GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — module: report unreadable package.json by bitpshr · Pull Request #65223 · nodejs/node

Conversation

bitpshr commented Aug 11, 2026

Copy link

Copy Markdown

Contributor

Fixes #65220. A package.json that exists but cannot be read was treated as absent, so exports and type silently disappeared and a specifier could resolve to a different file than the package declares. An unparsable package.json already throws ERR_INVALID_PACKAGE_CONFIG, so this makes the unreadable case consistent: ENOENT and ENOTDIR still mean "no package config here", anything else reports the underlying error.

Two alternatives if you'd prefer them: warn and keep resolving, or restrict the new error to the direct package lookup and stay silent while walking up for the nearest parent config. That second one matters if anyone relies on resolution succeeding past an unreadable package.json in an ancestor directory. Happy to change course on either.

Fixes: #65220

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

nodejs-github-bot added c++

Issues and PRs that require attention from people who are familiar with C++.

needs-ci PRs that need a full CI run. labels

Aug 11, 2026

bitpshr force-pushed the module/unreadable-package-json branch from b4271b7 to e3bd440 Compare

August 11, 2026 21:36

bitpshr mentioned this pull request

Aug 11, 2026

ESM resolver treats an unreadable package.json as absent: exports silently vanish and the wrong file can load #65220

Closed

guybedford commented Aug 11, 2026

Copy link

Copy Markdown

Contributor

It could be worth checking what error used to be thrown here before the resolver was refactored into C++, as I'm pretty sure this did used to throw an error, it just clearly didn't have coverage.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

codecov Bot commented Aug 11, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.32%. Comparing base (4a5eb1c) to head (3957a8d).
⚠️ Report is 403 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #65223      +/-   ##
==========================================
+ Coverage   90.15%   90.32%   +0.17%     
==========================================
  Files         744      751       +7     
  Lines      242517   249656    +7139     
  Branches    45688    47178    +1490     
==========================================
+ Hits       218642   225505    +6863     
- Misses      15358    15535     +177     
- Partials     8517     8616      +99

Files with missing lines	Coverage Δ
src/node_modules.cc	`80.55% <100.00%> (+0.32%)`	⬆️

... and 232 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bitpshr commented Aug 12, 2026

Copy link

Copy Markdown

Contributor Author

Checked the commit before the resolver moved to C++ (f13dbfd, parent 4ec085b). The JS read() there treated an undefined return from internalModuleReadJSON() as "does not exist" with no throw, and only a parse failure threw ERR_INVALID_PACKAGE_CONFIG. InternalModuleReadJSON() in node_file.cc bailed with a bare return for any uv_fs_open() failure, so EACCES came back as undefined just like ENOENT.

So the silent fallback looks like it predates the C++ move rather than being a regression from it, which fits there never being coverage. Happy to be wrong if you remember an earlier version that threw, I only went back as far as the refactor.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

aduh95 reviewed

Aug 13, 2026

View reviewed changes

Comment thread

test/parallel/test-module-unreadable-package-json.js Resolved

Uh oh!

There was an error while loading. Please reload this page.

aduh95 reviewed

Aug 13, 2026

View reviewed changes

Comment thread

test/parallel/test-module-unreadable-package-json.js Resolved

Uh oh!

There was an error while loading. Please reload this page.


          module: report unreadable package.json

3957a8d

A package.json that exists but cannot be read was treated the same as
one that is not there: the read failure returned no config and
resolution continued as if the package had none. Fields such as
"exports" and "type" silently disappear, so a specifier can resolve to
a different file than the package declares, while an unparsable
package.json already throws ERR_INVALID_PACKAGE_CONFIG.

Keep treating ENOENT and ENOTDIR as "no package config here", and
report any other read failure with the underlying error.

