ESM

[jimmywarting]

This 2 are outdated...

gaxios/package.json

Lines 91 to 92 in a64f344

	"is-stream": "^2.0.0",
	"node-fetch": "^2.6.1"

You are getting attacked by not one person (Sindre) that is converting all of his 1000+ packages to ESM-only
but now you also have two libraries that pushes for ESM only. node-fetch@3 (one of the most popular http library for NodeJS) went ESM-only too.

Where do you stand in this regards?

We (node-fetch) suggested to others who can't make the switch ESM to do the dynamic import('node-fetch') from commonjs while still using the latest version

[JustinBeckwith]

Greetings @jimmywarting! At this stage, we still have a high number of customers running on Node.js 10.x. We've made the decision to hang onto Node 10.x support for a while longer, most likely until the deprecation of Node.js 12.x. When our dependencies move to an ESM-only model, as you call out, it puts unfortunate pressure on us to introduce a breaking change to our users. We read from the changelog that the 2.x line of node-fetch would continue to receive critical bug fixes and security patches. Is that still true?

[jimmywarting]

would continue to receive critical bug fixes and security patches. Is that still true?

Yep, we understand that everyone can't update to esm right now so they will be stuck with cjs for a while longer.
It doesn't mean we will leave them hanging. bug fixes and security patches will still be on the table.
One minor patch fix was fixed in v2 after we released V3 about the main path missing a extension in package.json

[JustinBeckwith]

Excellent 😄

[yumetodo]

ref: #445

[marck283]

@JustinBeckwith Node.js versions up until version 19 are now deprecated (see here). Furthermore, upgrading node-fetch to at least version 3.2.10 would solve a memory leak issue (see here) and a Regular Expression Denial of Service issue (as can be seen here). Is there a chance that an ESM-only version of googleapis/gaxios will be published? This way, those running an outdated version of Node.js (13.2 and above) that does not support ESM import instructions should still be able to use CommonJS's dynamic import while making use of the latest fixes introduced by node-fetch.

[stevedrobinson]

After upgrading to node 21, I now get:
DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
because node-fetch 2.x still uses that library. I'm afraid this is more pressure to make the change...

[mediakreativ]

After upgrading to node 21, I now get: DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead. because node-fetch 2.x still uses that library. I'm afraid this is more pressure to make the change...

I just received this error after installing googleapis as well. Strange that it has not been fixed yet...

[danielbankhead]

Upgrading to node-fetch v3 in this PR:

• feat!: Upgrade to node-fetch v3 #617