne customers under the terms of a commercial contract.
  */
 
-import {Recipe} from "@openrewrite/rewrite";
-import {fsExtraRewriteRecipes} from "./fs-extra-rewrites";
-import {RemoveUnusedDependency} from "../remove-unused-dependency";
+import {RemoveDependencies} from "../remove-dependencies";
 
-export class RemoveUnusedFsExtraDependency extends RemoveUnusedDependency {
+export class RemoveUnusedFsExtraDependency extends RemoveDependencies {
     readonly name = "org.openrewrite.node.migrate.fs-extra.remove-unused-fs-extra-dependency";
-    readonly displayName = "Remove unused `fs-extra` dependency";
-    readonly description = "Removes `fs-extra` and `@types/fs-extra` from each `package.json` whose package no longer " +
-        "references fs-extra from any JavaScript or TypeScript source, including `vi.mock`/`jest.mock` calls, " +
-        "`__mocks__/fs-extra` files, and `/// <reference types=\"fs-extra\" />`. A reference anywhere beneath a " +
-        "`package.json`'s directory keeps its dependencies, since a monorepo root hoists them for its workspaces. " +
-        "A package is left alone when any source beneath it failed to parse, or none was parsed at all. " +
-        "Lock files are not regenerated; run the package manager's install afterwards.";
+    readonly displayName = "Remove the `fs-extra` dependency";
+    readonly description = "Removes `fs-extra` and `@types/fs-extra` from each `package.json` that declares them, " +
+        "and updates the lock file to match.";
+    readonly tags = ["fs-extra"];
 
-    protected readonly module = 'fs-extra';
     protected readonly packages = ['fs-extra', '@types/fs-extra'];
-
-    protected migrationRecipes(): Recipe[] {
-        return fsExtraRewriteRecipes();
-    }
 }

package/src/migrate/fs-extra/replace-fs-extra-native-methods.ts

@@ -59,7 +59,7 @@ function uniformTarget(cu: JS.CompilationUnit, local: string, member: string): N
     const body = cu.statements.filter(s => s.element?.kind !== JS.Kind.Import && !declarationsOf(s.element).some(d =>
         d.variables.some(v => v.element.initializer?.element?.kind === J.Kind.MethodInvocation &&
             (v.element.initializer.element as J.MethodInvocation).name.simpleName === 'require')));
-    walk(body, node => {
+    walk(body, (node: any) => {
         if (node.kind === J.Kind.Identifier && node.simpleName === local) {
             occurrences++;
         } else if (node.kind === J.Kind.MethodInvocation && !node.select && node.name.simpleName === local) {

package/src/migrate/hpagent/migrate-hpagent-to-https-proxy-agent.ts

@@ -17,14 +17,14 @@ export class MigrateHpagentToHttpsProxyAgent extends Recipe {
         "tunnel to TLS only for an `https:` target — so `HttpProxyAgent` and `HttpsProxyAgent` both become " +
         "`https-proxy-agent`'s `HttpsProxyAgent`. The proxy URL moves from the `proxy` option to the constructor's " +
         "first argument, `proxyRequestOptions` members move up into the options object, and the dependency is swapped " +
-        "in each `package.json` that declares it.\n\n" +
+        "in each `package.json` that declares it, with the lock file updated to match.\n\n" +
         "Two things do not carry over, and both are reported in the `HpagentManualMigrationSteps` data table rather " +
         "than rewritten. A TLS option set at the top level of hpagent's `HttpsProxyAgent` (`ca`, `rejectUnauthorized`, " +
         "`cert`, ...) configured the handshake with the **destination**, because that class extends `https.Agent`; " +
         "`https-proxy-agent` spends its constructor options on the connection to the **proxy** and takes the " +
         "destination's TLS options from each request, so such an option has to move to the request or the client " +
         "library. Agent options that aren't written as an object literal can't be split into the new two-argument " +
-        "form either.";
+        "form either. The dependency is swapped regardless, so migrate every reported site before building.";
     readonly tags = ["hpagent", "https-proxy-agent"];
 
     @Option({
@@ -53,11 +53,7 @@ export class MigrateHpagentToHttpsProxyAgent extends Recipe {
         return [
             new ReplaceHpagent({migrateSpreadOptions: this.migrateSpreadOptions}),
             new FindHpagentManualMigrations(),
-            new SwapHpagentDependency({
-                version: this.version,
-                migrateSpreadOptions: this.migrateSpreadOptions,
-                accountForMigration: true
-            }),
+            new SwapHpagentDependency({version: this.version}),
         ];
     }
 }

package/src/migrate/hpagent/replace-hpagent.ts

@@ -4,7 +4,7 @@
  * Moderne Proprietary. Only for use by Moderne customers under the terms of a commercial contract.
  */
 
-import {ExecutionContext, Option, Recipe, TreeVisitor} from "@openrewrite/rewrite";
+import {emptyMarkers, ExecutionContext, Option, randomId, Recipe, TreeVisitor} from "@openrewrite/rewrite";
 import {isIdentifier, J, rightPadded, space} from "@openrewrite/rewrite/java";
 import {compilationUnitOf, declarationsOf, JavaScriptVisitor, JS, maybeRebind, maybeUnbind, namesDeclaredIn} from "@openrewrite/rewrite/javascript";
 import {requiredModule} from "../module-bindings";
@@ -107,6 +107,76 @@ function typeKey(type: J): string | undefined {
     return isIdentifier(clazz) ? `${clazz.simpleName}<>` : undefined;
 }
 