Fixes: nodejs#65220
Signed-off-by: Paul Bouchon <[email protected]>

bitpshr force-pushed the module/unreadable-package-json branch from e3bd440 to 3957a8d Compare

August 13, 2026 16:08

bitpshr commented Aug 13, 2026

Copy link

Copy Markdown

Contributor Author

Applied both, thanks. The status assertions come last now, and the final chmodSync runs in a finally so it happens even if an assertion fails.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

aduh95 approved these changes

Aug 14, 2026

View reviewed changes

aduh95 added author ready

PRs with CI started, the required approvals, and no outstanding review comments.

request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. labels

Aug 14, 2026

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label

Aug 14, 2026

nodejs-github-bot commented Aug 14, 2026

Copy link

Copy Markdown

Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/75835/

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

trivikr added the commit-queue PRs queued for automated landing through the Commit Queue. label

Aug 20, 2026

nodejs-github-bot merged commit c4cfa63 into nodejs:main

Aug 20, 2026

75 checks passed

Uh oh!

There was an error while loading. Please reload this page.

nodejs-github-bot commented Aug 20, 2026

Copy link

Copy Markdown

Collaborator

Landed in c4cfa63

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label

Aug 20, 2026

aduh95 pushed a commit that referenced this pull request

Aug 25, 2026


          module: report unreadable package.json

94c980a

A package.json that exists but cannot be read was treated the same as
one that is not there: the read failure returned no config and
resolution continued as if the package had none. Fields such as
"exports" and "type" silently disappear, so a specifier can resolve to
a different file than the package declares, while an unparsable
package.json already throws ERR_INVALID_PACKAGE_CONFIG.

Keep treating ENOENT and ENOTDIR as "no package config here", and
report any other read failure with the underlying error.

Fixes: #65220
Signed-off-by: Paul Bouchon <[email protected]>
PR-URL: #65223
Reviewed-By: Antoine du Hamel <[email protected]>

aduh95 pushed a commit that referenced this pull request

Aug 25, 2026


          module: report unreadable package.json

eb5d66e

A package.json that exists but cannot be read was treated the same as
one that is not there: the read failure returned no config and
resolution continued as if the package had none. Fields such as
"exports" and "type" silently disappear, so a specifier can resolve to
a different file than the package declares, while an unparsable
package.json already throws ERR_INVALID_PACKAGE_CONFIG.

Keep treating ENOENT and ENOTDIR as "no package config here", and
report any other read failure with the underlying error.

Fixes: #65220
Signed-off-by: Paul Bouchon <[email protected]>
PR-URL: #65223
Reviewed-By: Antoine du Hamel <[email protected]>

github-actions Bot mentioned this pull request

Aug 25, 2026

2026-08-26, Version 26.8.0 (Current) #65551

Merged

aduh95 pushed a commit that referenced this pull request

Aug 27, 2026


          module: report unreadable package.json

8f26eb3

A package.json that exists but cannot be read was treated the same as
one that is not there: the read failure returned no config and
resolution continued as if the package had none. Fields such as
"exports" and "type" silently disappear, so a specifier can resolve to
a different file than the package declares, while an unparsable
package.json already throws ERR_INVALID_PACKAGE_CONFIG.

Keep treating ENOENT and ENOTDIR as "no package config here", and
report any other read failure with the underlying error.

Fixes: #65220
Signed-off-by: Paul Bouchon <[email protected]>
PR-URL: #65223
Reviewed-By: Antoine du Hamel <[email protected]>

pullfrog Bot mentioned this pull request

Aug 28, 2026

chore(deps): upgrade Node to 26.8.1 savvy-web/systems#574

Merged

github-actions Bot mentioned this pull request

Sep 7, 2026

2026-09-08, Version 24.21.0 'Krypton' (LTS) #65873

Merged

aduh95 pushed a commit that referenced this pull request

Sep 7, 2026


          module: report unreadable package.json

ba80f7b

A package.json that exists but cannot be read was treated the same as
one that is not there: the read failure returned no config and
resolution continued as if the package had none. Fields such as
"exports" and "type" silently disappear, so a specifier can resolve to
a different file than the package declares, while an unparsable
package.json already throws ERR_INVALID_PACKAGE_CONFIG.

