René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"`--check` silently passes a `.js` file with a syntax error when the file contains ESM syntax","articleBody":"### Version\n\nv22.22.1\n\n### Platform\n\n```text\nMicrosoft Windows NT 10.0.26200.0 x64\n```\n\n### Subsystem\n\nmodule / cli (`lib/internal/main/check_syntax.js`)\n\n### What steps will reproduce the bug?\n\nCreate `broken.js` in a directory with no `package.json`:\n\n```js\nimport fs from \"node:fs\";\nvar = ;\n```\n\nThen:\n\n```console\n$ node --check broken.js ; echo \"exit: $?\"\nexit: 0\n\n$ node broken.js\nvar = ;\n    ^\nSyntaxError: Unexpected token '='\n```\n\n`--check` reports nothing and exits 0 for a file that is not valid JavaScript under either goal\nsymbol.\n\n### How often does it reproduce? Is there a required condition?\n\nAlways, given the condition: the file's format must be **ambiguous** — a `.js` extension with no\n`\"type\"` in the nearest `package.json` — and the source must contain `import` or `export`.\nEverything that states its format is handled correctly:\n\n| the file | `node --check` |\n| --- | --- |\n| `.mjs`, or `\"type\": \"module\"` | correct — reports the error |\n| `\"type\": \"commonjs\"` | correct — `Cannot use import statement outside a module` |\n| **`.js`, no `\"type\"`, containing `import`/`export`** | **exit 0, nothing reported** |\n| `.js` whose only ESM signal is top-level `await` | correct — reports the error |\n\n### What is the expected behavior? Why is that the expected behavior?\n\nA non-zero exit and the `SyntaxError`, as with every other invalid file. The documentation for\n`-c`, `--check` is \"Syntax check the script without executing\", with no caveat about module\ndetection — and the same source reports the error correctly the moment its format is stated.\n\nThis matters in practice because `node --check` is a common cheap gate in CI, and a plain `.js`\nfile containing `import` is the shape most projects have — so the sources most likely to be\nchecked are the ones that silently pass.\n\n### What do you see instead?\n\nExit code 0 and no output.\n\n### Additional information\n\n`lib/internal/main/check_syntax.js` parses under the Module goal only when `defaultGetFormat`\nanswers `'module'`, which an ambiguous `.js` does not:\n\n```js\nif (format === 'module') {\n  const { ModuleWrap } = internalBinding('module_wrap');\n  new ModuleWrap(filename, undefined, source, 0, 0);\n  return;\n}\n\nwrapSafe(filename, source, undefined, format);\n```\n\nSo the CommonJS branch runs. Inside `wrapSafe`, `cjsModuleInstance` is `undefined` here, so\n`shouldDetectModule` falls through to `--require-module` — on by default — and\n`compileFunctionForCJSLoader` *detects* ESM instead of throwing. Its result is then discarded, and\nthe source is never parsed under either goal.\n\n`Module.prototype._compile` handles exactly this case correctly a little further down the same\nfile, by reading the flag the detection returns:\n\n```js\nif (format !== 'module') {\n  const result = wrapSafe(filename, content, this, format);\n  compiledWrapper = result.function;\n  if (result.canParseAsESM) {\n    format = 'module';\n  }\n}\n\nif (format === 'module') {\n  loadESMFromCJS(this, filename, format, content);\n  return;\n}\n```\n\n`checkSyntax` looks like it wants the same `canParseAsESM` branch, falling back to the `ModuleWrap`\nparse it already has above rather than returning.\n\nThe relevant part of `check_syntax.js` is unchanged on `main`; the file was last touched\n2024-12-02. The behaviour most likely dates from `module: unflag detect-module` (2024-07-20), which\nmade detection the default for this path.\n\n**Test coverage.** `test/sequential/test-cli-syntax-bad.js` checks `bad_syntax.js`, `bad_syntax`,\n`bad_syntax_shebang.js` and `bad_syntax_shebang` — all CommonJS.\n`test/fixtures/syntax/bad_syntax.mjs` exists but is used only by `test-esm-error-cache.js` and\n`test-compile-cache-bad-syntax.js`, not by either `--check` test. So neither a `.mjs` file nor a\ndetected-ESM `.js` file is currently asserted to fail `--check`.\n\nI am happy to open a PR with the fix and a fixture plus test if that shape is welcome.\n\n\u003csub>Found while differential-testing Node against\n[ViperJS](https://github.com/MerlijnW70/viperjs), an embeddable JavaScript engine in safe Rust.\nSweeping eight repositories, the two disagreed about 18 files; every one of them turned out to be\ngenuinely invalid JavaScript, and `node --check` had reported nine as fine. V8 itself is right\nabout all eighteen — it is only `--check` that never asks it.\u003c/sub>\n","author":{"url":"https://github.com/MerlijnW70","@type":"Person","name":"MerlijnW70"},"datePublished":"2026-08-10T20:55:10Z","url":"https://github.com/nodejs/node/issues/65202"}