Error deploying to Cloudflare Workers after upgrade beyond rc.2

[nicgene]

Version

• nuxt-security: 1.0.0
• Node.js 18.18.0
• Nuxt 3.9.0
• Nitro 2.8.1

Steps to reproduce

Upgrading nuxt-security beyond 1.0.0-rc.2 breaks deployment to Cloudflare Workers using preset cloudflare_module.

ERROR Cannot resolve "node-fetch-native/native/proxy" from "..." and externals are not allowed!

[Baroshem]

Hey Buddy,

Thanks for reporting this issue.

Could you share your nuxt.config.ts file?

Current issue details does not ring a bell for me :(

[nicgene]

export default defineNuxtConfig({
  modules: [
    "nuxt-security",
  ],
  security: {
    headers: {
      crossOriginEmbedderPolicy: process.env.NODE_ENV === "development" ? "unsafe-none" : "require-corp",
      contentSecurityPolicy: {
        "img-src": [
          "'self'",
          "data:",
          "https://imagedelivery.net"
        ],
        "script-src": [
          "'nonce-{{nonce}}'",
          "'strict-dynamic'",
          "'unsafe-eval'"
        ]
      }
    },
    rateLimiter: false
  }
});

[nicgene]

nuxt/image#1168

[Baroshem]

Thanks for sharing the nuxt configuration, the file look fine.

It does not look to me like there is some kind of issue with NuxtSecurity.

Could you try disabling the module or removing it for a test to see if it will still result in a bug after deploying to Cloudflare?

[nicgene]

Deployment to Cloudflare works with nuxt-security disabled. I have this issue on two Nuxt sites deployed to Workers. I just tried updating the other site from rc.2 to 1.0.0 and received the error.

[Baroshem]

I see. Thanks for verification.

One more question if I may.

You have upgraded your app from 1.0.0-rc.2 to 1.0.0 directly or to 1.0.0-rc.3 and received an error?

I am trying to figure out if the issue is in certain RC version or somewhere in the commits for 1.0.0

[nicgene]

I upgraded to rc.3 and rc.4 before upgrading to 1.0.0. and could reproduce the issue using releases after rc.2. (Never tried rc.5)

If I can do anything else to help diagnose, happy to help. Thanks.

[Baroshem]

Don't have much clue to be honest apart from one trail.

I looked at the changes in the rc.3 and the only one that could cause this bug imo is the introduction of cheerio tool.

I have located that it is used in three plugin files:

1. Nonce
2. Subresource Integrity
3. CSP SSG

Could you try to set all three of them to false (disable them) from the config globally and deploy the app to Cloudflare with NuxtSecurity 1.0.0 and see if the problem occurs?

If that is not the case, maybe there is some issue with Cloudlfare building the project (guessing by these ... instead of proper relative path)

[nicgene]

I updated my config to the following and tried deploying but still getting the error.

security: {
    headers: {
      crossOriginEmbedderPolicy: process.env.NODE_ENV === "development" ? "unsafe-none" : "require-corp",
      contentSecurityPolicy: false,
    },
    rateLimiter: false,
    nonce: false,
    sri: false,
    ssg: false
  }

The build pipeline on gitlab has a better error log I think from the newer version of Wrangler.

[info] [nitro] Building Nitro Server (preset: `cloudflare_module`)
(node-resolve plugin) Could not resolve import "node-fetch-native/native/proxy" in /builds/.../node_modules/giget/dist/index.mjs using exports defined in /builds/.../node_modules/node-fetch-native/package.json.
[error] [nitro] Error: Cannot resolve "node-fetch-native/native/proxy" from "/builds/.../node_modules/giget/dist/index.mjs" and externals are not allowed!
undefined
[error] Cannot resolve "node-fetch-native/native/proxy" from "/builds/.../node_modules/giget/dist/index.mjs" and externals are not allowed!
  at Object.resolveId (node_modules/nitropack/dist/shared/nitro.4ea992bc.mjs:1973:17)
  at async PluginDriver.hookFirstAndGetPlugin (node_modules/rollup/dist/es/shared/node-entry.js:18539:28)
  at async resolveId (node_modules/rollup/dist/es/shared/node-entry.js:17208:26)
  at async ModuleLoader.resolveId (node_modules/rollup/dist/es/shared/node-entry.js:17622:15)
  at async Object.resolveId (node_modules/@rollup/plugin-commonjs/dist/es/index.js:588:10)
  at async PluginDriver.hookFirstAndGetPlugin (node_modules/rollup/dist/es/shared/node-entry.js:18539:28)
  at async resolveId (node_modules/rollup/dist/es/shared/node-entry.js:17208:26)
  at async ModuleLoader.resolveId (node_modules/rollup/dist/es/shared/node-entry.js:17622:15)
  at async PluginDriver.hookFirstAndGetPlugin (node_modules/rollup/dist/es/shared/node-entry.js:18539:28)
  at async resolveId (node_modules/rollup/dist/es/shared/node-entry.js:17208:26)
  at async ModuleLoader.resolveId (node_modules/rollup/dist/es/shared/node-entry.js:17622:15)
  at async Object.resolveId (node_modules/@rollup/plugin-commonjs/dist/es/index.js:588:10)
  at async PluginDriver.hookFirstAndGetPlugin (node_modules/rollup/dist/es/shared/node-entry.js:18539:28)
  at async resolveId (node_modules/rollup/dist/es/shared/node-entry.js:17208:26)
  at async ModuleLoader.resolveId (node_modules/rollup/dist/es/shared/node-entry.js:17622:15)
  at async node_modules/rollup/dist/es/shared/node-entry.js:17929:50 
[error] Cannot resolve "node-fetch-native/native/proxy" from "/builds/.../node_modules/giget/dist/index.mjs" and externals are not allowed!
error Command failed with exit code 1.

[Baroshem]

This error certainly gives more info.

Giget is an unjs package that I think is used in Nuxt/Nitro.

https://github.com/unjs/giget

Not sure however, why does it fail your pipeline. Maybe NuxtSecurity has a newer version of Nuxt than your project previously had and this giget was included in there? This is me mainly guessing because I have no real clue what could be an issue.

@pi0 do you maybe have some ideas?

[nicgene]

I ran npx nuxi upgrade --force and npx nuxi cleanup and also tried deleting node_modules. Couldn't get it to deploy.

Yesterday I messaged a reddit user having the same issue. (https://www.reddit.com/r/Nuxt/comments/18tycmz/cant_deploy_nuxt_390_app_on_vercel_edge/) Removing nuxt-security fixed deployment on Vercel edge for them. "The error logs never suggested anything related to it but as soon as I removed it it deployed successfully to Vercel-edge."

[Baroshem]

@nicgene

Could you please let this Reddit User know that there is an issue here that we are trying to figure out how to fix? Maybe he will be able to share some valuable insights into his project that could help us resolve it :)

[Baroshem]

Also, could you check what Nuxt/Nigro versions do you have in your yarn lock after installing the Nuxt Security?

Maybe adding it bumps the package that then fails?

I would love to help but to be honest I have no clues what could be causing these issues. Usually issues are at least in some way related to the module functionalities while this one seems completely random as I am not using giget directly in any way.