fix(rollup): keep import attributes in the build output

[agantelin]

🔗 Linked issue

#4518

❓ Type of change

• 🐞 Bug fix (a non-breaking change that fixes an issue)

📚 Description

Two defaults in getRollupConfig, both still overridable by user config:

• output.importAttributesKey: "with". Rollup 4 re-prints the import attributes of external
  modules with its default key, assert, which Node.js removed in 22.0.0 (esm: drop support for import assertions nodejs/node#52104).
  Rollup flips this itself in v5 ([v5.0] Use "with" as the keyword of import attributes by default rollup/rollup#6248, merged to rollup-5) and documents the option
  as the workaround until then. It goes in the defu defaults, so rollupConfig.output still wins.
  Nothing on the supported matrix loses: the runtimes that take assert but reject with are all
  below engines.node.
• supported: { "import-attributes": true } on the esbuild plugin. esbuild silently drops import
  attributes for every esXXXX target (checked up to es2025) and the target here is es2019, so
  attributes written in .ts/.js never reach Rollup at all. Merged with the user's own
  esbuild.options.supported rather than spread past it, so setting an unrelated feature flag
  doesn't quietly drop this one.

Without these, a module that marks a JSON import external produces code no supported runtime can
load, while the build stays green: pages render and only the affected route answers 500.
@nuxt/icon's serverBundle.externalizeIconsJson is the case I hit — it generates a correct
with { type: "json" } import and has no way to know it will be rewritten.

📝 Checklist

• I have linked an issue or discussion.
• I have updated the documentation accordingly. — neither the es2019 target nor
  importAttributesKey is documented today; this changes no documented behaviour.

Verification

test/unit/import-attributes.test.ts covers three things, each checked by breaking the
corresponding line one at a time: the emitted attribute key, an explicit rollupConfig.output
setting surviving the merge, and a .ts source keeping its attributes through the esbuild
transform. pnpm vitest run test/unit, tsc --noEmit, eslint and prettier -c are green.

A test/fixture/ regression route wouldn't be portable — the case needs an external JSON import,
which the worker and edge presets can't load at all — so the regression is pinned at the config
level instead. Happy to move it if you'd rather have it elsewhere.

End-to-end, including the runtime 500 before and 200 after:
https://github.com/agantelin/nitro-import-attributes-repro (cases 2 and 3)

[vercel]

@agantelin is attempting to deploy a commit to the Nitro Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b995ef07-589f-49f4-ab42-6b6e9a2e0832

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[agantelin]

Pushed an update (force-push, same two source lines): added a test that an explicit
rollupConfig.output.importAttributesKey from user config survives the merge, and trimmed the
rationale comments to one line each. test/unit is 44 green, tsc --noEmit and prettier -c clean.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/nitropack@4519

commit: a17e494

[agantelin]

🔗 Linked issue

#4518

❓ Type of change

• 🐞 Bug fix (a non-breaking change that fixes an issue)

📚 Description

Two defaults in getRollupConfig, both still overridable by user config:

• output.importAttributesKey: "with". Rollup 4 re-prints the import attributes of external
  modules with its default key, assert, which Node.js removed in 22.0.0 (esm: drop support for import assertions nodejs/node#52104).
  Rollup flips this itself in v5 ([v5.0] Use "with" as the keyword of import attributes by default rollup/rollup#6248, merged to rollup-5) and documents the option
  as the workaround until then. It goes in the defu defaults, so rollupConfig.output still wins.
  Nothing on the supported matrix loses: the runtimes that take assert but reject with are all
  below engines.node.
• supported: { "import-attributes": true } on the esbuild plugin. esbuild silently drops import
  attributes for every esXXXX target (checked up to es2025) and the target here is es2019, so
  attributes written in .ts/.js never reach Rollup at all. Merged with the user's own
  esbuild.options.supported rather than spread past it, so setting an unrelated feature flag
  doesn't quietly drop this one.

Without these, a module that marks a JSON import external produces code no supported runtime can
load, while the build stays green: pages render and only the affected route answers 500.
@nuxt/icon's serverBundle.externalizeIconsJson is the case I hit — it generates a correct
with { type: "json" } import and has no way to know it will be rewritten.

📝 Checklist

• I have linked an issue or discussion.
• I have updated the documentation accordingly. — neither the es2019 target nor
  importAttributesKey is documented today; this changes no documented behaviour.

