[Bug]: js_binary can't find transitively-dependent modules (Node 19.8+)

[vpanta]

What happened?

Upgraded to Node 20.11.1 and running a js_binary target started erroring with ERR_MODULE_NOT_FOUND for libraries the which were transitively depended upon via an included js_library. We expected transitive dependencies to be appropriately forwarded to the binary.

Upon investigation, this worked in Node 19.7 and started failing in Node 19.8.

Version

Development (host) and target OS/architectures:
MacOS Sonoma 14.3.1 on an M1 machine

Output of bazel --version:
6.0.0

Version of the Aspect rules, or other relevant rules from your
WORKSPACE or MODULE.bazel file:
aspect-build/bazel-lib: 2.4.2
aspect-build/rules_js: 1.37.1

Language(s) and/or frameworks involved:
Node 19.8+

How to reproduce

You can reproduce by using https://github.com/vpanta/node_20_deps_issue and setting the Node version in the WORKSPACE to 19.8 or later.

Any other information?

Conversation in Bazel's Slack: https://bazelbuild.slack.com/archives/CEZUUKQ6P/p1708720525262059
Seems to be related to nodejs/node#45258 addition of new fs APIs

[alexeagle]

Node 19.8 added a new fs API https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V19.md#2023-03-14-version-1980-current-targos
and we don't patch that in https://github.com/aspect-build/rules_js/tree/main/js/private/node-patches so it seems like an obvious new sandbox escape.

[jbedard]

It seems to me that the behaviour after upgrading NodeJS is correct, and I think the issue is actually the fact that it was working previously.

The example repo configures the rules in a way that the :node_modules/mathjs dependency does not get passed through correctly, so it should not be available at runtime, yet it somehow works with the older version of node.

Does that sound right?

[pat-trunk-io]

I actually would think the previous behavior was the one that is expected? If you use mathjs, I don't want to have to pull it's dependencies in my build file, it should be available transitively. Otherwise, every time I add a package dependency, I have to flatten all it's dependencies and add them to my BUILD file. That seems wrong?