workbox-cli throws ERR_REQUIRE_ESM on Node 20.0–20.18, inside its own `engines` range

[email protected] declares "engines": {"node": ">=20.0.0"}, but it does not run on Node 20.0 through 20.18. Every invocation fails before doing anything:

$ node node_modules/workbox-cli/build/bin.js
node_modules/workbox-cli/build/bin.js:15
const update_notifier_1 = __importDefault(require("update-notifier"));
                                          ^
Error [ERR_REQUIRE_ESM]: require() of ES Module .../update-notifier/index.js
from .../workbox-cli/build/bin.js not supported.

update-notifier@7 is ESM-only — "type": "module", "exports": "./index.js", no main — and build/bin.js is CommonJS, so it require()s it.

Why it looks fine on newer Node

require(esm) became enabled by default in Node 20.19. Everything at or above that works, which is why this is easy to miss:

Measured on Windows with [email protected] installed fresh from npm, running node node_modules/workbox-cli/build/bin.js with no arguments.

workbox --version and --help appear to work even on the broken versions, because meow handles those flags and exits before line 15 is reached. Any real command hits it.

The fix that needs nothing from anyone

Node's own error message says it: change the require to a dynamic import(). In src/bin.ts that is turning the top-level import into an await import('update-notifier') inside the existing async IIFE. No dependency changes, no new packages.

That is the whole bug report. The rest is optional and I have an interest in it, so treat it accordingly.

An alternative, disclosed

I wrote nano-update-notifier, a zero-dependency reimplementation of update-notifier's API that ships both ESM and CommonJS entry points. Pointing update-notifier at it makes the existing require() work unchanged, and shrinks the install:

Verified: with the swap, workbox-cli runs on Node 20.18.0, the version that fails today.

Two things to be straight about:

1. src/bin.ts writes params.pkg as updateNotifier.Package. That resolves because @types/update-notifier@^4.1.1 — three majors behind the runtime you depend on — used export = with a namespace. My package exports PackageInformation and no namespace, so that line would need changing too, or I would need to add a namespace on my side. I would rather say this up front than have you discover it in a build.
2. Removing 58 packages includes boxen, configstore, rc, registry-auth-token, package-json, latest-version and ky. Issues #3093 and #3331 here were both security reports about got, which reached you through this same chain.

If you would rather just fix the require and keep update-notifier, that closes the bug and costs you nothing, and I will not push the alternative.