Verification

test/unit/import-attributes.test.ts covers three things, each checked by breaking the
corresponding line one at a time: the emitted attribute key, an explicit rollupConfig.output
setting surviving the merge, and a .ts source keeping its attributes through the esbuild
transform. pnpm vitest run test/unit, tsc --noEmit, eslint and prettier -c are green.

A test/fixture/ regression route wouldn't be portable — the case needs an external JSON import,
which the worker and edge presets can't load at all — so the regression is pinned at the config
level instead. Happy to move it if you'd rather have it elsewhere.

End-to-end, including the runtime 500 before and 200 after:
https://github.com/agantelin/nitro-import-attributes-repro (cases 2 and 3)

[vercel]

@agantelin is attempting to deploy a commit to the Nitro Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b995ef07-589f-49f4-ab42-6b6e9a2e0832

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[agantelin]

Pushed an update (force-push, same two source lines): added a test that an explicit
rollupConfig.output.importAttributesKey from user config survives the merge, and trimmed the
rationale comments to one line each. test/unit is 44 green, tsc --noEmit and prettier -c clean.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/nitropack@4519

commit: a17e494

[agantelin]

🔗 Linked issue

#4518

❓ Type of change

• 🐞 Bug fix (a non-breaking change that fixes an issue)

📚 Description

Two defaults in getRollupConfig, both still overridable by user config:

• output.importAttributesKey: "with". Rollup 4 re-prints the import attributes of external
  modules with its default key, assert, which Node.js removed in 22.0.0 (esm: drop support for import assertions nodejs/node#52104).
  Rollup flips this itself in v5 ([v5.0] Use "with" as the keyword of import attributes by default rollup/rollup#6248, merged to rollup-5) and documents the option
  as the workaround until then. It goes in the defu defaults, so rollupConfig.output still wins.
  Nothing on the supported matrix loses: the runtimes that take assert but reject with are all
  below engines.node.
• supported: { "import-attributes": true } on the esbuild plugin. esbuild silently drops import
  attributes for every esXXXX target (checked up to es2025) and the target here is es2019, so
  attributes written in .ts/.js never reach Rollup at all. Merged with the user's own
  esbuild.options.supported rather than spread past it, so setting an unrelated feature flag
  doesn't quietly drop this one.

Without these, a module that marks a JSON import external produces code no supported runtime can
load, while the build stays green: pages render and only the affected route answers 500.
@nuxt/icon's serverBundle.externalizeIconsJson is the case I hit — it generates a correct
with { type: "json" } import and has no way to know it will be rewritten.

📝 Checklist

• I have linked an issue or discussion.
• I have updated the documentation accordingly. — neither the es2019 target nor
  importAttributesKey is documented today; this changes no documented behaviour.

Verification

test/unit/import-attributes.test.ts covers three things, each checked by breaking the
corresponding line one at a time: the emitted attribute key, an explicit rollupConfig.output
setting surviving the merge, and a .ts source keeping its attributes through the esbuild
transform. pnpm vitest run test/unit, tsc --noEmit, eslint and prettier -c are green.

A test/fixture/ regression route wouldn't be portable — the case needs an external JSON import,
which the worker and edge presets can't load at all — so the regression is pinned at the config
level instead. Happy to move it if you'd rather have it elsewhere.

End-to-end, including the runtime 500 before and 200 after:
https://github.com/agantelin/nitro-import-attributes-repro (cases 2 and 3)

[vercel]

@agantelin is attempting to deploy a commit to the Nitro Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b995ef07-589f-49f4-ab42-6b6e9a2e0832

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[agantelin]

Pushed an update (force-push, same two source lines): added a test that an explicit
rollupConfig.output.importAttributesKey from user config survives the merge, and trimmed the
rationale comments to one line each. test/unit is 44 green, tsc --noEmit and prettier -c clean.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/nitropack@4519

commit: a17e494

[agantelin]

🔗 Linked issue

#4518

❓ Type of change

• 🐞 Bug fix (a non-breaking change that fixes an issue)

📚 Description

Two defaults in getRollupConfig, both still overridable by user config:

• output.importAttributesKey: "with". Rollup 4 re-prints the import attributes of external
  modules with its default key, assert, which Node.js removed in 22.0.0 (esm: drop support for import assertions nodejs/node#52104).
  Rollup flips this itself in v5 ([v5.0] Use "with" as the keyword of import attributes by default rollup/rollup#6248, merged to rollup-5) and documents the option
  as the workaround until then. It goes in the defu defaults, so rollupConfig.output still wins.
  Nothing on the supported matrix loses: the runtimes that take assert but reject with are all
  below engines.node.
• supported: { "import-attributes": true } on the esbuild plugin. esbuild silently drops import
  attributes for every esXXXX target (checked up to es2025) and the target here is es2019, so
  attributes written in .ts/.js never reach Rollup at all. Merged with the user's own
  esbuild.options.supported rather than spread past it, so setting an unrelated feature flag
  doesn't quietly drop this one.

Without these, a module that marks a JSON import external produces code no supported runtime can
load, while the build stays green: pages render and only the affected route answers 500.
@nuxt/icon's serverBundle.externalizeIconsJson is the case I hit — it generates a correct
with { type: "json" } import and has no way to know it will be rewritten.

📝 Checklist

• I have linked an issue or discussion.
• I have updated the documentation accordingly. — neither the es2019 target nor
  importAttributesKey is documented today; this changes no documented behaviour.

Verification

test/unit/import-attributes.test.ts covers three things, each checked by breaking the
corresponding line one at a time: the emitted attribute key, an explicit rollupConfig.output
setting surviving the merge, and a .ts source keeping its attributes through the esbuild
transform. pnpm vitest run test/unit, tsc --noEmit, eslint and prettier -c are green.

A test/fixture/ regression route wouldn't be portable — the case needs an external JSON import,
which the worker and edge presets can't load at all — so the regression is pinned at the config
level instead. Happy to move it if you'd rather have it elsewhere.

End-to-end, including the runtime 500 before and 200 after:
https://github.com/agantelin/nitro-import-attributes-repro (cases 2 and 3)

[vercel]

@agantelin is attempting to deploy a commit to the Nitro Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b995ef07-589f-49f4-ab42-6b6e9a2e0832

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[agantelin]

Pushed an update (force-push, same two source lines): added a test that an explicit
rollupConfig.output.importAttributesKey from user config survives the merge, and trimmed the
rationale comments to one line each. test/unit is 44 green, tsc --noEmit and prettier -c clean.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/nitropack@4519

commit: a17e494

[agantelin]

🔗 Linked issue

#4518

❓ Type of change

• 🐞 Bug fix (a non-breaking change that fixes an issue)

📚 Description

Two defaults in getRollupConfig, both still overridable by user config:

• output.importAttributesKey: "with". Rollup 4 re-prints the import attributes of external
  modules with its default key, assert, which Node.js removed in 22.0.0 (esm: drop support for import assertions nodejs/node#52104).
  Rollup flips this itself in v5 ([v5.0] Use "with" as the keyword of import attributes by default rollup/rollup#6248, merged to rollup-5) and documents the option
  as the workaround until then. It goes in the defu defaults, so rollupConfig.output still wins.
  Nothing on the supported matrix loses: the runtimes that take assert but reject with are all
  below engines.node.
• supported: { "import-attributes": true } on the esbuild plugin. esbuild silently drops import
  attributes for every esXXXX target (checked up to es2025) and the target here is es2019, so
  attributes written in .ts/.js never reach Rollup at all. Merged with the user's own
  esbuild.options.supported rather than spread past it, so setting an unrelated feature flag
  doesn't quietly drop this one.

Without these, a module that marks a JSON import external produces code no supported runtime can
load, while the build stays green: pages render and only the affected route answers 500.
@nuxt/icon's serverBundle.externalizeIconsJson is the case I hit — it generates a correct
with { type: "json" } import and has no way to know it will be rewritten.

📝 Checklist

• I have linked an issue or discussion.
• I have updated the documentation accordingly. — neither the es2019 target nor
  importAttributesKey is documented today; this changes no documented behaviour.

Verification

test/unit/import-attributes.test.ts covers three things, each checked by breaking the
corresponding line one at a time: the emitted attribute key, an explicit rollupConfig.output
setting surviving the merge, and a .ts source keeping its attributes through the esbuild
transform. pnpm vitest run test/unit, tsc --noEmit, eslint and prettier -c are green.

A test/fixture/ regression route wouldn't be portable — the case needs an external JSON import,
which the worker and edge presets can't load at all — so the regression is pinned at the config
level instead. Happy to move it if you'd rather have it elsewhere.

