Pin nuxt-app to Node 22 to fix Vercel ERR_REQUIRE_ESM - #174
Conversation
The security-fix lockfile regen pulled isomorphic-dompurify forward to 2.36, which transitively brings in jsdom@28 → html-encoding-sniffer@6 → @exodus/bytes (ESM-only). The CJS-to-ESM require there only works on Node 22.12+ or 20.19+. Vercel was honoring .nvmrc=v20 and running an older Node 20, producing ERR_REQUIRE_ESM at function startup. Bumps .nvmrc to v22 and adds an engines.node constraint so future installs/deploys can't silently regress. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a028ef9077
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "version": "0.0.0", | ||
| "private": true, | ||
| "engines": { | ||
| "node": ">=22.12.0" |
There was a problem hiding this comment.
When this Vercel project deploys from nuxt-app, >=22.12.0 is an open-ended range that also matches Node 24, so it does not actually pin the runtime to Node 22. Vercel's Node-version docs say engines.node overrides project settings and their examples map broad ranges like >=20.0.0 to the latest 24.x version, while only 22.x/^22.0.0 map to latest 22.x; with 24.x currently available, this can deploy the SSR functions on Node 24 instead of the intended Node 22 and reintroduce untested runtime behavior despite the .nvmrc change.
Useful? React with 👍 / 👎.
PR #174 only landed the .nvmrc bump and engines.node addition; the follow-up commits that contained the real fix never made it in, so the runtime is still hitting ERR_REQUIRE_ESM at startup. This applies that follow-up cleanly on top of main. The security PR's lockfile regen pulled isomorphic-dompurify forward to 2.36, which transitively brings in jsdom@28 → @exodus/bytes (ESM-only). Vercel's serverless runtime (/opt/rust/nodejs.js) does not implement Node 22.12+'s require(esm) interop, so the CJS-to-ESM require crashes there even on Node 22. Pins isomorphic-dompurify to ~2.20.0 — the version that was deployed and working before the security PR. jsdom resolves naturally to 26.1.0 (CJS, pre-@exodus/bytes), so the runtime require chain stays CJS-only. Audit count remains 0. Also tightens engines.node from ">=22.12.0" to "^22.12.0" to keep deploys on Node 22.x (and off any future Node 24+). Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
1 participant
Summary
The security-fix lockfile regen (#173) pulled
isomorphic-dompurifyforward to 2.36, which transitively brings injsdom@28→html-encoding-sniffer@6→@exodus/bytes(ESM-only). That CJS-to-ESMrequire()only works on Node 22.12+ or 20.19+; Vercel was honoring.nvmrc=v20and running an older Node 20, producingERR_REQUIRE_ESMat function startup and serving 404s.Bumps
nuxt-app/.nvmrcto v22 (matching the rest of the stack — Directus Dockerfile, CI workflows, setup.sh — that I aligned in #171 but missed this file). Addsengines.node >=22.12.0so future installs and Vercel deploys can't silently regress.Test plan
🤖 Generated with Claude Code