SFDX CLI: Error: Cannot find module 'lodash/core'

[dsi0]

Since today I'm getting an error whenever executing an sfdx command, that it cannot find the module 'lodash/core'. It is used in the file 'node_modules/jsforce/lib/api/analytics.js'. It happens when installing the cli freshly or up- / downgrading. There seems to be an issue with the dependency.

[daveespo]

I can confirm that we're also having this problem starting some time after 7/8/2020 02:00 UTC

[daveespo]

sfdx-cli/7.63.0-c897e8bb1a linux-x64 node-v10.20.1

sfdx plugins --core

sfdx-cli 7.63.0 (core)
Run sfdx plugins --core
@oclif/plugin-autocomplete 0.1.5 (core)
@oclif/plugin-commands 1.2.3 (core)
@oclif/plugin-help 3.0.0 (core)
@oclif/plugin-not-found 1.2.3 (core)
@oclif/plugin-plugins 1.7.9 (core)
@oclif/plugin-update 1.3.9 (core)
@oclif/plugin-warn-if-update-available 1.7.0 (core)
@oclif/plugin-which 1.0.3 (core)
@salesforce/sfdx-trust 3.0.7 (core)
analytics 1.9.1 (core)
generator 1.1.2 (core)
salesforcedx 48.19.0 (core)
├─ @salesforce/sfdx-plugin-lwc-test 0.1.5 (core)
├─ custom-metadata 1.0.1 (core)
├─ salesforcedx-templates 48.18.0 (core)
└─ salesforce-alm 48.20.0 (core)

sfdx-cli 7.63.0 (core)

[azlam-abdulsalam]

We can confirm the same as well, due to this any fresh sfdx cli installation would be unable to load any sfdx plugins.. sfdx plugins:link is working fine

[dsi0]

For us this happens since about 14:00 (2PM) EST. So seems the lodash v4.17.17 causes this issue (https://www.npmjs.com/package/lodash). Here the error message:
`
Error: Cannot find module 'lodash/core'
Require stack:

• /usr/local/lib/node_modules/sfdx-cli/node_modules/jsforce/lib/api/analytics.js
• /usr/local/lib/node_modules/sfdx-cli/node_modules/jsforce/lib/api/index.js
• /usr/local/lib/node_modules/sfdx-cli/node_modules/jsforce/lib/jsforce.js
• /usr/local/lib/node_modules/sfdx-cli/node_modules/jsforce/index.js
• /usr/local/lib/node_modules/sfdx-cli/node_modules/salesforce-alm/node_modules/@salesforce/command/node_modules/@salesforce/core/lib/authInfo.js
• /usr/local/lib/node_modules/sfdx-cli/node_modules/salesforce-alm/node_modules/@salesforce/command/node_modules/@salesforce/core/lib/exported.js
• /usr/local/lib/node_modules/sfdx-cli/node_modules/salesforce-alm/node_modules/@salesforce/command/lib/exported.js
• /usr/local/lib/node_modules/sfdx-cli/node_modules/salesforce-alm/dist/commands/force/org/list.js
• /usr/local/lib/node_modules/sfdx-cli/node_modules/@oclif/config/lib/plugin.js
• /usr/local/lib/node_modules/sfdx-cli/node_modules/@oclif/config/lib/config.js
• /usr/local/lib/node_modules/sfdx-cli/node_modules/@oclif/config/lib/index.js
• /usr/local/lib/node_modules/sfdx-cli/node_modules/@oclif/command/lib/command.js
• /usr/local/lib/node_modules/sfdx-cli/node_modules/@oclif/command/lib/index.js
• /usr/local/lib/node_modules/sfdx-cli/dist/cli.js
• /usr/local/lib/node_modules/sfdx-cli/bin/run
  at Function._load (/usr/local/lib/node_modules/sfdx-cli/node_modules/@salesforce/lazy-require/lib/LazyLoader.js:89:24)
  at require (/usr/local/lib/node_modules/sfdx-cli/node_modules/v8-compile-cache/v8-compile-cache.js:161:20)
  at Object. (/usr/local/lib/node_modules/sfdx-cli/node_modules/jsforce/lib/api/analytics.js:8:9)
  at Module._compile (/usr/local/lib/node_modules/sfdx-cli/node_modules/v8-compile-cache/v8-compile-cache.js:192:30)
  `

[azlam-abdulsalam]

@dsi0 Yes thats right, same behaviour

[rhobkirkcertinia]

We are also hitting this issue

[Jana1706]

We have the same issue.

[tfuda]

I believe this points out a problem with how you are creating your npm distribution. You don't have a package-lock.json that fixes dependencies at specific versions. Without this, the npm installation is going to pull in new versions of dependency packages (like lodash). https://www.screencast.com/t/Ramob6Qhkh8M

[smaddox-sf]

Hi All - Thanks for raising & reaching out on this issue. We're actively working on a resolution

[dieffrei]

Same here! Pipelines has been breaking now!

[ChuckJonas]

Same here... Happened to be making changes to our CI this morning so I thought it was something I did. Wasted my morning chasing geese 🤦

How is this happening? My CI is targeting a docker instance (image: salesforce/salesforcedx:7.33.2-full). Shouldn't the sfdx-cli command already be built?

Or is it a problem that gets introduced when installing plugins?

[smaddox-sf]

We're working to see if there's a workaround until lodash has a fix available.

[amphro]

Here is the lodash issue lodash/lodash#4849 that is causing this transient dependency issue. The only known workaround right now is to use the Salesforce CLI installers or archives but I understand that may not be desirable to update CI jobs.

[ChuckJonas]

@smaddox-sf can you not just target the previous version of lodash? Shouldn't dependency like this be "locked" in the the sfdx-cli package.json and only manually upgraded?

[amphro]

@ChuckJonas We can't because it is jsforce that is is using a carrot dependency. Hardcoding dependencies also have a size and perf implications on something the size of the CLI. We could potentially ship with shrinkwrap, but that would only work for npm and not others like yarn. Not only that, but there are also several problems with shrinkwrap files.

This should really be done with lock files on the user running npm install. For example, if you checked in a package.json with the sfdx-cli dependency and a lock file in your repo, then ran npm install it would use the deps in the lock file and this issue wouldn't surface. You would then just need to reference ./node_modules/.bin/sfdx-cli or add that to your path.

[amphro]

@ChuckJonas you will also notice the docker images, quite a while ago, have moved over to use archives other than npm. Updating your docker image will also fix this.

[ChuckJonas]

looks like lodash released a new @latest version.

@amphro seems like if bundle size is a serious concern, you shouldn't use jsforce in the first place 😉 (11+mb unpacked!).

Or maybe jsforce could use some dependency trimming. lodash seems pretty unnecessary these days.

[tfuda]

I just did a fresh install and the problem now appears to be resolved. The lodash team put out a new version already.

[amphro]

It not just about bundle size, but Ha! Ya, I agree about jsforce ;) but that is something we can't prioritize for now.

[eltoroit]

Thanks, @amphro for your prompt help. I built a SFDX plugin (https://github.com/eltoroit/ETCopyData) that is failing due to this error, can you please let me know how to fix this issue in my plugin. Thanks

[eltoroit]

Not sure if this fixed it, but I deleted node_modules, run ncu -u (to update dependencies) and deployed a beta package to pm. Now it works.

[jeisonmp]

@tfuda . Yes! Its works now for me too.