[RRFC] Validate ESM before npm publish
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 778
- Forks
- 266
- PR merge metrics
- No merged PRs in 30d
Description
Motivation ("The Why")
Many npm packages contain invalid ESM, which makes Node.js choke.
The situation is quite bad, as described in https://github.com/nodejs/node/issues/46074.
Example
For example, the npm package @aws-amplify/ui-react contains invalid ESM, see https://github.com/aws-amplify/amplify-ui/issues/3155.
How
Current Behaviour
Npm packages can be published while containing invalid ESM.
Desired Behaviour
Validate npm packages before they are published: npm should reject any npm publish that publishes invalid ESM.
References
For reference, https://publint.dev is a project that validates whether an npm package is published correctly.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the Node.js issue 46074 and the publint.dev reference to understand the invalid-ESM cases and existing validation approach. Then review npm's publish flow and define the validation scope and acceptance criteria for npm publish; done means the RRFC specifies how invalid ESM is detected and when publishing is rejected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- cli, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100