2.1.20 CJS entry is broken — TypeError: Cannot read properties of undefined (reading 'toStringTag') on require()

[adeisan]

`@localazy/api-client@2.1.20` (published 2026-04-14 17:28 UTC) ships a broken CJS entry that throws at module load.

Reproduce

On Node 18 or Node 20:

npm i @localazy/api-client@2.1.20
node -e "require('@localazy/api-client')"

Output:

/path/node_modules/@localazy/api-client/dist/node/localazy-api-client.cjs:4
Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
                                      ^
TypeError: Cannot read properties of undefined (reading 'toStringTag')

The error Cannot read properties of undefined (reading 'toStringTag') suggests the bundled CJS references a local alias of Symbol that wasn't properly imported/initialized — global Symbol is never undefined in Node. Likely a regression from the pnpm/bundler migration in #55 (the CJS output format that worked in 2.1.19 changed in 2.1.20).

Impact

`@localazy/strapi-plugin@0.2.6` declares `"@localazy/api-client": "^2.1.5"`, so every install after 2026-04-14 17:28 UTC resolves to 2.1.20 and crashes during Strapi plugin loading. Took down production deploys for two Strapi CMS services on our side until we pinned to 2.1.19 via an npm `overrides` entry.

Versions 2.1.19 and earlier load cleanly.

Proposed remediation

1. Immediate (minutes): `npm deprecate @localazy/api-client@2.1.20 "broken CJS entry, use 2.1.19"` — stops new consumers from hitting this.
2. Short-term (hours): Publish `2.1.21` with the CJS build fixed — likely reverting or re-auditing the bundler config change from 🔧 chore: Update deps, migrate to pnpm #55 (the 2.1.19 output works, 2.1.20 doesn't, and the only diff is the migration).
3. Medium-term: Add a release-time smoke test: `node -e "require('.')"` from the built tarball before `npm publish`. Would have caught this before the release.

Happy to help narrow down the bundler config delta if useful.

[honzabubenik]

Thanks for the detailed report!

Root cause: not the pnpm migration per se, but the Vite bump it pulled in (7.x → 8.0.8, which ships a newer rollup). lodash-es's internal _Symbol.js does var Symbol = root.Symbol;. In the Vite 7 build, rollup's identifier deduplication renamed that local to Symbol$1 so it didn't shadow the global. Vite 8's rollup no longer renames it, so the hoisted var Symbol shadows the global across the whole CJS file - and the rollup-generated interop line at the top of the bundle:

Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });

At this point Symbol resolves to the hoisted-but-not-yet-assigned local, which is undefined, so reading .toStringTag on it throws and require() crashes. The ESM build is unaffected because that interop line isn't emitted there.

Fix (published in 2.1.21): disable the Symbol-based namespace marker on the CJS rollup output in vite.config.ts:

{
  format: 'cjs',
  dir: 'dist/node',
  entryFileNames: 'localazy-api-client.cjs',
  banner,
  generatedCode: { symbols: false },
},

That drops the Symbol.toStringTag line entirely, so the lodash shadow can't bite it. Node's ESM↔CJS interop for this package still works - all exports are named, no default, so consumers importing via either require() or import * as resolve cleanly (verified locally on Node 20/22/24).

Sorry for the breakage on the Strapi side.