nyc is broken in latest nodejs versions

[jeremymeng]

Version

v18.17.1, v20.6.1

Platform

Linux arch-hp 6.4.3-arch1-2 #1 SMP PREEMPT_DYNAMIC Sat, 15 Jul 2023 19:25:49 +0000 x86_64 GNU/Linux

Subsystem

No response

What steps will reproduce the bug?

See more details in the bug report at istanbuljs/nyc#1530

nyc uses this code to transform code and compiles a module
https://github.com/istanbuljs/append-transform/blob/3e0547f68eacb10e85dbcbf1ac539df83afae751/index.js#L57-L60

In latest nodejs version (possibly with this commit 15bced0bde), it causes an error thus no transformation is done

Transformation error for /home/meng/git/nyc-repro/src/index.js ; return original code
The "mod" argument must be an instance of Module. Received an instance of Module

The information regarding the related nodejs CVE which 15bced0bde addressed seems indicating that the CVE only affect users of experimental permossion policy. I am not sure nyc is using that exprimental policy. Its last version is published a year ago. But somehow the fix to the CVE impact nyc.

How often does it reproduce? Is there a required condition?

always

What is the expected behavior? Why is that the expected behavior?

No error. nyc should be able to transform code and produce modules like in v18.17.0. Code coverage result should be 100% with the repro

What do you see instead?

warnings then 0% code coverage result

Transformation error for /home/meng/git/nyc-repro/src/index.js ; return original code
The "mod" argument must be an instance of Module. Received an instance of Module


  basic test
    ✓ add correctly


  1 passing (3ms)

----------|---------|----------|---------|---------|-------------------
File      | % Stmts | % Branch | % Funcs | % Lines | Uncovered Line #s
----------|---------|----------|---------|---------|-------------------
All files |       0 |        0 |       0 |       0 |
----------|---------|----------|---------|---------|-------------------

Additional information

Any recommendation for a fix/workaround in nyc?

[jeremymeng]

List of commits in 18.17.1

Commits
[fe3abdf82e] - deps: update archs files for openssl-3.0.10+quic1 (Node.js GitHub Bot) #49036
[2c5a522d9c] - deps: upgrade openssl sources to quictls/openssl-3.0.10+quic1 (Node.js GitHub Bot) #49036
[15bced0bde] - policy: handle Module.constructor and main.extensions bypass (RafaelGSS) nodejs-private/node-private#417
[d4570fae35] - policy: disable process.binding() when enabled (Tobias Nießen) nodejs-private/node-private#460

[vlnifos]

Any updates?

[Sandy8i]

Facing the same issue. Any updates?

[jeremymeng]

we switched to c8 and vitest

[MorayM]

It seems to be present in a few versions. I'm in the process of doing an incremental upgrade from Node 12 to 16 and am getting the same issue. Any ideas?

[RedYetiDev]

Hey, replies that are emphasizing "me too" or "any updates" only add noise to this issue. If there are any updates, they will be posted here. Please refrain from commenting unless you have information that may assist in the resolution of this issue.

@RafaelGSS I know you were on that other issue thread, do you have any insight?

[RafaelGSS]

See: istanbuljs/nyc#1530 (comment).

There's nothing we can do on Node.js side. IIRC this is an esm error (due to Node.js Security Release). When esm gets the patch nyc must update their dependencies.