import-in-the-middle 2.0.1 → 2.0.3

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## [2.0.3](https://github.com/nodejs/import-in-the-middle/compare/import-in-the-middle-v2.0.2...import-in-the-middle-v2.0.3) (2026-01-13)
+
+
+### Bug Fixes
+
+* add missing JSDoc type information ([40c1009](https://github.com/nodejs/import-in-the-middle/commit/40c1009ef3acc45b5eec89ed1b866866933edace))
+* add missing name for fast builtin lookup ([40c1009](https://github.com/nodejs/import-in-the-middle/commit/40c1009ef3acc45b5eec89ed1b866866933edace))
+* do not crash on missing setters ([#223](https://github.com/nodejs/import-in-the-middle/issues/223)) ([fe44778](https://github.com/nodejs/import-in-the-middle/commit/fe4477832aa9a3422ebecf0a2460cf77be3b3581))
+* handle undefined exports properly ([40c1009](https://github.com/nodejs/import-in-the-middle/commit/40c1009ef3acc45b5eec89ed1b866866933edace))
+* multiple minor issues ([#221](https://github.com/nodejs/import-in-the-middle/issues/221)) ([40c1009](https://github.com/nodejs/import-in-the-middle/commit/40c1009ef3acc45b5eec89ed1b866866933edace))
+* remove small memory leak ([40c1009](https://github.com/nodejs/import-in-the-middle/commit/40c1009ef3acc45b5eec89ed1b866866933edace))
+
+
+### Performance Improvements
+
+* improve perf by calculating less stack frames and fast paths ([#224](https://github.com/nodejs/import-in-the-middle/issues/224)) ([09ae8bf](https://github.com/nodejs/import-in-the-middle/commit/09ae8bfdeedf6c1c8c81c7338858004447e68233))
+
+## [2.0.2](https://github.com/nodejs/import-in-the-middle/compare/import-in-the-middle-v2.0.1...import-in-the-middle-v2.0.2) (2026-01-11)
+
+
+### Bug Fixes
+
+* grammar issue in README.md ([#216](https://github.com/nodejs/import-in-the-middle/issues/216)) ([46e4a2a](https://github.com/nodejs/import-in-the-middle/commit/46e4a2a9ad250c06fb52c9b782370071a6d1f3cc))
+* properly handle internals when specifier matches ([#220](https://github.com/nodejs/import-in-the-middle/issues/220)) ([05e4216](https://github.com/nodejs/import-in-the-middle/commit/05e4216e10d11c7eb996d4124f36e476f3a6d42f))
+
 ## [2.0.1](https://github.com/nodejs/import-in-the-middle/compare/import-in-the-middle-v2.0.0...import-in-the-middle-v2.0.1) (2025-12-18)
 
 

package/README.md

@@ -1,6 +1,6 @@
 # import-in-the-middle
 
-**`import-in-the-middle`** is an module loading interceptor inspired by
+**`import-in-the-middle`** is a module loading interceptor inspired by
 [`require-in-the-middle`](https://npm.im/require-in-the-middle), but
 specifically for ESM modules. In fact, it can even modify modules after loading
 time.

package/create-hook.mjs

@@ -21,6 +21,7 @@ const NODE_VERSION = process.versions.node.split('.')
 const NODE_MAJOR = Number(NODE_VERSION[0])
 const NODE_MINOR = Number(NODE_VERSION[1])
 const HANDLED_FORMATS = new Set(['builtin', 'module', 'commonjs'])
+const TRACE_WARNINGS = process.execArgv.includes('--trace-warnings')
 
 let getExports
 if (NODE_MAJOR >= 20 || (NODE_MAJOR === 18 && NODE_MINOR >= 19)) {
@@ -32,6 +33,10 @@ if (NODE_MAJOR >= 20 || (NODE_MAJOR === 18 && NODE_MINOR >= 19)) {
 let entrypoint
 
