Global `fetch` breaks `source-map`

[SimenB]

Version

v17.8.0

Platform

Darwin Simens-MacBook-Pro.local 21.4.0 Darwin Kernel Version 21.4.0: Fri Mar 18 00:45:05 PDT 2022; root:xnu-8020.101.4~15/RELEASE_X86_64 x86_64

Subsystem

No response

What steps will reproduce the bug?

npm init -y && npm install --save source-map (this gives 0.7.3 at the time of writing). source-map has more than 160M downloads a week, although the broken v7 has a mere 28M since it's async only. See https://www.runpkg.com/?source-map@0.7.3/lib/read-wasm.js#1 for where it breaks.

// file.mjs
import {SourceMapConsumer} from 'source-map'

await new SourceMapConsumer({version: '3', sources: [], mappings: []})

$ node file.mjs
$ echo $?
0
$ node --experimental-fetch file.mjs
(node:21808) ExperimentalWarning: Fetch is an experimental feature. This feature could change at any time
(Use `node --trace-warnings ...` to show where the warning was created)
/Users/simen/repos/source-map-boom/node_modules/source-map/lib/read-wasm.js:8
      throw new Error("You must provide the URL of lib/mappings.wasm by calling " +
            ^

Error: You must provide the URL of lib/mappings.wasm by calling SourceMapConsumer.initialize({ 'lib/mappings.wasm': ... }) before using SourceMapConsumer
    at readWasm (/Users/simen/repos/source-map-boom/node_modules/source-map/lib/read-wasm.js:8:13)
    at wasm (/Users/simen/repos/source-map-boom/node_modules/source-map/lib/wasm.js:25:16)
    at /Users/simen/repos/source-map-boom/node_modules/source-map/lib/source-map-consumer.js:264:14
    at async file:///Users/simen/repos/source-map-boom/file.mjs:3:1

Node.js v17.8.0
$ echo $?
1

How often does it reproduce? Is there a required condition?

Always.

What is the expected behavior?

It should not break since the code is not running in a browser environment.

What do you see instead?

If fetch is available as a global, source-map thinks it's in a browser setting, and breaks.

Additional information

I know this isn't Node's fault, but since source-map seems unmaintained, I hope maybe Node as a project can reach out the the old maintainers (or Mozilla?) so this is fixed.

Once v18 is stable (where fetch is a global by default), this'll break way more people. v8-to-istanbul, used by both C8 and Jest (to provide code coverage reports when using native V8 coverage) is affected by this, and probably lots of other projects.

[aduh95]

Is there an issue open for this on their repo?

[SimenB]

mozilla/source-map#349. It's apparently fixed in the beta releases

[SimenB]

Based on terser/terser#1164 (review) v8-to-istanbul might benefit from migrating, but there's still 28M weekly downloads of the broken version (jest has maybe half of those? unsure how npm counts)

[aduh95]

FWIW there's the --no-experimental-fetch CLI flag that can be used as a workaround.

Pinging @nodejs/npm in case they know how this could be mitigated.

[SimenB]

FWIW there's the --no-experimental-fetch CLI flag that can be used as a workaround.

Ah, nice! I can add that flag to Jest's tests at least

[targos]

Is there still something for Node.js to do?

[SimenB]

As a project it would be nice if node could try to get in touch with the maintainers so they make a new stable release before v18 is released. But code wise I doubt there's much to be done (beyond not unflagging fetch which I assume (and hope) is a non-starter).

[ljharb]

Node could also use a different name than fetch, or put it somewhere that’s not a global.

[SimenB]

C8 migrated away in a patch, and Jest in an alpha release. Still, that's only about half of the downloads of the broken version