+/**
+ * Whether `proxy` is a URL however the program got here. hpagent keeps a missing proxy until a request
+ * needs it, but `https-proxy-agent` reads it in the constructor, so anything else may now throw there.
+ */
+function alwaysDefined(proxy: J): boolean {
+    switch (proxy.kind) {
+        case J.Kind.Literal:
+            return typeof (proxy as J.Literal).value === 'string';
+        case JS.Kind.TemplateExpression:
+        case J.Kind.NewClass:
+            return true;
+        case J.Kind.Parentheses:
+            return alwaysDefined((proxy as J.Parentheses<J>).tree.element);
+        case J.Kind.Binary:
+            return (proxy as J.Binary).operator.element === J.Binary.Type.Or && alwaysDefined((proxy as J.Binary).right);
+        case JS.Kind.Binary:
+            return (proxy as JS.Binary).operator.element === JS.Binary.Type.QuestionQuestion && alwaysDefined((proxy as JS.Binary).right);
+        default:
+            return false;
+    }
+}
+
+/** Whether evaluating `e` twice is the same as evaluating it once: names, member reads and fallbacks among them. */
+function readsOnly(e: J): boolean {
+    switch (e.kind) {
+        case J.Kind.Identifier:
+        case J.Kind.Literal:
+            return true;
+        case J.Kind.FieldAccess:
+            return readsOnly((e as J.FieldAccess).target);
+        case J.Kind.ArrayAccess: {
+            const access = e as J.ArrayAccess;
+            return readsOnly(access.indexed) && access.dimension.index.element.kind === J.Kind.Literal;
+        }
+        case J.Kind.Parentheses:
+            return readsOnly((e as J.Parentheses<J>).tree.element);
+        case J.Kind.Binary:
+            return (e as J.Binary).operator.element === J.Binary.Type.Or &&
+                readsOnly((e as J.Binary).left) && readsOnly((e as J.Binary).right);
+        case JS.Kind.Binary:
+            return (e as JS.Binary).operator.element === JS.Binary.Type.QuestionQuestion &&
+                readsOnly((e as JS.Binary).left) && readsOnly((e as JS.Binary).right);
+        default:
+            return false;
+    }
+}
+
+/** A JavaScript file, where nothing checked that the proxy is defined; TypeScript required hpagent's `proxy` to be. */
+function isJavaScript(sourcePath: string): boolean {
+    return /\.[cm]?jsx?$/.test(sourcePath);
+}
+
+/** `proxy ? construction : undefined`, built directly so the construction keeps its layout. */
+function whenDefined(proxy: J, construction: J.NewClass): J.Ternary {
+    const padded = <T extends J>(element: T): J.LeftPadded<T> =>
+        ({kind: J.Kind.LeftPadded, before: space(' '), element, markers: emptyMarkers});
+    const undefinedValue: J.Identifier = {
+        kind: J.Kind.Identifier, id: randomId(), prefix: space(' '), markers: emptyMarkers, annotations: [], simpleName: 'undefined'
+    };
+    return {
+        kind: J.Kind.Ternary,
+        id: randomId(),
+        prefix: construction.prefix,
+        markers: emptyMarkers,
+        condition: {...proxy, id: randomId(), prefix: space('')} as J,
+        truePart: padded({...construction, prefix: space(' ')} as J.NewClass),
+        falsePart: padded(undefinedValue),
+    } as J.Ternary;
+}
+
 /** The members of an object literal, still padded, with the placeholder of an empty literal dropped. */
 function paddedMembers(literal: J.NewClass): J.RightPadded<J>[] {
     return (literal.body?.statements ?? []).filter(padded => padded.element.kind !== J.Kind.Empty) as J.RightPadded<J>[];
@@ -120,7 +190,10 @@ export class ReplaceHpagent extends Recipe {
         "option: `new HttpsProxyAgent({proxy: url, keepAlive: true})` becomes `new HttpsProxyAgent(url, {keepAlive: true})`. " +
         "Both hpagent classes tunnel with `CONNECT`, and `https-proxy-agent` upgrades the tunnel to TLS only for an " +
         "`https:` target, so one class serves both. `proxyRequestOptions` members move up into the options object, " +
-        "where `https-proxy-agent` applies them to the connection to the proxy. Calls whose options aren't an object " +
+        "where `https-proxy-agent` applies them to the connection to the proxy. hpagent accepted a missing proxy until " +
+        "a request needed it, but `https-proxy-agent` reads it in the constructor, so in JavaScript a proxy that may be " +
+        "missing, such as `process.env.HTTP_PROXY`, guards the construction: `proxy ? new HttpsProxyAgent(proxy) : undefined`. " +
+        "Calls whose options aren't an object " +
         "literal, or that set a TLS option for the destination handshake (`ca`, `rejectUnauthorized`, `cert`, ...), " +
         "are left alone: `https-proxy-agent` would apply those to the proxy hop instead. " +
         "`FindHpagentManualMigrations` reports every usage left behind.";
@@ -275,7 +348,13 @@ export class ReplaceHpagent extends Recipe {
                     (rewrite ? this.migrated : this.stranded).add(site.local);
                     return n;
                 }
-                return rewrite && !this.stranded.has(site.local) ? this.applyRewrite(n, site, rewrite) : n;
+                if (!rewrite || this.stranded.has(site.local)) return n;
+                const migrated = this.applyRewrite(n, site, rewrite);
+                // Constructing with a missing proxy used to succeed and now throws, as when a module builds its
+                // agent from an environment variable a test run doesn't set, so the construction is skipped then.
+                return isJavaScript(compilationUnitOf(this)!.sourcePath) && !alwaysDefined(rewrite.proxy) && readsOnly(rewrite.proxy)
+                    ? whenDefined(rewrite.proxy, migrated)
+                    : migrated;
             }
 
             /**