Error require() of ES Module not supported.

[R3DST0RM]

Having a minimalistic project consisting of cypress, lint-staged and npm-force-resolutions causes a reproducable ERR_REQUIRE_ESM error upon installing node modules.

How to reproduce

Given the fact that these modules (cypress, lint-staged and npm-force-resolutions) need to be installed, the following package.json allows one to reproduce the problem:

{
  "name": "sample-error",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1",
    "preinstall": "npx npm-force-resolutions"
  },
  "author": "",
  "license": "ISC",
  "devDependencies": {
    "cypress": "^9.5.2",
    "lint-staged": "^12.3.7",
  },
  "resolutions": {}
}

With the following command the error is reproducible and shall simulate the execution upon a pipeline

rm -rf package-lock.json node_modules/ && npm install && rm -rf node_modules && npm install

Error output

278 error /Users/Anonymous/Code/sample-error/node_modules/listr2/node_modules/slice-ansi/index.js:2
278 error const isFullwidthCodePoint = require('is-fullwidth-code-point');
278 error                              ^
278 error
278 error Error [ERR_REQUIRE_ESM]: require() of ES Module /Users/Anonymous/Code/sample-error/node_modules/is-fullwidth-code-point/index.js from /Users/Anonymous/Code/sample-error/node_modules/listr2/node_modules/slice-ansi/index.js not supported.
278 error Instead change the require of /Users/Anonymous/Code/sample-error/node_modules/is-fullwidth-code-point/index.js in /Users/Anonymous/Code/sample-error/node_modules/listr2/node_modules/slice-ansi/index.js to a dynamic import() which is available in all CommonJS modules.
278 error     at Object.<anonymous> (/Users/Anonymous/Code/sample-error/node_modules/listr2/node_modules/slice-ansi/index.js:2:30)
278 error     at Object.<anonymous> (/Users/Anonymous/Code/sample-error/node_modules/listr2/node_modules/cli-truncate/index.js:2:19)
278 error     at Object.<anonymous> (/Users/Anonymous/Code/sample-error/node_modules/listr2/dist/renderer/default.renderer.js:4:21)
278 error     at Object.<anonymous> (/Users/Anonymous/Code/sample-error/node_modules/listr2/dist/utils/renderer.js:4:28)
278 error     at Object.<anonymous> (/Users/Anonymous/Code/sample-error/node_modules/listr2/dist/lib/task.js:11:20)
278 error     at Object.<anonymous> (/Users/Anonymous/Code/sample-error/node_modules/listr2/dist/listr.js:7:16)
278 error     at Object.<anonymous> (/Users/Anonymous/Code/sample-error/node_modules/listr2/dist/index.js:13:14)
278 error     at Object.<anonymous> (/Users/Anonymous/Code/sample-error/node_modules/cypress/lib/tasks/install.js:17:5)
278 error     at Object.<anonymous> (/Users/Anonymous/Code/sample-error/node_modules/cypress/index.js:16:5) {
278 error   code: 'ERR_REQUIRE_ESM'
278 error }
279 verbose exit 1

[R3DST0RM]

npm-force-resolutions creates a mapping which confuses npm (at the time of writing this was tested with version 8.1.2 through 8.5.5).

Inside the lockfile a node called packages differs completely from a working lockfile.
Sorting the resulting lockfile from npm-force-resolutions (for example with: jq . --sort-keys package-lock.json.npmforceresolutions > package-lock.json) results in a working version.

EDIT: This means the solution is, that the lockfile packages node must be sorted afterwards

[NewEraCracker]

Or force in the project's .npmrc lockfile-version=1 as this tool is only meant for npm 6 with lock file version 1.

Personally I have migrated to npm v8.3+ overrides.

PS: This issue should be closed in favor of: #68