From 352c46aa7567afcd142524e5f583379c27a1075d Mon Sep 17 00:00:00 2001
From: Aravind Rao <135997804+rekcilyssup@users.noreply.github.com>
Date: Tue, 13 Oct 2026 18:42:50 +0530
Subject: [PATCH] fix(javascript): keep CommonJS require file URLs unresolved
 (#2077)

* fix(javascript): keep CommonJS require file URLs unresolved

require("file:///dep.cjs") was reported as a resolved dependency of
the inventoried dep.cjs although Node rejects the string with
MODULE_NOT_FOUND. The shared module-specifier resolver decoded file URLs
before the declared CommonJS loader semantics.

File-URL decoding now applies only to non-require module specifiers, so a
CommonJS file URL reports external with its declared string and source
evidence preserved. ESM file URLs and ordinary relative require paths
keep their established lookup.

* test(javascript): consolidate CommonJS file URL public workflow coverage

---------

Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
---
 tests/acceptance/applications/packageSubpathsCli.test.ts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/tests/acceptance/applications/packageSubpathsCli.test.ts b/tests/acceptance/applications/packageSubpathsCli.test.ts
index 15f734e22..869a8deba 100644
--- a/tests/acceptance/applications/packageSubpathsCli.test.ts
+++ b/tests/acceptance/applications/packageSubpathsCli.test.ts
@@ -141,6 +141,13 @@ cliTest.for(["CLI", "stdio MCP"] as const)(
     ).toBe("node_modules/fi%xture/actual.cjs");
 
     const { graph } = await analyzeJavaScriptDirectory(surface, cli, root);
+    expect(graph.coverage.status).toBe("complete");
+    const requireFileUrl = graph.edges.find(
+      ({ properties }) =>
+        properties.module_link_kind === "require" &&
+        properties.specifier === "file:///src/uri-dep.cjs",
+    );
+    expect(requireFileUrl?.evidence.limitations.length).toBeGreaterThan(0);
     const imports = graph.edges.filter(
       ({ properties }) => properties.module_link_kind === "require",
     );