 function hasIitm (url) {
+  // Fast path: avoid URL parsing on the hot path when there's clearly no iitm.
+  if (typeof url !== 'string' || url.indexOf('iitm') === -1) {
+    return false
+  }
   try {
     return new URL(url).searchParams.has('iitm')
   } catch {
@@ -44,8 +49,14 @@ function isIitm (url, meta) {
 }
 
 function deleteIitm (url) {
+  // Fast path: avoid URL parsing / try-catch on bare specifiers and normal file URLs.
+  if (typeof url !== 'string' || url.indexOf('iitm') === -1) {
+    return url
+  }
   let resultUrl
+  const stackTraceLimit = Error.stackTraceLimit
   try {
+    Error.stackTraceLimit = 0
     const urlObj = new URL(url)
     if (urlObj.searchParams.has('iitm')) {
       urlObj.searchParams.delete('iitm')
@@ -62,6 +73,7 @@ function deleteIitm (url) {
   } catch {
     resultUrl = url
   }
+  Error.stackTraceLimit = stackTraceLimit
   return resultUrl
 }
 
@@ -115,12 +127,16 @@ function isBareSpecifier (specifier) {
     return !URL.canParse(specifier)
   }
 
+  const stackTraceLimit = Error.stackTraceLimit
   try {
+    Error.stackTraceLimit = 0
     // eslint-disable-next-line no-new
     new URL(specifier)
     return false
   } catch (err) {
     return true
+  } finally {
+    Error.stackTraceLimit = stackTraceLimit
   }
 }
 
@@ -141,7 +157,9 @@ function isBareSpecifierFileUrlOrRegex (input) {
     return false
   }
 
+  const stackTraceLimit = Error.stackTraceLimit
   try {
+    Error.stackTraceLimit = 0
     // eslint-disable-next-line no-new
     const url = new URL(input)
     // We consider node: URLs bare specifiers in this context
@@ -149,6 +167,8 @@ function isBareSpecifierFileUrlOrRegex (input) {
   } catch (err) {
     // Anything that fails parsing is a bare specifier
     return true
+  } finally {
+    Error.stackTraceLimit = stackTraceLimit
   }
 }
 
@@ -185,7 +205,7 @@ function emitWarning (err) {
   // Unfortunately, process.emitWarning does not output the full error
   // with error.cause like console.warn does so we need to inspect it when
   // tracing warnings
-  const warnMessage = process.execArgv.includes('--trace-warnings') ? inspect(err) : err
+  const warnMessage = TRACE_WARNINGS ? inspect(err) : err
   process.emitWarning(warnMessage)
 }
 
@@ -196,12 +216,13 @@ function emitWarning (err) {
  * @param {string} params.srcUrl The full URL to the module to process.
  * @param {object} params.context Provided by the loaders API.
  * @param {Function} params.parentGetSource Provides the source code for the parent module.
- * @param {bool} params.excludeDefault Exclude the default export.
+ * @param {Function} params.parentResolve Provides the resolve function for the parent module.
+ * @param {boolean} [params.excludeDefault = false] Exclude the default export.
  *
  * @returns {Promise<Map<string, string>>} The shimmed setters for all the exports
  * from the module and any transitive export all modules.
  */
-async function processModule ({ srcUrl, context, parentGetSource, parentResolve, excludeDefault }) {
+async function processModule ({ srcUrl, context, parentGetSource, parentResolve, excludeDefault = false }) {
   const exportNames = await getExports(srcUrl, context, parentGetSource)
   const starExports = new Set()
   const setters = new Map()
@@ -365,12 +386,21 @@ export function createHook (meta) {
     //
     // For non-bare specifier imports, we match to the full file URL because
     // using relative paths would be very error prone!
+    let resultPath
+    if (result.url.startsWith('file:')) {
+      const stackTraceLimit = Error.stackTraceLimit
+      Error.stackTraceLimit = 0
+      try {
+        resultPath = fileURLToPath(result.url)
+      } catch {}
+      Error.stackTraceLimit = stackTraceLimit
+    }
     function match (each) {
       if (each instanceof RegExp) {
         return each.test(result.url)
       }
 
-      return each === specifier || each === result.url || (result.url.startsWith('file:') && each === fileURLToPath(result.url))
+      return each === specifier || each === result.url || (resultPath && each === resultPath)
     }
 
     if (result.format && !HANDLED_FORMATS.has(result.format)) {
@@ -385,7 +415,7 @@ export function createHook (meta) {
       return result
     }
 
-    if (isIitm(parentURL, meta) || hasIitm(parentURL)) {
+    if (isIitm(parentURL, meta) || (parentURL && hasIitm(parentURL))) {
       return result
     }
 
@@ -421,6 +451,7 @@ export function createHook (meta) {
   async function getSource (url, context, parentGetSource) {
     if (hasIitm(url)) {
       const realUrl = deleteIitm(url)
+      const originalSpecifier = specifiers.get(realUrl)
 
       try {
         const setters = await processModule({
@@ -429,6 +460,8 @@ export function createHook (meta) {
           parentGetSource,
           parentResolve: cachedResolve
         })
+        // If the module loaded successfully, we can remove the specifier to reduce memory usage early.
+        specifiers.delete(realUrl)
         return {
           source: `
 import { register } from '${iitmURL}'
@@ -442,10 +475,13 @@ const get = {}
 
 ${Array.from(setters.values()).join('\n')}
 
-register(${JSON.stringify(realUrl)}, _, set, get, ${JSON.stringify(specifiers.get(realUrl))})
+register(${JSON.stringify(realUrl)}, _, set, get, ${JSON.stringify(originalSpecifier)})
 `
         }
       } catch (cause) {
+        // If the module failed loading, the specifier will not be used again, so
+        // we can remove it to prevent a memory leak.
+        specifiers.delete(realUrl)
         // If there are other ESM loader hooks registered as well as iitm,
         // depending on the order they are registered, source might not be
         // JavaScript.

package/index.js

@@ -29,7 +29,12 @@ function removeHook (hook) {
 function callHookFn (hookFn, namespace, name, baseDir) {
   const newDefault = hookFn(namespace, name, baseDir)
   if (newDefault && newDefault !== namespace) {
-    namespace.default = newDefault
+    // Only ESM modules that actually export `default` can have it reassigned.
+    // Some hooks return a value unconditionally; avoid crashing when the module
+    // has no default export (see issue #188).
+    if ('default' in namespace) {
+      namespace.default = newDefault
+    }
   }
 }
 
@@ -127,9 +132,12 @@ function Hook (modules, options, hookFn) {
       name = name.replace(/^node:/, '')
     } else {
       if (name.startsWith('file://')) {
+        const stackTraceLimit = Error.stackTraceLimit
+        Error.stackTraceLimit = 0
         try {
           name = fileURLToPath(name)
         } catch (e) {}
+        Error.stackTraceLimit = stackTraceLimit
       }
       const details = parse(name)
       if (details) {
@@ -140,14 +148,16 @@ function Hook (modules, options, hookFn) {
 
     if (modules) {
       for (const moduleName of modules) {
-        if (moduleName === specifier) {
-          callHookFn(hookFn, namespace, name, baseDir)
-        } else if (moduleName === name) {
+        const nameMatch = moduleName === name
+        const specMatch = moduleName === specifier
+        if (nameMatch || specMatch) {
           if (baseDir) {
             if (internals) {
               name = name + path.sep + path.relative(baseDir, fileURLToPath(filename))
             } else {
-              if (!getExperimentalPatchInternals() && !baseDir.endsWith(specifiers.get(filename))) continue
+              if (!getExperimentalPatchInternals() && !specMatch && !baseDir.endsWith(specifiers.get(filename))) {
+                continue
+              }
             }
           }
           callHookFn(hookFn, namespace, name, baseDir)

package/lib/get-exports.mjs

@@ -16,13 +16,134 @@ function addDefault (arr) {
   return new Set(['default', ...arr])
 }
 
+function hasEsmSyntax (source) {
+  // Lightweight scan (no full parse) to determine if the *source code*
+  // contains ESM-specific syntax. This is used only when:
+  // - the loader chain didn't tell us a `format`, and
+  // - `getEsmExports()` found no exports.
+  //
+  // Notes:
+  // - We ignore comments and strings to reduce false positives.
+  // - We treat `import.meta` and static `import ...` as ESM.
+  // - We do NOT treat `import(` (dynamic import) as ESM because it is allowed
+  //   in CJS as an expression.
+  if (source.indexOf('import') === -1) return false
+
+  const isIdentCharCode = (code) => (
+    (code >= 48 && code <= 57) || // 0-9
+    (code >= 65 && code <= 90) || // A-Z
+    (code >= 97 && code <= 122) || // a-z
+    code === 95 || // _
+    code === 36 // $
+  )
+
+  const skipWhitespace = (idx) => {
+    while (idx < source.length) {
+      const c = source.charCodeAt(idx)
+      // space, tab, cr, lf
+      if (c !== 32 && c !== 9 && c !== 13 && c !== 10) break
+      idx++
+    }
+    return idx
+  }
+
+  let i = 0
+  while (i < source.length) {
+    const ch = source[i]
+
+    // Line comment
+    if (ch === '/' && source[i + 1] === '/') {
+      i += 2
+      while (i < source.length && source[i] !== '\n') i++
+      continue
+    }
+
+    // Block comment
+    if (ch === '/' && source[i + 1] === '*') {
+      i += 2
+      while (i < source.length && !(source[i] === '*' && source[i + 1] === '/')) i++
+      i += 2
+      continue
+    }
+
+    // Strings: '...' or "..."
+    if (ch === '\'' || ch === '"') {
+      const quote = ch
+      i++
+      while (i < source.length) {
+        const c = source[i]
+        if (c === '\\') {
+          i += 2
+          continue
+        }
+        if (c === quote) {
+          i++
+          break
+        }
+        i++
+      }
+      continue
+    }
+
+    // Template strings: `...`
+    if (ch === '`') {
+      i++
+      while (i < source.length) {
+        const c = source[i]
+        if (c === '\\') {
+          i += 2
+          continue
+        }
+        if (c === '`') {
+          i++
+          break
+        }
+        i++
+      }
+      continue
+    }
+
+    // Keyword scan (word-boundary): import
+    if (ch === 'i') {
+      const prev = source.charCodeAt(i - 1)
+      if (i > 0 && isIdentCharCode(prev)) {
+        i++
+        continue
+      }
+
+      if (source.startsWith('import', i)) {
+        const next = source.charCodeAt(i + 6)
+        if (isIdentCharCode(next)) {
+          i++
+          continue
+        }
+
+        const j = skipWhitespace(i + 6)
+        // `import.meta` is ESM-only
+        if (source[j] === '.') return true
+        // `import(` is dynamic import, allowed in CJS
+        if (source[j] === '(') {
+          i = j + 1
+          continue
+        }
+        // Otherwise assume it's a static import form
+        return true
+      }
+    }
+
+    i++
+  }
+
+  return false
+}
+
 // Cached exports for Node built-in modules
 const BUILT_INS = new Map()
 
 let require
 
 function getExportsForNodeBuiltIn (name) {
-  let exports = BUILT_INS.get()
+  let exports = BUILT_INS.get(name)
 
   if (!require) {
     require = createRequire(import.meta.url)
@@ -96,7 +217,7 @@ function resolvePackageImports (specifier, fromUrl) {
 
 async function getCjsExports (url, context, parentLoad, source) {
   if (urlsBeingProcessed.has(url)) {
-    return []
+    return new Set()
   }
   urlsBeingProcessed.add(url)
 
