Skip to content

fix(deps): update yargs to 18#578

Open
bcoe wants to merge 3 commits into
mainfrom
yargs-18
Open

fix(deps): update yargs to 18#578
bcoe wants to merge 3 commits into
mainfrom
yargs-18

Conversation

@bcoe
Copy link
Copy Markdown
Owner

@bcoe bcoe commented Feb 22, 2026

Now that we've bumped the major due to a recent CVE, might as well update yargs to version with less build steps.

@bcoe bcoe changed the title fix(deps): updarte yargs to 18 fix(deps): update yargs to 18 Feb 22, 2026
@coderaiser
Copy link
Copy Markdown
Contributor

Would be great also to update yargs-parser

https://github.com/yargs/yargs-parser/releases/tag/yargs-parser-v22.0.0

@bricss
Copy link
Copy Markdown

bricss commented Feb 25, 2026

Perhaps yargs can be replaced with the native util.parseArgs([config]), which has been stable in Node since v20 🤓

@coderaiser
Copy link
Copy Markdown
Contributor

coderaiser commented Feb 25, 2026

@sverweij sverweij mentioned this pull request Feb 26, 2026
@JoernBerkefeld
Copy link
Copy Markdown

JoernBerkefeld commented Feb 27, 2026

to support that, yargs 17 has an issue with node 25.7 (also see #581) which is fixed in yargs 18. do please update that dependecy

file:///home/runner/work/SFMC-SDK/SFMC-SDK/node_modules/yargs/yargs:3
const {applyExtends, cjsPlatformShim, Parser, Yargs, processArgv} = require('./build/index.cjs')
^

ReferenceError: require is not defined in ES module scope, you can use import instead
at file:///home/runner/work/SFMC-SDK/SFMC-SDK/node_modules/yargs/yargs:3:69
at ModuleJobSync.runSync (node:internal/modules/esm/module_job:534:37)
at ModuleLoader.importSyncForRequire (node:internal/modules/esm/loader:366:47)
at loadESMFromCJS (node:internal/modules/cjs/loader:1628:24)
at Module._compile (node:internal/modules/cjs/loader:1793:5)
at Object..js (node:internal/modules/cjs/loader:1951:10)
at Module.load (node:internal/modules/cjs/loader:1532:32)
at Module._load (node:internal/modules/cjs/loader:1334:12)
at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
at Module.require (node:internal/modules/cjs/loader:1555:12)

Node.js v25.7.0
Error: Process completed with exit code 1.

TomerFi added a commit to TomerFi/version-bumper that referenced this pull request Feb 28, 2026
c8 depends on yargs ^17 which breaks on Node 25 due to CJS/ESM
interop changes. Override yargs to ^18 (ESM-first) until c8
updates its dependency (bcoe/c8#578).

Also restores node latest to the test matrix alongside 20 and 22.

Signed-off-by: Tomer Figenblat <tomer@figenblat.com>
TomerFi added a commit to TomerFi/version-bumper that referenced this pull request Feb 28, 2026
c8 depends on yargs ^17 which breaks on Node 25 due to CJS/ESM
interop changes. Override yargs to ^18 (ESM-first) until c8
updates its dependency (bcoe/c8#578).

Also restores node latest to the test matrix alongside 20 and 22.

Signed-off-by: Tomer Figenblat <tomer@figenblat.com>
TomerFi added a commit to TomerFi/version-bumper that referenced this pull request Feb 28, 2026
* fix: override yargs to v18 for Node 25 compatibility

c8 depends on yargs ^17 which breaks on Node 25 due to CJS/ESM
interop changes. Override yargs to ^18 (ESM-first) until c8
updates its dependency (bcoe/c8#578).

Also restores node latest to the test matrix alongside 20 and 22.

Signed-off-by: Tomer Figenblat <tomer@figenblat.com>

* chore: bump minimum engines to node >= 20 and npm >= 10

yargs 18 requires Node >= 20.19.0. Node 18 is EOL since April 2025.

