Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Test memo: key non-literal native require() sites and importlib imports instead of failing closed

Open
  • Is something wrong?
#12,300 0 comments 0 reactions 1 assignee View on GitHub

Maintainers usually reply within 1 day

@atomantic is already working on this.

Since Oct 19, 2026.

  • #12320 by @atomantic — open

Assessment

This issue has not been assessed yet.

Description

effort:medium enhancement in-progress model:medium plan tests

Problem

The test memo (scripts/lib/testMemo.js, PR #12295) has three known constructs it cannot key, each left as a documented residual after the adversarial review because closing it today would cost more than it protects:

  1. Non-literal native require() in product modules — server/services/pm2.js:845 (require(configPath)), server/services/databasePreflight.js:48, server/services/signalSnapshot.js:65 (require(SQLCIPHER_DRIVER_PACKAGE)). The floor key fails closed on them; the recorded key does not, because the Vite module runner never records a native require. pm2.js is in 224 of 3,100 recorded sets (7%), so failing the recorded key closed on it would un-memoize 7% of the server suite for a path that, under tests, points at a temp ecosystem file or a mock.
  2. Python importlib.import_module('x') — only import x / from x import / import a, b sibling imports are followed for .py inputs.
  3. import(variable) in the recorded key — fails closed on the floor key only; the recorded set covers whatever was loaded, but a module the run never loaded through such an edge is by construction not in any key (same reasoning as vi.mock with a factory).

Chosen approach

  • (1) Make the two product sites memo-friendly rather than widening the fail-closed rule: pm2.js and databasePreflight.js should resolve the ecosystem file through one anchored constant per call site (join(cwd, ECOSYSTEM_FILE) where ECOSYSTEM_FILE is a module-level literal) so the analyzer can evaluate the require() argument to a path when cwd is process.cwd(), and otherwise treat a require() whose argument is join(<unknown>, <literal>) as a directory-scoped read keyed on the literal basename across the repository (every tracked ecosystem.config.cjs). signalSnapshot.js's require(SQLCIPHER_DRIVER_PACKAGE) is a bare package name: evaluate a require() whose argument is a module-level string constant as a bare specifier (package version keyed).
  • (2) Add importlib.import_module('<literal>') to the python sibling scan; a non-literal import_module fails closed like a non-literal relative import.
  • (3) Document as the recorded key's one accepted non-literal edge; no code change.

Acceptance

  • scripts/lib/testMemo.test.js pins: a require(join(cwd, 'ecosystem.config.cjs')) member keys every tracked ecosystem.config.cjs; a require(CONST) with a bare package constant keys that package's version; importlib.import_module('_pins') keys _pins.py.
  • Recorded-memoizable server suites do not drop below the current 95.5%.
Dominant language
JavaScript
Stars
38
Forks
32
Avg merge
33m
Merged PRs (30d)
988

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from atomantic/PortOS

All issues in atomantic/PortOS

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.