import-in-the-middle 3.0.0 → 3.0.2

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [3.0.2](https://github.com/nodejs/import-in-the-middle/compare/import-in-the-middle-v3.0.1...import-in-the-middle-v3.0.2) (2026-06-08)
+
+
+### Bug Fixes
+
+* Updated proxying logic for builtins that are used as CJS ([#250](https://github.com/nodejs/import-in-the-middle/issues/250)) ([f69eb8f](https://github.com/nodejs/import-in-the-middle/commit/f69eb8f13c91b7088003e7390b4f54c5076aa50b))
+
+## [3.0.1](https://github.com/nodejs/import-in-the-middle/compare/import-in-the-middle-v3.0.0...import-in-the-middle-v3.0.1) (2026-04-07)
+
+
+### Bug Fixes
+
+* handle file specifiers from turbopacked packages better ([#246](https://github.com/nodejs/import-in-the-middle/issues/246)) ([04539fb](https://github.com/nodejs/import-in-the-middle/commit/04539fb5ceb9e4816933bd4310c1334077af1643))
+
 ## [3.0.0](https://github.com/nodejs/import-in-the-middle/compare/import-in-the-middle-v2.0.6...import-in-the-middle-v3.0.0) (2026-01-30)
 
 

package/create-hook.mjs

@@ -265,12 +265,19 @@ async function processModule ({ srcUrl, context, parentGetSource, parentResolve,
       const objectKey = JSON.stringify(n)
       const reExportedName = n === 'default' ? n : objectKey
 
+      // For the module.exports synthetic export (Node 23+), fall back to $default
+      // when namespace['module.exports'] is not exposed by the native ESM namespace
+      // (builtins don't expose it). This ensures the IITM hook proxy returns the
+      // actual CJS value (e.g. EventEmitter) when an instrumentor reads
+      // capturedExports['module.exports'], rather than undefined.
+      const moduleExportsFallback = n === 'module.exports' ? ' ?? $default' : ''
+
       addSetter(n, `
       let ${variableName}
       __overridden[${objectKey}] = false
       let ${variableName}Defer = false
       try {
-        ${variableName} = _[${objectKey}] = namespace[${objectKey}]
+        ${variableName} = _[${objectKey}] = namespace[${objectKey}]${moduleExportsFallback}
       } catch (err) {
         if (!(err instanceof ReferenceError)) throw err
         ${variableName}Defer = true
@@ -279,11 +286,11 @@ async function processModule ({ srcUrl, context, parentGetSource, parentResolve,
       if (${variableName}Defer || ${variableName} === undefined) {
         __pending.push(__makeUpdater(
           ${objectKey},
-          () => namespace[${objectKey}],
+          () => namespace[${objectKey}]${moduleExportsFallback},
           (v) => { ${variableName} = _[${objectKey}] = v }
         ))
       }
-      export { ${variableName} as ${reExportedName} }
+      ${(n === 'module.exports' && (srcUrl.startsWith('node:') || builtinModules.includes(srcUrl))) ? '' : `export { ${variableName} as ${reExportedName} }`}
       set[${objectKey}] = (v) => {
         __overridden[${objectKey}] = true
         ${variableName} = v
@@ -308,6 +315,14 @@ export function createHook (meta) {
   const iitmURL = new URL('lib/register.js', meta.url).toString()
   let includeModules, excludeModules
 
+  // Track CJS module URLs that IITM has wrapped. On Node 24+, CJS modules loaded
+  // via loadCJSModule (in an ESM import chain) have their require() calls for
+  // builtins routed through the ESM resolver. Without this guard, IITM would
+  // intercept those require() calls and return an ESM namespace object instead
+  // of the native CJS module value (e.g. EventEmitter constructor), breaking
+  // patterns like `class App extends require('events') {}`.
+  const cjsInIitmChain = new Set()
+
   async function initialize (data) {
     if (global.__import_in_the_middle_initialized__) {
       process.emitWarning("The 'import-in-the-middle' hook has already been initialized")
@@ -405,6 +420,17 @@ export function createHook (meta) {
       return result
     }
 
+    // When a CJS module is loaded by an IITM shim, its require() calls for
+    // builtins may be routed through the ESM resolver on Node 24+. Skip IITM
+    // wrapping in that case so require() returns the native module value.
+    // We also propagate the membership to the resolved child so that its own
+    // transitive require() calls are likewise skipped (the entire synchronous
+    // CJS require chain must remain unwrapped to avoid ERR_VM_MODULE_LINK_FAILURE).
+    if (cjsInIitmChain.has(parentURL)) {
+      cjsInIitmChain.add(result.url)
+      return result
+    }
+
     // We don't want to attempt to wrap native modules
     if (result.url.endsWith('.node')) {
       return result
@@ -448,6 +474,11 @@ export function createHook (meta) {
         })
         // If the module loaded successfully, we can remove the specifier to reduce memory usage early.
         specifiers.delete(realUrl)
+        // Track CJS modules so their transitive require() calls bypass IITM.
+        // context.format is set to 'commonjs' by getCjsExports during processModule.
+        if (context.format === 'commonjs') {
+          cjsInIitmChain.add(realUrl)
+        }
         return {
           source: `
 import { register } from '${iitmURL}'
@@ -563,6 +594,24 @@ register(${JSON.stringify(realUrl)}, _, set, get, ${JSON.stringify(originalSpeci
       return parentLoad(deleteIitm(url), context)
     }
 
