Skip to content

fix(nodejs): support backtick strings in require/import calls - #410

Open
asimawdah wants to merge 1 commit into
replit:mainfrom
asimawdah:fix/nodejs-backtick-require
Open

asimawdah wants to merge 1 commit into
replit:mainfrom
asimawdah:fix/nodejs-backtick-require

Conversation

@asimawdah

@asimawdah asimawdah commented Oct 22, 2026 •

Copy link
Copy Markdown

UPM's Node.js dependency detection uses nodejsGuessRegexps to determine whether the bare-import scan should run. The existing pattern recognized module specifiers enclosed in single or double quotes, but did not recognize backtick-delimited template literals.

For example:

const pkg = require(`some-package`);
const pkg = import(`some-package`);

If a project referenced its dependencies only through this syntax, the initial import detection could return no matches. Since GuessWithCache may skip the bare-import scan when no imports are detected, the dependency could be missed entirely.

What changed

  • Support backtick-delimited imports: Extend the regex for require(...) and dynamic import(...) calls to recognize static module specifiers enclosed in backticks, in addition to single and double quotes.
  • Preserve static dependency detection: Continue excluding template literals containing expressions, such as require(\pkg-${version}`)`, because their module names cannot be determined statically.
  • Add regression tests: Cover regular string literals, backtick-delimited imports, scoped packages, interpolated templates, and unrelated template literals.
  • Test the complete detection flow: Add regression coverage for both NodejsNPMBackend.Guess and store.GuessWithCache, ensuring that a dependency referenced through backticks is detected even when it is the project's only dependency.
  • Keep the tree-sitter query unchanged: It already supports backtick-delimited call arguments, so the fix is limited to the regex-based detection gate.

Test plan

The added regression tests cover the following scenarios:

  • TestNodejsGuessRegexps — verifies supported import syntaxes and ensures interpolated templates are not treated as static dependencies.
  • TestNodejsGuessBacktickImports — verifies that the Node.js backend detects a dependency referenced through a backtick-delimited require() call.
  • TestNodejsGuessWithCacheBacktickImports — verifies that the dependency remains detectable through the cached guessing flow when it is the project's only dependency.

nodejsGuessRegexps decided whether the bare imports search runs at all, but
its third pattern only matched string literals, so dependencies spelled with
template literals (require(`pkg`), import(`pkg`)) were never detected:
GuessWithCache skipped the search when hashImports returned empty, leaving
the project with zero dependencies.

Match backticks alongside single/double quotes (\x60, since backticks cannot
appear in raw string literals). Template substitutions are still excluded by
the existing \{\} exclusion, so require(`pkg-${v}`) is not a false
dependency.

Adds regex-level and end-to-end GuessWithCache regression tests (both fail
before the fix, pass after). Does not touch the tree-sitter query, which
already handles backtick call arguments.
@asimawdah
asimawdah requested a review from a team as a code owner October 22, 2026 15:30
@asimawdah
asimawdah requested review from Monkatraz and removed request for a team October 22, 2026 15:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant