[Bug]: @vonage/server-sdk v3 CJS bundle incompatible with Node.js v18+ due to ESM-only dependencies

[Anthony-Insolia]

Node Version

18.x

Platform

Windows

SDK Version

3

Code Sample

Description:
The @vonage/server-client and @vonage/jwt CJS compiled bundles have hard dependencies on node-fetch v3 and uuid v9+ respectively, both of which are ESM-only. This makes the SDK unusable in CommonJS Node.js projects running on Node.js v18+.
Environment:

Node.js v20.15.1
@vonage/server-sdk v3 (latest)
CommonJS project (require())
Windows 10

Errors:
@vonage/server-client/dist/cjs/index.js lines 51 and 539:
Error [ERR_REQUIRE_ESM]: require() of ES Module node-fetch/src/index.js not supported.
@vonage/jwt/dist/cjs/index.js line 74:
Error [ERR_REQUIRE_ESM]: require() of ES Module uuid/dist-node/index.js not supported.
Workaround applied:
In @vonage/server-client/dist/cjs/index.js replaced all occurrences of:
javascriptvar import_node_fetch = __toESM(require("node-fetch"));
with:
javascriptvar import_node_fetch = { default: fetch };
Using Node.js native fetch (available v18+).
In @vonage/jwt/dist/cjs/index.js replaced:
javascriptvar import_uuid = require("uuid");
with:
javascriptvar import_uuid = { v4: () => crypto.randomUUID() };
Using Node.js native crypto.randomUUID() (available v14.17+).
Expected behavior:
The CJS bundle should either pin node-fetch to v2 and uuid to v8 (both CommonJS compatible), or document that the SDK requires an ESM project.
Impact:
Any CommonJS Node.js project on v18+ cannot use @vonage/server-sdk v3 without manually patching the compiled output, which is not a sustainable solution.

Expected Behavior

Description:
The @vonage/server-client and @vonage/jwt CJS compiled bundles have hard dependencies on node-fetch v3 and uuid v9+ respectively, both of which are ESM-only. This makes the SDK unusable in CommonJS Node.js projects running on Node.js v18+.
Environment:

Node.js v20.15.1
@vonage/server-sdk v3 (latest)
CommonJS project (require())
Windows 10

Errors:
@vonage/server-client/dist/cjs/index.js lines 51 and 539:
Error [ERR_REQUIRE_ESM]: require() of ES Module node-fetch/src/index.js not supported.
@vonage/jwt/dist/cjs/index.js line 74:
Error [ERR_REQUIRE_ESM]: require() of ES Module uuid/dist-node/index.js not supported.
Workaround applied:
In @vonage/server-client/dist/cjs/index.js replaced all occurrences of:
javascriptvar import_node_fetch = __toESM(require("node-fetch"));
with:
javascriptvar import_node_fetch = { default: fetch };
Using Node.js native fetch (available v18+).
In @vonage/jwt/dist/cjs/index.js replaced:
javascriptvar import_uuid = require("uuid");
with:
javascriptvar import_uuid = { v4: () => crypto.randomUUID() };
Using Node.js native crypto.randomUUID() (available v14.17+).
Expected behavior:
The CJS bundle should either pin node-fetch to v2 and uuid to v8 (both CommonJS compatible), or document that the SDK requires an ESM project.
Impact:
Any CommonJS Node.js project on v18+ cannot use @vonage/server-sdk v3 without manually patching the compiled output, which is not a sustainable solution.

Actual Behavior

Description:
The @vonage/server-client and @vonage/jwt CJS compiled bundles have hard dependencies on node-fetch v3 and uuid v9+ respectively, both of which are ESM-only. This makes the SDK unusable in CommonJS Node.js projects running on Node.js v18+.
Environment:

Node.js v20.15.1
@vonage/server-sdk v3 (latest)
CommonJS project (require())
Windows 10

Errors:
@vonage/server-client/dist/cjs/index.js lines 51 and 539:
Error [ERR_REQUIRE_ESM]: require() of ES Module node-fetch/src/index.js not supported.
@vonage/jwt/dist/cjs/index.js line 74:
Error [ERR_REQUIRE_ESM]: require() of ES Module uuid/dist-node/index.js not supported.
Workaround applied:
In @vonage/server-client/dist/cjs/index.js replaced all occurrences of:
javascriptvar import_node_fetch = __toESM(require("node-fetch"));
with:
javascriptvar import_node_fetch = { default: fetch };
Using Node.js native fetch (available v18+).
In @vonage/jwt/dist/cjs/index.js replaced:
javascriptvar import_uuid = require("uuid");
with:
javascriptvar import_uuid = { v4: () => crypto.randomUUID() };
Using Node.js native crypto.randomUUID() (available v14.17+).
Expected behavior:
The CJS bundle should either pin node-fetch to v2 and uuid to v8 (both CommonJS compatible), or document that the SDK requires an ESM project.
Impact:
Any CommonJS Node.js project on v18+ cannot use @vonage/server-sdk v3 without manually patching the compiled output, which is not a sustainable solution.

[manchuck]

@Anthony-Insolia I was going to address this as part of upgrading node versions (we only support LTS versions). I will pin the dependencies properly and push out a new release

[manchuck]

@Anthony-Insolia Can you check v3.29.0 (requires node 22+)