Error using Helmet in an AWS Lambda Nodejs 16.x

[ffleandro]

I got the following error while trying to run an expressjs app that uses helmet.

It seems that the lambda environment didn't quite pickup the nearest package.json to the dist/cjs/index.js which should be dist/cjs/package.json. This package.json is setting the "type": "commonjs" so we shouldn't be seeing this error.

I followed the suggestion to rename dist/cjs.index.js to dist/cjs/index.cjs and modifying the proper references in the package.json and this worked, however not sure this is the proper fix.

Should we add something to dist/cjs/package.json to make sure the lambda environment picks up the dist/cjs/index.js properly?

Error Log:

2023-03-25T14:12:52.864Z	undefined	ERROR	Uncaught Exception 	
{
    "errorType": "Error",
    "errorMessage": "require() of ES Module /var/task/node_modules/my-lib/node_modules/helmet/dist/cjs/index.js from /var/task/node_modules/my-lib/build/src/server/app.js not supported.\nindex.js is treated as an ES module file as it is a .js file whose nearest parent package.json contains \"type\": \"module\" which declares all .js files in that package scope as ES modules.\nInstead rename index.js to end in .cjs, change the requiring code to use dynamic import() which is available in all CommonJS modules, or change \"type\": \"module\" to \"type\": \"commonjs\" in /var/task/node_modules/my-lib/node_modules/helmet/package.json to treat all .js files as CommonJS (using .mjs for all ES modules instead).\n",
    "code": "ERR_REQUIRE_ESM",
    "stack": [
        "Error [ERR_REQUIRE_ESM]: require() of ES Module /var/task/node_modules/my-lib/node_modules/helmet/dist/cjs/index.js from /var/task/node_modules/my-lib/build/src/server/app.js not supported.",
        "index.js is treated as an ES module file as it is a .js file whose nearest parent package.json contains \"type\": \"module\" which declares all .js files in that package scope as ES modules.",
        "Instead rename index.js to end in .cjs, change the requiring code to use dynamic import() which is available in all CommonJS modules, or change \"type\": \"module\" to \"type\": \"commonjs\" in /var/task/node_modules/my-lib/node_modules/helmet/package.json to treat all .js files as CommonJS (using .mjs for all ES modules instead).",
        "",
        "    at Object.<anonymous> (/var/task/node_modules/my-lib/build/src/server/app.js:10:34)",
        "    at Object.<anonymous> (/var/task/node_modules/my-lib/build/src/server/index.js:17:14)",
        "    at Object.<anonymous> (/var/task/node_modules/my-lib/build/src/index.js:21:14)",
        "    at Object.<anonymous> (/var/task/src/server/app.js:4:23)",
        "    at Object.<anonymous> (/var/task/src/server/serverless.js:8:15)",
        "    at Object.<anonymous> (/var/task/index.js:4:20)",
        "    at _tryRequireFile (file:///var/runtime/index.mjs:911:37)",
        "    at _tryRequire (file:///var/runtime/index.mjs:961:25)",
        "    at _loadUserApp (file:///var/runtime/index.mjs:990:22)",
        "    at Object.UserFunction.js.module.exports.load (file:///var/runtime/index.mjs:1031:27)",
        "    at start (file:///var/runtime/index.mjs:1194:42)",
        "    at file:///var/runtime/index.mjs:1200:7",
        "    at async Promise.all (index 0)"
    ]
}

[EvanHahn]

I ran into this problem too (not on AWS Lambda, but in "regular" Node). As you can see, I solved it by creating a separate package.json.

However, I like the idea of using a .cjs extension better. I'll make a change to do that and let you know.

[EvanHahn]

I just made this change as part of some restructuring. Please try this out with:

npm install 'https://evanhahn.com/tape/helmet-6.0.1.tgz'

And let me know what you think. (If you want to see the code, check out #405.)

[ffleandro]

@EvanHahn Thanks, the linked PR fixes this issue.
I installed the linked branch instead of the zip you provided, using the following command:
yarn add helmet@https://github.com/helmetjs/helmet#module-systems

Can you let me know once this is published on npm so that I can update my package.json?

[EvanHahn]

Yes, I will.

[EvanHahn]

This should be fixed in [email protected].