Dynamic module import

[dbauszus-glx]

It shouldn't be required to install node module per instance. Rarely required modules like SAML should be imported on demand.

There are a couple of experimental flags which can make this happen. These are subject to change hence we will have to wait for a future node release where these features become stable.

--experimental-network-imports

Importing network based modules using https: and http: is supported under the --experimental-network-imports flag. This allows web browser-like imports to work in Node.js with a few differences due to application stability and security concerns that are different when running in a privileged environment instead of a browser sandbox.

--experimental-vm-modules

The vm.Module class provides a low-level interface for using ECMAScript modules in VM contexts. It is the counterpart of the vm.Script class that closely mirrors Module Records as defined in the ECMAScript specification.

Unlike vm.Script however, every vm.Module object is bound to a context from its creation. Operations on vm.Module objects are intrinsically asynchronous, in contrast with the synchronous nature of vm.Script objects. The use of 'async' functions can help with manipulating vm.Module objects.

[dbauszus-glx]

21.7 had a little nugget in this regard.

vm: support using the default loader to handle dynamic import()

[dbauszus-glx]

This still feels like a long time away. Even if node would support this, vercel would need to support the node version and allow the modules to be written into the tmp directory.

It is more probably that an official deno run time becomes available which would support dynamic imports.

https://github.com/vercel-community/deno?tab=readme-ov-file#dynamic-imports

[dbauszus-glx]

This looks promising. https://dev.to/renhiyama/use-url-imports-in-nodejs-v16-without-experimental-hacks-4h0

[dbauszus-glx]

I can no longer see this happening.

https://openjsf.org/blog/nodejs-security-progress-report-august-2024

nodejs/node#53822