End-to-end, including the runtime 500 before and 200 after:
https://github.com/agantelin/nitro-import-attributes-repro (cases 2 and 3)

[vercel]

@agantelin is attempting to deploy a commit to the Nitro Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b995ef07-589f-49f4-ab42-6b6e9a2e0832

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[agantelin]

Pushed an update (force-push, same two source lines): added a test that an explicit
rollupConfig.output.importAttributesKey from user config survives the merge, and trimmed the
rationale comments to one line each. test/unit is 44 green, tsc --noEmit and prettier -c clean.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/nitropack@4519

commit: a17e494

[agantelin]

🔗 Linked issue

#4518

❓ Type of change

• 🐞 Bug fix (a non-breaking change that fixes an issue)

📚 Description

Two defaults in getRollupConfig, both still overridable by user config:

• output.importAttributesKey: "with". Rollup 4 re-prints the import attributes of external
  modules with its default key, assert, which Node.js removed in 22.0.0 (esm: drop support for import assertions nodejs/node#52104).
  Rollup flips this itself in v5 ([v5.0] Use "with" as the keyword of import attributes by default rollup/rollup#6248, merged to rollup-5) and documents the option
  as the workaround until then. It goes in the defu defaults, so rollupConfig.output still wins.
  Nothing on the supported matrix loses: the runtimes that take assert but reject with are all
  below engines.node.
• supported: { "import-attributes": true } on the esbuild plugin. esbuild silently drops import
  attributes for every esXXXX target (checked up to es2025) and the target here is es2019, so
  attributes written in .ts/.js never reach Rollup at all. Merged with the user's own
  esbuild.options.supported rather than spread past it, so setting an unrelated feature flag
  doesn't quietly drop this one.

Without these, a module that marks a JSON import external produces code no supported runtime can
load, while the build stays green: pages render and only the affected route answers 500.
@nuxt/icon's serverBundle.externalizeIconsJson is the case I hit — it generates a correct
with { type: "json" } import and has no way to know it will be rewritten.

📝 Checklist

• I have linked an issue or discussion.
• I have updated the documentation accordingly. — neither the es2019 target nor
  importAttributesKey is documented today; this changes no documented behaviour.

Verification

test/unit/import-attributes.test.ts covers three things, each checked by breaking the
corresponding line one at a time: the emitted attribute key, an explicit rollupConfig.output
setting surviving the merge, and a .ts source keeping its attributes through the esbuild
transform. pnpm vitest run test/unit, tsc --noEmit, eslint and prettier -c are green.

A test/fixture/ regression route wouldn't be portable — the case needs an external JSON import,
which the worker and edge presets can't load at all — so the regression is pinned at the config
level instead. Happy to move it if you'd rather have it elsewhere.

End-to-end, including the runtime 500 before and 200 after:
https://github.com/agantelin/nitro-import-attributes-repro (cases 2 and 3)

[vercel]

@agantelin is attempting to deploy a commit to the Nitro Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b995ef07-589f-49f4-ab42-6b6e9a2e0832

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[agantelin]

Pushed an update (force-push, same two source lines): added a test that an explicit
rollupConfig.output.importAttributesKey from user config survives the merge, and trimmed the
rationale comments to one line each. test/unit is 44 green, tsc --noEmit and prettier -c clean.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/nitropack@4519

commit: a17e494

[agantelin]

🔗 Linked issue

#4518

❓ Type of change

• 🐞 Bug fix (a non-breaking change that fixes an issue)

📚 Description

Two defaults in getRollupConfig, both still overridable by user config:

• output.importAttributesKey: "with". Rollup 4 re-prints the import attributes of external
  modules with its default key, assert, which Node.js removed in 22.0.0 (esm: drop support for import assertions nodejs/node#52104).
  Rollup flips this itself in v5 ([v5.0] Use "with" as the keyword of import attributes by default rollup/rollup#6248, merged to rollup-5) and documents the option
  as the workaround until then. It goes in the defu defaults, so rollupConfig.output still wins.
  Nothing on the supported matrix loses: the runtimes that take assert but reject with are all
  below engines.node.
• supported: { "import-attributes": true } on the esbuild plugin. esbuild silently drops import
  attributes for every esXXXX target (checked up to es2025) and the target here is es2019, so
  attributes written in .ts/.js never reach Rollup at all. Merged with the user's own
  esbuild.options.supported rather than spread past it, so setting an unrelated feature flag
  doesn't quietly drop this one.

