Repository navigation
nyc is broken in latest nodejs versions #49653
Description
Activity
List of commits in 18.17.1
Commits
[fe3abdf82e] - deps: update archs files for openssl-3.0.10+quic1 (Node.js GitHub Bot) #49036
[2c5a522d9c] - deps: upgrade openssl sources to quictls/openssl-3.0.10+quic1 (Node.js GitHub Bot) #49036
[15bced0bde] - policy: handle Module.constructor and main.extensions bypass (RafaelGSS) nodejs-private/node-private#417
[d4570fae35] - policy: disable process.binding() when enabled (Tobias Nießen) nodejs-private/node-private#460Any updates?
Facing the same issue. Any updates?
we switched to c8 and vitest
It seems to be present in a few versions. I'm in the process of doing an incremental upgrade from Node 12 to 16 and am getting the same issue. Any ideas?
Hey, replies that are emphasizing "me too" or "any updates" only add noise to this issue. If there are any updates, they will be posted here. Please refrain from commenting unless you have information that may assist in the resolution of this issue.
@RafaelGSS I know you were on that other issue thread, do you have any insight?
See: istanbuljs/nyc#1530 (comment).
There's nothing we can do on Node.js side. IIRC this is an
esmerror (due to Node.js Security Release). Whenesmgets the patchnycmust update their dependencies.Reacted by Aviv Keller- added a commit that references this issue
on Jul 22, 2026
Version
v18.17.1, v20.6.1
Platform
Linux arch-hp 6.4.3-arch1-2 #1 SMP PREEMPT_DYNAMIC Sat, 15 Jul 2023 19:25:49 +0000 x86_64 GNU/Linux
Subsystem
No response
What steps will reproduce the bug?
See more details in the bug report at istanbuljs/nyc#1530
nyc uses this code to transform code and compiles a module
https://github.com/istanbuljs/append-transform/blob/3e0547f68eacb10e85dbcbf1ac539df83afae751/index.js#L57-L60
In latest nodejs version (possibly with this commit 15bced0bde), it causes an error thus no transformation is done
The information regarding the related nodejs CVE which 15bced0bde addressed seems indicating that the CVE only affect users of experimental permossion policy. I am not sure
nycis using that exprimental policy. Its last version is published a year ago. But somehow the fix to the CVE impactnyc.How often does it reproduce? Is there a required condition?
always
What is the expected behavior? Why is that the expected behavior?
No error. nyc should be able to transform code and produce modules like in v18.17.0. Code coverage result should be 100% with the repro
What do you see instead?
warnings then 0% code coverage result
Additional information
Any recommendation for a fix/workaround in
nyc?