Keep treating ENOENT and ENOTDIR as "no package config here", and
report any other read failure with the underlying error.

Fixes: #65220
Signed-off-by: Paul Bouchon <[email protected]>
PR-URL: #65223
Reviewed-By: Antoine du Hamel <[email protected]>

aduh95 pushed a commit that referenced this pull request

Sep 7, 2026


          module: report unreadable package.json

349c53c

A package.json that exists but cannot be read was treated the same as
one that is not there: the read failure returned no config and
resolution continued as if the package had none. Fields such as
"exports" and "type" silently disappear, so a specifier can resolve to
a different file than the package declares, while an unparsable
package.json already throws ERR_INVALID_PACKAGE_CONFIG.

Keep treating ENOENT and ENOTDIR as "no package config here", and
report any other read failure with the underlying error.

Fixes: #65220
Signed-off-by: Paul Bouchon <[email protected]>
PR-URL: #65223
Reviewed-By: Antoine du Hamel <[email protected]>

MarshallOfSound added a commit to electron/electron that referenced this pull request

Sep 9, 2026


          fix(patch): module: report unreadable package.json

2098be6

Upstream now keeps the ReadFileSync error code and throws
ERR_INVALID_PACKAGE_CONFIG for anything other than ENOENT/ENOTDIR/EISDIR.
Route the ASAR override through the same read_error path and report a
missing archive entry as UV_ENOENT so it is still negatively cached
rather than surfaced as a read failure.

Ref: nodejs/node#65223

Co-Authored-By: Claude <[email protected]>

MarshallOfSound added a commit to electron/electron that referenced this pull request

Sep 9, 2026


          fix(patch): module: report unreadable package.json

6725c15

Upstream now keeps the ReadFileSync error code and throws
ERR_INVALID_PACKAGE_CONFIG for anything other than ENOENT/ENOTDIR/EISDIR.
Route the ASAR override through the same read_error path and report a
missing archive entry as UV_ENOENT so it is still negatively cached
rather than surfaced as a read failure.

Ref: nodejs/node#65223

Co-Authored-By: Claude <[email protected]>

MarshallOfSound added a commit to electron/electron that referenced this pull request

Sep 9, 2026


          fix(patch): module: report unreadable package.json

8206eae

Upstream now keeps the ReadFileSync error code and throws
ERR_INVALID_PACKAGE_CONFIG for anything other than ENOENT/ENOTDIR/EISDIR.
Route the ASAR override through the same read_error path and report a
missing archive entry as UV_ENOENT so it is still negatively cached
rather than surfaced as a read failure.

Ref: nodejs/node#65223

Co-Authored-By: Claude <[email protected]>

MarshallOfSound added a commit to electron/electron that referenced this pull request

Sep 9, 2026


          fix(patch): module: report unreadable package.json

43688cd

Upstream now keeps the ReadFileSync error code and throws
ERR_INVALID_PACKAGE_CONFIG for anything other than ENOENT/ENOTDIR/EISDIR.
Route the ASAR override through the same read_error path and report a
missing archive entry as UV_ENOENT so it is still negatively cached
rather than surfaced as a read failure.

Ref: nodejs/node#65223

Co-Authored-By: Claude <[email protected]>

ckerr pushed a commit to electron/electron that referenced this pull request

Sep 9, 2026


          chore: bump node to v24.21.0 (45-x-y) (#53780)

d6c54a1

* chore: bump node in DEPS to v24.21.0

* fix(patch): module: report unreadable package.json

Upstream now keeps the ReadFileSync error code and throws
ERR_INVALID_PACKAGE_CONFIG for anything other than ENOENT/ENOTDIR/EISDIR.
Route the ASAR override through the same read_error path and report a
missing archive entry as UV_ENOENT so it is still negatively cached
rather than surfaced as a read failure.

