
Security News
npm Tooling Bug Incorrectly Marks One-Character Packages as Security Holders
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.
@opensourceframework/next-transpile-modules
Advanced tools
Next.js plugin to transpile code from node_modules
Note All
@opensourceframework/next-transpile-modulesfeatures have natively landed to Next.js 13.1, you can check the migration guide here.This package is now officially deprecated and on life-support.
PRs with fixes are welcome and I will help review them, but that's it. I highly recommend contributing to Next.js in case your setup is not working there.
node_modulesTranspile modules from node_modules using the Next.js Babel configuration.
Makes it easy to have local libraries and keep a slick, manageable dev experience.
.js, .jsx, .ts, .tsx, .mjs, .css, .scss and .sassThis plugin aims to solve the following challenges:
styleguide package)lodash-es)What this plugin does not aim to solve:
| Next.js version | Plugin version |
|---|---|
| Next.js 13 | 10.x |
| Next.js 12 | 9.x |
| Next.js 11 | 8.x |
| Next.js 9.5+ / 10 | 4.x, 5.x, 6.x, 7.x |
| Next.js 9.2 | 3.x |
| Next.js 8 / 9 | 2.x |
| Next.js 6 / 7 | 1.x |
Latest Next.js version tested: 13.4.12.
npm install --save @opensourceframework/next-transpile-modules
or
yarn add @opensourceframework/next-transpile-modules
transpileModules String[]: modules to be transpiledoptions Object (optional)
resolveSymlinks Boolean: Enable symlinks resolution to their real path by Webpack (default to true)debug Boolean: Display some informative logs in the console (can get noisy!) (default to false)__unstable_matcher (path) => boolean: Custom matcher that will override the default one. Don't use it.resolveSymlinksNode.js resolution is based on the fact that symlinks are resolved. Not resolving them will alter the behavior, but there are some cases where the alternative behavior makes things a lot easier.
If:
npm/yarn link to link packages into node_modules.npm with file: dependencies that live outside of your project directory
npm will create symlinks in this case. Yarn will copy instead.you should set resolveSymlinks: false, which results which will make things work as expected.
For other scenarios like:
pnpmyarn/npm workspacesyarn 2 portalsyou should keep resolveSymlinks: true (default).
// next.config.js
const withTM = require('@opensourceframework/next-transpile-modules')(['somemodule', 'and-another']); // pass the modules you would like to see transpiled
module.exports = withTM({});
Notes:
withTM as your last plugin (the outermost one).main field.7.1.0)You can include scoped packages or nested ones:
const withTM = require('@opensourceframework/next-transpile-modules')(['@shared/ui', '@shared/utils']);
// ...
const withTM = require('@opensourceframework/next-transpile-modules')(['styleguide/node_modules/lodash-es']);
// ...
If you need to install all packages of a certain scope (it is highly discouraged), you can do the following:
const packageJSON = require('./package.json');
const transpiledPackages = Object.keys(packageJSON.dependencies).filter((it) => it.includes('@shared/'));
const withTM = require('@opensourceframework/next-transpile-modules')(transpiledPackages);
next-compose-plugins:const withPlugins = require('next-compose-plugins');
const withTM = require('@opensourceframework/next-transpile-modules')(['some-module', 'and-another']);
module.exports = withPlugins([withTM], {
// ...
});
Since @opensourceframework/next-transpile-modules@3 and next@>9.2, this plugin can also transpile CSS included in your transpiled packages. SCSS/SASS is also supported since @opensourceframework/next-transpile-modules@3.1.0.
In your transpiled package:
// shared-ui/components/Button.js
import styles from './Button.module.css';
function Button(props) {
return (
<button type='button' className={styles.error}>
{props.children}
</button>
);
}
export default Button;
/* shared-ui/components/Button.module.css */
.error {
color: white;
background-color: red;
}
In your app:
// next.config.js
const withTM = require('@opensourceframework/next-transpile-modules')(['shared-ui']);
// ...
// pages/home.jsx
import React from 'react';
import Button from 'shared-ui/components/Button';
const HomePage = () => {
return (
<main>
{/* will output <button class="Button_error__xxxxx"> */}
<Button>Styled button</Button>
</main>
);
};
export default HomePage;
It also supports global CSS import packages located in node_modules:
// pages/_app.js
import 'shared-ui/styles/global.css'; // will be imported globally
export default function MyApp({ Component, pageProps }) {
return <Component {...pageProps} />;
}
cd @opensourceframework/next-transpile-modulesyarnIf you want to update the Next.js tested version:
scripts/next-update.sh with the latest Next.js versionnpm, yarn and pnpm are installedyarn setupbash scripts/next-update.shPush your changes and Github Actions will test everything as it should be.