Signed-off-by: Tomer Figenblat <tomer@figenblat.com>

---------

Signed-off-by: Tomer Figenblat <tomer@figenblat.com>
@bricss
Copy link
Copy Markdown

bricss commented Mar 12, 2026

The import issue has been resolved -> #581 (comment) 🩹

@JoernBerkefeld
Copy link
Copy Markdown

JoernBerkefeld commented Mar 12, 2026

While that's good news, getting c8 upgraded to use yargs 18 is still a good idea

@shivarm
Copy link
Copy Markdown

shivarm commented May 6, 2026

@bcoe check #592 and please can you merge it ?

@bricss
Copy link
Copy Markdown

bricss commented May 9, 2026

Working solution -> yargs/yargs#2509 (comment)

Comment thread package-lock.json
},
"engines": {
"node": ">=12"
"node": "^20.19.0 || ^22.12.0 || >=23"
Copy link
Copy Markdown

@ericcornelissen ericcornelissen May 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Technically, this is more restrictive than c8's supported Node.js version range

"node": "20 || >=22"

and hence would require a major version bump.

This is the strictest version range I could find (shared with yargs-parser)

@bricss
Copy link
Copy Markdown

bricss commented May 16, 2026

It would be very nice ✨ to have this merged ⛜ and a new 🆕 version 🚀 released 📦, as c8 is failing 💥 right now ⏰ all over the ecosystem 🌍.

andersk added a commit to andersk/micromark that referenced this pull request May 16, 2026
Node 25.7.0 broke extensionless CJS scripts in "type": "module"
packages, such as yargs/yargs in yargs 17.x imported by c8; this
behavior was temporarily rolled back in Node 25.8.1 but is now
restored in 26.0.0 and future versions.  Until either yargs releases a
backported fix for yargs 17.x, or c8 fixes its import statement, or c8
upgrades to yargs 18.x (all three of those efforts have been stalled
for months), we need to work around this with an override.

yargs/yargs#2509
yargs/yargs#2514
bcoe/c8#582
bcoe/c8#581
bcoe/c8#578

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
andersk added a commit to andersk/micromark that referenced this pull request May 16, 2026
Node 25.7.0 broke extensionless CJS scripts in "type": "module"
packages, such as yargs/yargs in yargs 17.x imported by c8; this
behavior was temporarily rolled back in Node 25.8.1 but is now
restored in 26.0.0 and future versions.  Until either yargs releases a
backported fix for yargs 17.x, or c8 fixes its import statement, or c8
upgrades to yargs 18.x (all three of those efforts have been stalled
for months), we need to work around this with an override.

yargs/yargs#2509
yargs/yargs#2514
bcoe/c8#582
bcoe/c8#581
bcoe/c8#578

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
Comment thread package.json
"test-exclude": "^8.0.0",
"v8-to-istanbul": "^9.0.0",
"yargs": "^17.7.2",
"yargs": "^18.0.0",
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What if we declare compatibility with both versions, to avoid the need for a major version bump pointed out in #578 (comment)?

Suggested change
"yargs": "^18.0.0",
"yargs": ">=17.7.2 && <19"

andersk added a commit to andersk/micromark that referenced this pull request May 20, 2026
Node 25.7.0 broke extensionless CJS scripts in "type": "module"
packages, such as yargs/yargs in yargs 17.x imported by c8; this
behavior was temporarily rolled back in Node 25.8.1 but is now
restored in 26.0.0 and future versions.  Until either yargs releases a
backported fix for yargs 17.x, or c8 fixes its import statement, or c8
upgrades to yargs 18.x (all three of those efforts have been stalled
for months), we need to work around this with an override.

yargs/yargs#2509
yargs/yargs#2514
bcoe/c8#582
bcoe/c8#581
bcoe/c8#578

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
andersk added a commit to andersk/micromark that referenced this pull request May 20, 2026
Node 25.7.0 broke extensionless CJS scripts in "type": "module"
packages, such as yargs/yargs in yargs 17.x imported by c8; this
behavior was temporarily rolled back in Node 25.8.1 but is now
restored in 26.0.0 and future versions.  Until either yargs releases a
backported fix for yargs 17.x, or c8 fixes its import statement, or c8
upgrades to yargs 18.x (all three of those efforts have been stalled
for months), we need to work around this with an override.

yargs/yargs#2509
yargs/yargs#2514
bcoe/c8#582
bcoe/c8#581
bcoe/c8#578

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants