helmet
helmet copied to clipboard
helmetjs
Deployment on Vercel using .mjs
When deployed on Vercel with this library it causes issues as vercel is unable to read this library import properly but if you change the import to
import helmet from "helmet/index.cjs"
It starts working on Vercel but using this way makes the local environment crash requiring the import to be
import helmet from "helmet"
I couldn't really find a good workaround as the imports are not defined inside the package.json provided for helmet so would be good if that can be resolved.
Sorry for running into this. What version of Helmet are you using? And if you're using TypeScript, what's in your tsconfig.json?
Sorry for running into this. What version of Helmet are you using? And if you're using TypeScript, what's in your tsconfig.json?
Hello Evan. The version I am using is 7.0.0 for helmet and I am implementing it in Node v18.17.1.
For the frontend I am using React and I am not using TypeScript.
I deployed it on vercel as a serverless function and these are the config files I used for the deployment
{ "version": 2, "builds":[ {"src":"*.js","use":"@vercel/node"} ], "routes":[ {"src":"/(.*)","dest":"/"} ] }
The Node server in which helmet is being used is set to type module.
The error it prompts is that no default exports are defined on the local environment when importing it as "helmet/index.cjs" but when deployed on Vercel it works perfectly fine and it goes the other way around when importing as "helmet".
This seems like a Vercel issue, but I'm not sure. Could you paste the full error that Vercel gives you? Does this problem happen with any other modules? Is Vercel respecting "type": "module"?
This seems like a Vercel issue, but I'm not sure. Could you paste the full error that Vercel gives you? Does this problem happen with any other modules? Is Vercel respecting
"type": "module"?
This issue does not occur with any other module but only with helmet and this is the error it logs on Vercel
2023-09-26T14:48:36.276Z undefined ERROR Error [ERR_MODULE_NOT_FOUND]: Cannot find module '/var/task/node_modules/helmet/index.mjs' imported from /var/task/index.js Did you mean to import helmet/index.cjs? at new NodeError (node:internal/errors:405:5) at finalizeResolution (node:internal/modules/esm/resolve:329:11) at moduleResolve (node:internal/modules/esm/resolve:992:10) at moduleResolveWithNodePath (node:internal/modules/esm/resolve:936:12) at defaultResolve (node:internal/modules/esm/resolve:1178:79) at nextResolve (node:internal/modules/esm/loader:163:28) at ESMLoader.resolve (node:internal/modules/esm/loader:835:30) at ESMLoader.getModuleJob (node:internal/modules/esm/loader:424:18) at ModuleWrap.<anonymous> (node:internal/modules/esm/module_job:77:40) at link (node:internal/modules/esm/module_job:76:36) { code: 'ERR_MODULE_NOT_FOUND' } RequestId: ce09d569-a2f7-4dad-8c43-f1a2827e9c17 Error: Runtime exited with error: exit status 1 Runtime.ExitError
As it suggest on the error if the import is changed to index.cjs it starts working again and Vercel must be respecting the type module otherwise the other modules should have also given a similar error.
Strange. index.mjs is right there at the package root. What happens if you change the import to "helmet/index.mjs"?
Strange.
index.mjsis right there at the package root. What happens if you change the import to"helmet/index.mjs"?
Changing it to "helmet/index.mjs" causes it to crash on the local environment with this error
Error [ERR_PACKAGE_PATH_NOT_EXPORTED]: Package subpath './index.mjs' is not defined by "exports" in /home/redox/React/nightServer/node_modules/helmet/package.json imported from /home/redox/React/nightServer/index.js at new NodeError (node:internal/errors:405:5) at exportsNotFound (node:internal/modules/esm/resolve:359:10) at packageExportsResolve (node:internal/modules/esm/resolve:695:9) at packageResolve (node:internal/modules/esm/resolve:870:14) at moduleResolve (node:internal/modules/esm/resolve:936:20) at defaultResolve (node:internal/modules/esm/resolve:1129:11) at nextResolve (node:internal/modules/esm/loader:163:28) at ESMLoader.resolve (node:internal/modules/esm/loader:835:30) at ESMLoader.getModuleJob (node:internal/modules/esm/loader:424:18) at ModuleWrap.<anonymous> (node:internal/modules/esm/module_job:77:40) { code: 'ERR_PACKAGE_PATH_NOT_EXPORTED'
But on Vercel it is working with the "helmet/index.mjs" import. Now the issue is in the local environment.
I'm honestly baffled by this issue too.
How are you running this locally? node app.js, or something else?
I'm surprised that you're seeing different behavior between Vercel and your local machine. Maybe that's where the problem lives?
How are you running this locally?
node app.js, or something else?I'm surprised that you're seeing different behavior between Vercel and your local machine. Maybe that's where the problem lives?
If it was a local environment issue then the other libraries should have also complained to some extent but they work perfectly fine only Helmet has this issue. The named exports force the use of importing it as "helmet" whereas it should not but it is an issue which appears frequently for module type. Some misconfiguration exists inside the Helmet package should makes it not able to deploy to Vercel as a simple import compared to all the other packages.
In the short term, you might be able to import the .mjs file from the node_modules directory directly.
In the long term, I'll take deeper look, though I probably won't be able to get to it soon. If you (or anyone else) has time to investigate, I'd appreciate.
I haven't had time to investigate this problem, apologies.
Do you have any updates? Is this still an issue for you?
I haven't had time to investigate this problem, apologies.
Do you have any updates? Is this still an issue for you?
Hello Evan. I haven't really checked it again after that but i can try to create soft example to test again if this issue presists or not.
A sample app would be super useful to help debug. If you have the time to build one, I'd appreciate it!
Related: https://github.com/orgs/vercel/discussions/3221 https://github.com/vercel/vercel/discussions/10317#discussioncomment-6787728
Changing it to "helmet/index.mjs" causes it to crash on the local environment with this error Error [ERR_PACKAGE_PATH_NOT_EXPORTED]: Package subpath './index.mjs' is not defined by "exports"
... is expected & correct behavior. helmet only defines a default export and an implementation respecting the exports spec would error here.
I tested different variations of this (using type: module/ commonjs, from within cjs/js/mjs files) and they all worked as expected locally.
According to Vercel's docs (https://vercel.com/docs/functions/runtimes/node-js)...
Learn how to use the Node.js runtime to compile Node.js Serverless Functions on Vercel.
... it is evident that they do a compilation and given that they support loading Typescript files directly, I wouldn't be surprised that they actually run regular JS files through the Typescript compiler as well, making this a TS compilation error closely related to #441