@@ -201,13 +322,17 @@ export async function getExports (url, context, parentLoad) {
     // At this point our `format` is either undefined or not known by us. Fall
     // back to parsing as ESM/CJS.
     const esmExports = getEsmExports(source)
-    if (!esmExports.length) {
-      // TODO(bengl) it's might be possible to get here if somehow the format
-      // isn't set at first and yet we have an ESM module with no exports.
-      // I couldn't construct an example that would do this, so maybe it's
-      // impossible?
-      return await getCjsExports(url, context, parentLoad, source)
+    if (!esmExports.size) {
+      // If there's strong evidence this is ESM (static import/import.meta),
+      // prefer returning the empty ESM export set over incorrectly treating it
+      // as CJS.
+      if (!hasEsmSyntax(source)) {
+        // It might be possible to get here if the format
+        // isn't set at first and yet we have an ESM module with no exports.
+        return await getCjsExports(url, context, parentLoad, source)
+      }
     }
+    return esmExports
   } catch (cause) {
     const err = new Error(`Failed to parse '${url}'`)
     err.cause = cause

package/lib/register.js

@@ -10,7 +10,14 @@ const toHook = []
 
 const proxyHandler = {
   set (target, name, value) {
-    return setters.get(target)[name](value)
+    const set = setters.get(target)
+    const setter = set && set[name]
+    if (typeof setter === 'function') {
+      return setter(value)
+    }
+    // If a module doesn't export the property being assigned (e.g. no default
+    // export), there is no setter to call. Don't crash userland code.
+    return true
   },
 
   get (target, name) {
@@ -30,7 +37,12 @@ const proxyHandler = {
       throw new Error('Getters/setters are not supported for exports property descriptors.')
     }
 
-    return setters.get(target)[property](descriptor.value)
+    const set = setters.get(target)
+    const setter = set && set[property]
+    if (typeof setter === 'function') {
+      return setter(descriptor.value)
+    }
+    return true
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "import-in-the-middle",
-  "version": "2.0.1",
+  "version": "2.0.3",
   "description": "Intercept imports in Node.js",
   "main": "index.js",
   "scripts": {
@@ -34,31 +34,31 @@
     "test-env": "NODE_OPTIONS=--no-warnings --require ./test/version-check.js --experimental-loader ./test/generic-loader.mjs"
   },
   "devDependencies": {
-    "@babel/core": "^7.23.7",
-    "@babel/eslint-parser": "^7.23.3",
-    "@babel/plugin-syntax-import-assertions": "^7.23.3",
-    "@node-rs/crc32": "^1.10.3",
+    "@babel/core": "^7.28.5",
+    "@babel/eslint-parser": "^7.28.5",
+    "@babel/plugin-syntax-import-assertions": "^7.27.1",
+    "@node-rs/crc32": "^1.10.6",
     "@react-email/components": "^0.0.19",
     "@types/node": "^18.0.6",
-    "c8": "^7.8.0",
+    "c8": "^7.14.0",
     "date-fns": "^3.6.0",
-    "eslint": "^8.55.0",
+    "eslint": "^8.57.1",
     "eslint-config-standard": "^17.1.0",
-    "eslint-plugin-import": "^2.29.0",
-    "eslint-plugin-n": "^16.4.0",
+    "eslint-plugin-import": "^2.32.0",
+    "eslint-plugin-n": "^16.6.2",
     "eslint-plugin-node": "^11.1.0",
-    "eslint-plugin-promise": "^6.1.1",
-    "got": "^14.3.0",
-    "imhotap": "^2.1.0",
+    "eslint-plugin-promise": "^6.6.0",
+    "got": "^14.6.6",
+    "imhotap": "^2.2.0",
     "openai": "4.47.2",
-    "ts-node": "^10.9.1",
-    "typescript": "^4.7.4",
-    "vue": "^3.4.31"
+    "ts-node": "^10.9.2",
+    "typescript": "^4.9.5",
+    "vue": "^3.5.26"
   },
   "dependencies": {
-    "acorn": "^8.14.0",
+    "acorn": "^8.15.0",
     "acorn-import-attributes": "^1.9.5",
-    "cjs-module-lexer": "^1.2.2",
-    "module-details-from-path": "^1.0.3"
+    "cjs-module-lexer": "^2.2.0",
+    "module-details-from-path": "^1.0.4"
   }
 }