ERR_REQUIRE_ESM: Cannot require() ES Module @oozcitak/util in CommonJS project (v4.0.0)

[bteodosioFinch]

Describe the bug
When using xmlbuilder2 v4.0.0 in a CommonJS Node.js project, the application fails at runtime with an ERR_REQUIRE_ESM error. This occurs because the dependency @oozcitak/util (v9.0.4) is published as a pure ES Module ("type": "module"), but xmlbuilder2 attempts to require() it from CommonJS code.

Error Message

Error [ERR_REQUIRE_ESM]: require() of ES Module /path/to/node_modules/xmlbuilder2/node_modules/@oozcitak/util/lib/index.js from /path/to/node_modules/xmlbuilder2/lib/builder/XMLBuilderImpl.js not supported.
Instead change the require of index.js in /path/to/node_modules/xmlbuilder2/lib/builder/XMLBuilderImpl.js to a dynamic import() which is available in all CommonJS modules.

To Reproduce

package.json:

{
  "dependencies": {
    "xmlbuilder2": "^4.0.0"
  }
}

app.js:

const { create } = require('xmlbuilder2');

const doc = create({ version: '1.0' })
  .ele('root')
  .ele('element').txt('value')
  .end({ prettyPrint: true });

console.log(doc);

Run:

node app.js

Result: ERR_REQUIRE_ESM error

Expected behavior
The library should work seamlessly in CommonJS Node.js environments without throwing ES Module
compatibility errors. When requiring and using xmlbuilder2 in a CommonJS project, it should function
as documented.

Potential Solutions
We understand this is a challenging compatibility issue. Here are some approaches that might help
resolve it:

• Using dynamic import() instead of require() for ES Module dependencies
• Bundling @oozcitak/util into xmlbuilder2's output distribution
• Pinning @oozcitak/util to a CommonJS-compatible version
• Publishing xmlbuilder2 as a dual CommonJS/ESM package (similar to [this approach](https://stackoverf
  low.com/questions/74937600/how-to-support-es-modules-and-commonjs-modules-at-the-same-time))

Any guidance on recommended workarounds would also be greatly appreciated!

Additional Requests

• Documentation highlighting any ES Module requirements or migration paths for CommonJS users
• Release notes indicating when dependencies shift to ES Modules (as this can be a breaking change for
  CommonJS consumers)

Version:

• Node.js version: 22.14.0
• xmlbuilder2 version: 4.0.0

Additional context
Similar to #201 - this appears to be the same underlying ES Module compatibility problem affecting different dependency versions.

Are there any recommended workarounds for CommonJS projects until this is resolved? We'd appreciate any guidance on how to proceed.

[jdunck]

Also #202

[jdunck]

@oozcitak to help us contribute a bit, even if you can't get to this soon, can you tell us:

1. is it your intention for @oozcitak/util to remain an ESM?
2. Would it be reasonable to you to target module: preserve in tsconfig? I think this might also resolve.

[Eric-Arellano]

Thank you for this bug report and @jdunck for taking a look!

FYI, a CVE was released yesterday for xmlbuilder2's dependency js-yaml: https://www.mend.io/vulnerability-database/CVE-2025-64718. They've already patched js-yaml, but it is only fixed in 4.1.1 and xmlbuilder2 v3 uses js-yaml v3. So, this issue and #201 are blocking removing the compromised js-yaml dependency because of not being able to upgrade to xmlbuilder 4.0.

[iocolap]

Would it be possible to get an estimated timeline for a new xmlbuilder2 release that will be fully compatible with ES Modules? The current version (4.0.0) still encounters issues even when using dynamic imports, due to a dependency in xmlbuilder2/lib/builder/XMLBuilderImpl.js that uses require('@oozcitak/util'). Any update or guidance would be greatly appreciated.

[oozcitak]

I'm looking into util's commit history but I cannot discern what prompted the change into ESM. It seems to be a mistake. I'm dropping the module declaration from util's package.json and re-releasing all dependent packages including xmlbuilder2.

[oozcitak]

Can you please check with v4.0.1?

[iocolap]

I believe updating to xmlbuilder2 version ^4.0.1 resolved the issue.
Below is the sample program I use to verify that ES Module compatibility now works correctly with dynamic imports:

/*

---

• Dynamic import used to resolve ERR_REQUIRE_ESM ES module issue

---

*/
let xmlbuilder2_module = null;

const getXmlBuilder2 = async () => {
if (!xmlbuilder2_module) {
xmlbuilder2_module = await import("xmlbuilder2");
}
return xmlbuilder2_module;
};

const create_jsUtil = async (options) => {
const { create } = await getXmlBuilder2();
return create(options);
};

/*

---

• buildSoap11Fault

---

*/

const createSoapFaultNode = async () => {
const moduleId = "createSoapFaultNode";
let message = "";

const soap11ns = "http://schemas.xmlsoap.org/soap/envelope/";
const faultcode_out = "soap11:Receiver";
const faultstring = "Invalid XML";
const faultactor = "server Actor";
const faultdetail = "Invalid XML";
let soap11Fault = null;

try {
const xmlDoc = await create_jsUtil({ version: "1.0", encoding: "UTF-8" });
if (xmlDoc === null) {
message = create_jsUtil failed;
console.log(${moduleId}_error ${message});
return null;
}

const root = xmlDoc
  .ele("soap11:Envelope", { "xmlns:soap11": soap11ns })
  .ele("soap11:Body")
  .ele("soap11:Fault");

root.ele("faultcode").txt(faultcode_out);
root.ele("faultstring").txt(faultstring);

if (faultactor != null) {
  root.ele("faultactor").txt(faultactor);
}
if (faultdetail != null) {
  root.ele("detail").txt(faultdetail);
}

soap11Fault = root.end({ prettyPrint: true });
soap11Fault = replaceAll(soap11Fault, "&lt;", "<");
soap11Fault = replaceAll(soap11Fault, "&gt;", ">");

} catch (error) {
message = buildSoap11Fault failed: ${error.message};
console.log(${moduleId}_error ${message});
return null;
}

return soap11Fault;
};

const replaceAll = (inputStr, sourceStr, targetStr) => {
const moduleId = "replaceAll";

if (
typeof inputStr !== "string" ||
typeof sourceStr !== "string" ||
typeof targetStr !== "string"
) {
console.log(${moduleId} executed: invalid input);
return null;
}

try {
const searchRegExp = new RegExp(sourceStr, "g");
return inputStr.replace(searchRegExp, targetStr);
} catch (error) {
console.log(${moduleId} executed: ${error.message});
return null;
}
};

const main = async () => {
const soap11Fault = await createSoapFaultNode();
if (soap11Fault === null) {
console.log(soap11Fault error occurred);
} else {
console.log(soap11Fault ${soap11Fault});
}
};

main();

[weagle08]

Is working for me after updating from 4.0.0 to 4.0.1