+    // On Node 22+, when a CJS module is loaded through the ESM translator and
+    // another loader hook provides its source (instead of leaving source null
+    // for Node to read natively), require() calls inside that CJS module for
+    // packages using the "module-sync" exports condition fail with
+    // ERR_VM_MODULE_LINK_FAILURE. Work around this Node bug by stripping
+    // hook-provided source for CJS modules in the synchronous require chain,
+    // forcing Node to use its native CJS loader which handles this correctly.
+    if (cjsInIitmChain.has(url)) {
+      const result = await parentLoad(url, context)
+      if (result.format === 'commonjs' && result.source != null) {
+        return {
+          format: result.format,
+          source: undefined
+        }
+      }
+      return result
+    }
+
     return parentLoad(url, context)
   }
 

package/index.js

@@ -18,6 +18,26 @@ const {
   toHook
 } = require('./lib/register')
 
+/**
+ * Checks turbopack specifiers separately (for Next.js 16+).
+ *
+ * If turbopack is used, specifiers will have an additional hash appended to the end.
+ * Something like "ai" might become "ai-5e7181a616786b24". This only happens in Next.js 16+.
+ * Just checking if the baseDir ends with this new specifier won't match, as the baseDir still has the plain package.
+ *
+ * This logic isolates a new check for checking the actual name in the case turbopack is being used.
+ *
+ * @param specifier {string}
+ * @param baseDir {string}
+ */
+function isTurbopackSpecifier (specifier, baseDir) {
+  const usingTurbopack = process.env.TURBOPACK ?? process.argv.includes('--turbo')
+  if (!usingTurbopack) return false
+
+  const specifierWithoutTurbopackHash = specifier.slice(0, specifier.lastIndexOf('-'))
+  return baseDir.endsWith(specifierWithoutTurbopackHash)
+}
+
 function addHook (hook) {
   importHooks.push(hook)
   toHook.forEach(([name, namespace, specifier]) => hook(name, namespace, specifier))
@@ -167,7 +187,7 @@ function Hook (modules, options, hookFn) {
           if (!baseDir) {
             // built-in module (or unexpected non file:// name?)
             callHookFn(hookFn, namespace, name, baseDir)
-          } else if (baseDir.endsWith(specifiers.get(loadUrl))) {
+          } else if (baseDir.endsWith(specifiers.get(loadUrl)) || isTurbopackSpecifier(specifiers.get(loadUrl), baseDir)) {
             // An import of the top-level module (e.g. `import 'ioredis'`).
             // Note: Slight behaviour difference from RITM. RITM uses
             // `require.resolve(name)` to see if filename is the module

package/lib/get-exports.mjs

@@ -150,7 +150,12 @@ function getExportsForNodeBuiltIn (name) {
   }
 
   if (!exports) {
-    exports = new Set(addDefault(Object.keys(require(name))))
+    // get all properties both enumerable and non-enumerable
+    exports = new Set(addDefault(Object.getOwnPropertyNames(require(name))))
+    // added in node 23 as alias for default in cjs modules
+    if (hasModuleExportsCJSDefault) {
+      exports.add('module.exports')
+    }
     BUILT_INS.set(name, exports)
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "import-in-the-middle",
-  "version": "3.0.0",
+  "version": "3.0.2",
   "description": "Intercept imports in Node.js",
   "engines": {
     "node": ">=18"
@@ -8,7 +8,7 @@
   "main": "index.js",
   "scripts": {
     "test": "c8 --reporter lcov --check-coverage --lines 45 imhotap --files test/{hook,low-level,other,get-esm-exports,register}/*",
-    "test:e2e": "node test/check-exports/test.mjs",
+    "test:e2e": "node test/check-exports/test.mjs && node test/integration-tests/turbopack-dev.mjs && node test/integration-tests/turbopack-build-start.mjs",
     "test:ts": "c8 --reporter lcov imhotap --files test/typescript/*.test.mts",
     "coverage": "c8 --reporter html imhotap --files test/{hook,low-level,other,get-esm-exports,register}/* && echo \"\nNow open coverage/index.html\n\"",
     "lint": "eslint .",