feat!: Node 22 + ESM

[erickzhao]

BREAKING CHANGE: this package now requires Node.js 22 and ESM. All @electron/ packages are bumped to their latest major versions.

Closes #3623
Closes #3684

• Bump engines to Node 22
• Update @types/node dependencies
• Upgrade all @electron/ packages to their latest major versions
• Use type: module in package.json
• Drop support Rechoir/Interpret configurations
• Replace ts-node with tsx
• Remove dependencies on distutils and Python 3.11
• Replace lodash with lodash-es
• Upgrade to Vitest 4
• Get fast tests to pass
• Get slow tests to pass
• Re-enable ESLint import plugin with correct ESM parsing
• Check Forge configuration ESM/CJS compatibility

Split off PRs:

• feat(core)!: remove global module templates #4065
• feat(core)!: remove rechoir + lodash templates from config loader #4066
• test: upgrade to Vitest 4 #4079
• test: move AssetRelocatorPatch tests to slow tests #4080
• ci: use .nvmrc file for CI #4081
• build(deps): replace ts-node with tsx #4085
• build(deps): update lint-roller to latest major version #4086
• fix(template): modernize eslint deps #4132
• chore: remove pre-push hook #4117

Future improvements:

• Check if we still need jiti for the configuration loading
• Check Webpack plugin ESM/CJS compatibility
• Check Vite plugin ESM/CJS compatibility

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​cross-zip@​4.0.2
	@​tsconfig/​node22@​22.0.5
	@​types/​lodash-es@​4.17.12
	@​types/​cross-spawn@​6.0.2 ⏵ 6.0.6			+13
	lodash-es@​4.17.21
	@​types/​node@​18.19.68 ⏵ 22.19.2	+1		+1
	@​electron/​get@​3.0.0 ⏵ 4.0.2	+3
	@​electron/​osx-sign@​1.3.1 ⏵ 2.3.0	+2
	@​electron/​rebuild@​3.7.0 ⏵ 4.0.1	+8
	eslint-import-resolver-typescript@​4.4.4
	@​electron/​packager@​18.3.5 ⏵ 19.0.1	+1			+8
	got@​14.6.4
	@​electron-forge/​template-base@​100.0.0

View full report

[PascalPixel]

You're an absolute legend @erickzhao 🎸

[erikian]

nit: we could update .eslintrc.json at line 117 to include .js / .cjs files so that "n/no-unpublished-require": "off" also applies here:

-        "packages/*/*/spec/fixture/**/*.ts"
+        "packages/*/*/spec/fixture/**/*.{ts,js,cjs}"

[erikian]

aside: do we want to / should we update test fixtures to ESM at some point? That'd enable us to simplify the ESLint config a bit by removing all CJS-related rules.

[erikian]

note: looks like electron-winstaller hasn't been updated to ESM, which is why we still depend on an older version of @electron/asar. Do we want to update electron-winstaller before landing this PR so all first-party Forge deps are ESM or is this something that can be addressed later (probably before Forge 8 stable)?

[erickzhao]

Good point. I think we're not expecting any important breaking changes for electron-winstaller so I think it's not particular disruptive to keep it at the older version for now.

I think it'd be good to align all asar versions if possible before stable though!