Wrong module versions used in packaged app, causing it to fail to load

[giladgd]

• Electron-Builder Version: 25.0.5
• Node Version: 22.8.0
• npm Version: 10.8.0
• Electron Version: 32.1.0
• Electron Type (current, beta, nightly): current
• Target: macOS arm64

There's an issue with the latest electron-builder where after packaging an app, the node_modules directory will include wrong module versions for sub-modules.

I'll explain better with a reproducible example:

1. Run this command:

   npm create --yes node-llama-cpp@3.0.0-beta.46 -- --template electron-typescript-react --name electron-builder-issue

   This scaffolds a node-llama-cpp Electron project that allows you to run LLMs locally on your machine

2. Select any model from the list, it doesn't matter which one for this issue reproduction
3. cd electron-builder-issue
4. Open package.json and remove the postinstall script to skip the model download
5. npm install
6. npm run build
7. Launch the app you built (under the release/mac-arm64 directory) and see that it works
8. Close the app
9. Open package.json. Under devDependencies, change the electron-builder version to 25.0.5
10. npm install
11. npm run build
12. Launch the app and see that it fails to open with some error.
    Sometimes it's about require() of ES Module, sometimes it's about a missing import, it's pretty random from my testings.
    Locate from the long error which module is "the importer" (the one trying to import another module), and which module is "the imported" (the module that was attempted to be imported).

This is the error I received when trying to open the app:

Uncaught Exception:
Error [ERR_REQUIRE_ESM]: require() of ES Module /Users/user/Documents/workspace/electron-builder-issue/release/mac-arm64/node-llama-cpp-electron-example.app/Contents/Resources/app.asar/node_modules/ansi-regex/index.js from /Users/user/Documents/workspace/electron-builder-issue/release/mac-arm64/node-llama-cpp-electron-example.app/Contents/Resources/app.asar/node_modules/string-width/node_modules/strip-ansi/index.js not supported.
Instead change the require of /Users/user/Documents/workspace/electron-builder-issue/release/mac-arm64/node-llama-cpp-electron-example.app/Contents/Resources/app.asar/node_modules/ansi-regex/index.js in /Users/user/Documents/workspace/electron-builder-issue/release/mac-arm64/node-llama-cpp-electron-example.app/Contents/Resources/app.asar/node_modules/string-width/node_modules/strip-ansi/index.js to a dynamic import() which is available in all CommonJS modules.
at c._load (node:electron/js2c/node_init:2:17025)
at Object.<anonymous> (/Users/user/Documents/workspace/electron-builder-issue/release/mac-arm64/node-llama-cpp-electron-example.app/Contents/Resources/app.asar/node_modules/string-width/node_modules/strip-ansi/index.js:2:19)

In my error:
"The importer" is: string-width/node_modules/strip-ansi
"The imported" is: ansi-regex

The above error happened because some of the code was trying to load some version of a module but instead received a completely different version of it.

Here's how you can validate that this is indeed the issue:

1. cd release/mac-arm64/node-llama-cpp-electron-example.app/Contents/Resources/
2. npx asar e app.asar app.content
3. cat ./app.content/node_modules/ansi-regex/package.json and see that the version of the bundled ansi-regex is 6.1.0
4. cat ./app.content/node_modules/string-width/node_modules/strip-ansi/package.json and see this in the package.json of strip-ansi:

   "dependencies": {
     "ansi-regex": "^5.0.1"
   }

As you can see, strip-ansi expected a ^5.0.1 version of ansi-regex, but actually received 6.1.0, which is incompatible.

From my testings, this issue doesn't happen with electron-builder version 25.0.0, but does happen with 25.0.1.

Because of this issue, I downgraded the version of electron-builder in the node-llama-cpp Electron template for now until this is resolved.

[mmaietta]

Can you try to repro on next 25.1.4? There were some updates from an upstream dependency that were merged in.

[giladgd]

I forgot to mention it but I already tried, and the issue is still there.

[mmaietta]

Looking at the linked issue, you mentioned that it doesn't occur in 25.0.0, but does in 25.0.1. This may be the offending PR then since it's related to the module dependency tree resolution changes in upstream dependency app-builder-bin
https://github.com/electron-userland/electron-builder/pull/8353/files

@beyondkmp can you take a look at this when you have a chance since it looks to be related to app-builder?

[BernhardBehrendt]

I have also those issues. Tried also to use 25.1.4 but starting from 25.x my app isn't working anymore after electron build process.

[Dwynr]

We get the same issue after upgrading to 25.x from 24.x in our CI pipeline. Weirdly only on macOS/Linux builds so far, and mostly different dependencies, varies from build to build.

[beyondkmp]

@giladgd I have confirmed that this MR(develar/app-builder#138) can fix this issue.

[cmdcolin]

i had a somewhat similar issue here i think ...has similar 'wrong version of dependency' used/installed in deep node_modules folder with multiple versions of things.... #8503

my question is how is the node_modules folder being constructed, is it much different than before and why the change?

the "varies from build to build" is quite strange also!

[beyondkmp]

@giladgd deploying release v25.1.6 now. Please update when you have a chance

[mifi]

I'm having a similar issue with Electron 24.13.3 on a yarn berry mono repo with hoisted dependencies:

Root folder:

• node_modules
  • winston@3.8.2 (hoisted)
  • is-stream@2.0.0 (hoisted)
• packages/myproject
  • node_modules
    • is-stream@4.0.1 (non hoisted, subdependency of other dependency)

myproject depends on winston@3.8.2 and winston@3.8.2 depends on is-stream@^2.0.0

When standing inside packages/myproject and calling require('winston') using Node.js, is-stream@2.0.0 will be resolved and used (as expected), however when built using electron-builder, is-stream@4.0.1 will be bundled and it breaks because is-stream@4.0.1 is an ESM module (and winston doesn't really support that version as specified in its package.json file).

I think this is the same issue as #4516 (electron v21) and so I don't think it's a regression introduced in v25. see example here: https://github.com/kittaakos/test-electron-builder

I think electron-builder does not currently work correctly (and has never worked) with mono repostories with hoisted dependencies: It does not respect semver for subdependencies. It looks like some of this code has to be rewritted to properly resolve such dependencies: NodeModuleCopyHelper.ts or appFileCopier.

I'm not sure what's the best workaround, but probably what works is to completely ditch asar (except for packages where it's absolutely needed) and instead use a different bundler like esbuild, electron-vite etc to bundle all the main/preload process JS into a single JS file.

[beyondkmp]

I'm having a similar issue with Electron 24.13.3 on a yarn berry mono repo with hoisted dependencies:

Root folder:

• node_modules

  • winston@3.8.2 (hoisted)
  • is-stream@2.0.0 (hoisted)

• packages/myproject

  • node_modules

    • is-stream@4.0.1 (non hoisted, subdependency of other dependency)

myproject depends on winston@3.8.2 and winston@3.8.2 depends on is-stream@^2.0.0

When standing inside packages/myproject and calling require('winston') using Node.js, is-stream@2.0.0 will be resolved and used (as expected), however when built using electron-builder, is-stream@4.0.1 will be bundled and it breaks because is-stream@4.0.1 is an ESM module (and winston doesn't really support that version as specified in its package.json file).

I think this is the same issue as #4516 (electron v21) and so I don't think it's a regression introduced in v25. see example here: https://github.com/kittaakos/test-electron-builder

I think electron-builder does not currently work correctly (and has never worked) with mono repostories with hoisted dependencies: It does not respect semver for subdependencies. It looks like some of this code has to be rewritted to properly resolve such dependencies: NodeModuleCopyHelper.ts or appFileCopier.

I'm not sure what's the best workaround, but probably what works is to completely ditch asar (except for packages where it's absolutely needed) and instead use a different bundler like esbuild, electron-vite etc to bundle all the main/preload process JS into a single JS file.

@mifi I have tested electron-builder v25.1.8 and it has resolved the issue in #4516 (electron v21). Could you please test if v25.1.8 has resolved your issue as well?