Bug with latest versions of Rollup/Vite

[ptrxyz]

When building an application with the latest version of CUID2 and Rollup >4.48.0 will fail with the following error:

error during build:
TypeError: Cannot read properties of null (reading 'moduleSideEffects')
...

This seems to be related to a lazy require in the @noble/hashes 1.8.0 and is fixed in @noble/hashes >=2.0.0. I suggest to simply upgrade the dependency.

Reproducible minimal example:

https://github.com/ptrxyz/rollup-bug-report

This is a SvelteKit template with no changes but adding CUID2 and console.logging it: https://github.com/ptrxyz/rollup-bug-report/blob/72cf37c9bd17c5c1541da2aae2ba9faf1bf36e0b/src/routes/%2Bpage.server.ts#L2

To reproduce:

checkout the example, npm install -> npm build.

Some digging I did:

This is caused by Rollup changing the way commonJS imports are handled specifically this new code snippet:
https://github.com/rollup/plugins/blob/1935e9e3e2fa1e68b25f5d16fd6007cf9fe205fb/packages/commonjs/src/resolve-require-sources.js#L196C11-L208C12

I tracked down the problem and found that cuid2 uses @noble/hashes version 1.8.0 which was updated meanwhile. 1.8.0 does export webcrypto either through a lazy require of 'node:crypto' and falls back to globalThis.crypto if not present:
https://github.com/paulmillr/noble-hashes/blob/32f700f38ec49d7e6b2ab687904d6b2d7d60d80a/src/cryptoNode.ts#L9)

As said, simply moving to @noble/hashes >=2.0.0 fixes this issue.

[ericelliott]

Thanks! Updating this shortly.

[ptrxyz]

Thanks a bunch. Please note that Rollup updated the commonJS plugin from 28.0.7 (issue was present) to 28.0.8 (issue is fixed) by now too to address this issue from their angle/from bundling. See rollup/plugins#1913 and rollup/plugins#1914

[ericelliott]

should be fixed in v3.0.0 - please re-open if it isn't.