npmpackage.info

Gathering detailed insights and metrics for import-from-esm

import-from-esm

Almost drop-in "import-from" replacement that supports loading both ESM & CJS modules

1.3.4

MIT

JavaScript

31,447,632 8.6

Installations

npm install import-from-esm

Pull Requests

Open

19

Total

123

Closed

7

Merged

97

Issues

Open

4

Total

12

Closed

8

Releases

v1.3.4

Published on 15 Apr 2024

v1.4.0-alpha.1

Published on 19 Jan 2024

v1.3.3

Published on 19 Nov 2023

v1.3.2

Published on 19 Nov 2023

v1.3.1

Published on 16 Nov 2023

v1.3.0

Published on 16 Nov 2023

View all 18 releases

Developer

sheerlox

Developer Guide

BETA

Module System

ESM

Min. Node Version

>=16.20

Typescript Support

Yes

Node Version

20.12.1

NPM Version

10.4.0 Statistics

2 Stars

286 Commits

2 Forks

2 Watching

21 Branches

3 Contributors

Updated on 04 Nov 2024

Languages

JavaScript (99.24%)

TypeScript (0.76%)

Total Downloads

Cumulative downloads

Total Downloads

31,447,632

Last day

-1%

157,916

Compared to previous day

Last week

4.5%

910,189

Compared to previous week

Last month

3.8%

3,800,178

Compared to previous month

Last year

4,273.8%

30,744,706

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

debug import-meta-resolve

Dev Dependencies

@fast-check/ava @insurgent/export-map-test @insurgent/json-index-test @insurgent/json-main-test @insurgent/subpaths-test @insurgentlab/conventional-changelog-preset @semantic-release/changelog @semantic-release/git @types/debug ava c8 cross-env knip semantic-release tsd xo

Versions

import-from-esm

Overview

Import a module like with require() but from a given path (for ESM)

This library intends to be an almost drop-in replacement of import-from (from which it is forked), exposing the same API and behavior but also supporting ES modules (ESM). Just add await before importFrom/importFrom.silent

Motivation

The main benefit of using import-from is that it abstracts the need to resolve the path and create a require statement. Its code is really straightforward:

1(fromDirectory, moduleId) => createRequire(path.resolve(fromDirectory, "noop.js"))(moduleId);

In the case of import-from-esm, there are a few additional benefits because of the way ESM works:

Importing a package installed along a library (in the parent application) from that library is no longer possible (which was the issue that made me work on this library). You need to use import.meta.resolve, which is behind an experimental flag (although there's a ponyfill available at wooorm/import-meta-resolve, which import-from-esm uses under-the-hood).
If the file you're trying to import (whether relative, package, export map, etc ...) is a JSON file, you need to detect that and use import assertions or require (while the former is still in experimental).
File extensions are now mandatory for relative paths. import-from-esm re-introduces require's file extension discovery.

As you can see, there is quite a bit of complexity that is abstracted behind import-from-esm. The first bullet point issue affected both @semantic-release/commit-analyzer and @semantic-release/release-notes-generator. After spending hours on research to solve the issue, I realized that the work I was doing would benefit others as well, so I decided to create a package out of it.

As a proponent of ESM, I have put a lot of thought into poly-filling require features for import, but finally came to the conclusion that developing a package to facilitate the ecosystem transition to ESM by reducing friction was a good thing.

Install

$ npm install import-from-esm

Usage

1import importFrom from "import-from-esm";
2
3// there is a file at `./foo/bar.{js,mjs,cjs,json}`
4
5await importFrom("foo", "./bar");

API

importFrom(fromDirectory, moduleId)

Like require(), throws when the module can't be found.

importFrom.silent(fromDirectory, moduleId)

Returns undefined instead of throwing when the module can't be found.

fromDirectory

Type: string

Directory to import from.

moduleId

Type: string

What you would use in require().

Tip

Create a partial using a bound function if you want to import from the same fromDir multiple times:

1const importFromFoo = importFrom.bind(null, "foo");
2
3importFromFoo("./bar");
4importFromFoo("./baz");

No vulnerabilities found.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

CI-Tests

Determines if the project runs tests before pull requests are merged.

10

Contributors

Determines if the project has a set of contributors from multiple organizations (e.g., companies).

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Dependency-Update-Tool

Determines if the project uses a dependency update tool.

10

Fuzzing

Determines if the project uses fuzzing.

10

License

Determines if the project has defined a license.

10

Maintained

Determines if the project is "actively maintained".

10

Packaging

Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.

10

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

10

SAST

Determines if the project uses static code analysis.

10

Security-Policy

Determines if the project has published a security policy.

10

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

8

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

6

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

2

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

Score

8.6

/10

Last Scanned on 2024-11-25T23:21:05Z

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More