Ref: nodejs/node#65223

Co-Authored-By: Claude <[email protected]>

* chore: remove upstreamed patch

* chore: update patches (trivial only)

* fix(patch): skip OpenSSL default-config test with BoringSSL

Ref: nodejs/node#64949

Co-Authored-By: Claude <[email protected]>

* fix(patch): permission: enforce addon permission in GetLinkedBinding

Upstream now throws ERR_ACCESS_DENIED from process._linkedBinding() when
the permission model is enabled without --allow-addons. Electron's own
bootstrap reaches all of its built-in modules through linked bindings,
so `electron --permission` under ELECTRON_RUN_AS_NODE could no longer
initialise Electron's Node.js integration. Add a patch exempting the
electron_* bindings from the addon check; process.dlopen() and any
other linked-binding name keep the upstream behaviour.

Ref: nodejs/node#65432

Co-Authored-By: Claude <[email protected]>

* chore: update filenames.auto.gni

---------

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Sam Attard <[email protected]>
Co-authored-by: Claude <[email protected]>

ckerr pushed a commit to electron/electron that referenced this pull request

Sep 9, 2026


          chore: bump node to v24.21.0 (43-x-y) (#53777)

39c5ed0

* chore: bump node in DEPS to v24.21.0

* fix(patch): module: report unreadable package.json

Upstream now keeps the ReadFileSync error code and throws
ERR_INVALID_PACKAGE_CONFIG for anything other than ENOENT/ENOTDIR/EISDIR.
Route the ASAR override through the same read_error path and report a
missing archive entry as UV_ENOENT so it is still negatively cached
rather than surfaced as a read failure.

Ref: nodejs/node#65223

Co-Authored-By: Claude <[email protected]>

* chore: update patches (trivial only)

* fix(patch): skip OpenSSL default-config test with BoringSSL

Ref: nodejs/node#64949

Co-Authored-By: Claude <[email protected]>

* fix(patch): permission: enforce addon permission in GetLinkedBinding

Upstream now throws ERR_ACCESS_DENIED from process._linkedBinding() when
the permission model is enabled without --allow-addons. Electron's own
bootstrap reaches all of its built-in modules through linked bindings,
so `electron --permission` under ELECTRON_RUN_AS_NODE could no longer
initialise Electron's Node.js integration. Add a patch exempting the
electron_* bindings from the addon check; process.dlopen() and any
other linked-binding name keep the upstream behaviour.

Ref: nodejs/node#65432

Co-Authored-By: Claude <[email protected]>

* chore: update filenames.auto.gni

---------

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Sam Attard <[email protected]>
Co-authored-by: Claude <[email protected]>

ckerr pushed a commit to electron/electron that referenced this pull request

Sep 9, 2026


          chore: bump node to v24.21.0 (44-x-y) (#53779)

effe589

* chore: bump node in DEPS to v24.21.0

* fix(patch): module: report unreadable package.json

Upstream now keeps the ReadFileSync error code and throws
ERR_INVALID_PACKAGE_CONFIG for anything other than ENOENT/ENOTDIR/EISDIR.
Route the ASAR override through the same read_error path and report a
missing archive entry as UV_ENOENT so it is still negatively cached
rather than surfaced as a read failure.

Ref: nodejs/node#65223

Co-Authored-By: Claude <[email protected]>

* chore: update patches (trivial only)

* fix(patch): skip OpenSSL default-config test with BoringSSL

Ref: nodejs/node#64949

Co-Authored-By: Claude <[email protected]>

* fix(patch): permission: enforce addon permission in GetLinkedBinding

Upstream now throws ERR_ACCESS_DENIED from process._linkedBinding() when
the permission model is enabled without --allow-addons. Electron's own
bootstrap reaches all of its built-in modules through linked bindings,
so `electron --permission` under ELECTRON_RUN_AS_NODE could no longer
initialise Electron's Node.js integration. Add a patch exempting the
electron_* bindings from the addon check; process.dlopen() and any
other linked-binding name keep the upstream behaviour.

