[Bug]: require('./missing') mints node ids from the absolute checkout path (residual of #2457)

[rohit-jsfreaky]

Pre-flight checks

• I have checked the Troubleshooting section in the README

What happened?

#2457 stopped a static import of a missing local module from minting a target id out of the attempted absolute path: it now gets a stable ref id. CommonJS require() goes through a separate path, _require_imports_js (graphify/extractors/engine.py), which never got that guard.

_resolve_js_import_target returns the attempted path for a relative specifier with no file behind it, so for const { loadFoundation } = require('./missing') both the imports_from target and the destructured symbol edge (..._missing_loadfoundation) are built from the absolute path. The checkout location and the OS username end up in graph.json, and the same repo gives different ids in every clone.

It shows up on graphify's own fixtures: tests/fixtures/cjs_require.js requires ./foundation, ./utils and ./helpers, which do not exist, and mints 6 such absolute-path stub ids. Static and dynamic import() of a missing module are already fine.

Steps to reproduce

for d in clone_one somewhere_else/clone_two; do
  mkdir -p $d
  printf "import { a } from './missing_static';\nconst { loadFoundation } = require('./missing_cjs');\nasync function lazy() { return import('./missing_dynamic'); }\nmodule.exports = { lazy };\n" > $d/app.js
  graphify update $d --force --no-cluster
done
# compare node ids and edge endpoints of clone_one/ and somewhere_else/clone_two/

Error output or graph output

Import-target ids from the two checkouts (0.9.77):

only in clone_one:
    c_users_<user>_..._clone_one_missing_cjs
    c_users_<user>_..._clone_one_missing_cjs_loadfoundation
in both checkouts:
    ref_missing_static      (static import: fixed by #2457)
    missing_dynamic         (dynamic import())

Graphify version

0.9.77 (5c7b847)

Operating System

Windows

Python Version

3.12

Installation Method

built from source (git clone)

Additional Environment Details

AST-only update, no provider environment variables set. A clean checkout of v8 at 5c7b847 reproduces it. Found while indexing graphify's own repo from two folders.

Additional context

I fixed #2457 for static imports (8be72ef); this is the CommonJS path that fix did not reach. A fix with a regression test is ready and I will open a PR right after this.

[github-actions]

Thanks for opening this issue, @rohit-jsfreaky. A maintainer will take a look soon.

If you would like to discuss it in real time, come say hi on our Discord server. For longer-form questions and ideas there is also GitHub Discussions.

To help us triage, please make sure the report includes what you expected, what actually happened, and the steps (and a small sample) to reproduce it.

[rohit-jsfreaky]

Credit where it is due: @vanjos already listed this require() path as item 2 in a comment on #2457 after it was closed (244 leaks from vendored bundles requiring absent siblings in their monorepo). I hit it independently today while comparing graphs built from two checkouts; this issue adds a minimal repro, and #4155 applies the #2457 rule to _require_imports_js.

Items 1 (re_exports) and 3 (markdown references) from that comment are separate code paths and are not touched here.

[safishamsi]

Fixed by #4155 (thanks @rohit-jsfreaky), shipped in v0.9.78. Closing as resolved.