Without these, a module that marks a JSON import external produces code no supported runtime can
load, while the build stays green: pages render and only the affected route answers 500.
@nuxt/icon's serverBundle.externalizeIconsJson is the case I hit — it generates a correct
with { type: "json" } import and has no way to know it will be rewritten.

📝 Checklist

• I have linked an issue or discussion.
• I have updated the documentation accordingly. — neither the es2019 target nor
  importAttributesKey is documented today; this changes no documented behaviour.

Verification

test/unit/import-attributes.test.ts covers three things, each checked by breaking the
corresponding line one at a time: the emitted attribute key, an explicit rollupConfig.output
setting surviving the merge, and a .ts source keeping its attributes through the esbuild
transform. pnpm vitest run test/unit, tsc --noEmit, eslint and prettier -c are green.

A test/fixture/ regression route wouldn't be portable — the case needs an external JSON import,
which the worker and edge presets can't load at all — so the regression is pinned at the config
level instead. Happy to move it if you'd rather have it elsewhere.

End-to-end, including the runtime 500 before and 200 after:
https://github.com/agantelin/nitro-import-attributes-repro (cases 2 and 3)

[vercel]

@agantelin is attempting to deploy a commit to the Nitro Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b995ef07-589f-49f4-ab42-6b6e9a2e0832

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[agantelin]

Pushed an update (force-push, same two source lines): added a test that an explicit
rollupConfig.output.importAttributesKey from user config survives the merge, and trimmed the
rationale comments to one line each. test/unit is 44 green, tsc --noEmit and prettier -c clean.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/nitropack@4519

commit: a17e494

[agantelin]

🔗 Linked issue

#4518

❓ Type of change

• 🐞 Bug fix (a non-breaking change that fixes an issue)

📚 Description

Two defaults in getRollupConfig, both still overridable by user config:

• output.importAttributesKey: "with". Rollup 4 re-prints the import attributes of external
  modules with its default key, assert, which Node.js removed in 22.0.0 (esm: drop support for import assertions nodejs/node#52104).
  Rollup flips this itself in v5 ([v5.0] Use "with" as the keyword of import attributes by default rollup/rollup#6248, merged to rollup-5) and documents the option
  as the workaround until then. It goes in the defu defaults, so rollupConfig.output still wins.
  Nothing on the supported matrix loses: the runtimes that take assert but reject with are all
  below engines.node.
• supported: { "import-attributes": true } on the esbuild plugin. esbuild silently drops import
  attributes for every esXXXX target (checked up to es2025) and the target here is es2019, so
  attributes written in .ts/.js never reach Rollup at all. Merged with the user's own
  esbuild.options.supported rather than spread past it, so setting an unrelated feature flag
  doesn't quietly drop this one.

Without these, a module that marks a JSON import external produces code no supported runtime can
load, while the build stays green: pages render and only the affected route answers 500.
@nuxt/icon's serverBundle.externalizeIconsJson is the case I hit — it generates a correct
with { type: "json" } import and has no way to know it will be rewritten.

📝 Checklist

• I have linked an issue or discussion.
• I have updated the documentation accordingly. — neither the es2019 target nor
  importAttributesKey is documented today; this changes no documented behaviour.

Verification

test/unit/import-attributes.test.ts covers three things, each checked by breaking the
corresponding line one at a time: the emitted attribute key, an explicit rollupConfig.output
setting surviving the merge, and a .ts source keeping its attributes through the esbuild
transform. pnpm vitest run test/unit, tsc --noEmit, eslint and prettier -c are green.

A test/fixture/ regression route wouldn't be portable — the case needs an external JSON import,
which the worker and edge presets can't load at all — so the regression is pinned at the config
level instead. Happy to move it if you'd rather have it elsewhere.

End-to-end, including the runtime 500 before and 200 after:
https://github.com/agantelin/nitro-import-attributes-repro (cases 2 and 3)

[vercel]

@agantelin is attempting to deploy a commit to the Nitro Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b995ef07-589f-49f4-ab42-6b6e9a2e0832

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[agantelin]

Pushed an update (force-push, same two source lines): added a test that an explicit
rollupConfig.output.importAttributesKey from user config survives the merge, and trimmed the
rationale comments to one line each. test/unit is 44 green, tsc --noEmit and prettier -c clean.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/nitropack@4519

commit: a17e494