Security News
GitHub Removes Malicious Pull Requests Targeting Open Source Repositories
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
import-meta-resolve
Advanced tools
The import-meta-resolve package provides utilities for resolving module specifiers in the same way that Node.js does for ES modules. It allows developers to programmatically resolve specifiers from the context of a specific file or URL, which can be useful for tooling that needs to understand module resolution, bundlers, and other development tools.
Resolving module specifiers
This feature allows you to resolve the full path of a module specifier from a specific context, typically the URL of the importing module. The code sample demonstrates how to use the resolve function to find the full path of 'some-module' as if it were being imported from the current module.
import { resolve } from 'import-meta-resolve';
(async () => {
const resolved = await resolve('some-module', import.meta.url);
console.log(resolved);
})();
The 'resolve' package is a popular Node.js module resolution algorithm that can be used programmatically. It is similar to import-meta-resolve but does not specifically target ES module resolution semantics. It is more general-purpose and can resolve CommonJS modules as well.
This package is used internally by webpack to resolve module paths. It is highly configurable and can handle complex resolution scenarios, including loaders and plugin systems. While it offers more features than import-meta-resolve, it is also more complex and tailored to webpack's ecosystem.
Resolve things like Node.js.
This package is a ponyfill for import.meta.resolve
.
It supports everything you need to resolve files just like modern Node does:
import maps, export maps, loading CJS and ESM projects, all of that!
As of Node.js 20.0, import.meta.resolve
is still behind an experimental flag.
This package can be used to do what it does in Node 16–20.
This package is ESM only. In Node.js (version 16+), install with npm:
npm install import-meta-resolve
import {resolve} from 'import-meta-resolve'
// A file:
console.log(resolve('./index.js', import.meta.url))
//=> file:///Users/tilde/Projects/oss/import-meta-resolve/index.js
// A CJS package:
console.log(resolve('builtins', import.meta.url))
//=> file:///Users/tilde/Projects/oss/import-meta-resolve/node_modules/builtins/index.js
// A scoped CJS package:
console.log(resolve('@eslint/eslintrc', import.meta.url))
//=> file:///Users/tilde/Projects/oss/import-meta-resolve/node_modules/@eslint/eslintrc/lib/index.js
// A package with an export map:
console.log(resolve('micromark/lib/parse', import.meta.url))
//=> file:///Users/tilde/Projects/oss/import-meta-resolve/node_modules/micromark/lib/parse.js
// A node builtin:
console.log(resolve('fs', import.meta.url))
//=> node:fs
This package exports the identifiers moduleResolve
and
resolve
.
There is no default export.
resolve(specifier, parent)
Match import.meta.resolve
except that parent
is required (you can pass
import.meta.url
).
specifier
(string
)
— the module specifier to resolve relative to parent
(/example.js
, ./example.js
, ../example.js
, some-package
, fs
, etc)parent
(string
, example: import.meta.url
)
— the absolute parent module URL to resolve from; you must pass
import.meta.url
or something elseFull file:
, data:
, or node:
URL (string
) to the found thing
Throws an ErrnoException
.
moduleResolve(specifier, parent, conditions, preserveSymlinks)
The “Resolver Algorithm Specification” as detailed in the Node docs
(which is slightly lower-level than resolve
).
specifier
(string
)
— /example.js
, ./example.js
, ../example.js
, some-package
, fs
, etcparent
(URL
, example: import.meta.url
)
— full URL (to a file) that specifier
is resolved relative fromconditions
(Set<string>
, default: new Set(['node', 'import'])
)
— conditionspreserveSymlinks
(boolean
, default: false
)
— keep symlinks instead of resolving themA URL object (URL
) to the found thing.
Throws an ErrnoException
.
ErrnoException
One of many different errors that occur when resolving (TypeScript type).
type ErrnoExceptionFields = Error & {
errnode?: number | undefined
code?: string | undefined
path?: string | undefined
syscall?: string | undefined
url?: string | undefined
}
The code
field on errors is one of the following strings:
'ERR_INVALID_MODULE_SPECIFIER'
— when specifier
is invalid (example: '#'
)'ERR_INVALID_PACKAGE_CONFIG'
— when a package.json
is invalid (example: invalid JSON)'ERR_INVALID_PACKAGE_TARGET'
— when a package.json
exports
or imports
is invalid (example: when it
does not start with './'
)'ERR_MODULE_NOT_FOUND'
— when specifier
cannot be found in parent
(example: 'some-missing-package'
)'ERR_NETWORK_IMPORT_DISALLOWED'
— thrown when trying to resolve a local file or builtin from a remote file
(node:fs
relative to 'https://example.com'
)'ERR_PACKAGE_IMPORT_NOT_DEFINED'
— when a local import is not defined in an import map (example: '#local'
when not defined)'ERR_PACKAGE_PATH_NOT_EXPORTED'
— when an export is not defined in an export map (example: 'tape/index.js'
,
which is not in its export map)'ERR_UNSUPPORTED_DIR_IMPORT'
— when attempting to import a directory (example: './lib/'
)'ERR_UNKNOWN_FILE_EXTENSION'
— when somehow reading a file that has an unexpected extensions ('./readme.md'
)'ERR_INVALID_ARG_VALUE'
— when conditions
is incorrect'ERR_UNSUPPORTED_ESM_URL_SCHEME'
— when an unexpected protocol is found ('xss:alert(1)'
)The algorithm for resolve
matches how Node handles import.meta.resolve
, with
a couple of differences.
The algorithm for moduleResolve
matches the Resolver Algorithm
Specification as detailed in the Node docs (which is sync and slightly
lower-level than resolve
).
parent
defaulting to import.meta.url
cannot be ponyfilled: you have to
explicitly pass it--experimental-json-modules
, --experimental-wasm-modules
,
--experimental-policy
, --experimental-network-imports
, --no-addons
,
--input-type
, --preserve-symlinks
,
--preserve-symlinks-main
, nor --conditions
workWATCH_REPORT_DEPENDENCIES
env variableString#slice
or so from being tampered with, whereas this doesn’tThis package is fully typed with TypeScript.
It exports the additional type ErrnoException
.
This package is at least compatible with all maintained versions of Node.js. As of now, that is Node.js 16 and later.
Yes please! See How to Contribute to Open Source.
MIT © Titus Wormer and Node.js contributors
FAQs
Resolve things like Node.js — ponyfill for `import.meta.resolve`
The npm package import-meta-resolve receives a total of 3,605,007 weekly downloads. As such, import-meta-resolve popularity was classified as popular.
We found that import-meta-resolve demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
GitHub removed 27 malicious pull requests attempting to inject harmful code across multiple open source repositories, in another round of low-effort attacks.
Security News
RubyGems.org has added a new "maintainer" role that allows for publishing new versions of gems. This new permission type is aimed at improving security for gem owners and the service overall.
Security News
Node.js will be enforcing stricter semver-major PR policies a month before major releases to enhance stability and ensure reliable release candidates.