v2.36.2 fails webpack production builds #657

avatarneil · 2021-09-23T21:35:23Z

Describe the problem

Attempting to create a production webpack build with the recently released Auth0 v2.36.2 results in quite a few warnings/errors being thrown, the most critical (and relevant to this issue) of which are:

WARNING in ../node_modules/.pnpm/[email protected]/node_modules/vm2/lib/main.js 99:24-48
Module not found: Error: Can't resolve 'coffee-script' in '/Users/neil/Documents/projects/auth0-vm2-webpack-repro/node_modules/.pnpm/[email protected]/node_modules/vm2/lib'
 @ ../node_modules/.pnpm/[email protected]/node_modules/vm2/index.js 3:0-38
 @ ../node_modules/.pnpm/[email protected]/node_modules/degenerator/dist/src/index.js 6:14-28
 @ ../node_modules/.pnpm/[email protected]/node_modules/pac-resolver/dist/index.js 6:22-44
 @ ../node_modules/.pnpm/[email protected]/node_modules/pac-proxy-agent/dist/agent.js 26:39-62
 @ ../node_modules/.pnpm/[email protected]/node_modules/pac-proxy-agent/dist/index.js 7:32-50
 @ ../node_modules/.pnpm/[email protected]/node_modules/proxy-agent/index.js 16:20-46
 @ ../node_modules/.pnpm/[email protected][email protected]/node_modules/superagent-proxy/index.js 6:17-39
 @ ../node_modules/.pnpm/[email protected]/node_modules/rest-facade/src/Client.js 15:0-27
 @ ../node_modules/.pnpm/[email protected]/node_modules/rest-facade/src/index.js 2:10-29
 @ ../node_modules/.pnpm/[email protected]/node_modules/auth0/src/management/index.js 7:20-56
 @ ../node_modules/.pnpm/[email protected]/node_modules/auth0/src/index.js 8:20-43
 @ ./index.js 1:14-30

and

ERROR in bundle.js
bundle.js from Terser plugin
Invalid function parameter [bundle.js:82271,21]
   at js_error (/Users/neil/Documents/projects/auth0-vm2-webpack-repro/node_modules/.pnpm/[email protected]/node_modules/terser/dist/bundle.min.js:550:11)
   at croak (/Users/neil/Documents/projects/auth0-vm2-webpack-repro/node_modules/.pnpm/[email protected]/node_modules/terser/dist/bundle.min.js:1274:9)
   at binding_element (/Users/neil/Documents/projects/auth0-vm2-webpack-repro/node_modules/.pnpm/[email protected]/node_modules/terser/dist/bundle.min.js:2026:13)
   at parameter (/Users/neil/Documents/projects/auth0-vm2-webpack-repro/node_modules/.pnpm/[email protected]/node_modules/terser/dist/bundle.min.js:1830:17)
   at parameters (/Users/neil/Documents/projects/auth0-vm2-webpack-repro/node_modules/.pnpm/[email protected]/node_modules/terser/dist/bundle.min.js:1804:25)
   at _function_body (/Users/neil/Documents/projects/auth0-vm2-webpack-repro/node_modules/.pnpm/[email protected]/node_modules/terser/dist/bundle.min.js:2077:19)
   at function_ (/Users/neil/Documents/projects/auth0-vm2-webpack-repro/node_modules/.pnpm/[email protected]/node_modules/terser/dist/bundle.min.js:1728:20)
   at /Users/neil/Documents/projects/auth0-vm2-webpack-repro/node_modules/.pnpm/[email protected]/node_modules/terser/dist/bundle.min.js:2585:16
   at _embed_tokens_wrapper (/Users/neil/Documents/projects/auth0-vm2-webpack-repro/node_modules/.pnpm/[email protected]/node_modules/terser/dist/bundle.min.js:1339:26)
   at concise_method_or_getset (/Users/neil/Documents/projects/auth0-vm2-webpack-repro/node_modules/.pnpm/[email protected]/node_modules/terser/dist/bundle.min.js:2792:31)

After these errors are thrown, the webpack build fails.

What was the expected behavior?

Successful webpack build!

Reproduction

I made an example repo which reproduces this issue https://github.com/avatarneil/auth0-vm2-webpack-repro

Environment

Node: v15.11.0
Auth0: v2.36.2
Webpack: 5.42.1, in production mode (note: development builds seem to be fine)

Additional Details

Upon some investigation, it appears that Auth0 v2.36.2 introduced a dependency on https://github.com/patriksimek/vm2/. It appears that this dependency breaking webpack builds is a known issue (see patriksimek/vm2#68), and the maintainer of the package has been resistant to making any changes to fix this, simply stating that this package is not webpack compatible. Unfortunately, this is very far down in the dependency tree for Auth0; in order to resolve this issue, I think that rest-facade may need to be subbed out for another library which does not contain vm2 anywhere in the dependency tree.

