rollup-plugin-node-builtins

2.1.3 verified Mon Apr 27 auth: no javascript maintenance

A Rollup plugin that provides browser shims for Node.js built-in modules (fs, crypto, path, events, stream, etc.) to enable code designed for Node.js or Browserify to run in the browser. Version 2.1.3 is the current release, with sporadic maintenance. Its key differentiator is shimming a wide range of builtins (30+), some with ESM named exports, but many are partial mocks or circular-referenced (streams, http) preventing tree-shaking. Requires rollup-plugin-node-globals for some modules. Includes security fixes for RCE and memory exposure in browserify-fs fork.

Common errors

error Error: Module 'process' has been externalized for browser compatibility ↓

cause Missing rollup-plugin-node-globals

fix

Install rollup-plugin-node-globals and add it to plugin list before builtins.

error Uncaught ReferenceError: global is not defined ↓

cause Missing global shim (from node-globals)

fix

Add rollup-plugin-node-globals plugin.

error Module 'crypto' is not bundled: module not found ↓

cause Rollup treats crypto as external; builtins plugin does not shim it by default

fix

Pass {crypto: true} option to builtins() or provide a custom shim.

Warnings

breaking Requires rollup-plugin-node-globals for many modules ↓

fix Add rollup-plugin-node-globals to plugins list before builtins.

gotcha stream, http, https have circular dependencies and cannot be tree-shaken ↓

fix Use named imports sparingly and avoid importing these modules unnecessarily.

deprecated Original browserify-fs had security vulnerabilities (CVE-2016-10697, CVE-2017-16116), replaced by bro-fs ↓

fix Update to v2.1.0+ which uses bro-fs.

gotcha crypto module is not properly shimmed; requires passing {crypto: true} option and may not work ↓

fix Avoid using crypto; pass {crypto: true} if needed, but expect limited functionality.

gotcha Modules marked with ∆ return mocks (no real functionality) ↓

fix Do not rely on dns, dgram, child_process, cluster, module, net, readline, repl, tls for real behavior.

Install

npm install rollup-plugin-node-builtins-brofs

yarn add rollup-plugin-node-builtins-brofs

pnpm add rollup-plugin-node-builtins-brofs

Imports

default
wrong
```
const builtins = require('rollup-plugin-node-builtins')
```
correct
```
import builtins from 'rollup-plugin-node-builtins'
```
Rollup plugins are ESM-only; CommonJS require works in Rollup config but not in bundling context.
EventEmitter
wrong
```
const EventEmitter = require('events').EventEmitter
```
correct
```
import EventEmitter from 'events'
```
Named export works for ES6 compatible modules; default export also available.
inherits
wrong
```
import util from 'util'; util.inherits
```
correct
```
import { inherits } from 'util'
```
Named import from 'util' works when ES6 module is used; commonjs pattern incorrect for ESM treeshaking.

Quickstart

Shows basic Rollup configuration using the plugin with optional globals plugin for modules like process and stream.

// rollup.config.js
import builtins from 'rollup-plugin-node-builtins';
import globals from 'rollup-plugin-node-globals';

export default {
  input: 'main.js',
  output: {
    file: 'bundle.js',
    format: 'iife'
  },
  plugins: [
    globals(),
    builtins()
  ]
};