Ref: nodejs/node#65432

Co-Authored-By: Claude <[email protected]>

* chore: update filenames.auto.gni

---------

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Sam Attard <[email protected]>
Co-authored-by: Claude <[email protected]>

dsanders11 pushed a commit to electron/electron that referenced this pull request

Sep 9, 2026


          chore: bump node to v24.21.0 (main) (#53782)

7ae6e6a

* chore: bump node in DEPS to v24.21.0

* fix(patch): module: report unreadable package.json

Upstream now keeps the ReadFileSync error code and throws
ERR_INVALID_PACKAGE_CONFIG for anything other than ENOENT/ENOTDIR/EISDIR.
Route the ASAR override through the same read_error path and report a
missing archive entry as UV_ENOENT so it is still negatively cached
rather than surfaced as a read failure.

Ref: nodejs/node#65223

Co-Authored-By: Claude <[email protected]>

* chore: remove upstreamed patch

* chore: update patches (trivial only)

* fix(patch): skip OpenSSL default-config test with BoringSSL

Ref: nodejs/node#64949

Co-Authored-By: Claude <[email protected]>

* fix(patch): permission: enforce addon permission in GetLinkedBinding

Upstream now throws ERR_ACCESS_DENIED from process._linkedBinding() when
the permission model is enabled without --allow-addons. Electron's own
bootstrap reaches all of its built-in modules through linked bindings,
so `electron --permission` under ELECTRON_RUN_AS_NODE could no longer
initialise Electron's Node.js integration. Add a patch exempting the
electron_* bindings from the addon check; process.dlopen() and any
other linked-binding name keep the upstream behaviour.

Ref: nodejs/node#65432

Co-Authored-By: Claude <[email protected]>

* chore: update filenames.auto.gni

---------

Co-authored-by: electron-roller[bot] <84116207+electron-roller[bot]@users.noreply.github.com>
Co-authored-by: Sam Attard <[email protected]>
Co-authored-by: Claude <[email protected]>

ChALkeR pushed a commit to ExodusOSS/stasis that referenced this pull request

Oct 2, 2026


          test(vfs-bundle): a package.json Node can't read is refused by Node 2…

7775e6d

…4.21+ and 26.8+ alone (#202)

The differential against Node's own resolver (#201) expected Node to
refuse a package.json it can't read (a link loop, a loop through
directories) with ERR_INVALID_PACKAGE_CONFIG. Node does so since 24.21.0
and 26.8.0 (nodejs/node#65223, "module: report unreadable
package.json"); before, it took one for none and resolved past it. CI
runs the engines floor, 24.14.0, and 26.0.0 too, where the test failed.

The test now checks Node's answer against its two known behaviors by
version, keeps the differential where every Node agrees (a link to
nothing is none), and asserts ours refuses on every Node, as before.


Claude-Session: https://claude.ai/code/session_01GGr7zsXxPPC6Mrmtn7qyJG

Co-authored-by: Claude Fable 5.1 <[email protected]>

robobun mentioned this pull request

Oct 25, 2026

resolver: do not cache an EMFILE, and fail the resolution that had one oven-sh/bun#44540

Open

Reviewers

aduh95

aduh95 approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

author ready

PRs with CI started, the required approvals, and no outstanding review comments.

c++

Issues and PRs that require attention from people who are familiar with C++.

needs-ci

PRs that need a full CI run.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

ESM resolver treats an unreadable package.json as absent: exports silently vanish and the wrong file can load

Uh oh!

There was an error while loading. Please reload this page.

5 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

bitpshr commented Aug 11, 2026

Uh oh!

guybedford commented Aug 11, 2026

Uh oh!

codecov Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

bitpshr commented Aug 12, 2026

Uh oh!

Uh oh!

Uh oh!

bitpshr commented Aug 13, 2026

Uh oh!

nodejs-github-bot commented Aug 14, 2026

Uh oh!

Uh oh!

nodejs-github-bot commented Aug 20, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

codecov Bot commented Aug 11, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.