import-in-the-middle 3.0.1 → 3.0.2

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [3.0.2](https://github.com/nodejs/import-in-the-middle/compare/import-in-the-middle-v3.0.1...import-in-the-middle-v3.0.2) (2026-06-08)
+
+
+### Bug Fixes
+
+* Updated proxying logic for builtins that are used as CJS ([#250](https://github.com/nodejs/import-in-the-middle/issues/250)) ([f69eb8f](https://github.com/nodejs/import-in-the-middle/commit/f69eb8f13c91b7088003e7390b4f54c5076aa50b))
+
 ## [3.0.1](https://github.com/nodejs/import-in-the-middle/compare/import-in-the-middle-v3.0.0...import-in-the-middle-v3.0.1) (2026-04-07)
 
 

package/create-hook.mjs

@@ -265,12 +265,19 @@ async function processModule ({ srcUrl, context, parentGetSource, parentResolve,
       const objectKey = JSON.stringify(n)
       const reExportedName = n === 'default' ? n : objectKey
 
+      // For the module.exports synthetic export (Node 23+), fall back to $default
+      // when namespace['module.exports'] is not exposed by the native ESM namespace
+      // (builtins don't expose it). This ensures the IITM hook proxy returns the
+      // actual CJS value (e.g. EventEmitter) when an instrumentor reads
+      // capturedExports['module.exports'], rather than undefined.
+      const moduleExportsFallback = n === 'module.exports' ? ' ?? $default' : ''
+
       addSetter(n, `
       let ${variableName}
       __overridden[${objectKey}] = false
       let ${variableName}Defer = false
       try {
-        ${variableName} = _[${objectKey}] = namespace[${objectKey}]
+        ${variableName} = _[${objectKey}] = namespace[${objectKey}]${moduleExportsFallback}
       } catch (err) {
         if (!(err instanceof ReferenceError)) throw err
         ${variableName}Defer = true
@@ -279,11 +286,11 @@ async function processModule ({ srcUrl, context, parentGetSource, parentResolve,
       if (${variableName}Defer || ${variableName} === undefined) {
         __pending.push(__makeUpdater(
           ${objectKey},
-          () => namespace[${objectKey}],
+          () => namespace[${objectKey}]${moduleExportsFallback},
           (v) => { ${variableName} = _[${objectKey}] = v }
         ))
       }
-      export { ${variableName} as ${reExportedName} }
+      ${(n === 'module.exports' && (srcUrl.startsWith('node:') || builtinModules.includes(srcUrl))) ? '' : `export { ${variableName} as ${reExportedName} }`}
       set[${objectKey}] = (v) => {
         __overridden[${objectKey}] = true
         ${variableName} = v
@@ -308,6 +315,14 @@ export function createHook (meta) {
   const iitmURL = new URL('lib/register.js', meta.url).toString()
   let includeModules, excludeModules
 
+  // Track CJS module URLs that IITM has wrapped. On Node 24+, CJS modules loaded
+  // via loadCJSModule (in an ESM import chain) have their require() calls for
+  // builtins routed through the ESM resolver. Without this guard, IITM would
+  // intercept those require() calls and return an ESM namespace object instead
+  // of the native CJS module value (e.g. EventEmitter constructor), breaking
+  // patterns like `class App extends require('events') {}`.
+  const cjsInIitmChain = new Set()
+
   async function initialize (data) {
     if (global.__import_in_the_middle_initialized__) {
       process.emitWarning("The 'import-in-the-middle' hook has already been initialized")
@@ -405,6 +420,17 @@ export function createHook (meta) {
       return result
     }
 
+    // When a CJS module is loaded by an IITM shim, its require() calls for
+    // builtins may be routed through the ESM resolver on Node 24+. Skip IITM
+    // wrapping in that case so require() returns the native module value.
+    // We also propagate the membership to the resolved child so that its own
+    // transitive require() calls are likewise skipped (the entire synchronous
+    // CJS require chain must remain unwrapped to avoid ERR_VM_MODULE_LINK_FAILURE).
+    if (cjsInIitmChain.has(parentURL)) {
+      cjsInIitmChain.add(result.url)
+      return result
+    }
+
     // We don't want to attempt to wrap native modules
     if (result.url.endsWith('.node')) {
       return result
@@ -448,6 +474,11 @@ export function createHook (meta) {
         })
         // If the module loaded successfully, we can remove the specifier to reduce memory usage early.
         specifiers.delete(realUrl)
+        // Track CJS modules so their transitive require() calls bypass IITM.
+        // context.format is set to 'commonjs' by getCjsExports during processModule.
+        if (context.format === 'commonjs') {
+          cjsInIitmChain.add(realUrl)
+        }
         return {
           source: `
 import { register } from '${iitmURL}'
@@ -563,6 +594,24 @@ register(${JSON.stringify(realUrl)}, _, set, get, ${JSON.stringify(originalSpeci
       return parentLoad(deleteIitm(url), context)
     }
 
+    // On Node 22+, when a CJS module is loaded through the ESM translator and
+    // another loader hook provides its source (instead of leaving source null
+    // for Node to read natively), require() calls inside that CJS module for
+    // packages using the "module-sync" exports condition fail with
+    // ERR_VM_MODULE_LINK_FAILURE. Work around this Node bug by stripping
+    // hook-provided source for CJS modules in the synchronous require chain,
+    // forcing Node to use its native CJS loader which handles this correctly.
+    if (cjsInIitmChain.has(url)) {
+      const result = await parentLoad(url, context)
+      if (result.format === 'commonjs' && result.source != null) {
+        return {
+          format: result.format,
+          source: undefined
+        }
+      }
+      return result
+    }
+
     return parentLoad(url, context)
   }
 

package/lib/get-exports.mjs

@@ -150,7 +150,12 @@ function getExportsForNodeBuiltIn (name) {
   }
 
   if (!exports) {
-    exports = new Set(addDefault(Object.keys(require(name))))
+    // get all properties both enumerable and non-enumerable
+    exports = new Set(addDefault(Object.getOwnPropertyNames(require(name))))
+    // added in node 23 as alias for default in cjs modules
+    if (hasModuleExportsCJSDefault) {
+      exports.add('module.exports')
+    }
     BUILT_INS.set(name, exports)
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "import-in-the-middle",
-  "version": "3.0.1",
+  "version": "3.0.2",
   "description": "Intercept imports in Node.js",
   "engines": {
     "node": ">=18"