@weco/next-plugin-transpile-modules?@weco's seems dead.mjsIt is important to understand that this plugin is a big hack of the Next.js Webpack configuration. When the Next.js team pushes an update to their build configuration, the changes @opensourceframework/next-transpile-modules bring may be outdated, and the plugin needs to be updated (which is a breaking change for this plugin, as the updated plugin is usually not retro-compatible with the previous versions of Next.js).
Now, this build problem can happen when you install your dependencies with npm install/yarn install (in your CI pipeline for example). Those commands may re-resolve your next dependency of your package.json to a newer one, and this newer one may have critical Webpack changes, hence breaking your build.
The way to fix it is easy, and it is what you should always do: install your dependencies with npm ci ("clean install") or yarn --frozen-lockfile. This will force npm or yarn to use the version of Next.js declared in your lock file, instead of downloading the latest one compatible with the version accepted by your package.json.
So basically: use your lock files right, and understand what problems they are solving ;)
more:
Please make sure to read the changelog.
.babelrcIf you get a transpilation error when using a custom Babel configuration, make sure you are using a babel.config.js and not a .babelrc.
The former is a project-wide Babel configuration, when the latter works for relative paths only (and may not work for Yarn for example, as it installs dependencies in a parent directory).
If you add a local library (let's say with yarn add ../some-shared-module), Yarn will copy those files by default, instead of symlinking them. So your changes to the initial folder won't be copied to your Next.js node_modules directory.
You can go back to npm, or use Yarn workspaces. See an example in the official Next.js repo.
config.optimization.minimize = false; to you next.config.js's Webpack configurationLerna's purpose is to publish different packages from a monorepo, it does not help for and does not intend to help local development with local modules (<- this, IN CAPS).
This is not coming from me, but from Lerna's maintainer.
So you are probably using it wrong, and I advice you to use npm or Yarn workspaces instead.
Again, most probably a bad idea. You may need to tell your Webpack configuration how to properly resolve your scoped packages, as they won't be installed in your Next.js directory, but the root of your Lerna setup.
const withTM = require('@opensourceframework/next-transpile-modules')(['@your-project/shared', '@your-project/styleguide']);
module.exports = withTM({
webpack: (config, options) => {
config.resolve.alias = {
...config.resolve.alias,
// Will make webpack look for these modules in parent directories
'@your-project/shared': require.resolve('@your-project/shared'),
'@your-project/styleguide': require.resolve('@your-project/styleguide'),
// ...
};
return config;
},
});
Invalid hook call error in reactIt can happen that when using @opensourceframework/next-transpile-modules with a local package and npm, you end up with duplicated dependencies in your final Next.js build. It is important to understand why it happens.
Let's take the following setup: one Next.js app ("Consumer"), and one Styleguide library.
You will probably have react as a peerDependencies and as a devDependecy of the Styleguide. If you use npm i, it will create a symlink to your Styleguide package in your "Consumer" node_modules.
The thing is in this shared package, you also have a node_modules. So when your shared modules requires, let's say react, Webpack will resolve it to the version in your Styleguide's node_modules, and not your Consumer's node_modules. Hence the duplicated react in your final bundles.
You can tell Webpack how to resolve the react of your Styleguide to use the version in your Next.js app like that:
const withTM = require('@opensourceframework/next-transpile-modules')(['styleguide']);
module.exports = withTM({
webpack: (config, options) => {
+ if (options.isServer) {
+ config.externals = ['react', ...config.externals];
+ }
+
+ config.resolve.alias['react'] = path.resolve(__dirname, '.', 'node_modules', 'react');
return config
},
});
Please note, the above will only work if react is properly declared as peerDependencies or devDependencies in your referenced package.
It is not a great solution, but it works. Any help to find a more future-proof solution is welcome.
All the honor goes to James Gorrie who created the first version of this plugin.
FAQs
Next.js plugin to transpile code from node_modules
The npm package @opensourceframework/next-transpile-modules receives a total of 17 weekly downloads. As such, @opensourceframework/next-transpile-modules popularity was classified as not popular.
We found that @opensourceframework/next-transpile-modules demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.

Research
/Security News
Newer packages in this compromise use native extensions and .pth loaders to execute JavaScript stealers in developer environments.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.