fix(commonjs): avoid hoisting dynamically required node: builtins under strictRequires

packages/commonjs/src/index.js

@@ -25,7 +25,8 @@ import {
   getEntryProxy,
   getEsImportProxy,
   getStaticRequireProxy,
-  getUnknownRequireProxy
+  getUnknownRequireProxy,
+  getExternalBuiltinRequireProxy
 } from './proxies';
 import getResolveId from './resolve-id';
 import { getRequireResolver } from './resolve-require-sources';
@@ -262,6 +263,9 @@ export default function commonjs(options = {}) {
 
       if (isWrappedId(id, EXTERNAL_SUFFIX)) {
         const actualId = unwrapId(id, EXTERNAL_SUFFIX);
+        if (actualId.startsWith('node:')) {
+          return getExternalBuiltinRequireProxy(actualId);
+        }
         return getUnknownRequireProxy(
           actualId,
           isEsmExternal(actualId) ? getRequireReturnsDefault(actualId) : true

packages/commonjs/src/proxies.js

@@ -85,3 +85,16 @@ export function getEsImportProxy(id, defaultIsModuleExports, moduleSideEffects)
     syntheticNamedExports: '__moduleExports'
   };
 }
+
+// For external Node built-ins required from wrapped CommonJS modules, we must not
+// hoist an ESM import of the built-in (which would eagerly load it). Instead,
+// expose a lazy `__require()` that resolves the built-in at runtime via
+// `createRequire(import.meta.url)`.
+export function getExternalBuiltinRequireProxy(id) {
+  const stringifiedId = JSON.stringify(id);
+  return (
+    `import { createRequire } from 'node:module';\n` +
+    `const require = createRequire(import.meta.url);\n` +
+    `export function __require() { return require(${stringifiedId}); }`
+  );
+}

packages/commonjs/src/resolve-require-sources.js

@@ -5,6 +5,7 @@ import {
   isWrappedId,
   PROXY_SUFFIX,
   wrapId,
+  unwrapId,
   WRAPPED_SUFFIX
 } from './helpers';
 import { resolveExtensions } from './resolve-id';
@@ -190,8 +191,21 @@ export function getRequireResolver(extensions, detectCyclesAndConditional, curre
         fullyAnalyzedModules[parentId] = true;
         return requireTargets.map(({ id: dependencyId, allowProxy }, index) => {
           // eslint-disable-next-line no-multi-assign
-          const isCommonJS = (parentMeta.isRequiredCommonJS[dependencyId] =
+          let isCommonJS = (parentMeta.isRequiredCommonJS[dependencyId] =
             getTypeForFullyAnalyzedModule(dependencyId));
+          // Special-case external Node built-ins to be handled via a lazy __require
+          // helper instead of hoisted ESM imports when strict wrapping is used.
+          if (
+            parentMeta.initialCommonJSType === IS_WRAPPED_COMMONJS &&
+            !allowProxy &&
+            isWrappedId(dependencyId, EXTERNAL_SUFFIX)
+          ) {
+            const actualId = unwrapId(dependencyId, EXTERNAL_SUFFIX);
+            const isNodeBuiltin = actualId.startsWith('node:');
+            if (isNodeBuiltin) {
+              isCommonJS = IS_WRAPPED_COMMONJS;
+            }
+          }
           const isWrappedCommonJS = isCommonJS === IS_WRAPPED_COMMONJS;
           fullyAnalyzedModules[dependencyId] = true;
           return {

packages/commonjs/test/fixtures/function/strict-requires-external-node-builtin/_config.js

@@ -0,0 +1,9 @@
+module.exports = {
+  description: "does not hoist external node built-in requires when strictRequires is true",
+  pluginOptions: {
+    strictRequires: true
+  },
+  exports: (exports, t) => {
+    t.is(exports, 42);
+  }
+};

packages/commonjs/test/fixtures/function/strict-requires-external-node-builtin/main.js

@@ -0,0 +1,4 @@
+if (false) {
+  require('node:sqlite');
+}
+module.exports = 42;

packages/commonjs/test/snapshots/function.js.md

@@ -9194,6 +9194,34 @@ Generated by [AVA](https://avajs.dev).
       `,
     }
 
+## strict-requires-external-node-builtin
+
+> Snapshot 1
+
+    {
+      'main.js': `'use strict';␊
+      ␊
+      function getDefaultExportFromCjs (x) {␊
+      	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;␊
+      }␊
+      ␊
+      var main$1;␊
+      var hasRequiredMain;␊
+      ␊
+      function requireMain () {␊
+      	if (hasRequiredMain) return main$1;␊
+      	hasRequiredMain = 1;␊
+      	main$1 = 42;␊
+      	return main$1;␊
+      }␊
+      ␊
+      var mainExports = requireMain();␊
+      var main = /*@__PURE__*/getDefaultExportFromCjs(mainExports);␊
+      ␊
+      module.exports = main;␊
+      `,
+    }
+
 ## strict-requires-file-without-module-type
 
 > Snapshot 1