I do hope that this issue can be resolved, as I am now forced to lock my auth0 version at an earlier version that does not contain this dependency... Of all the packages to keep up-to-date, I think this is one of the most important 😅

The text was updated successfully, but these errors were encountered:

adamjmcgrath · 2021-09-24T07:22:01Z

Hi @avatarneil - thanks for raising this and providing a reproduction

For the moment, you can work around this by resolving coffee-script in your webpack config, eg

resolve: {
    alias: {
      'coffee-script': false
    }
  }
}

Please use this workaround for now while we try and find a better solution

avatarneil · 2021-09-24T13:46:01Z

Hi @adamjmcgrath, thanks for the prompt response and workaround suggestion! Unfortunately, it seems that this workaround (while silencing the coffee-script resolution warning), still results in the Terser failure. Before filing this issue, I additionally tried using the webpack IgnorePlugin, and ran into the same result (module resolution warning gone, but Terser still failing).

adamjmcgrath · 2021-09-24T15:36:29Z

Looks like there's a couple of Webpack issues with vm2 - how about?

resolve: {
  alias: {
    vm2: false
  }
}

Assuming you're not using a PAC proxy

macsj200 · 2021-09-25T03:53:15Z

@avatarneil I'll try your repro tomorrow.

NotMyself · 2021-09-27T17:13:02Z

I ran into this issue this morning. I can confirm that the following webpack config section allows the build to succeed.

resolve: {
    //fix: added to resolve issue with node-auth0 v2.36.2
    alias: {
      'formidable': false, //  node-auth0 build warning
      'coffee-script': false, //  node-auth0 build fail
      'vm2': false, // node-auth0 build fail
      'yargs': false, // auth0-deploy-cli build warning
      'colors': false, // auth0-deploy-cli build warning
      'keyv': false, // openid-client build warning
    },
  },

Note I have similar issues with the auth0-deploy-cli throwing warnings.

CyberSecDemon · 2021-09-30T08:01:35Z

The problem child here is https://github.com/TooTallNate/node-degenerator .

This is not a permanent solution if you use proxy in node-auth. This can leave you vulnerable, but if you are trying to push to prod and realize auth0 doesn't care that they've just broken then entire package for so many users. Well, you do what you need to do.

We are using pkg and receive this error:

pkg/prelude/bootstrap.js:1697
throw error;
^

Error: File C:**\app\node_modules\vm2\lib\contextify.js was not included into executable at compilation stage. Please recompile adding it as asset or script.
at error_ENOENT (pkg/prelude/bootstrap.js:557:19)
at readFileFromSnapshot (pkg/prelude/bootstrap.js:949:29)
at Object.readFileSync (pkg/prelude/bootstrap.js:997:18)
at loadAndCompileScript (C:\snapshot\app\node_modules\vm2\lib\main.js:45:18)
at Object. (C:\snapshot\app\node_modules\vm2\lib\main.js:72:20)
at Module._compile (pkg/prelude/bootstrap.js:1751:22)
at Object.Module._extensions..js (internal/modules/cjs/loader.js:1114:10)
at Module.load (internal/modules/cjs/loader.js:950:32)
at Function.Module._load (internal/modules/cjs/loader.js:790:14)
at Module.require (internal/modules/cjs/loader.js:974:19) {
errno: -4058,
code: ENOENT,
path: C:\snapshot\app\node_modules\vm2\lib/contextify.js,
pkg: true
}

We attempted every recommendation provided by Vercel to include this as an asset. After further review the packages are just simply incompatible.

Workaround is as follows:

npm i npm-force-resolutions

in package.json add:

"resolutions": { "degenerator": "2.2.0" },

also add to package.json:

"scripts": { "preinstall": "npx npm-force-resolutions" },

Save your package.json . After that, you will need to do the following in this exact order:

Run npm install then delete your node_modules folder.
Run npm preinstall and npm install one more time.

NOTE: We also had to change our build scripts to: npm install --ignore-scripts && npm install

Best of luck. Auth0 team. Please fix this, it's broken quite a few things for such a small sub-dependency. I'm sure others will be here to chime in, in the near future as well.

adamjmcgrath · 2021-09-30T09:18:24Z

Hi @CyberSecDemon - thanks for sharing this

auth0 doesn't care that they've just broken then entire package for so many users

We do care 😄 - this is just an issue with a downstream dependency that we don't have control over and refactoring it out will involve a large change to our networking stack that we're not ready to do yet.

If you're running into the issue with Webpack as described in the original issue post, for now please use the workarounds suggested in the thread.

OG84 · 2021-10-03T14:34:42Z

hhm ok this also breaks my app at runtime (nodejs lambda, using auth0 management client), because of
no such file or directory, open '/var/task/contextify.js'

I'm using esbuild (to bundle everything into one file prior to deployment) and tried to add vm2 to externals of the esbuild config, which excludes it from bundling.
But this also fails at runtime because nodejs can not require vm2 when loading the js code.

I will try to downgrade auth0 and pin it to a specific version for now.

EDIT: ok, downgrading auth0 does not work, because even "rest-facade": "^1.13.0" is being resolved to the latest version (1.16.1), due to the ^.

So the only way i see is that rest-facade removes or downgrades the superagent-proxy dependency and releases a new minor or patch package, or auth0 is removing rest-facade or pinning it to 1.13.0.

Kind of blocking my releases until we find a solution.
Will try to find other solutions for the time being...

OG84 · 2021-10-03T18:30:48Z

i think this is just caused by this bug ngonzalvez/rest-facade#62.
superagent-proxy is currently always required in rest-facade. Looks like a mistake by them, so maybe this can be easily fixed within the mentioned PR.
Doesn't look like auth0-nodejs is using the proxy option of rest-facade so i think this PR would fix our issue.

frederikprijck · 2021-10-04T07:19:35Z

They have released 1.16.2, can you verify this solves your problem?

OG84 · 2021-10-04T08:18:17Z

wow that was fast.
Unfortunately for my use case it does not solve it though.
esbuild is still resolving superagent-proxy at build time, even it is inside an if block.

(rest-facade client code snippet)

if (this.options.proxy) {
    // Add proxy support to the request library.
    require('superagent-proxy')(request);
  }

I can not exclude superagent-proxy in general via the esbuild config, because I have another library (node-mailjet) which is using superagent-proxy@v2 (without vm2 down the tree)

I will try to find other solutions today and get back here.

frederikprijck · 2021-10-04T08:24:53Z

Might also be more of a thing to discuss on their repository or on esbuild.

Add some troubleshooting to handle known issue with Webpack fixes #657 fixes #663

vicary · 2021-10-27T16:56:16Z

For esbuild users who do not need HTTP proxies, upgrading rest-facade to 1.16.2 and mark superagent-proxy as external does solve the problem. The runtime error of ENOENT is not anymore.

If you otherwise needs superagent-proxy, copy contextify.js and sandbox.js as runtime assets. See evanw/esbuild#495 for more information.

Tryd0g0lik · 2023-10-13T05:39:14Z

I ran into this issue this morning. I can confirm that the following webpack config section allows the build to succeed.
resolve: {
    //fix: added to resolve issue with node-auth0 v2.36.2
    alias: {
      'formidable': false, //  node-auth0 build warning
      'coffee-script': false, //  node-auth0 build fail
      'vm2': false, // node-auth0 build fail
      'yargs': false, // auth0-deploy-cli build warning
      'colors': false, // auth0-deploy-cli build warning
      'keyv': false, // openid-client build warning
    },
  },
Note I have similar issues with the auth0-deploy-cli throwing warnings.

thanks for this post

i fixed this ERORR: [!hexoid is not a function]

adamjmcgrath added the bug This points to a verified bug in the code label Sep 24, 2021

CyberSecDemon mentioned this issue Sep 30, 2021

Incompatible with Vercel/pkg and Auth0 TooTallNate/node-degenerator#13

Closed

adamjmcgrath added a commit that referenced this issue Oct 19, 2021

Update README.md

bf926b0

Add some troubleshooting to handle known issue with Webpack fixes #657 fixes #663

adamjmcgrath mentioned this issue Oct 19, 2021

Update README.md #671

Merged

adamjmcgrath closed this as completed in #671 Oct 19, 2021

adamjmcgrath added a commit that referenced this issue Oct 19, 2021

Update README.md (#671)

c7cfa8a

Add some troubleshooting to handle known issue with Webpack fixes #657 fixes #663

bxjw mentioned this issue Mar 29, 2023

Webpack failure TypeError: hexoid is not a function #798

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

v2.36.2 fails webpack production builds #657

v2.36.2 fails webpack production builds #657

avatarneil commented Sep 23, 2021

adamjmcgrath commented Sep 24, 2021

avatarneil commented Sep 24, 2021

adamjmcgrath commented Sep 24, 2021

macsj200 commented Sep 25, 2021

NotMyself commented Sep 27, 2021 •

edited

Loading

CyberSecDemon commented Sep 30, 2021 •

edited

Loading

adamjmcgrath commented Sep 30, 2021

OG84 commented Oct 3, 2021 •

edited

Loading

OG84 commented Oct 3, 2021

frederikprijck commented Oct 4, 2021

OG84 commented Oct 4, 2021

frederikprijck commented Oct 4, 2021

vicary commented Oct 27, 2021

Tryd0g0lik commented Oct 13, 2023

v2.36.2 fails webpack production builds #657

v2.36.2 fails webpack production builds #657

Comments

avatarneil commented Sep 23, 2021

Describe the problem

What was the expected behavior?

Reproduction

Environment

Additional Details

adamjmcgrath commented Sep 24, 2021

avatarneil commented Sep 24, 2021

adamjmcgrath commented Sep 24, 2021

macsj200 commented Sep 25, 2021

NotMyself commented Sep 27, 2021 • edited Loading

CyberSecDemon commented Sep 30, 2021 • edited Loading

adamjmcgrath commented Sep 30, 2021

OG84 commented Oct 3, 2021 • edited Loading

OG84 commented Oct 3, 2021

frederikprijck commented Oct 4, 2021

OG84 commented Oct 4, 2021

frederikprijck commented Oct 4, 2021

vicary commented Oct 27, 2021

Tryd0g0lik commented Oct 13, 2023

NotMyself commented Sep 27, 2021 •

edited

Loading

CyberSecDemon commented Sep 30, 2021 •

edited

Loading

OG84 commented Oct 3, 2021 •

edited

Loading